Design docs

Circulated when written, not when accepted. Some of this has not shipped.

A doc goes up when it is ready to be argued with. Status reflects where it is in that argument, not whether the code exists.

• Notifier delivery rework DraftTarget 2026.10 · Replaces fixed-ceiling retry with a per-destination budget. Open questions on the dead-letter contract.
• Passkey recovery flow AcceptedTarget 2026.9.1 · What happens when the only enrolled device is gone, and why the answer is not an email link.
• Schema versioning for ingest AcceptedTarget 2026.8.2 · Batches carry the schema version they were written against. Staging validates, it does not coerce.