docs(adr): 0002 no end-to-end encryption

Private and shared content is stored in plaintext on the instance and is readable by its operator, as on Mastodon. Private sharing happens only between persons of the same instance; only public content travels between instances. The key management that encryption needed (master key, recovery phrase, per-space keys, re-wrapping, compaction on devices only, signed operations) was the largest subsystem on the plan, and it shut the server out of grammar checking, search and publishing. Whoever trusts no operator can run an instance.

Rules: the privacy page and a notice when sharing say so; deleting content first blanks the payloads of its revisions, because the sync engine keeps rows until their space is deleted; content stays in the versioned payload, because every migration of a synced table locks older app versions out of syncing; server features decode payloads into server-only tables; reports and suggestions go through endpoints, so the author comes from the session. keyId and nonce stay nullable as the one way back.

ADR 0001 gets an "Amended by" note; its decision and rules stand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0001-offline-sync.md

@@ -4,6 +4,11 @@
 - **Date:** 2026-09-27
 - **Evidence:** branch `spike/offline-sync` (never merged), tests in
   `halkyon_learn_server/test/spike/`, run against a live server on Serverpod 4.0.2.
+- **Amended by:** [ADR 0002](0002-no-end-to-end-encryption.md) (2026-09-29): there is no
+  end-to-end encryption, so the premise below that the server syncs data it cannot read no
+  longer holds. The decision and its rules stand. Deleted content is redacted before
+  deletion (ADR 0002, rule 2), and how authorship is secured in shared spaces is decided
+  with shared spaces (ADR 0002, *Consequences*).
 
 ## Context