docs(brainstorm): record Q1, Q2, Q4, Q5 and make the lifecycle visitor-only

[systemfsoftware-maker]

Amends docs/brainstorms/2026-10-08-0340-feat-starter-state-of-the-art-plan.md with Ryan's and the conductor's answers.

Decided

• Q1: @systemfsoftware/xstate from our sovereign fork only (github:systemfsoftware/xstate, main 84e602e). Never upstream xstate, never npm. If the planning spike fails, A stops; no upstream fallback.
• Q2 (conductor, option b): no privileged actor, no auth. Every lifecycle event is a visitor action.
• Q4: no rat-stack code runs anywhere.
• Q5: no evals in a starter kit. Area B is removed from the doc entirely (requirements, acceptance examples, flows, sources, summary, table, dependencies, Goal Capsule).

Lifecycle (replaces R1, R7, R10, R11)

• States Visible, Flagged, Hidden; events Flag, Vouch, both open to any visitor.
• Legal: Visible→Flagged on Flag, Flagged→Visible on Vouch, Flagged→Hidden on Flag. 3 legal, 3 illegal; Hidden is final.
• Public list returns Visible and Flagged, never Hidden.
• Journey: sign, flag, vouch, flag twice, gone after a fresh page load; each step a separate request.
• R8 adapted to the three states and pairs; R3/R6 say "three-state". AE1, AE2, AE4, F1 and the diagram follow.

Other

• Fork citations re-read at 84e602e (StateMachine.ts:615, :1543-1564; transition.ts:77, :118).
• R- and AE-numbers of kept items are unchanged, because the gates plan cites R22-R26 and AE5/6/9/10/11.

Docs only. No judgment surface changes.