[P2][docs] Align README and RELIABILITY durability claims with actual semantics

[cevheri]

Summary

README and docs/RELIABILITY.md state durability guarantees that are publicly falsifiable with the current kernel/adapter behavior — especially after IO errors (B3) and missing directory fsync (B9). For a project whose manifesto stakes identity on honesty, this is the sentence a Hacker News commenter will quote and disprove.

Audit ID: B11 (Medium doc) — pre-announcement blocker for marketing truth, not code-only.

Problematic claims (examples)

README ~L266-268 / RELIABILITY.md ~L3:

• "A returned transact() is durable" — false when B3 unfixed.
• "A crash can only ever damage the last, un-fsync'd record" — false for IO-error poisoned WAL, short reads (B10), mid-log truncate (B8).

README status line ~L296 says "pre-alpha (0.0.x)" while package is 0.1.3 — self-contradiction (also tracked as separate small fix).

Dependencies

Do not close this issue until:

• B3 (fsyncgate / failure latch) — merged or explicitly scoped in docs
• B9 (dir fsync + truncate fsync) — merged or explicitly scoped
• Prefer also: B8, B10 resolved or caveated

If blockers slip schedule, interim text must scope claims precisely:

On a healthy local disk with successful fsync, … IO-error handling improvements tracked in #XX.

Tasks for agent

1. Read current README.md Reliability section and docs/RELIABILITY.md end-to-end.
2. Align wording with actual crash model vs IO-error model vs multi-writer (B4).
3. Update README status to match semver reality (0.1.x beta/early — pick honest label).
4. Cross-link GitHub issues for known gaps instead of hiding them.
5. No emoji; English only.

Acceptance criteria

• No headline claim remains that a skeptic can disprove in ~20 lines without caveats.
• Status line matches shipped version series.
• RELIABILITY.md lists explicit non-guarantees (multi-writer, foreign file open before B1, async transact before B2).
• No changeset required (docs only) unless README is copied into package — verify project policy; likely no changeset.

Related issues

• B1, B2, B3, B4, B8, B9, B10
• Separate issue for README status-only if split; can be same PR.

Agent constraints

• Docs must not oversell; must not undersell the genuine crash-model strength.
• Code wins over docs — if code fixed first, docs follow.

Verification

Manual review + bun run gate (no test changes expected).

[cevheri]

Dependency graph (do not close until resolved or explicitly caveated):

Wave 1 code blockers: #13 #16 #19 #21 #22 #15 #23 (partial)

Suggested claim alignment order:

1. Fix [P1][kernel] Latch database on append/fsync failure (fsyncgate) #19 (fsyncgate) and [P1][adapters] fsync parent directory on create and after recovery truncate #15 (dir fsync)
2. Fix [P0][kernel] Refuse opening non-LibreDB files — WAL magic header + no silent truncate #13/[P1][kernel] Refuse open on mid-log corruption; surface torn-tail truncation #22 recovery semantics
3. Update README + RELIABILITY in this issue

Also fix README status line (pre-alpha 0.0.x vs shipped 0.1.3) as part of this doc pass.

[cevheri]

Implemented and shipped in PR #43 (merge commit 69f7161), released as v0.2.0. The PR description's comma-separated Closes list only auto-closed the first reference — closing manually. For #39/#28-style partials: the shipped scope is done; the real-browser verification half of #39 continues under #10, and the typed-error contract (#28) shipped as LibreDbError with stable codes across kernel, adapters, lenses, and CLI.