feat: publish Tend v0.2 Preview 2 source

Export the reviewed allowlisted snapshot from private source commit 8aab3db43f35e6a49aa497f45d73701b13fc9f32 and tree 992132ea4703437dc13ffdbb04a077816c02caf9. This includes routed singleton continuity, deployment evidence, strict schema-2 configuration, restricted transport, and the independently compilable public-tree guard.

AI-Assisted: OpenAI Codex
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

docs/ARCHITECTURE.md

@@ -50,12 +50,31 @@ probes it, atomically replaces one imported Caddy handler, validates the full
 Caddy configuration, reloads Caddy, and records the prior active slot.
 
 Singleton mode starts the new release in a hardened transient systemd unit on a
-separate loopback address, probes it, stops the candidate, changes the current
-release pointer, and restarts the installed singleton unit.
+separate loopback address and probes it. Tend then validates and atomically
+routes the imported Caddy handler to that candidate. While the candidate serves
+the canonical origin, Tend changes the current release pointer, restarts and
+probes the installed fixed-address unit, validates Caddy again, and routes back
+to it. The candidate remains healthy through the activation window and stops
+only after the handoff succeeds.
 
 After the local post-activation probes, Tend also checks configured HTTPS public
-origins. Any failure before state persistence restores the previously observed
-Caddy bytes and/or release pointers. Rollback is a separate explicit command
+origins throughout a bounded activation window. Blue/green mode also probes the
+previous slot, and singleton mode probes the handoff candidate, for health and
+readiness throughout that window. Any failure before success is recorded
+restores the previously observed Caddy bytes and/or release pointers. State
+records desired, candidate, active, previous, and last-attempt
+release identities, including failed attempts without claiming they became
+active. Rollback is a separate explicit command
 over the recorded state. It rechecks local health/readiness and public reachability,
 but deliberately does not apply a future release's content marker to an older
 release whose routes may differ. Pruning preserves both active and previous releases.
+
+## Evidence boundary
+
+Every attempted activation and explicit rollback emits bounded, versioned JSONL
+events with an operation ID, service, approved artifact digest, source commit,
+release version, phase, slot, elapsed duration, and outcome. Values are
+validated rather than copied from command output. The log contains no
+environment values, arbitrary process output, HTTP bodies, or secret paths.
+Identity, entropy, file, and downstream observability failures are deliberately
+best effort and cannot control Tend's deployment or rollback result.