docs(contracts): state the offline limit of checkout removal

.serena/.auto_sync_head

@@ -0,0 +1 @@
+f8930197661c66eb037fb04b1d31ac043096a14f

docs/adr/0025-out-of-estate-external-workspace-root.md

@@ -50,6 +50,17 @@ implies GDS materializes there.
    outside every declared `workspace_root`, no placement finding
    (`GDS_WORKSPACE_PLACEMENT_DRIFT`, `GDS_WORKSPACE_ROOT_NOT_READY`) is produced
    and no bogus `expected_path` is computed.
+
+   The accepted finding is not free, and this decision did not foresee its
+   price. The complete relationship index requires an anchor on **every**
+   boundary under the root it analyses, so a single external checkout under
+   `${HOME}/Developer` makes `gds repository delete` unusable for every
+   repository in the tree, not only for the external one. Narrowing
+   `--inventory-root` past the external root is the documented escape: the
+   planner stores the root it analysed as `analysis_root` and the apply path
+   reuses exactly that, so the narrowed scope is bound into the plan and the
+   approval. Narrow it only with independent evidence that the subject is a
+   leaf — no relationship and no consumer naming it in the full index.
 5. Promotion out of `external` is an explicit estate change: it requires a new
    owner, an installation that can observe the account, and a selector — that
    is, transfer or adoption of the repository, never a local move alone.

docs/contracts/lifecycles-v1.md

@@ -345,6 +345,18 @@ publication-proven checkout with no unsafe worktree state is atomically moved
 to deterministic device quarantine. Restoration requires a separate explicit
 plan.
 
+Like materialization, removal is currently local-only. Proving publication
+means reading the remote ref, the mutation runner runs every Git command with
+`protocol.allow=never`, and the URL it accepts must resolve locally — so a
+checkout whose `origin` is an ordinary `https://` or `ssh://` remote is refused
+with `GDS_WORKSPACE_REMOVE_UNSAFE`, carrying the message `network Git mutation
+is disabled before the live provider stage`. That is the offline stance of this
+runner, not a property of the checkout, and the error names the runner rather
+than the cause. Until the live provider stage lands, a device-local retirement
+gathers the same evidence directly: clean status, `@{u}` neither ahead nor
+behind, no stashes, no commits reachable only locally, and no tags the remote
+does not have.
+
 ## Portfolio planning
 
 ```text