docs(adr): ADR 009 states twin-loss recovery and the store as an integrate trace (improvise-felo.4)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

context/adr/009-incremental-evaluation.md

@@ -123,7 +123,9 @@ The affected pairs are evaluated in the formula graph's topological order.
 
 **An aggregate over an expression** (`SUM(Revenue * Price)`) is a pipeline:
 1. A per-record stage retracts and reinserts each touched record. It reads the record's
-   previous cells as the store minus the delta, so it keeps no copy of the values.
+   previous cells as the store minus the delta, so it keeps no copy of the values. The
+   store is the `integrate` operator's trace over the cell delta, read as an input of
+   the stage, so the stage stays self-contained.
 2. A map produces `(context, order key, expr)`. The order key is (context rank, record
    key in `CellKey` order), which is eager's concatenation order.
 3. The group aggregate, with an error channel that reads the first `Err` in order.
@@ -213,8 +215,9 @@ boundary. Where a piece of state physically lives (a client, the host or a worke
 an implementation detail. The model store's decisions depend only on the model. A
 server-side twin of a client's state, such as its filter, watermark or window, may be
 held at the serving end of an edge where that makes the graph genuinely simpler. It is
-then part of the edge, not of the model store, and it is disposable: losing it forces a
-correction from the client's watermark, never wrong data.
+then part of the edge, not of the model store, and it is disposable: losing it never
+gives wrong data. A client that keeps its own watermark recovers with a correction from
+it. A client that relied on the twin for its watermark recovers with a full refetch.
 
 **Every edge may cross a network.** An edge, meaning the stream from one operator to the
 next, may be in-process or remote. No edge assumes a function call or shared