dds

# 0.15.0 — declared out-of-corpus ADRs + judged-leg sampling (issues #44, #45)

Two changes, no file moves.

**`Realized-in:` trailer.** An ADR whose rule is real but whose
mechanism lives outside this tree (a sibling repo, an artifact, a
process) can now declare it: a trailer beside `Risk:` naming where the
mechanism lives. The ADR leaves the judged corpus (no verdict expected,
no evaluability debt), its risk coverage still counts, and the walk
publishes the declaration (`out_of_corpus`). Canon: `conventions.md`
§1 "Realized-in".

**Borderline verdicts are sampled.** A judged verdict whose first
sample lands anything but conformant now draws extra independent
samples (default 3 total, both judge runtimes); the modal verdict
stands, ties resolve to the most severe, and the record carries a
`samples` list — splits surface as stability notes. Automatic; nothing
to configure.

## Steps

1. Run `dds upgrade` (canon reconcile picks up the conventions text).
2. For each ADR the check has been reporting as permanent
   `not_verifiable` because its mechanism is elsewhere (e.g. a
   deploy-via-gitops ADR realized in Terraform/ArgoCD repos): add
   `Realized-in: <repo(s) or artifact>` after its `Risk:` trailers.
   Keep the trailers — coverage is the point of keeping the ADR.
3. Do NOT use `Realized-in:` for rules a capable judge could verify
   against this tree — sharpen those Rules instead.