docs(privacy): a newest settings row taken away (ADR 0019)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0019-private-studysets.md

@@ -328,7 +328,9 @@ what decides keys and to test against a hostile instance:
   older one rolls nothing back; rows folded away here are never read again.
   Count me folds off where any row says off, so an instance handing back a
   genuine older on can't switch it on (the person switches it on again at
-  worst). The short reading's `HLKS` counter is gone.
+  worst). A row seen as newest that is gone, not folded here and covered by
+  no row read (another device's fold always leaves one), leaves out every
+  row it doesn't cover. The short reading's `HLKS` counter is gone.
 - **Publishing** sends exactly the tag names the sheet showed; names that
   changed in the sync before Publish are refused on the device.
 - **Finish** lists what it would take in, each edit with what it says, and
@@ -381,7 +383,9 @@ device that never saw it private; a studyset made readable by its own
 record taken as private once the instance moved it under a private one;
 settings rolled back by withholding a newer row; and two queries that
 failed at run time (`id IN` with nullable ids: a path's step revisions and
-answers couldn't be read). Each has a test of its own now.
+answers couldn't be read); then, over 400 more seeds, a settings row of
+the device's own taken away so that another device's older on was read
+alone. Each has a test of its own now.
 
 Residual risks, as they stand: