ADR: define retention-derived lifecycle surfaces

[flyingrobots]

Outcome

Define how application-friendly vault, mutable root-set, managed cache-set, and expiry-safe replay-set surfaces lower onto Keep retention namespaces and generations without importing application meaning, ambient clocks, or unsafe early-release policy into the core.

Dependencies

• Implement retention namespace generation transitions #19 retention generation transitions
• Implement precise verification reports and corruption refusal #20 precise verification reports
• Implement deterministic GC planning and identity-preserving compaction #21 deterministic GC and compaction

Decision questions

• Which primitives belong in Keep core, an optional Keep policy crate, or the consuming application?
• How are named assets mapped to opaque digests without leaking human labels?
• What compare-and-swap evidence governs root-set generations?
• How do cache capacity, logical-byte limits, approximate LRU, and scoped acquisitions use caller-supplied observations without becoming identity?
• How does a replay marker provide atomic add-if-absent and expiry-only release with no remove, repair, or capacity path that shortens its acceptance window?
• Which handles and receipts bind logical content, physical retention, generation, and policy observation?
• How do recovery, GC, replica deletion, and stale callers interact?

Acceptance criteria

• A numbered ADR draws the core, policy, and application boundary for every surface.
• No path, caller identity, wall clock, TTL, LRU score, or application label enters content identity.
• All mutations compare exact expected and observed generations and return immutable evidence.
• Scoped acquisitions retain a complete selected generation until explicit release.
• Replay-set release is expiry-only and cannot be shortened by cache, repair, or capacity mechanisms.
• Private naming has an explicit metadata and equality-leak threat model.
• Crash-state and concurrency tables cover every cross-generation transition.
• The design names which surfaces wait for Implement deterministic GC planning and identity-preserving compaction #21 and which can ship over retention alone.

Non-goals

• Embedding one consumer's case, claim, or authorization semantics in Keep.
• Treating file existence or recent access as liveness.
• Giving the Keep core an ambient clock.
• Recreating Git refs as public identity.