docs(AR-004): record the three holes the wedging audit closed

The register said "two remaining holes now closed" and the SPEC's Current:
still described `push_blocking`, which parking replaced. Both now match the
code.

Three additions, in the order they surfaced:

  (c) FilterNode and RouterNode were the last data paths still using the
      throwing push() with the exception swallowed, so a full output discarded
      the value — including the EOF sentinel. The decimator passes EOF by
      predicate but its output is reliably full, the embedder being the slowest
      node, so the token went nowhere and nothing downstream shut down. That is
      the wedge the runs were being killed for, and it is worth the register
      saying so plainly.
  (d) The sentinel could be delivered ahead of a value still queued behind it,
      losing the tail to any consumer treating EOF as a hard stop.
  (e) Two firings of one node could overlap, which breaks the one-slot park
      itself: a parked value can be overwritten with no drop recorded.

(e) also corrects (b). The startup lost wake was recorded as a missed
empty->non-empty edge closed by a level-triggered re-check; the actual cause
was the callbacks being written while a running neighbour read them — ten
ThreadSanitizer races — and they are now installed in a prepare() pass before
any node starts. The re-check stays and is still needed, but for a benign
ordering rather than as cover for a race.

Two things the requirement now carries that it did not before. A channel holds
at most one undelivered sentinel: a second is refused and reported rather than
silently overwriting the first, which matters the moment a pipeline is reused
for a second input. And a lossless decimator is a backpressure point rather
than a relief valve, so the source throttles to the face branch instead of
quietly thinning it — what the requirement asks for, but it changes the shape
of a loaded run and is not yet benchmarked.

The Gap is unchanged and still open: capacity is counted in items, not bytes,
so a crowd frame carrying 60 crops occupies one slot exactly as an empty one
does. AR-004 stays **Mostly** for that reason.

Verification plan updated with the cases the KPN suite now pins.

TRACES: AR-004 | SR-002

docs/SPEC.md

@@ -128,10 +128,43 @@ Two consequences worth stating:
   depends on timing. The same command run twice can produce different dumps, and
   a golden fixture cannot be built on that.
 
-**Current:** fixed in KPN — node data outputs use `push_blocking`, sentinels
-remain out-of-band so EOF can always overtake a stalled data path. Verified on
-the same clip: 385 of 385 sampled frames written, zero drops, and two
-consecutive runs byte-identical where previously they were not.
+**Current:** fixed in KPN. Node data outputs *park* on a full channel — the
+value is held in a one-slot buffer, the worker is released, and the channel's
+space callback resubmits the node once the consumer drains. That replaced
+`push_blocking`, which slept inside the push and, with one thread per node,
+stopped that node draining its own input. Sentinels remain out-of-band so EOF
+can always overtake a stalled data path. Verified on the same clip: 385 of 385
+sampled frames written, zero drops, and two consecutive runs byte-identical
+where previously they were not.
+
+A later audit found the losslessness was still incomplete in three places, all
+now closed and each pinned by a regression case in the KPN suite:
+
+- **`FilterNode` and `RouterNode`** were the last data paths still using the
+  throwing `push()` with the exception swallowed. A full output discarded the
+  value, and that included the **EOF sentinel**. The decimator passes EOF by
+  predicate but its output is reliably full — the embedder is the slowest node
+  in the chain — so the token was discarded, nothing downstream shut down, and
+  the run had to be killed. This was the wedge.
+- **The sentinel could arrive ahead of a value still queued behind it.** `pop()`
+  observed the ring empty and then took the sentinel; a producer can push a
+  value *and* publish the sentinel inside that window, so a consumer treating
+  EOF as a hard stop loses the tail.
+- **Two firings of one node could overlap**, because the submit gate was
+  released before the firing had finished with the node's state. That breaks the
+  one-slot park itself: a parked value can be overwritten by the other firing,
+  with no drop recorded anywhere.
+
+**New constraint:** a channel carries at most one undelivered sentinel. A second
+offered before the first is taken is refused and reported, never queued and
+never overwritten — two control tokens on one channel means the stream ended
+twice. Single-shot EOF is what everything does today; this becomes live the
+moment a pipeline is reused for a second input.
+
+**Consequence:** a lossless decimator is a backpressure point, not a relief
+valve. The source now throttles to the face branch rather than quietly thinning
+it. That is what this requirement asks for, but it changes the shape of a loaded
+run and has not yet been benchmarked.
 
 It also ran *faster* (29 s → 17 s). A dropped frame has already cost its decode,
 and the overflow exception cost more — so the lossy path was paying for work it