Fix the review findings in the three design documents

ARCHITECTURE.md: the chunk size limits, the commit date, the cases in
which a backup skips its prune, and two sentences that read badly.

docs/DATAMODEL.md: which repository type serves which table, what the
metadata export deletes and keeps, the blobs table in a restore, and
when a chunk row is deleted.

docs/REPOSTRUCTURE.md: how an object's size relates to its contents,
what blob sizes can leak and when, and a sentence moved out of the
prune rules.

All three now say that prune drops a local snapshot whose manifest is
gone, not whose directory is gone.

Model: fable-5-1

docs/REPOSTRUCTURE.md

@@ -253,17 +253,23 @@ therefore does not stop overwrites.
 
 ### Sizes are visible
 
-age adds no padding. The size of an object is the exact size of its compressed
-contents.
+An object's size follows exactly from the size of its compressed contents.
 
 All the new chunks in one blob share one zstd stream. The stream looks back 8
 MiB, or 4 MiB at compression levels 1 and 2. A blob is closed at
 `blob_size_limit` and at the end of each configured path. A chunk that is
 already stored is never packed again.
 
-Someone who can write into a backed-up file and watch blob sizes can learn
-something in one case. Their data and a secret must land in the same chunk, in
-a file that keeps changing.
+Data that an outsider writes compresses smaller when it matches a secret in the
+same chunk, so the blob gets smaller. The blob's size therefore shows the
+outsider whether their data matched the secret.
+
+This works only when all of these hold:
+
+- The outsider can write into a backed-up file.
+- The outsider can see the blob sizes at the destination.
+- The outsider's data and the secret land in the same chunk.
+- The file keeps changing.
 
 Back up a directory that outsiders can write to as a snapshot of its own.
 
@@ -363,10 +369,11 @@ objects. An rclone remote that cannot move objects can keep a partial object.
 - a blob that no manifest lists
 - a directory under `metadata/` that has no manifest
 
+It reads the manifests, which are not encrypted, so it needs no private key.
+
 These rules keep it from deleting data that is in use:
 
 - It keeps every blob that any manifest lists.
-- It reads the manifests, which are not encrypted, so it needs no private key.
 - It deletes nothing when any manifest cannot be downloaded or decoded.
 - It deletes a blob only once the blob is older than `prune_grace_period`.
 - It deletes a directory only once every object in it is that old.