docs: amend DESIGN.md for four rulings

Untracking a season now clears its episodes' wanted flag, unified search
returns titles only, the library is the homepage and the signal chain moves
into settings, and the wordmark links home.

Refs #169

DESIGN.md

@@ -139,9 +139,12 @@ manually marked S02 needs no special case: three wanted episodes, nothing else.
 
 `Season.tracked` is also a rule, not intent. Turning tracking on marks every
 already-revealed episode in the season wanted, and keeps marking episodes
-wanted as metadata reveals them. Turning it off withdraws nothing: leaf intent
-is never removed implicitly, so anything already marked wanted stays wanted
-until cleared explicitly.
+wanted as metadata reveals them. Turning it off clears `wanted` on every
+episode of that season: toggling the flag is itself the explicit act, and the
+product offers no other way to withdraw a season's worth of intent. Without
+that, untracking leaves a series with every season off and every episode still
+wanted, pinned at `incomplete` with no way back. Marking individual episodes
+wanted on a season that was never tracked is unaffected by any of this.
 
 Both rules skip season 0. Specials are dozens of undated shorts and recaps
 that indexers do not carry, so `auto_track` never marks season 0 tracked. See
@@ -485,12 +488,10 @@ lower-priority crate** (§9.4), not the primary shape.
 
 ### 9.2 Unified search
 
-One box. Two grouped result sets: **in library** first (title match, and for TV
-also episode title, so `bluey hospital` finds the episode), **on TMDB** below.
-An episode row surfaces only when the query matches something beyond the series
-title: a query satisfied by the series title alone returns the series row and
-nothing below it. Enter on a TMDB result opens the add flow with root and
-policy pre-filled.
+One box. Two grouped result sets: **in library** first, **on TMDB** below. Both
+sets are titles — series and movies. Episode rows never appear, under any
+query, and there are no season rows. Enter on a TMDB result opens the add flow
+with root and policy pre-filled.
 
 The same box accepts a raw TMDB or IMDb ID, and a pasted magnet or `.torrent`,
 which skips to the manual-grab flow.
@@ -597,6 +598,22 @@ Out of scope here, because they are the adjacent scope most likely to creep:
 watch providers, recommendations or similar titles, collections, person pages
 inside the app, review text.
 
+### 9.7 The shell
+
+**The library is the homepage.** `/` renders the library view described in
+§9.6. It is what the operator opens the app to look at, so it is what the app
+opens on.
+
+**The signal chain is a settings section.** The four upstreams — tmdb,
+prowlarr, arr, transmission — and their lamps live inside `/settings`, and have
+no route of their own. Per-upstream health is something you check when
+something is wrong, not a homepage.
+
+**The master lamp stays on the rail**, so the at-a-glance read that the chain
+is healthy survives the move and no navigation is needed to get it.
+
+**The wordmark is a link home.** `arr` on the rail navigates to `/`.
+
 ## 10. Persistence
 
 SQLite via `sqlx`, compile-time-checked queries, migrations in `arr-db`.