CES-70 — lock replace mode, resolve remaining decisions, mark READY

[JMNofziger]

Follow-up to PR #22 (already merged). Product locked replace over merge and confirmed cross-account imports stay a warning, so the spec flips from Draft to Complete (v1) and the execution prompt from BLOCKED to READY.

Docs only. No application code, no schema migration, no CES-71 rename.

Mode: replace

Merge is deferred to v1.x — not built, not stubbed, not selectable. The decisive argument: export deliberately omits soft-deleted rows, so a merge sees no tombstones and can never remove anything. Every row deleted on the source device would survive on the destination forever and be re-affirmed by every subsequent import. Row-level LWW would also spend the v1.x field-level merge decision ADR 002 deliberately deferred, on a design no spec defines.

Replace has one deterministic post-state, which makes the golden round-trip test a complete correctness proof rather than a set of encoded guesses.

Revisit gate: merge needs v1.x merge rules and tombstones in export. Both are prerequisites, not nice-to-haves.

Follow-on decisions replace forced

Two of these corrected wrong assumptions in the first draft, found by reading the schema rather than trusting the earlier note:

Table	Disposition	Why
vehicles, fill_ups, maintenance_rules, maintenance_events	Hard DELETE then insert	Soft-delete would leave rows colliding with incoming ids on the primary key
settings	UPDATE in place, never deleted	A DELETE would destroy settings.id and violate the identity invariant
outbox	Cleared	Its table CHECK admits only the four replaced tables, so every queued mutation describes a row being destroyed
drafts	Preserved when the draft's vehicle survives; discarded otherwise	Drafts are looked up by vehicle (openDraftForVehicle), so a draft whose vehicle is gone is unreachable by construction — and would resurface if that vehicle id ever returned
photo_refs + JPEGs	Follow drafts	Correction: photo_refs.draft_id is an FK to drafts, not fill_ups, and ttl_expires_at is an absolute stamp — so replacing fill-ups orphans no photos and changes no TTL

Photo files are deleted only after the transaction commits. An interruption then leaves files with no row, which PhotoService.sweep already collects as orphanFilesDeleted; deleting files first would leave rows pointing at missing files on rollback.

Also added

• Technical rationale for replace (5 numbered arguments) in the spec and on the issue.
• User-facing explanation — plain-language copy ready to drop into install-*.md, a help sheet, or the confirm dialog, plus copy notes for whoever wires the UI.
• Cross-account revisit gate — differing user_key_hash stays a warning, with re-open triggers named: CES-46 landing a real telemetry user key, or M3 (CES-42/43) introducing server accounts.
• Confirmation rules — typed REPLACE when local history is non-empty with an inline export-first offer; plain confirm on an empty database, since that is the new-phone path and friction there buys no safety.

Error table 13 → 17 codes; test list 15 → 17 items.

Verification

flutter analyze clean · python3 ci/telemetry-gate.py PASS · docs-only (three files) · all relative links and internal anchors resolve. Rebased onto current main so CES-41's merged export code is intact — the earlier branch was on a stale base.