docs(design): reconcile models 0008/0009 STATUS with the shipped #55 cutover

The 0008 totality core shipped via #55 (spec 0062, 76b21c0), but both
model whitepapers still claimed "nothing here is shipped" — drift the
architect would flag.

- 0008: STATUS now "partially realised". Records what landed (binary
  ParamMode, value-type trivial-own, no mode-polymorphism, the hash
  reset) and points at the contract ledger for current-state facts.
  Marks §3.4/Q3 naming as resolved (verbal own/borrow kept, user
  decision); leaves the return-side escape axis (§5.1-5.2), multi-return
  (§5.3), and Q2/Q4 as the genuine remainder. escape.rs is named as the
  opt-only stack-promotion pass, not the §5.2 reachability check.
- 0009: STATUS stays "nothing shipped" (true), but the runtime-axis-dual
  paragraph now notes 0008's annotation axis landed, so 0009's
  precondition is met rather than hypothetical; the §8-Q3 coupling to
  0008's unshipped return-escape pass is flagged as still ahead.

Contract 0008-memory-model.md needed no change — already current.

design/models/0009-explicit-rc.md

@@ -17,13 +17,21 @@ shape before committing it. If adopted, it revises the floor recorded in
 
 This is the **runtime-axis dual** of ownership totality
 (`0008-ownership-totality.md`). That whitepaper makes the *annotation*
-total — every position carries `own`/`borrow`, no `Implicit`. This one
-asks the question totality makes askable: once ownership is authored on
-every position, does the *runtime discipline* still have to be universal
-RC, or can it follow the annotation — affine values drop deterministically
-with no refcount, and RC narrows to the positions that actually declare
-sharing? The two compose: 0008 makes ownership total in the type; 0009
-makes the runtime mechanism track the type.
+total — every position carries `own`/`borrow`, no `Implicit` — and its
+core **shipped** via #55 (spec 0062, commit `76b21c0`, 2026-06-02), so
+the precondition this proposal needs is now met, not hypothetical. This
+one asks the question that totality, now in place, makes askable: once
+ownership is authored on every position, does the *runtime discipline*
+still have to be universal RC, or can it follow the annotation — affine
+values drop deterministically with no refcount, and RC narrows to the
+positions that actually declare sharing? The two compose: 0008 makes
+ownership total in the type; 0009 makes the runtime mechanism track the
+type. **Nothing in 0009 is built** — universal RC + uniqueness-elision
+(§1) is still the floor; what changed is only that 0008 cleared its
+runway. One coupling carried over intact: 0009's transitive `box`-drop
+(§8 Q3) leans on 0008's return-side escape pass, which 0008 did *not*
+ship (borrow-returns are rejected, not verified), so that dependency is
+still entirely ahead.
 
 ---