docs(privacy): a private studyset's files and its marker, as built (ADR 0019)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0019-private-studysets.md

@@ -117,12 +117,26 @@ millisecond), its table and the columns it changed.
 
 ## As built (21 Oct 2026)
 
-- **Not yet:** a private studyset's files (D5) are still uploaded readable,
-  and an asset row's file name with them. The instance takes encrypted
-  uploads already (`startUpload`/`finishUpload`'s `encrypted`: no PDF check,
-  4 KiB more room); the app has yet to seal a file with its studyset's key
-  before hashing it, which every place adding a file (the editors, the PDF
-  import, copies, archives) must name the studyset for.
+- **Files** (D5, built 21 Oct): a private studyset's file is sealed with its
+  tree's key for its asset row before it is hashed; the row's hash and size
+  and the file uploaded (`encrypted`, which skips the PDF check) are the
+  sealed file's, and its sealed payload carries the file name and the hash
+  of what was sealed (asset schema 2). The device keeps the sealed file to
+  upload and check, and the opened one by its own hash for what reads files
+  by path. A file is a row per key. Every place adding a file names its
+  studyset (the editors through `StudysetFiles`, which every screen of a
+  studyset and the PDF reader set; PDFs, screenshots, imports, copies,
+  whose top studyset is now made before their files; accepted suggestions
+  by their item's tree). Making a tree private or not, or moving a topic
+  into another tree, adds its files anew under the tree's key, names the
+  new rows in its content (whole `asset:` values and a PDF's file, never
+  text) and blanks the old rows nothing else names.
+- **The marker** (the developer's, 21 Oct): on the library's cards and the
+  studyset's Share alike, a lock for private, an open lock for readable by
+  the instance and not published, a globe for published. The locks open
+  one dialog saying what that means and changing it (and, while not
+  private, leading to the Publish sheet); the globe opens the Publish
+  sheet.
 - **Count me** stays in the person's settings, which follow them to every
   device, and the device mirrors it to the instance after each sync
   (`counted_learner`), reporting the copies only while it is on: the