docs: document layer extraction deferral semantics

Records in SPEC.md how extract_tarball handles directory modes and
hard links the tar order cannot resolve inline; the constraint behind
the fedora:latest directory-hash extraction fix.

SPEC.md

@@ -177,6 +177,27 @@ If architecture is not available in manifest list, error with available architec
 Error: No manifest found for architecture 'riscv64'. Available: amd64, arm64, ppc64le, s390x
 ```
 
+### Layer Extraction
+
+`extract::extract_tarball` handles plain rootfs tarballs and OCI layer
+bundles. Symlink entries are always created verbatim — link targets are
+never opened or followed during extraction. OCI whiteout markers (`.wh.*`
+and `.wh..wh..opq`) delete lower-layer paths during the layer pass.
+
+Two tar-ordering hazards are handled by deferral instead of inline
+application, because the tar order does not guarantee an entry's
+prerequisites exist when it appears:
+
+- Directory modes are recorded during extraction and applied after the
+  last layer is written. Images ship read-only directories (Fedora's
+  ca-trust tree is `dr-xr-xr-x`) whose own contents an eagerly applied
+  mode would reject; later layers also write into base-layer directories.
+- Hard links are applied after the file pass, so targets later in the tar
+  or in an earlier layer resolve to real hard links. A link whose target
+  exists nowhere becomes a symlink to the raw target (possibly dangling)
+  with a verbose warning — matching what Docker/podman produce for e.g.
+  Fedora's `ca-trust/extracted/pem/directory-hash` entries.
+
 ## Execution Flow
 
 The CLI delegates to the library; the namespace-mode flow is: