@nimiplatform/nimi-coding 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## 0.5.0
+
+- Hard-cut canonical source admission to `nimicoding.authority/v2`; removed `fmt --upgrade`, `check --require-format`, and all v1 migration/history compatibility paths.
+- Hard-cut the public `authority evidence` surface and impact-disposition contract; implementation/test/gate execution and conformance remain host-project responsibilities.
+- Revised `authority audit`, `authority impact`, and `authority review` to v2 contracts: audit evaluates explicit graph and exact lexical-invariant bindings without positive proof packets, impact is pure before/after analysis, and review reports narrow assurance dimensions with business semantics and implementation conformance explicitly not evaluated.
+- Added explicit-channel `authority change-candidates`, immutable per-invocation compiler snapshots with transient indexes, acronym-bearing term support, and focused source-string escape handling for authority consumer paths; no SQLite, cache, ranking, inferred relation, or semantic judgment is introduced.
+- Reused one immutable snapshot pair across diff and change-derived recall, made audit consume the same read model, normalized fail-closed `partial: false` envelopes, hardened segment-aware path containment, and added corpus-bound audit surface consistency checks.
+- Renamed graph and audit traversal accounting away from proof terminology while preserving complete fail-closed budget enforcement.
+
 ## 0.4.0
 
 - Added bounded fail-closed `authority anchors` validation for closed lexical file/script anchors and optional tracked-file scope globs against an exact Git repository root.

package/README.md

@@ -4,13 +4,13 @@
 
 **Deterministic authority for AI coding systems and third-party extensions.**
 
-Nimi Coding turns project-owned normative specifications into stable identities, exact source locations, authored relations, and bounded fail-closed machine products. AI hosts, agent frameworks, CI systems, editor tooling, and third-party extensions can use those products to discover authority, assemble evidence, navigate relationships, and review exact changes without treating model inference as repository truth.
+Nimi Coding turns project-owned normative specifications into stable identities, exact source locations, authored relations, and bounded fail-closed machine products. AI hosts, agent frameworks, CI systems, editor tooling, and third-party extensions can use those products to discover authority, navigate relationships, and review exact changes without treating model inference as repository truth.
 
 Most end users should not need to invoke `nimicoding` directly. The primary integration surface is the documented CLI and its purpose-specific JSON products. Nimi Coding is not an AI agent, planner, code generator, approval workflow, or universal specification language.
 
 ## Why it exists
 
-AI models are good at generating code. They are less reliable at determining which document is authoritative, whether a search result is complete, how a rule moved across files, which declared relationships a change affects, or whether available evidence actually proves conformance.
+AI models are good at generating code. They are less reliable at determining which document is authoritative, whether a search result is complete, how a rule moved across files, which declared relationships a change affects, or what a deterministic check actually evaluated.
 
 Nimi Coding makes those questions explicit:
 
@@ -19,11 +19,12 @@ Nimi Coding makes those questions explicit:
 | Several documents appear authoritative | One closed canonical authority boundary |
 | Paths and headings change | Stable logical unit IDs independent of files and order |
 | Search returns noisy or truncated context | Bounded discovery, exact query, declared context, and graph products |
+| A semantic cut leaves unchanged survivors outside declared relations | Change-derived recall over caller-selected exact owner/scope/term/relation/Definition channels |
 | A model cannot cite the exact source | Portable field- and relation-level SourceMap locations |
 | Textual diffs obscure semantic change | Stable-ID semantic diff and declared impact obligations |
-| “No result” is presented as “clean” | Explicit budgets, completeness, gaps, refusal, and failure semantics |
+| “No result” is presented as “clean” | Explicit budgets, scoped statuses, refusal, and failure semantics |
 | A Git review may mix moving inputs | Immutable base OID plus race-checked complete worktree capture |
-| A file or test name is treated as proof | Evidence and conformance are separate product states |
+| Structural checks are read as product conformance | Business semantics and implementation conformance remain explicitly `not_evaluated` |
 
 ## Product model
 
@@ -38,7 +39,7 @@ Authority Foundation
                     ▼
 Spec Intelligence Plane
   discover · query · context · refs/path/subgraph
-  diff · impact · audit · review · evidence
+  diff · change-candidates · impact · audit · review
                     │
                     ▼
 Purpose-specific JSON / human output / SARIF (audit only)
@@ -56,12 +57,11 @@ Projects own all product meaning. Nimi Coding admits, locates, relates, and deri
 | Authority Foundation | Canonical YAML/Markdown, formatter, complete-root check, private deterministic compiler and SourceMap | Unknown or unsupported canonical input is rejected, not ignored |
 | Discovery and exact reads | Exact kind/owner/scope/lifecycle filters, normalized lexical snippets, optional direct relation preview, exact query, bounded declared context | No semantic search, automatic authority selection, or absence proof |
 | Graph navigation | Incoming/outgoing refs, deterministic paths, bounded subgraphs over `applies_to` and `supersedes` | Only authored relations; no inferred semantic graph |
-| Change intelligence | Stable-ID semantic diff and relation-derived impact obligations | Impact is a review requirement, not synchronization proof |
-| Deterministic audit | Project-owned verifier bindings, observations/findings/required gaps, JSON and SARIF 2.1.0 | The current built-in detector is a narrow governance verifier, not a natural-language contradiction engine |
-| Git-aware review | Immutable base commit plus exact, race-checked current worktree snapshot composed through compile/diff/impact/audit | Read-only; not branch, PR, approval, or release orchestration |
-| Authority-to-code evidence | Exact authority/scope to declared package-script command/test target reachability | Static narrow slice only; commands/tests are not executed and completed evidence leaves conformance `not_evaluated` |
+| Change intelligence | Stable-ID semantic diff, change-derived active-survivor recall, and relation-derived impact obligations | Candidate completeness is scoped to explicit channels; impact accepts no disposition or completion state |
+| Deterministic audit | Project-owned bindings for the graph verifier and exact lexical invariants, with JSON and SARIF 2.1.0 | Exact case-sensitive token/phrase checks only; no synonym, embedding, or natural-language contradiction inference |
+| Git-aware review | Immutable base commit plus exact, race-checked current worktree snapshot composed through compile/diff/impact/audit | Read-only; business semantics and implementation conformance are explicitly `not_evaluated` |
 
-The current Nimi-realm validation corpus contains 38 canonical containers, 793 authority units, and 1,260 authored relations. Those figures demonstrate a real large-corpus replay; they are not package limits or a claim that the grammar covers every possible domain.
+The current Nimi-realm validation corpus contains 33 canonical containers, 2,212 authority units, and 2,159 authored relations. Those figures demonstrate a real large-corpus replay; they are not package limits or a claim that the grammar covers every possible domain.
 
 ## Five-minute adoption path
 
@@ -97,7 +97,7 @@ units:
         target: definition.checkout-session
 ```
 
-> The example is the current v2 authoring format: the container carries `owner` and a single `scope`, and units omit `lifecycle` and empty `relations`. `nimicoding.authority/v1` is a migration input only -- `fmt --upgrade` reads it and emits v2, and history-facing commands still read it -- not a format to author in.
+> `nimicoding.authority/v2` is the only admitted source format. The container carries `owner` and a single `scope`, and units may omit `lifecycle` and empty `relations`. Older source formats fail closed in formatting, admission, compilation, and history-facing analysis; Git history remains the recovery record rather than a compatibility input.
 
 Format changed files, admit the complete root, and query one exact unit:
 
@@ -132,7 +132,7 @@ Only active-unit `meaning`, `statement`, `condition`, and `failure` fields are s
 
 Canonical YAML is a closed `format` plus non-empty `units` container. Canonical Markdown is a strict single-unit profile. The model is intentionally compact: `Rule` and `Definition`, `active` and `removed`, `must` and `must_not`, plus authored `applies_to` and linear `supersedes` relations.
 
-If a domain needs member-level API, schema, enum, state-machine, formula, or catalog structure that this grammar does not support, keep that precision in a specialized artifact outside the canonical grammar. Connect it only through an explicitly admitted project binding or adapter; the current built-in evidence slice supports package-script targets, not general API, schema, consumer, or runtime integration. Do not add arbitrary canonical fields: unknown fields fail closed so that no consumer can silently ignore intended authority.
+If a domain needs member-level API, schema, enum, state-machine, formula, or catalog structure that this grammar does not support, keep that precision in a specialized artifact outside the canonical grammar. Connect it through a project-owned adapter when a real integration requires it. Do not add arbitrary canonical fields: unknown fields fail closed so that no consumer can silently ignore intended authority.
 
 ## AI host and extension journey
 
@@ -145,12 +145,11 @@ Task has no exact authority ID
   → fmt changed sources + check the complete root
   → review immutable base versus exact worktree
       (semantic diff + declared impact + current audit)
-  → separately, if configured, inspect current-worktree evidence
 ```
 
 The host owns authority selection, planning, editing, retries, remediation, review state, and completion. Nimi Coding owns request validation, deterministic computation, explicit budgets, exact locations, and honest result boundaries.
 
-For machine integration, invoke the CLI with an argument array and consume both its exit status and JSON envelope. Read product-specific operation, completeness, policy, gap, and evidence states; never infer clean from an empty candidate/finding array. Invalid usage or internal failure and a completed-but-blocking or incomplete product have distinct command-specific exits.
+For machine integration, invoke the CLI with an argument array and consume both its exit status and JSON envelope. Read each product's scoped operation, analysis, and blocking status; never infer business or implementation conformance from an empty candidate/finding array. Invalid usage or internal failure and a completed-but-blocked product have distinct command-specific exits.
 
 In a configured Git project, use exact Git-aware review for one composed authority change product:
 
@@ -158,16 +157,30 @@ In a configured Git project, use exact Git-aware review for one composed authori
 pnpm exec nimicoding authority review . \
   --base origin/main \
   --bindings .nimi/config/authority-verifiers.yaml \
-  --dispositions .nimi/local/authority-impact-dispositions.yaml \
   --max-units 1024 \
   --max-edges 4096 \
   --max-bytes 2097152 \
   --json
 ```
 
-This example assumes that the repository already owns valid verifier bindings and impact dispositions, and that `origin/main` resolves to a commit containing `.nimi/spec`. `start` intentionally creates none of those project semantics or governance files.
+This example assumes that the repository already owns valid verifier bindings and that `origin/main` resolves to a commit containing `.nimi/spec`. `start` intentionally creates none of those project semantics or governance files.
 
-The base ref is resolved once to a full commit OID. The base `.nimi/spec` tree is read from Git objects; the complete current `.nimi/spec` filesystem tree includes tracked unchanged files, edits, deletions, untracked files, and unsupported entries. Capture races, missing objects, invalid corpora, malformed bindings/dispositions, and insufficient budgets refuse the result instead of publishing a mixed or false-clean review. The command never checks out, stashes, resets, stages, commits, or manages a PR.
+The base ref is resolved once to a full commit OID. The base `.nimi/spec` tree is read from Git objects; the complete current `.nimi/spec` filesystem tree includes tracked unchanged files, edits, deletions, untracked files, and unsupported entries. Capture races, missing objects, invalid corpora, malformed bindings, and insufficient budgets refuse the result instead of publishing mixed analysis. The command never checks out, stashes, resets, stages, commits, or manages a PR.
+
+For a redesign or rename that can leave unchanged active survivors outside the declared graph, run change-derived recall over an explicit channel set:
+
+```bash
+pnpm exec nimicoding authority change-candidates path/to/before-spec .nimi/spec \
+  --channels direct_relation,definition_identity,definition_title \
+  --max-candidates 2048 \
+  --max-reasons 20000 \
+  --max-bytes 33554432 \
+  --json
+```
+
+The result contains each recalled active non-root unit, its raw normative fields and modality, and exact side-qualified reasons. `complete: true` means the full union and all reasons for the caller-requested channels—not semantic relevance, conflict, retirement, authority validity, or implementation conformance. Owner, scope, and changed-term channels are available when the host explicitly wants their broader recall. Source-container proximity is excluded because regrouping is non-semantic and a complete annotation would grow as the root/candidate Cartesian product.
+
+Diff, review, and change-derived recall reuse immutable per-invocation compiler snapshots with transient `byId`, owner, scope, container, incoming, and outgoing indexes. Nothing is persisted: SQLite, cache invalidation, incremental compilation, embeddings, and cleanup state remain outside the product until a measured workload justifies them.
 
 ## Comparison: old Nimi, current Nimi Coding, and a mature conventional spec stack
 
@@ -176,7 +189,7 @@ The base ref is resolved once to a full commit OID. The base `.nimi/spec` tree i
 | Dimension | Pre-refactor Nimi spec system | Current Nimi Coding | Mature conventional spec stack |
 | --- | --- | --- | --- |
 | Authority boundary | Human contracts, tables, generated views, maps, and profile rules required precedence conventions | One closed canonical authority root | Several specialized sources of truth, usually without one cross-format boundary |
-| Reference corpus shape | 144 mixed files: 101 Markdown, 43 YAML, including 33 generated views and 42 tables | 38 canonical containers compiling to 793 stable units | Project-specific and heterogeneous |
+| Reference corpus shape | 144 mixed files: 101 Markdown, 43 YAML, including 33 generated views and 42 tables | 33 canonical containers compiling to 2,212 stable units | Project-specific and heterogeneous |
 | Identity | Contract IDs, `R-*` anchors, paths, and table rows were not universal | One stable ID per unit, independent of file, order, move, or regroup | Strong inside some formats, inconsistent across formats |
 | Domain-internal precision | Some tables modeled entities, required fields, API operations, Prisma/OpenAPI/service locators directly | Many enum/schema/state/catalog details remain atomic prose inside a Definition | OpenAPI, Schema, Protobuf, and dedicated DSLs are strongest in their domains |
 | Human rationale | Rich contracts and generated guides | Deliberately compact; long rationale belongs outside canonical authority | ADRs and design documents are strongest |
@@ -188,10 +201,10 @@ The base ref is resolved once to a full commit OID. The base `.nimi/spec` tree i
 | Relationship graph | Links, maps, custom fields, and Atlas-like projections | One authored, bounded `applies_to`/`supersedes` graph | `$ref`, links, imports, and conventions remain format-specific |
 | Conflict discovery | Custom checks could find project-specific drift | Structural conflicts are deterministic; prose contradictions still require AI/human analysis | Format-local conflicts can be strong; cross-format conflict remains difficult |
 | Semantic change | File diff and generated drift dominated | Stable-ID semantic diff; rename/regroup/format-only changes can be semantic zero | Prose is line-diffed; specialized formats may have excellent domain diff tools |
-| Impact and audit | Project scripts, maps, and team knowledge | Declared relation impact plus project-bound finding/gap semantics | Build graphs, CODEOWNERS, linters, and tests are strong but fragmented |
+| Impact and audit | Project scripts, maps, and team knowledge | Declared relation impact plus configured graph and exact lexical findings | Build graphs, CODEOWNERS, linters, and tests are strong but fragmented |
 | Git review | No unified exact authority snapshot product | Immutable-base, race-checked worktree review | Usually Git diff plus independent format-specific checks |
-| Spec-to-code relationship | Direct paths were detailed but could become stale | A narrow, identity-bound package-script evidence slice exists | Codegen, type checking, and contract tests can be substantially stronger |
-| Executable conformance | Some custom scripts checked specific project facts | Intentionally not claimed by current evidence | High-quality tests and executable contracts are strongest |
+| Spec-to-code relationship | Direct paths were detailed but could become stale | Not currently modeled by the authority core | Codegen, type checking, and contract tests can be substantially stronger |
+| Executable conformance | Some custom scripts checked specific project facts | Explicitly `not_evaluated` by review | High-quality tests and executable contracts are strongest |
 | Ecosystem | Highly project-specific | Stable CLI/JSON products, but no public JS SDK or model/tool standard yet | OpenAPI/Schema/test ecosystems and third-party interoperability are mature |
 | Authoring cost | Multiple representations and generators were expensive | IDs, owners, scopes, lifecycles, and relations require discipline | Lowest during exploration; governance cost rises with corpus size |
 | Best fit | A project-specific integrated spec system | Stable normative authority control alongside a large, AI-consumed estate of specialized specs | Exploration and specialized API/data/behavior contracts |
@@ -208,21 +221,21 @@ Three levels of product truth should remain distinct:
 2. **Improved but incomplete:** locating and tracing the exact inputs for human/AI conflict review, task-context assembly, owner/scope accountability, and spec-to-code traceability. Contradiction judgment itself is not a deterministic product.
 3. **Intentionally not solved:** universal business-semantic completeness, automatic authority selection, executable code conformance, model reasoning, and AI workflow orchestration.
 
-The long-term ceiling is high if Nimi Coding standardizes the authority protocol rather than attempting to absorb every domain language. A model-native ecosystem could train AI systems to discover before guessing, resolve exact IDs, distinguish authored facts from inference, honor gaps and completeness, and request review/evidence after edits. Deterministic runtime products must remain the oracle; model familiarity must never replace admission or evidence.
+The long-term ceiling is high if Nimi Coding standardizes the authority protocol rather than attempting to absorb every domain language. A model-native ecosystem could train AI systems to discover before guessing, resolve exact IDs, distinguish authored facts from inference, honor refusal and scoped status, and request bounded analysis after edits. Deterministic runtime products must remain the oracle; model familiarity must never replace admission or the project's real tests and gates.
 
 ## Safety and truth boundaries
 
 - Only `*.authority.yaml` and `*.authority.md` under `.nimi/spec/**` are canonical product authority.
 - IDs, relations, owners, and scopes are declared facts. Nimi Coding does not infer relations or organizational truth from prose.
 - `discover` is deterministic lexical candidate retrieval, not semantic search, selection, context assembly, or absence proof.
+- `change-candidates` returns the complete union only for explicitly requested deterministic channels. It does not rank, infer conflict, choose retirement, or prove absence outside those channels.
 - `context` is a complete bounded outgoing interpretation closure, not complete task context.
 - `audit` evaluates explicitly bound deterministic governance checks; it does not prove that all business rules are non-contradictory.
-- `impact` produces declared review obligations; a disposition does not prove implementation or tests are synchronized.
-- `review` audits the captured current snapshot and does not attribute a current finding to the change unless a future product explicitly compares finding fingerprints.
+- `impact` reports declared relation impact and host-owned consumer/test follow-up targets. It accepts no disposition or completion state.
+- `review` audits the captured current snapshot and reports `businessSemanticStatus` and `implementationConformanceStatus` as `not_evaluated`; it does not attribute a current finding to the change.
 - Snapshot no-follow hardening is platform-dependent. On `win32`, Node.js does not expose `O_NOFOLLOW`/`O_DIRECTORY`, so snapshot capture uses surrounding `lstat`/`realpath` validation without descriptor-level no-follow guarantees.
-- `evidence` currently proves only declared package-script target reachability. It executes no command or test; every completed evidence product reports `conformanceStatus: not_evaluated`, while refused input returns no evidence product.
 - Raw AuthorityIR, SourceMap internals, and compiler implementation are package-private. There is currently no public JavaScript API (`exports` is empty).
-- `.nimi/local/**` is derived or local evidence, never product authority.
+- `.nimi/local/**` is derived or local output, never product authority.
 
 ## Future roadmap
 
@@ -231,9 +244,9 @@ The roadmap is paused at the current validated baseline. The entries below are c
 | Candidate lane | Intended product | Entry condition |
 | --- | --- | --- |
 | Stateless AI tool adapter | Typed tools over current bounded JSON products, potentially via MCP or an extension API | A real host integration demonstrates that direct CLI invocation is insufficient |
-| General M4 API/consumer evidence | API/consumer locators and producer → API → consumer reachability | A real canonical-authority seam exists; no inference from the current package-script slice |
+| Read-only unit/code locator | Exact project-declared unit → declaration/test/gate bindings and reverse lookup | A real implementation-alignment journey demonstrates stable explicit bindings; no execution or conformance status is added |
 | D2 IDE/LSP | Live diagnostics, exact-ID navigation/completion, full-snapshot unsaved-buffer overlays | A sustained editor journey justifies a separate delivery unit |
-| D3 local Studio | Read-only unit/graph/diff/impact/audit/evidence exploration | Several real review/exploration journeys are validated first |
+| D3 local Studio | Read-only unit/graph/diff/impact/audit exploration | Several real review/exploration journeys are validated first |
 | D4 external semantic candidates | Model/embedding/reranking candidates with provenance and abstention | Lexical/graph shortcomings are measured on an owner-approved task corpus |
 | E1 multi-repository Atlas | Visibility-filtered composition of canonical repository snapshots | Ecosystem repositories, identity, visibility, ownership, and workspace membership are explicit |
 
@@ -253,9 +266,8 @@ The current public integration surface is the CLI. All budgets are explicit posi
 | Author and admit | `authority fmt`, `authority check`, `authority compile` |
 | Find and read | `authority discover`, `authority query`, `authority context` |
 | Navigate | `authority refs`, `authority path`, `authority subgraph` |
-| Analyze and review | `authority audit`, `authority diff`, `authority impact`, `authority review` |
+| Analyze and review | `authority audit`, `authority diff`, `authority change-candidates`, `authority impact`, `authority review` |
 | Validate lexical anchors | `authority anchors` |
-| Connect bounded evidence | `authority evidence` |
 | Project lifecycle | `start`, `sync`, `doctor`, `clear` |
 | Optional L3 repository governance | `validate-ai-governance` |
 
@@ -263,8 +275,8 @@ The current public integration surface is the CLI. All budgets are explicit posi
 <summary>Complete authority command syntax</summary>
 
 ```text
-nimicoding authority fmt <file> [--check] [--upgrade] [--json]
-nimicoding authority check <path> [--scope-bindings <file>] [--require-format <format>] [--json]
+nimicoding authority fmt <file> [--check] [--json]
+nimicoding authority check <path> [--scope-bindings <file>] [--json]
 nimicoding authority compile <path> [--json]
 nimicoding authority anchors <repository-path> --spec <corpus-path> [--scope-bindings <file>] [--embedded-paths] --max-units <n> --max-anchors <n> --max-bytes <n> [--json]
 nimicoding authority consumers <repository-path> --spec <corpus-path> [--external-root <scheme>=<path>]... --max-files <n> --max-refs <n> --max-bytes <n> [--json]
@@ -278,9 +290,9 @@ nimicoding authority path <path> <from-id> <to-id> --traversal <directed|inciden
 nimicoding authority subgraph <path> <id> --direction <incoming|outgoing|both> --relations <comma-separated-relation-types> --depth <n> --max-units <n> --max-edges <n> --max-bytes <n> [--json]
 nimicoding authority audit <path> --bindings <file> --max-units <n> --max-edges <n> --max-bytes <n> [--json|--sarif]
 nimicoding authority diff <before-path> <after-path> --max-bytes <n> [--json]
-nimicoding authority impact <before-path> <after-path> --dispositions <file> --max-bytes <n> [--json]
-nimicoding authority review <repository-path> --base <git-ref> --bindings <file> --dispositions <file> --max-units <n> --max-edges <n> --max-bytes <n> [--json]
-nimicoding authority evidence <repository-path> --bindings <tracked-.nimi/config-path> [--probe-results <.nimi/local-path>] --max-units <n> --max-bindings <n> --max-locators <n> --max-edges <n> --max-input-bytes <n> --max-bytes <n> [--json]
+nimicoding authority change-candidates <before-path> <after-path> --channels <comma-separated-closed-set> --max-candidates <n> --max-reasons <n> --max-bytes <n> [--json]
+nimicoding authority impact <before-path> <after-path> --max-bytes <n> [--json]
+nimicoding authority review <repository-path> --base <git-ref> --bindings <file> --max-units <n> --max-edges <n> --max-bytes <n> [--json]
 ```
 
 </details>

package/README.zh-CN.md

@@ -4,13 +4,13 @@
 
 **面向 AI Coding 系统和第三方扩展的确定性 authority 控制层。**
 
-Nimi Coding 将项目自行拥有的规范性规则转化为稳定身份、精确源码位置、显式关系和有界、fail-closed 的机器产品。AI host、agent framework、CI、编辑器工具和第三方扩展可以据此发现 authority、组装证据、导航关系并审查精确变更，而不把模型推断当作 repository truth。
+Nimi Coding 将项目自行拥有的规范性规则转化为稳定身份、精确源码位置、显式关系和有界、fail-closed 的机器产品。AI host、agent framework、CI、编辑器工具和第三方扩展可以据此发现 authority、导航关系并审查精确变更，而不把模型推断当作 repository truth。
 
 大多数最终用户不需要直接调用 `nimicoding`。当前主要 integration surface 是已文档化的 CLI 及其 purpose-specific JSON 产品。Nimi Coding 不是 AI agent、planner、代码生成器、审批 workflow 或万能规范语言。
 
 ## 为什么需要 Nimi Coding
 
-AI 模型擅长生成代码，却不总能可靠判断：哪份文档真正权威、搜索结果是否完整、规则移动文件后是否还是同一规则、一次修改影响哪些显式关系，以及现有 evidence 是否真的证明 conformance。
+AI 模型擅长生成代码，却不总能可靠判断：哪份文档真正权威、搜索结果是否完整、规则移动文件后是否还是同一规则、一次修改影响哪些显式关系，以及某个确定性检查究竟评价了什么。
 
 Nimi Coding 把这些问题变成显式产品语义：
 
@@ -19,11 +19,12 @@ Nimi Coding 把这些问题变成显式产品语义：
 | 多份文档看起来都像 authority | 一个封闭的 canonical authority 边界 |
 | 路径和 heading 发生变化 | 与文件和顺序无关的稳定 logical unit ID |
 | 搜索产生噪声或被截断的上下文 | 有界 discovery、exact query、declared context 和 graph 产品 |
+| Semantic hard cut 在 declared relations 之外留下 unchanged survivors | 基于 caller-selected exact owner/scope/term/relation/Definition channels 的 change-derived recall |
 | 模型无法精确引用规则来源 | 字段级和关系级的 portable SourceMap location |
 | 文本 diff 掩盖真实语义变化 | Stable-ID semantic diff 和 declared impact obligations |
-| “没有结果”被展示为“clean” | 显式 budget、completeness、gap、refusal 和 failure 语义 |
+| “没有结果”被展示为“clean” | 显式 budget、窄作用域 status、refusal 和 failure 语义 |
 | Git review 可能混入移动中的输入 | Immutable base OID 加完整 worktree race revalidation |
-| 文件或测试名称被当作符合性证明 | Evidence 与 conformance 是不同的产品状态 |
+| 结构检查被扩大解释为产品 conformance | Business semantics 与 implementation conformance 固定显式为 `not_evaluated` |
 
 ## 产品模型
 
@@ -38,7 +39,7 @@ Authority Foundation
                     ▼
 Spec Intelligence Plane
   discover · query · context · refs/path/subgraph
-  diff · impact · audit · review · evidence
+  diff · change-candidates · impact · audit · review
                     │
                     ▼
 Purpose-specific JSON / human output / SARIF（仅 audit）
@@ -51,17 +52,16 @@ AI host · 第三方扩展 · CI · future editor/UI surfaces
 
 ## 当前已经可用的能力
 
-| 层 | 当前能力 | 证明边界 |
+| 层 | 当前能力 | 事实边界 |
 | --- | --- | --- |
 | Authority Foundation | Canonical YAML/Markdown、formatter、完整 root check、private deterministic compiler 和 SourceMap | 未知或 unsupported canonical input 会被拒绝，不会被忽略 |
 | Discovery 和 exact read | Exact kind/owner/scope/lifecycle filters、normalized lexical snippets、可选 direct relation preview、exact query、bounded declared context | 不提供 semantic search、自动 authority selection 或 absence proof |
 | Graph navigation | `applies_to`/`supersedes` 上的 incoming/outgoing refs、deterministic path 和 bounded subgraph | 只使用 authored relations，不生成 inferred semantic graph |
-| Change intelligence | Stable-ID semantic diff 和 relation-derived impact obligations | Impact 是 review requirement，不是同步证明 |
-| Deterministic audit | Project-owned verifier bindings、observation/finding/required gap、JSON 和 SARIF 2.1.0 | 当前 built-in detector 是窄 governance verifier，不是自然语言矛盾引擎 |
-| Git-aware review | Immutable base commit 加 exact、race-checked current worktree snapshot，并复用 compile/diff/impact/audit | 只读；不管理 branch、PR、approval 或 release |
-| Authority-to-code evidence | Exact authority/scope 到 declared package-script command/test target reachability | 只是静态窄 slice；不执行 command/test，completed evidence 的 conformance 保持 `not_evaluated` |
+| Change intelligence | Stable-ID semantic diff、change-derived active-survivor recall 和 relation-derived impact obligations | Candidate completeness 只覆盖显式 channels；impact 不接受 disposition 或 completion state |
+| Deterministic audit | Project-owned graph verifier 与 exact lexical invariant bindings，输出 JSON 和 SARIF 2.1.0 | 只做大小写敏感的 exact token/phrase 检查；不做 synonym、embedding 或自然语言矛盾推断 |
+| Git-aware review | Immutable base commit 加 exact、race-checked current worktree snapshot，并复用 compile/diff/impact/audit | 只读；business semantics 与 implementation conformance 固定为 `not_evaluated` |
 
-当前 Nimi-realm 验证 corpus 包含 38 个 canonical containers、793 个 authority units 和 1,260 条 authored relations。这些数字证明了真实大型 corpus replay，不是 package 上限，也不代表 grammar 已覆盖所有领域。
+当前 Nimi-realm 验证 corpus 包含 33 个 canonical containers、2,212 个 authority units 和 2,159 条 authored relations。这些数字证明了真实大型 corpus replay，不是 package 上限，也不代表 grammar 已覆盖所有领域。
 
 ## 五分钟接入
 
@@ -97,7 +97,7 @@ units:
         target: definition.checkout-session
 ```
 
-> 示例为当前 v2 authoring 格式：容器承载 `owner` 与单值 `scope`，unit 省略 `lifecycle` 与空 `relations`。`nimicoding.authority/v1` 仅为迁移输入——`fmt --upgrade` 读取它并产出 v2，面向历史的命令仍可读取——不是可用于编写的格式。
+> `nimicoding.authority/v2` 是唯一 admitted source format。容器承载 `owner` 与单值 `scope`，unit 可以省略 `lifecycle` 与空 `relations`。旧 source format 在格式化、admission、compile 和 history-facing analysis 中一律 fail closed；恢复依据是 Git history，而不是 compatibility input。
 
 格式化变更文件、admit 完整 root，并查询一个 exact unit：
 
@@ -132,7 +132,7 @@ pnpm exec nimicoding authority anchors . \
 
 Canonical YAML 是封闭的 `format` 加非空 `units` container；Canonical Markdown 是严格的 single-unit profile。当前模型刻意保持紧凑：`Rule` 和 `Definition`、`active` 和 `removed`、`must` 和 `must_not`，以及 authored `applies_to` 和线性 `supersedes` 关系。
 
-如果某个领域需要 grammar 尚不支持的 API、schema、enum、state machine、formula 或 catalog 成员级结构，应把精度保留在 canonical grammar 之外的专业 artifact 中。只有存在显式 admitted project binding 或 adapter 时才能连接；当前 built-in evidence slice 只支持 package-script targets，不支持通用 API、schema、consumer 或 runtime integration。不要向 canonical authority 随意添加字段：unknown field 必须 fail closed，才能避免 consumer 静默忽略原本想表达的 authority。
+如果某个领域需要 grammar 尚不支持的 API、schema、enum、state machine、formula 或 catalog 成员级结构，应把精度保留在 canonical grammar 之外的专业 artifact 中；真实 integration 有需要时由项目自己的 adapter 显式连接。不要向 canonical authority 随意添加字段：unknown field 必须 fail closed，才能避免 consumer 静默忽略原本想表达的 authority。
 
 ## AI host 和第三方扩展的调用旅程
 
@@ -145,12 +145,11 @@ Canonical YAML 是封闭的 `format` 加非空 `units` container；Canonical Mar
   → fmt 变更 sources + check 完整 root
   → review immutable base 与 exact worktree
       (semantic diff + declared impact + current audit)
-  → 如果已配置，再独立检查 current-worktree evidence
 ```
 
 Host 负责 authority selection、planning、editing、retry、remediation、review state 和 completion。Nimi Coding 负责 request validation、deterministic computation、explicit budgets、exact locations 和诚实的结果边界。
 
-Machine integration 应使用 argument array 调用 CLI，并同时消费 exit status 和 JSON envelope。必须读取 product-specific operation、completeness、policy、gap 和 evidence states，不能从空 candidate/finding array 推断 clean。Invalid usage/internal failure 与 completed 但 blocking/incomplete 的产品具有不同的 command-specific exit。
+Machine integration 应使用 argument array 调用 CLI，并同时消费 exit status 和 JSON envelope。必须读取各产品窄作用域的 operation、analysis 与 blocking status，不能从空 candidate/finding array 推断业务或实现 conformance。Invalid usage/internal failure 与 completed 但 blocked 的产品具有不同的 command-specific exit。
 
 在已经配置好的 Git 项目中，可以使用 Git-aware exact review 获得一份组合后的 authority change product：
 
@@ -158,16 +157,30 @@ Machine integration 应使用 argument array 调用 CLI，并同时消费 exit s
 pnpm exec nimicoding authority review . \
   --base origin/main \
   --bindings .nimi/config/authority-verifiers.yaml \
-  --dispositions .nimi/local/authority-impact-dispositions.yaml \
   --max-units 1024 \
   --max-edges 4096 \
   --max-bytes 2097152 \
   --json
 ```
 
-这个例子假设 repository 已经拥有合法 verifier bindings 和 impact dispositions，并且 `origin/main` 能解析到包含 `.nimi/spec` 的 commit。`start` 刻意不会创建这些项目语义或 governance files。
+这个例子假设 repository 已经拥有合法 verifier bindings，并且 `origin/main` 能解析到包含 `.nimi/spec` 的 commit。`start` 刻意不会创建这些项目语义或 governance files。
 
-Base ref 在开始时只解析一次并固定为 full commit OID。Base `.nimi/spec` tree 从 Git objects 读取；完整 current `.nimi/spec` filesystem tree 包含 tracked unchanged files、edits、deletions、untracked files 和 unsupported entries。Capture race、missing object、invalid corpus、malformed binding/disposition 或 budget 不足都会拒绝结果，而不是发布 mixed 或 false-clean review。该命令不会 checkout、stash、reset、stage、commit，也不管理 PR。
+Base ref 在开始时只解析一次并固定为 full commit OID。Base `.nimi/spec` tree 从 Git objects 读取；完整 current `.nimi/spec` filesystem tree 包含 tracked unchanged files、edits、deletions、untracked files 和 unsupported entries。Capture race、missing object、invalid corpus、malformed binding 或 budget 不足都会拒绝结果，而不是发布混合分析。该命令不会 checkout、stash、reset、stage、commit，也不管理 PR。
+
+Redesign 或 rename 可能在 declared graph 之外留下 unchanged active survivors 时，应对显式 channel set 执行 change-derived recall：
+
+```bash
+pnpm exec nimicoding authority change-candidates path/to/before-spec .nimi/spec \
+  --channels direct_relation,definition_identity,definition_title \
+  --max-candidates 2048 \
+  --max-reasons 20000 \
+  --max-bytes 33554432 \
+  --json
+```
+
+结果包含每个被召回的 active non-root unit、原始 normative fields、modality，以及 side-qualified exact reasons。`complete: true` 只表示 caller-requested channels 的完整 union 和全部 reasons，不表示 semantic relevance、conflict、retirement、authority validity 或 implementation conformance。Host 明确需要更宽召回时可选择 owner、scope 和 changed-term channels。Source-container proximity 不进入产品：regrouping 是 non-semantic change，而完整 annotation 会形成 roots 与 candidates 的笛卡尔积。
+
+Diff、review 与 change-derived recall 复用 per-invocation immutable compiler snapshots，并构建 transient `byId`、owner、scope、container、incoming 和 outgoing indexes。所有数据都不持久化：SQLite、cache invalidation、incremental compilation、embedding 和 cleanup state 继续在产品边界之外，直到真实 workload 与 profiling 证明其必要性。
 
 ## 多维比较：旧 Nimi、当前 Nimi Coding 与成熟普通 spec
 
@@ -176,7 +189,7 @@ Base ref 在开始时只解析一次并固定为 full commit OID。Base `.nimi/s
 | 维度 | 重构前 Nimi spec 系统 | 当前 Nimi Coding | 成熟普通 spec 组合 |
 | --- | --- | --- | --- |
 | Authority 边界 | Human contracts、tables、generated views、maps 和 profile rules 依赖 precedence 约定 | 一个封闭 canonical authority root | 多个专业 source of truth，通常没有跨格式统一边界 |
-| Reference corpus 形态 | 144 个混合文件：101 Markdown、43 YAML，其中包括 33 generated views 和 42 tables | 38 canonical containers 编译为 793 个稳定 units | 由项目决定，通常高度异构 |
+| Reference corpus 形态 | 144 个混合文件：101 Markdown、43 YAML，其中包括 33 generated views 和 42 tables | 33 canonical containers 编译为 2,212 个稳定 units | 由项目决定，通常高度异构 |
 | 身份 | Contract ID、`R-*` anchor、路径和 table row 没有统一覆盖所有对象 | 每个 unit 一个 stable ID，不依赖文件、顺序、移动或 regroup | 部分格式内部很强，跨格式不统一 |
 | 领域内部精度 | 部分 tables 能直接建模 entity、required field、API operation、Prisma/OpenAPI/service locator | 很多 enum/schema/state/catalog 细节仍是 Definition 内的原子 prose | OpenAPI、Schema、Protobuf 和专业 DSL 在各自领域最强 |
 | 人类 rationale | Rich contracts 和 generated guides | 刻意紧凑；长篇理由应放在 canonical authority 之外 | ADR 和 design docs 最强 |
@@ -188,10 +201,10 @@ Base ref 在开始时只解析一次并固定为 full commit OID。Base `.nimi/s
 | Relationship graph | Links、maps、custom fields 和 Atlas-like projections 共同表达 | 一个 authored、有界的 `applies_to`/`supersedes` graph | `$ref`、links、imports 和 conventions 仍按格式分散 |
 | 冲突发现 | Custom checks 能发现项目特定 drift | 结构冲突可确定发现；prose 矛盾仍需 AI/人判断 | 格式内可很强，跨格式冲突仍困难 |
 | Semantic change | File diff 和 generated drift 占主导 | Stable-ID semantic diff；rename/regroup/format-only 可为 semantic zero | Prose 多为 line diff；专业格式可能有优秀 domain diff |
-| Impact 与 audit | Project scripts、maps 和团队知识共同决定 | Declared relation impact 加 project-bound finding/gap 语义 | Build graph、CODEOWNERS、linters 和 tests 很强但分散 |
+| Impact 与 audit | Project scripts、maps 和团队知识共同决定 | Declared relation impact 加 configured graph 与 exact lexical findings | Build graph、CODEOWNERS、linters 和 tests 很强但分散 |
 | Git review | 没有统一 exact authority snapshot product | Immutable-base、race-checked worktree review | 通常是 Git diff 加多个独立 format-specific checks |
-| Spec-to-code | Direct paths 很细，但可能 stale | 已有窄、identity-bound package-script evidence slice | Codegen、type checking 和 contract tests 可能明显更强 |
-| Executable conformance | 部分 custom scripts 验证具体项目事实 | 当前 evidence 刻意不声称 conformance | 高质量 tests 和 executable contracts 最强 |
+| Spec-to-code | Direct paths 很细，但可能 stale | Authority core 当前不建模这一关系 | Codegen、type checking 和 contract tests 可能明显更强 |
+| Executable conformance | 部分 custom scripts 验证具体项目事实 | Review 显式固定为 `not_evaluated` | 高质量 tests 和 executable contracts 最强 |
 | 生态 | 高度 project-specific | 有稳定 CLI/JSON products，但还没有 public JS SDK 或模型/tool 标准 | OpenAPI/Schema/test 生态与第三方互操作最成熟 |
 | Authoring 成本 | 多种表示和 generators 成本高 | 必须维护 ID、owner、scope、lifecycle 和 relation | 探索期最低；corpus 扩大后治理成本上升 |
 | 最佳适用场景 | 项目专用的一体化 spec 系统 | 与大型、主要由 AI 消费的专业 spec estate 并行工作的稳定 normative authority control | 探索期和专业 API/data/behavior contracts |
@@ -208,21 +221,21 @@ Base ref 在开始时只解析一次并固定为 full commit OID。Base `.nimi/s
 2. **已经改善但仍不完整：** 为人/AI conflict review 定位和追踪 exact inputs、task-context assembly、owner/scope accountability 和 spec-to-code traceability；矛盾判定本身不是 deterministic product。
 3. **刻意没有解决：** 通用业务语义完备性、自动 authority selection、可执行 code conformance、模型推理和 AI workflow orchestration。
 
-如果 Nimi Coding 标准化的是 authority protocol，而不是试图吞并所有领域语言，它的长期上限很高。Model-native 生态可以训练 AI：先 discover 再猜测、解析 exact ID、区分 authored fact 与 inference、尊重 gap/completeness，并在编辑后主动请求 review/evidence。但 deterministic runtime product 必须继续作为 oracle；模型熟悉 Nimi Coding 不能替代 admission 或 evidence。
+如果 Nimi Coding 标准化的是 authority protocol，而不是试图吞并所有领域语言，它的长期上限很高。Model-native 生态可以训练 AI：先 discover 再猜测、解析 exact ID、区分 authored fact 与 inference、尊重 refusal 与窄作用域 status，并在编辑后主动请求有界分析。但 deterministic runtime product 必须继续作为 oracle；模型熟悉 Nimi Coding 不能替代 admission 或项目真实的 tests 和 gates。
 
 ## 安全与 truth 边界
 
 - 只有 `.nimi/spec/**` 下的 `*.authority.yaml` 和 `*.authority.md` 是 canonical product authority。
 - ID、relation、owner 和 scope 都是 declared facts。Nimi Coding 不从 prose 推断关系或现实组织责任。
 - `discover` 是 deterministic lexical candidate retrieval，不是 semantic search、selection、context assembly 或 absence proof。
+- `change-candidates` 只对显式请求的 deterministic channels 返回完整 union；它不 ranking、不推断 conflict、不选择 retirement，也不证明这些 channels 之外不存在候选。
 - `context` 是 complete bounded outgoing interpretation closure，不是 complete task context。
 - `audit` 执行显式绑定的 deterministic governance check，不证明全部业务规则不存在矛盾。
-- `impact` 生成 declared review obligations；disposition 不证明 implementation 或 tests 已同步。
-- `review` 评价 captured current snapshot；除非未来产品显式比较 finding fingerprints，否则不把 current finding 归因为本次 change。
+- `impact` 报告 declared relation impact 和 host-owned consumer/test follow-up targets；它不接受 disposition 或 completion state。
+- `review` 评价 captured current snapshot，并把 `businessSemanticStatus` 与 `implementationConformanceStatus` 固定报告为 `not_evaluated`；它不把 current finding 归因为本次 change。
 - Snapshot no-follow 加固受平台能力限制。在 `win32` 上，Node.js 不提供 `O_NOFOLLOW`/`O_DIRECTORY`，因此 snapshot capture 仅使用外围 `lstat`/`realpath` 校验，不具备 descriptor-level no-follow 保证。
-- `evidence` 当前只证明 declared package-script target reachability。它不执行 command/test；每个 completed evidence product 都报告 `conformanceStatus: not_evaluated`，refused input 则不返回 evidence product。
 - Raw AuthorityIR、SourceMap internals 和 compiler implementation 都是 package-private。当前没有 public JavaScript API（`exports` 为空）。
-- `.nimi/local/**` 是 derived/local evidence，永远不是 product authority。
+- `.nimi/local/**` 是 derived/local output，永远不是 product authority。
 
 ## Future roadmap
 
@@ -231,9 +244,9 @@ Roadmap 当前暂停在已经验证的 baseline。以下是 future candidate lan
 | Candidate lane | 目标产品 | Entry condition |
 | --- | --- | --- |
 | Stateless AI tool adapter | 在现有 bounded JSON products 上提供 typed tools，可采用 MCP 或 extension API | 真实 host integration 证明直接调用 CLI 不足 |
-| General M4 API/consumer evidence | API/consumer locators 和 producer → API → consumer reachability | 存在真实 canonical-authority seam；不得从当前 package-script slice 外推 |
+| Read-only unit/code locator | 精确的 project-declared unit → declaration/test/gate binding 和反向查询 | 真实 implementation-alignment journey 证明 binding 稳定；不加入执行或 conformance status |
 | D2 IDE/LSP | Live diagnostics、exact-ID navigation/completion、full-snapshot unsaved-buffer overlay | 持续 editor journey 足以支持独立 delivery unit |
-| D3 local Studio | Read-only unit/graph/diff/impact/audit/evidence exploration | 先验证多个真实 review/exploration journeys |
+| D3 local Studio | Read-only unit/graph/diff/impact/audit exploration | 先验证多个真实 review/exploration journeys |
 | D4 external semantic candidates | 带 provenance 和 abstention 的 model/embedding/reranking candidates | 在 owner-approved task corpus 上量化 lexical/graph 不足 |
 | E1 multi-repository Atlas | Visibility-filtered canonical repository snapshot composition | Ecosystem repositories、identity、visibility、ownership 和 workspace membership 都已明确 |
 
@@ -253,9 +266,8 @@ Roadmap 当前暂停在已经验证的 baseline。以下是 future candidate lan
 | Author 和 admit | `authority fmt`、`authority check`、`authority compile` |
 | Find 和 read | `authority discover`、`authority query`、`authority context` |
 | Navigate | `authority refs`、`authority path`、`authority subgraph` |
-| Analyze 和 review | `authority audit`、`authority diff`、`authority impact`、`authority review` |
+| Analyze 和 review | `authority audit`、`authority diff`、`authority change-candidates`、`authority impact`、`authority review` |
 | 校验词法 anchors | `authority anchors` |
-| 连接 bounded evidence | `authority evidence` |
 | Project lifecycle | `start`、`sync`、`doctor`、`clear` |
 | 可选 L3 repository governance | `validate-ai-governance` |
 
@@ -263,8 +275,8 @@ Roadmap 当前暂停在已经验证的 baseline。以下是 future candidate lan
 <summary>完整 authority command syntax</summary>
 
 ```text
-nimicoding authority fmt <file> [--check] [--upgrade] [--json]
-nimicoding authority check <path> [--scope-bindings <file>] [--require-format <format>] [--json]
+nimicoding authority fmt <file> [--check] [--json]
+nimicoding authority check <path> [--scope-bindings <file>] [--json]
 nimicoding authority compile <path> [--json]
 nimicoding authority anchors <repository-path> --spec <corpus-path> [--scope-bindings <file>] [--embedded-paths] --max-units <n> --max-anchors <n> --max-bytes <n> [--json]
 nimicoding authority consumers <repository-path> --spec <corpus-path> [--external-root <scheme>=<path>]... --max-files <n> --max-refs <n> --max-bytes <n> [--json]
@@ -278,9 +290,9 @@ nimicoding authority path <path> <from-id> <to-id> --traversal <directed|inciden
 nimicoding authority subgraph <path> <id> --direction <incoming|outgoing|both> --relations <comma-separated-relation-types> --depth <n> --max-units <n> --max-edges <n> --max-bytes <n> [--json]
 nimicoding authority audit <path> --bindings <file> --max-units <n> --max-edges <n> --max-bytes <n> [--json|--sarif]
 nimicoding authority diff <before-path> <after-path> --max-bytes <n> [--json]
-nimicoding authority impact <before-path> <after-path> --dispositions <file> --max-bytes <n> [--json]
-nimicoding authority review <repository-path> --base <git-ref> --bindings <file> --dispositions <file> --max-units <n> --max-edges <n> --max-bytes <n> [--json]
-nimicoding authority evidence <repository-path> --bindings <tracked-.nimi/config-path> [--probe-results <.nimi/local-path>] --max-units <n> --max-bindings <n> --max-locators <n> --max-edges <n> --max-input-bytes <n> --max-bytes <n> [--json]
+nimicoding authority change-candidates <before-path> <after-path> --channels <comma-separated-closed-set> --max-candidates <n> --max-reasons <n> --max-bytes <n> [--json]
+nimicoding authority impact <before-path> <after-path> --max-bytes <n> [--json]
+nimicoding authority review <repository-path> --base <git-ref> --bindings <file> --max-units <n> --max-edges <n> --max-bytes <n> [--json]
 ```
 
 </details>