fix(runtime): fail closed on offline artifact misses

docs/09_OBSERVATION_SESSIONS.md

@@ -224,7 +224,7 @@ a separately attested storage root:
 export MISSIONCORE_DATA_DIR=/absolute/private/path/mission-core
 # Full K1 point-plus-camera evidence must currently remain below the checkout.
 export MISSIONCORE_EVIDENCE_DIR=/absolute/path/to/NODEDC_MISSION_CORE/.runtime/mission-core/evidence/sessions
-# Optional operator retention quota; unset means no application byte quota.
+# Optional operator override; the application default is 8 GiB.
 # export MISSIONCORE_RRD_CACHE_MAX_BYTES=8589934592
 export MISSIONCORE_RRD_FREE_SPACE_RESERVE_BYTES=2147483648
 uv run k1link serve
@@ -298,10 +298,11 @@ global cross-process export gate to cap concurrent RAM, CPU and temporary-disk
 use. Crash leftovers from candidates, exporter temporary files and staged replay
 prefixes are scavenged under that lock before capacity accounting. Ready cache
 hits and active response leases do not wait behind that gate. The derived cache
-has no application byte quota by default, so a single multi-hour RRD is not
-rejected at 8 GiB. It still preserves a 2 GiB default filesystem reserve. An
-operator may set `MISSIONCORE_RRD_CACHE_MAX_BYTES` to enable LRU eviction of
-derived RRDs only; native evidence is never deleted.
+has an 8 GiB application byte quota and a 2 GiB filesystem reserve by default.
+`MISSIONCORE_RRD_CACHE_MAX_BYTES` can override the quota; LRU eviction still
+affects derived RRDs only, and native evidence is never deleted. A single
+derived RRD larger than the configured quota fails explicitly instead of
+consuming the operator host without a bound.
 
 ## Capture-clock envelope