docs: mark the offline-engine design + review as superseded

Both describe a full offline mail replica with a persistent cursor-based sync
engine. That scope was dropped in favour of "a SQLite index we can prompt
against" - see the notes prepended to each file for what shipped instead
(lib/mail-index/** + app/api/offline/{reindex,search}).

Kept rather than deleted because several findings are still accurate and still
load-bearing: the SQLCipher binding investigation, the PRAGMA-key
silent-no-op landmine, the safeStorage Linux basic_text hazard, the
hosted-deployment gate, and the codebase survey.

The review's note also records the disposition of every CRITICAL/HIGH finding.
Most became MOOT rather than fixed - C2, C3, C4, H1 and H2 were all
consequences of a long-lived worker holding credentials, and the new shape has
no worker. C1 (the Docker build breakage) and H2's env-vs-fd point were fixed
as specified, and the review's two corrections to the design (the
cipher_version check needing a non-empty string, getSelectedStorageBackend
being Linux-only) are both in the shipped code.

Also recorded: two things the design got wrong beyond the scope change - its
claim that the chosen process needs no new secret handling (the review was
right) and its assumption that Next's file tracing would carry the native
module (it does not).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/ELECTRON-OFFLINE-ENGINE-DESIGN.md

@@ -1,7 +1,42 @@
+> # ⚠️ SUPERSEDED — this is not what was built
+>
+> This document designs a **full offline mail replica**: a persistent background sync engine with
+> JMAP `Foo/changes` cursors, three state machines, a retry ladder, reconcile/sweep logic and an
+> epoch-fenced multi-account registry. **That scope was dropped.** After the adversarial review
+> (`ELECTRON-OFFLINE-ENGINE-REVIEW.md`), the human narrowed the requirement to *"a SQLite index we
+> can prompt against"* — retrieval to feed an LLM, refreshed on each delivery/change event.
+>
+> **What was actually built:** `lib/mail-index/**` + `app/api/offline/{reindex,search}` — an
+> encrypted SQLite/FTS5 index over mail, calendar, contacts and file *metadata*, written by an
+> ordinary request-scoped API route that the renderer's existing live JMAP push connection calls
+> when something changes. No background worker, no cursors, no resident credentials. Staleness
+> between refreshes is acceptable by design.
+>
+> Most of the review's CRITICAL and HIGH findings **stopped existing** rather than being fixed: C2,
+> C3, C4, H1 and H2 were all consequences of a long-lived worker holding credentials, and there is
+> no worker.
+>
+> **Still accurate and still worth reading here:**
+> - §3 — the SQLite/SQLCipher binding investigation. `@signalapp/sqlcipher` is what shipped, for the
+>   reasons given, and the `PRAGMA key` silent-no-op landmine is real (the shipped code asserts
+>   `cipher_version` returns a non-empty *string*, per the review's correction).
+> - §6 — `safeStorage`, including the Linux `basic_text` hazard. Shipped as described, with
+>   `getSelectedStorageBackend()` correctly guarded to Linux only (a review finding).
+> - §1 — the codebase survey (auth model, push pipeline, CSP, account model). All verified.
+> - §2.4's hosted-deployment gate (`VNCMAIL_DESKTOP_STORE_DIR`) — shipped, and now covered by a test.
+> - §14 — what was and was not empirically verified.
+>
+> **Wrong in hindsight, beyond the scope change:** §2.1's claim that Option A needs no new secret
+> handling (the review's C2 is right — credentials are request-scoped, not resident); and §2.1's
+> assumption that Next's output file tracing would carry the native module (it does not — the
+> standalone build needs an explicit copy step, now in `scripts/assemble-standalone.mjs`).
+
 # Electron Offline Engine — Design
 
-Status: **design only, not implemented.** Nothing outside this file has been changed on this
-branch. `electron/main.ts`, `electron/preload.ts` and `lib/jmap/client.ts` are untouched.
+Status: **superseded design, never implemented.** See the note above. Nothing outside this file was
+changed by the pass that wrote it; `electron/main.ts`, `electron/preload.ts` and
+`lib/jmap/client.ts` were untouched *at that time* (`main.ts` has since gained the index's store-dir
+and key-channel wiring, which is a small fraction of what this document describes).
 
 Repo: `brvncde-dotcom/vncmail-plus`, branch `claude/electron-offline-design`, worktree
 `~/worktrees/vncmail-electron-sqlite`. Based on `claude/electron-desktop` (the working desktop