diff --git a/docs/DESIGN.md b/docs/DESIGN.md
index ca25cf7..3c18df8 100644
--- a/docs/DESIGN.md
+++ b/docs/DESIGN.md
@@ -543,14 +543,28 @@ constructor-blocked recursions in `map`, `sort`, `insert`
 remain unmarked — they cannot benefit from `musttail`
 without a source-level rewrite.
 
-## Decision 9: transitional allocator — Boehm conservative GC
+## Decision 9: dual allocator — Boehm conservative GC + RC
 
-**Status: superseded by Decision 10 (RC + Uniqueness, 2026-05-08).**
-This section documents the active runtime as of Iter 17a / the
-GC bench, but it is no longer the canonical memory model. Boehm
-remains linked behind `--alloc=gc` (the current default) until
-the RC pipeline (Iters 18a–18d) is validated and the default
-flips. The `--alloc=bump` mode introduced for the bench is a
+**Status: dual-allocator policy as of 2026-05-08.** Originally
+framed (2026-05-07) as "transitional Boehm until the RC
+pipeline (Iters 18a–18g) lands and the default flips". The RC
+pipeline landed and was validated end-to-end (live=0 on the
+canonical bench fixture; tail latency 23× better than Boehm;
+RSS lower than Boehm). The orchestrator's call on retirement
+was to **keep both allocators live**: Boehm stays as the
+default for general workloads, RC is selected via `--alloc=rc`
+for real-time-sensitive workloads where bounded per-operation
+latency matters more than peak throughput.
+
+The retirement question reopens if maintaining the Boehm path
+costs significant attention (libgc upgrade pain, runtime
+divergence, build complexity); until then the dual-allocator
+asymmetry (Boehm = default, RC = ready alternative) is the
+canonical state. Decision 10 (RC + uniqueness) holds as the
+specification of the RC alternative; the rest of this section
+documents the Boehm half of the dual model.
+
+The `--alloc=bump` mode introduced for the bench is a
 measurement tool, not a production target.
 
 Through Iter 14e, every ADT box, lambda env, and closure pair was