docs(r6): reconcile y-crdt#639 state — merged upstream, not yet released

[montfort]

What moved

y-crdt/y-crdt#639 — CHARTER-08 deliverable (a), hardening the yrs decoder against length-prefix allocation bombs — was merged upstream on 2026-08-05 10:51 UTC. Merge commit 3074c84d; our commit 2ee533eb landed unchanged, no revisions requested since the maintainer's APPROVED on 15 Jul.

Five live places in this repo still described it as "approved / still open". This PR reconciles them.

What this PR does NOT do

No code changes. The yrs = "=0.27.2" pin stays exactly where it is, and native/** is untouched.

The merge does not trigger FU-015, whose trigger is «merged and published»: crates.io still ships yrs 0.27.3 (13 Jul), which predates the merge. The follow-up moves from «blocked on upstream review» to «waiting on a release» — still open.

Changes

Area	Change
docs/architecture.md, GOVERNANCE.md, quickstart.md, requirements.md	«approved» → merged 2026-08-05, not yet released
.github/workflows/ci.yml	Spell out why the fuzz job's informative treatment of a crash remains valid despite the merge: our pin predates it and there is no release. The ::warning strings are deliberately untouched — they are still true
.straymark/follow-ups-backlog.md	FU-015 premise + Verified-at, written by the straymark followups CLI (never by hand)
AILOG-2026-08-05-001	The record

Untouched on purpose: the historical record (.straymark/charters/12-*.md says «#639 is still open» and that was true when it was written; prior AILOGs/AIDECs likewise).

The premise that was dead on arrival

Going to execute FU-015 surfaced a clause that had been false since the day it was written: «revert the StrangeDaysTech/y-crdt fork». The repo never consumed that fork — native/**/Cargo.toml pulls yrs from crates.io, with no [patch.crates-io] and no git dependencies.

Same pattern as FU-016/017/018/019/020 in the backlog drain, and the reason the CLI has followups verify: a follow-up is a dated hypothesis that decays, and the cheap moment to re-test it is when you go to act on it. The new premise names the 3 real pin sites (weft-yrs-ffi/Cargo.toml:17,21 + fuzz/Cargo.toml:12) and requires proving the fix with cargo +nightly fuzz run -s none export_since rather than assuming it.

Sibling class, still unresolved

y-crdt#644 (third party) fixes two from_utf8_unchecked sites that #639 does not touch and that are still on main (encoding/read.rs:137, updates/decoder.rs:486). The maintainer flagged it as a possible duplicate of #639 — true only for the any.rs half.

It is a different failure class: not a failed allocation but UB / a non-unwinding abort, equally opaque to the shim's catch_unwind (Principle I). Argued in the #644 thread (comment) rather than opened as our own backlog entry, since the fix already exists there with tests. If #644 dies without merging, that decision should be reopened.

Verification

• straymark followups status → still 1 open / 20 total; followups drift in sync
• git diff clean across native/** and every Cargo.toml — the pin is untouched
• ci.yml still parses as valid YAML; the 5 ::warning strings intact
• Every claim checked against the GitHub API, crates.io and the raw of main — not from memory