The design doc stopped at the model layer while ports.py and service.py
had already landed, so it described the inner ring as one third of what
is actually there and still called the other two "to be built".
Two new chapters. Ports covers the three contracts that matter more than
the signatures — another user's task reads as absent rather than
forbidden, only ThreadBusyError or LaunchFailedError may escape a
launch, and RunOutcome keeps the run runtime out of the domain — plus
the two deliberate absences (no Clock, no claimer identity) and the line
between single-threaded semantics, which the contract owns, and
atomicity, which it does not. The service chapter walks dispatch_task's
four exits as a diagram, explains why the global budget is not a
per-poll batch size, and records why the context change travels packaged
rather than behind a sentinel.
The rest follows: the migration map now shows the inner ring complete
and only adapters outstanding, the overview gains the discipline each of
the three layers is held to, the dev guide gains "add a use case" and a
warning against writing rules in the service, and the pitfalls and
glossary pick up what the new layers introduce.
b56e939c4b