Two stale claims in the design doc, one of them repeated in code.
The .id is on the TabView inside ContentView, not on ContentView itself. The spec and PushRouter's doc comment both said otherwise, and that claim was the stated justification for owning the router above ContentView. The placement is still right — the router must outlive the TabView — but the reason given was wrong, and the real consequence is the opposite of what the text implied: ContentView's own @State survives an account switch, which is exactly why the Dashboard path has to be reset explicitly in the drain. Surfaced by the whole-branch review; the code was already correct.
The device token is not declared under Identifiers. The spec instructed declaring it, so it would read as an outstanding to-do. Now records the decision and the reasoning — per-app, rotates, not the advertising identifier, not used for tracking. Also notes that if it were ever declared it would be "linked to the user", since push_devices.user_id ties it to the account; the spec previously claimed unlinked, which was wrong.
Documentation and one doc comment. Build succeeds; no behaviour change.