@c4a/context-cli 0.6.18 → 0.6.19

package/providers/context/resources/manuals/reference/code-extractors.md

@@ -104,7 +104,7 @@ configuration problem, not a Review decision.
 
 If no current capability can parse the source reliably, stop at configuration
 and report the missing generic capability. Do not silently emit an empty
-codegraph or reuse an unrelated parser.
+codeindex or reuse an unrelated parser.
 
 ## Plan Before Parsing
 
@@ -114,7 +114,7 @@ application, adapter, CLI/tool, monorepo container, derived source,
 authoritative contract source, or unknown.
 A hybrid module may declare several `moduleTypes` and several behavior `facets`;
 keep one primary `moduleType` for concise reports. Record inspected paths in
-`moduleTypeEvidence`, then read all matching Route-recommended files below
+`moduleTypeEvidence`, record every Markdown file actually read in `documents`, then read all matching Route-recommended files below
 `resources/semantic/code-index/templates/` and combine them into one plan.
 After that, choose exactly one closed output profile: `module-map`,
 `application-map`, `protocol-index`, `service-boundary`, `runtime-map`,
@@ -136,8 +136,9 @@ selected symbol and permits one owning index unit per source. Use it for an
 intentional granular public reference. Use `extractCustom()` for module-level
 aggregation, registries, protocol indexes, cross-module flows, or multiple
 candidate owners over one source; each candidate declares its `module` and
-evidence-scoped `sections`. Each section's typed coverage and exact evidence is
-checked against the output profile during preview. Resolve repositories from
+at least one evidence-scoped `section`; there is no page-level Markdown
+fallback. Each section's typed coverage and exact evidence is checked against
+the output profile during preview. Resolve repositories from
 the extractor context's `sources[].absolutePath`, never from a
 machine-specific checkout path. Cross-module flow output must also emit
 source-backed structured edges. Generated clients/models, mirrored sources, legacy

package/providers/context/resources/manuals/reference/package-templates.md

@@ -47,7 +47,7 @@ kbPackage({
 llmsPackage({
   name: "component-lib-llms",
   template: "src/package-templates/llms",
-  select: { include: ["codegraph/component-lib/**"] },
+  select: { include: ["codeindex/component-lib/**"] },
 });
 ```
 
@@ -265,7 +265,7 @@ its pages instead of producing one index per path segment.
 The generated
 `dist/<package-name>/wikis/` tree is the required default
 KB entry surface. Internal collections are mapped into OKF roots during build:
-`codegraph`, `business`, and `product` go to `wikis/`; `architecture`, `sop`,
+`codeindex`, `business`, and `product` go to `wikis/`; `architecture`, `sop`,
 `faq`, `decision`, and `incident` go to `guides/`; `standards` and `test` go to
 `rules/`; and `feats` goes to `feats/`. Treat `wikis/` as the structured
 entity-and-relationship layer. Guides and rules may explain, operationalize,
@@ -313,17 +313,25 @@ wants project-specific behavior beyond knowledge lookup.
 
 ## Context OKF Profiles
 
-Approved Markdown under `knowledge/` is the production source of truth:
+Approved Markdown under `knowledge/` and its deterministic
+`knowledge/structure.yaml` projection form the authoring source of truth:
 
 - top-level YAML frontmatter uses OKF fields such as `type`, `title`,
   `description`, `tags`, `timestamp`, and `resource`;
-- Context production metadata such as `sources`, `node_type`, `visibility`,
-  `code_symbols`, relationship records, and `candidate_fingerprint` also lives
-  at the top level;
+- each Markdown page keeps reader fields, stable page identity, `sources`, and a
+  small recovery capsule (`resource`, `node_type`, containment fields, and
+  relationship mode);
+- large or repeated machine state such as complete `code_symbols`, code
+  evidence, relationship records, candidate fingerprints, and optimization
+  decisions lives once in the corresponding `structure.yaml` view record;
+- Context readers hydrate that machine state in memory before verify, audit,
+  revision, or build. Do not copy a compact page as a new page without using a
+  Context authoring command;
 - do not nest Context production metadata under `context`; fields such as
   `context.sources` and `context.code_symbols` are not part of the 0.6 profile;
 - section provenance lives in `<!-- context:section ... source_ref="..." -->`
-  comments;
+  comments. When a Section needs more than one citation, the CLI preserves the
+  complete set in its adjacent `context:source_refs` block;
 - do not add frontmatter `source_refs`; page-level provenance is derived from
   section source refs when needed;
 - do not add `context` or `schema` fields.
@@ -346,7 +354,7 @@ src-N#span:<heading-hint> L<start>-<end>@<span-hash>
 
 The code symbol form includes the source-relative file so same-name symbols in
 different files resolve to one exact symbol-index row. Consumers should still
-treat the complete `source_ref` as opaque. Production codegraph pages keep
+treat the complete `source_ref` as opaque. Production codeindex pages keep
 `candidate_fingerprint` at the top level and do not duplicate this evidence in
 `code_origin`.
 
@@ -398,8 +406,8 @@ current closed state.
 
 Before writing output, `context build` validates that rendered template paths
 are safe, unique, and do not collide with copied knowledge paths. For example,
-a template file that renders to `wikis/codegraph/foo.md` is rejected if
-selected knowledge such as `knowledge/codegraph/foo.md` maps to that same OKF
+a template file that renders to `wikis/codeindex/foo.md` is rejected if
+selected knowledge such as `knowledge/codeindex/foo.md` maps to that same OKF
 output path. Rename the template file or use `select.exclude` when the
 collision is intentional.
 

package/providers/context/resources/manuals/reference/project-api.md

@@ -35,7 +35,7 @@ the date:
 ```text
 knowledge/<collection>/<slug>.md
 knowledge/<collection>/<containment>/<slug>.md  # only for an intentional hierarchy
-knowledge/codegraph/<module>/symbol/<slug>.md
+knowledge/codeindex/<module>/symbol/<slug>.md
 repo:<date>/<module>#symbol:...
 file:<date>/<module>/<document>#span:...
 lark:<date>/<module>/<document>#span:...
@@ -47,12 +47,12 @@ dist/<source-name>-kb/...
 Choose the module boundary before extraction. In a monorepo, register each
 confirmed package/subdirectory under the same date batch. A repo root that
 resolves to multiple modules is for inspection; it is not an extraction unit.
-Approved codegraph paths use the stable module name; the date remains only in
+Approved codeindex paths use the stable module name; the date remains only in
 source selectors, phase ids, and evidence refs:
 
 ```text
-knowledge/codegraph/module-a/...
-knowledge/codegraph/module-b/...
+knowledge/codeindex/module-a/...
+knowledge/codeindex/module-b/...
 ```
 
 For prose Views, provide a stable filename `slug` and omit `path`; the CLI
@@ -63,7 +63,7 @@ it is not a required source/module wrapper.
 
 The registry stores this as one date entry containing several `modules` entries,
 and materializes each module at `sources/repo/<date>/<module>`.
-Repo module names are project-wide codegraph identities and therefore cannot be
+Repo module names are project-wide codeindex identities and therefore cannot be
 reused under another date batch. Refresh an existing module through its original
 date/module selector.
 When a repo module and the Context workspace share the same Git root, the CLI
@@ -408,7 +408,7 @@ alignProse({
 ```
 
 `collection` is an internal knowledge classification, not a package directory.
-Package build maps `codegraph`/`business`/`product` to `wikis/`,
+Package build maps `codeindex`/`business`/`product` to `wikis/`,
 `architecture`/`sop`/`faq`/`decision`/`incident` to `guides/`,
 `standards`/`test` to `rules/`, and `feats` to `feats/`. The complete output
 contract is documented in [Package Outputs](../guides/package-outputs.md).
@@ -598,7 +598,7 @@ Extract exported TypeScript / TSX symbols into draft candidates:
 ```ts
 extractTs({
   source: componentLib,
-  collection: "codegraph",
+  collection: "codeindex",
 });
 ```
 
@@ -607,7 +607,7 @@ Options:
 | Field | Meaning |
 |---|---|
 | `source` | `source("date", "module")` for one repo module |
-| `collection` | Code extraction uses `"codegraph"` |
+| `collection` | Code extraction uses `"codeindex"` |
 | `include` | Optional glob list inside the selected source; default is `["src/**/*.{ts,tsx}"]` |
 | `mode` | `"exports"` (default) traces public exports from automatic or configured entries; `"scan"` uses every file matched by `include` as an entry root |
 | `entries` | Optional source-relative entry files for `"exports"` mode. They override `package.json` entry detection and live only in the Context project configuration |
@@ -620,7 +620,7 @@ An explicit index unit records production intent rather than parser settings:
 ```ts
 extractTs({
   source: componentLib,
-  collection: "codegraph",
+  collection: "codeindex",
   indexUnits: [{
     id: "component-public-api",
     inputSources: ["20260712/component-lib"],
@@ -629,6 +629,7 @@ extractTs({
     moduleTypes: ["sdk-library"],
     facets: ["public-api", "plugin-extension"],
     moduleTypeEvidence: ["package.json exports and src/index.ts public entry"],
+    documents: ["README.md", "docs/public-api.md"],
     outputProfile: "public-api-reference",
     responsibility: "Document stable exported component contracts.",
     entries: ["src/index.ts"],
@@ -655,6 +656,9 @@ behaviors such as routing, protocol consumption, events, persistence, plugins,
 release, or cross-module chains. `moduleTypeEvidence` records the inspected
 paths that support the classification. Classify first, then read the matching
 Route-provided code-index templates, and only then finish the extraction plan.
+`documents` contains exact source-relative Markdown paths read for that plan;
+Context compares it with discovered module documents instead of treating a
+source-code comment as documentation coverage.
 `lifecycle` is `"authoritative"`, `"generated"`, `"mirrored"`, `"legacy"`,
 or `"vendored"`; derived sources normally use `"provenance-only"` rather
 than duplicating reader-facing pages. These are generic project facts, not
@@ -680,7 +684,7 @@ editing the source repository:
 ```ts
 extractTs({
   source: componentLib,
-  collection: "codegraph",
+  collection: "codeindex",
   include: ["src/**/*.ts"],
   entries: ["src/api.ts"],
 });
@@ -740,7 +744,7 @@ remain report signals and do not create another Gate.
 Phase id shape:
 
 ```text
-extract:<source-name-or-repo>:codegraph
+extract:<source-name-or-repo>:codeindex
 ```
 
 Codegraph extraction has two execution policies:
@@ -751,7 +755,7 @@ Codegraph extraction has two execution policies:
   the Agent re-evaluates `context status --format json`; only
   `workflow.current` decides whether Review is now required.
 - `context run <phase-id> --auto-promote` is the explicit CI/CD path. It is valid
-  only for `phase.extract.ts` codegraph phases, applies deterministic code deltas
+  only for `phase.extract.ts` codeindex phases, applies deterministic code deltas
   without Review, refreshes deterministic close when approved knowledge changed,
   then runs project verification. Close or verification errors make the command
   fail; JSON output reports applied/materialized/removed counts plus a `close`
@@ -763,7 +767,7 @@ other semantic knowledge. Agents must not infer a human gate from a phase-local
 result. Human gates and their inspection/resolution Actions are exposed only by
 `workflow.current`.
 
-Approved codegraph sections use the local evidence form
+Approved codeindex sections use the local evidence form
 `src-N#symbol:<file>:<symbol>:<kind>@<digest>`. The file segment makes reverse
 lookup exact when multiple files contain the same symbol name, kind, and digest;
 the complete ref remains opaque to agents. New pages keep only top-level
@@ -779,7 +783,7 @@ aggregated repository protocol:
 extractCustom({
   id: "extract:service:protocol",
   sources: [service],
-  collection: "codegraph",
+  collection: "codeindex",
   indexUnits: [{
     id: "service-protocol",
     inputSources: ["20260811/service"],
@@ -850,6 +854,12 @@ least one source-backed structured edge. `context status` therefore treats this
 pending code extraction target, and Review can verify snapshot freshness
 without a placeholder `extractTs` phase.
 
+Each `sections[].markdown` value is Section body content only; do not copy the
+template heading into it. Context renders `sections[].title` and rejects nested
+reader headings at the SDK boundary so empty template chapters cannot leak into
+knowledge. Evidence `symbol` and `kind` are canonical-ref tokens and cannot
+contain `:` or `@`; exact qualified signatures remain reader-facing prose.
+
 `indexUnits` is also the batch scale and ownership contract. Candidate
 `module` must match one declared unit id or output owner. Older callbacks that
 omit `indexUnits` remain compatible: Context groups candidates by `module` and
@@ -879,6 +889,21 @@ output profile. Coverage is based on source-backed evidence paths, not Markdown
 page count, so one aggregate page can pass while an entry-only static module
 card cannot.
 
+For a single-source index unit, Context also scans every represented language
+family and Markdown/MDX file after the unit's declared exclusions. The adapter's
+`eligibleFileTargets` and `eligibleLoc` must cover that independent baseline.
+Configuration files may be evidence, but a hand-picked evidence list cannot be
+reused as the source or LOC denominator. Cross-module-flow units remain scored
+against their declared entry, protocol, operation, and handoff boundaries rather
+than treating several repositories as one source-code page.
+
+The same baseline discovers conventional sibling page entries, route-register
+calls in Go router files, and exported receiver operations when a Go handler is
+the declared service source of truth. Every discovered identity must appear in
+the target-symbol and boundary denominators. An aggregate page may summarize
+these identities, but an adapter cannot list one representative sibling and
+silently omit the rest.
+
 The extractor returns knowledge semantics (`nodeRef`, rendered Markdown,
 Review summary and source-backed evidence). It must not write `knowledge/`,
 `.tmp/context-runtime/lifecycle/candidates.jsonl`, extraction fingerprints or
@@ -899,9 +924,9 @@ import { indexGoRepository } from "@c4a/extract-go";
 import { extractCustom } from "@c4a/context";
 
 extractCustom({
-  id: "extract:service:codegraph",
+  id: "extract:service:codeindex",
   sources: [service],
-  collection: "codegraph",
+  collection: "codeindex",
   extract: async ({ projectRoot }) => {
     const facts = await indexGoRepository(resolveServiceCheckout(projectRoot));
     return { candidates: buildServiceCandidates(facts) };
@@ -927,7 +952,7 @@ and its evidence coverage auditable before candidate writes.
 Declare the review step for a collection:
 
 ```ts
-reviewValidity({ collection: "codegraph" });
+reviewValidity({ collection: "codeindex" });
 ```
 
 Declare one review gate for all current draft collections:
@@ -939,7 +964,7 @@ reviewValidity({ scope: "all" });
 Phase id:
 
 ```text
-review:codegraph:validity
+review:codeindex:validity
 review:all:validity
 ```
 
@@ -965,7 +990,7 @@ continue wording does not invoke it.
 
 The gate is batch-scoped: prose waits for every planned View across all active
 structure slots and every declared `pendingStructureTargets` item in the round;
-codegraph waits for every pending extract phase in the confirmed module round.
+codeindex waits for every pending extract phase in the confirmed module round.
 Candidate count/hash therefore describes the complete current batch rather than
 one page, source slot, or module. Deterministic close later merges all active
 slots into `knowledge/structure.yaml`, retains only their source, collection,
@@ -995,13 +1020,13 @@ const sample = source("20260712", "sample");
 
 customPhase("custom:20260712/sample:review", async (ctx) => {
   await ctx.ensureSources({ source: sample });
-  await ctx.extract.ts(extractTs({ source: sample, collection: "codegraph" }));
-  await ctx.review.html(reviewValidity({ collection: "codegraph" }));
+  await ctx.extract.ts(extractTs({ source: sample, collection: "codeindex" }));
+  await ctx.review.html(reviewValidity({ collection: "codeindex" }));
 });
 ```
 
 Custom phases are an orchestration escape hatch. Use `extractCustom()` instead
-when project code needs to publish codegraph candidates. The supported runtime
+when project code needs to publish codeindex candidates. The supported runtime
 helpers are:
 
 - `ctx.ensureSources(...)` for repo source readiness.

package/providers/context/resources/procedures/close-and-build.md

@@ -6,14 +6,20 @@ mediaType: text/markdown
 
 # Close and build
 
-Close deterministically derives `knowledge/structure.yaml` from approved
-Markdown and the confirmed structure snapshots. It validates the rebuilt
-projection. When an approved page still points at a captured source asset,
+Close deterministically reconciles approved Markdown, existing durable machine
+metadata, and confirmed structure snapshots into `knowledge/structure.yaml`.
+It then compacts repeated machine fields out of each Markdown page and validates
+the hydrated result. When an approved page still points at a captured source asset,
 close may mechanically replace that target with its content-addressed
 `knowledge/assets` path; it does not rewrite reader-visible prose. Before
 removing the transient snapshots, it retains only each closed prose target's
 source, collection, and consumed snapshot hash under `source_inputs`.
 
+Do not hand-edit, duplicate, or move fields between Markdown and
+`structure.yaml`. The CLI owns compaction and hydration. A compact Markdown page
+remains readable and keeps enough identity for projection diagnostics; complete
+code and optimization metadata is intentionally not duplicated.
+
 Build runs only after close and verification are current. It writes declared
 packages under `dist/` and records an inventory receipt with added, updated,
 removed, and index changes.
@@ -26,11 +32,20 @@ package inventory. Revision sidecars are never emitted as separate knowledge.
 Run only the current route command, then evaluate again. A successful build
 means the currently declared scope is current; newly captured or newly declared
 targets can reopen earlier graph nodes.
+
+The final completion summary must cover the built outputs, validation status,
+knowledge scale, and unresolved issues. Add a compact `Review reports` section with every
+exact HTML report URL or local report path that the user actually used for a
+review decision in this conversation, together with its reviewed scope. Omit
+the section when no report was user-reviewed. Do not reconstruct it by scanning
+`.tmp`, invent a shareable URL, or classify fully managed or force approval as
+user review.
 # Code-index audit record
 
-When a package selects approved `codegraph` pages, build requires the current
-batch-level Agent audit to be accepted. The complete report remains in the
-Context workspace at `knowledge/code-index-audit.json` and is not copied into
-`dist/` or uploaded with the package. `context-build-inventory.json` stores only
-the report digest, decision, and compact package summary needed to identify the
-audited build.
+When a package selects approved `codeindex` pages, build requires the current
+batch-level Agent audit to be accepted. The complete report and decision state
+are runtime data below `.tmp/context-runtime/code-index-audit/`; deleting
+`.tmp/` causes Context to recompute and re-audit them. They are not copied into
+`dist/`, uploaded with the package, or committed as knowledge. The package
+inventory stores only the report digest, decision, and compact summary needed
+to identify the audited build.

package/providers/context/resources/procedures/code-extraction.md

@@ -27,6 +27,10 @@ selected package's public SDK/README before editing `src/index.ts`; never infer
 its API from bundled output. `moduleTypeEvidence` must identify the inspected
 paths that support the classification. An `unknown` unit or a unit with no
 classification evidence is an incomplete index plan.
+Record exact source-relative Markdown paths read during classification in
+`indexUnits[].documents`. Context inventories module Markdown independently:
+root README or documentation entry files require complete reading, while other
+related Markdown uses the reported Floor and Target coverage.
 
 For every custom extraction preview, Context probes source paths for known
 community structural capabilities: TypeScript symbols, React Router routes, Go
@@ -49,6 +53,15 @@ public-contract plan. Scan mode, repository collections, and custom extraction
 must declare their index units explicitly; an inferred plan is diagnostic only
 and cannot write candidates.
 
+Every index unit must expose one inventory contract. Built-in parsers produce
+it from AST and source traversal; a project adapter returns the same generic
+shape. The inventory separates eligible/analyzed files and non-empty LOC,
+discovered/read Markdown, discovered/analyzed/target/exported symbols, stable
+entries and profile-selected boundaries, plus excluded files and reasons. JSON,
+YAML, lockfiles and assets may be evidence but do not inflate source LOC.
+Evidence-only adapter output is explicitly `unscorable` and cannot pass the
+mechanical quality Gate as a complete module index.
+
 Extractor output shape must match the semantic plan. `extractTs()` projects one
 candidate page per selected symbol and assigns each source to one index unit;
 it is suitable for a deliberately granular public reference. Aggregated module
@@ -82,13 +95,17 @@ rerun the batch preview, then process exactly one pending extraction target and
 evaluate again. Do not add a second classification Gate after the page-count
 Gate; a plan revision returns through the same configuration step.
 
-A batch-total page warning and quality risks such as a thin aggregate are
-advisory only. They remain visible for cost and content-shape review but do not
-become a new Gate. Legal scale recovery includes narrowing `include`, excluding
-generated or mirrored directories, enabling `exportedOnly`, moving from a
-symbol catalog to an aggregated `extractCustom()` plan, or registering real
-child sources. Splitting one `extractTs()` source into overlapping units is not
-a valid workaround.
+A batch-total page warning remains advisory. After extraction, independent
+mechanical dimensions enforce source analysis, target-boundary coverage,
+facts/explanation, evidence scope, implementation ratio, and page shape.
+Aggregate custom candidates are rendered only from evidence-scoped `sections`;
+free Markdown, empty optional sections, template instructions, and placeholders
+cannot become reader-facing knowledge. A required Section without evidence is a
+material/capability gap instead of an empty heading. Legal scale recovery
+includes narrowing `include`, excluding generated or mirrored directories,
+enabling `exportedOnly`, moving from a symbol catalog to an aggregated
+`extractCustom()` plan, or registering real child sources. Splitting one
+`extractTs()` source into overlapping units is not a valid workaround.
 
 Current previews are cached below `.tmp/context-runtime/extract/previews/` and
 formal extraction reuses their validated structural result. Cache identity is
@@ -97,6 +114,12 @@ locks, and the preview protocol. Deleting
 `.tmp` only causes a fresh preview. Existing approved knowledge is not
 retroactively rejected solely because it is large.
 
+New workspaces write `knowledge/codeindex/**`. If an old workspace contains
+legacy `knowledge/codegraph/**`, follow the Route-returned
+`context migrate codeindex --format json` action. It rewrites formal collection
+identities and invalidates derived extraction/audit state without requiring
+`.tmp`. Never create a permanent dual-write or move the directory by hand.
+
 Do not open Review while another extraction target in the same batch remains.
 Unchanged approved or rejected symbols do not need another decision; new or
 changed candidates remain subject to the current Review policy.
@@ -148,10 +171,11 @@ empty or guessed graph.
 
 After every complete code-extraction batch, the Route produces one batch-level
 code-index audit. Mechanical signals cover content depth, evidence scope,
-declared-source coverage, and structured handoffs. They are review evidence,
-not an automatic numeric rejection: the Agent must inspect the affected pages
-and submit one `accept`, `revise`, or `request-input` decision for all index
-units together.
+declared-source coverage, and structured handoffs. A dimension outside its
+absolute bounds is a mechanical rejection and cannot be accepted. Advisory or
+elevated signals inside those bounds remain review evidence: the Agent must
+inspect the affected pages and submit one `accept`, `revise`, or
+`request-input` decision for all index units together.
 
 Do not split this into one confirmation per module. In fully managed operation,
 real issues select `revise` and the Route returns through project configuration,

package/providers/context/resources/procedures/code-index-audit.md

@@ -10,17 +10,48 @@ This Route is a required semantic review of the complete proposed code index.
 The CLI reports mechanical signals; the Agent reads the affected candidate
 content and evidence, compares registered sources with the user-confirmed
 scope, and decides whether the index is fit for its declared output profiles.
+Reader metrics exclude Context lifecycle comments and evidence annotations.
+Improve the source-backed knowledge itself; do not change Markdown syntax,
+sentence count, or pagination solely to influence a mechanical counter.
 
-The report is not a numeric rejection. A signal may be a false positive, but
-it may not be ignored. Every elevated signal must receive an assessment tied
-to inspected content. Submit one `context.code-index-audit-decision.v1`
-payload for the complete batch.
+The report contains no aggregate score. Every dimension is computed
+independently with its observed value, floor, recommended target, ceiling,
+mechanical score, uncovered identities, and legal repair actions. A dimension
+outside its absolute bounds cannot be accepted or offset by another strong
+dimension. Every elevated signal must receive an assessment tied to inspected
+content. Submit one `context.code-index-audit-decision.v1` payload for the
+complete batch.
+
+Read the complete inventory before deciding. It separates eligible and
+analyzed files/LOC, read documents, target and exported symbols, stable entries,
+protocol boundaries, exclusions, and parser gaps. For each failed or
+below-target dimension, use the returned uncovered identities, affected pages,
+recommended template resources, and action vocabulary. Do not replace those
+facts with an inferred file list.
+
+For custom adapters, file and symbol identity arrays are complete denominators,
+not samples: their lengths must match the declared counts, analyzed identities
+must belong to eligible identities, and exported identities must belong to the
+target-symbol set. For a single-source unit, the CLI independently enumerates
+the represented language families plus Markdown/MDX after declared exclusions;
+an adapter cannot make its ratio pass by reporting only hand-picked evidence
+files. Conventional sibling page entries, Go route-register calls, and exported
+operations from a declared Go handler source of truth are also independently
+enumerated; include every discovered identity in the target-symbol and boundary
+denominators even when one aggregate page explains them. Section evidence may
+contain multiple files and may overlap
+another Section when one fact crosses a boundary. It must not be reduced to one
+arbitrary primary file, and every Section must not repeat the complete page
+evidence set merely to satisfy coverage. Distinct structured relationships must
+cite the concrete evidence for their own handoff instead of repeating one whole
+page evidence set across every destination.
 
 ## Decisions
 
-- `accept`: the requested scope is represented and every real content-depth,
-  evidence-scope, and relationship issue is resolved. An acceptable or
-  non-applicable signal needs a concrete reason.
+- `accept`: the requested scope is represented, every dimension is within its
+  absolute bounds, and every real content-depth, evidence-scope, template, and
+  relationship issue is resolved. A below-target dimension remains visible
+  and needs a concrete reason in ordinary operation.
 - `revise`: one or more real problems remain. Identify the affected units and
   describe changes to scope, aggregation, sections, evidence, or structured
   handoffs. The Route returns to `src/index.ts`, Preview, extraction, and a new
@@ -31,13 +62,22 @@ payload for the complete batch.
 
 ## Fully managed operation
 
-Fully managed authority does not auto-accept this audit. When a signal is a
-real problem, choose `revise` and continue the revision loop without asking the
-user. Repeat until the proposed index matches the requested scope and its
-module maps, contracts, and handoffs contain useful source-backed explanation.
-Pause only for unavailable material, source access, tool failure, or a
-concrete no-progress blocker.
+Fully managed authority does not bypass the audit. When an absolute dimension
+fails, choose a returned repair action and continue through configuration,
+Preview, extraction, and audit without asking the user. Aim for the recommended
+target instead of stopping immediately at the floor. The retry ledger is bound
+to unit, source revision, profile, and problem fingerprint; superficial wording
+changes do not reset it. After three unsuccessful revisions of the same
+problem, Context combines all affected modules into one human-guidance Gate.
+Pause earlier only for unavailable material, source access, or missing parser
+capability.
 
 After each decision, briefly tell the user which decision was selected, the
 affected units, and the next Graph path. Do not stop a managed run merely to
 announce a successful automatic revision.
+
+The current `context.code-index-audit-report.v2` is computed from proposed or
+approved knowledge. Only its decision receipt and compact retry metrics stay
+under `.tmp/context-runtime/code-index-audit/`. Package output records only the
+selected report digest and decision; page metrics, exclusions, template
+fingerprints, and repair history are never published.

package/providers/context/resources/procedures/document-capture.md

@@ -47,3 +47,12 @@ asset links. If a selected local
 boundary is a documentation site rather than plain Markdown, use the
 Context-provided processor/configuration diagnostic; do not invent rendered
 text or scan outside the confirmed boundary.
+
+For Lark reads, Context prefers the authenticated user identity. If that
+identity is unavailable because its credential is missing, expired, or cannot
+be refreshed, Context may retry the same registered source with the bot
+identity. It does not switch identity after a permission or missing-scope
+response. Once selected, the same identity is used for the document body and
+all embedded resources. If `docs +fetch` lacks the required `--doc-format`
+capability, follow the returned `lark-cli update` recovery and rerun the same
+Route command; do not replace the capture with a hand-written export.