@polymorphism-tech/morph-spec 8.47.0 → 9.1.0

package/framework/standards/STANDARDS.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.0.0",
+  "version": "3.0.0",
   "standards": [
     {
       "id": "ai-agents-agent-archetypes",
@@ -16,16 +16,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "agent archetype",
-        "arquetipo de agente",
-        "qual forma de agente",
-        "conversational agent",
-        "one-shot agent",
-        "batch agent",
-        "vision agent",
-        "chat with history"
-      ],
       "anchors": {
         "escolha": "#como-escolher",
         "conversacional": "#conversacional-com-fases",
@@ -35,12 +25,7 @@
         "lastro": "#lastro-de-campo-por-arquétipo",
         "checklist": "#checklist-verifiable-in-review"
       },
-      "digest": "The four shapes an agent can take, and the plan-phase question that picks one: conversational-with-phases, one-shot batch, vision + structured output, chat with history. Field ballast is UNEVEN and the standard says so: batch has 3 exemplars, conversational has 1, vision+structured has ZERO (it is a projected shape, not a distilled one), and conversational and chat-with-history are two AXES OF THE SAME AGENT (phases x history ownership), not alternatives. Pairs with ai-agents-sweet-spot, which decides agent-vs-workflow before this file decides which shape.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/src/Morph.AiKit/Agents/AgentFactory.cs` e `.../Conversation/ConversationStore.cs` (arquétipos **one-shot em batch** e **chat com histórico** — o conversacional com fases NÃO tem lastro no kit, e `ai-agents-conversational-agent-with-phases` declara isso no próprio cabeçalho). O arquétipo visão + structured output é **verificação documental** — o ai-kit não exercita multimodalidade.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Agents/AgentFactory.cs",
-        ".../Conversation/ConversationStore.cs"
-      ]
+      "digest": "The four shapes an agent can take, and the plan-phase question that picks one: conversational-with-phases, one-shot batch, vision + structured output, chat with history. Field ballast is UNEVEN and the standard says so: batch has 3 exemplars, conversational has 1, vision+structured has ZERO (it is a projected shape, not a distilled one), and conversational and chat-with-history are two AXES OF THE SAME AGENT (phases x history ownership), not alternatives. Pairs with ai-agents-sweet-spot, which decides agent-vs-workflow before this file decides which shape."
     },
     {
       "id": "ai-agents-agent-session",
@@ -57,30 +42,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "agent session",
-        "chat history",
-        "conversation state",
-        "chat reducer",
-        "history truncation",
-        "multi-turn",
-        "persistent session",
-        "ChatHistoryProvider",
-        "own conversation table",
-        "conversa propria",
-        "ProviderSessionState"
-      ],
       "anchors": {
         "when": "#o-critério--de-onde-o-histórico-deve-vir",
         "api": "#a-api",
         "example": "#exemplo-c--agente-conversacional-com-session-persistente-entre-turnos",
         "history": "#history-management"
       },
-      "digest": "Where conversation history comes from — the CRITERION first, the verdict after. Own conversation storage (project table/jsonb behind a ChatHistoryProvider subclass) is the DEFAULT whenever the conversation carries business fields, must be readable and editable by the application (retry, audit, deletion), or is multi-tenant; AgentSession + a built-in provider only when history is just the message list; InMemoryChatHistoryProvider only for prototypes. Override ProvideChatHistoryAsync / StoreChatHistoryAsync; serialize with SerializeSessionAsync / DeserializeSessionAsync. Key invariant: ONE provider instance shared by every session — per-session state lives in ProviderSessionState<TState>, never in a provider field. ConversationId is scoped to the API key, never an authorization boundary. The pre-GA thread API was renamed and no longer exists in 1.20.0.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/src/Morph.AiKit/Conversation/ConversationStore.cs` (a subclasse de `ChatHistoryProvider`, a invariante de instância única e o teste de duas sessões concorrentes). Nomes de tipo e membros medidos por reflexão sobre `Microsoft.Agents.AI.Abstractions` 1.20.0 em 2026-09-08.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Conversation/ConversationStore.cs"
-      ]
+      "digest": "Where conversation history comes from — the CRITERION first, the verdict after. Own conversation storage (project table/jsonb behind a ChatHistoryProvider subclass) is the DEFAULT whenever the conversation carries business fields, must be readable and editable by the application (retry, audit, deletion), or is multi-tenant; AgentSession + a built-in provider only when history is just the message list; InMemoryChatHistoryProvider only for prototypes. Override ProvideChatHistoryAsync / StoreChatHistoryAsync; serialize with SerializeSessionAsync / DeserializeSessionAsync. Key invariant: ONE provider instance shared by every session — per-session state lives in ProviderSessionState<TState>, never in a provider field. ConversationId is scoped to the API key, never an authorization boundary. The pre-GA thread API was renamed and no longer exists in 1.20.0."
     },
     {
       "id": "ai-agents-agent-spec",
@@ -97,15 +65,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "agent spec",
-        "AgentSpec",
-        "agent catalog",
-        "AgentCatalog",
-        "um agente por spec",
-        "defaults do agente",
-        "quantos agentes"
-      ],
       "anchors": {
         "dado": "#o-agente-como-dado",
         "spec": "#agentspec",
@@ -114,13 +73,7 @@
         "higiene": "#higiene-de-publicação",
         "checklist": "#checklist-verifiable-in-review"
       },
-      "digest": "The agent as DATA: one immutable AgentSpec record per agent (Alias required, Instructions required, Api?, Tools, OutputSchema?, Options, Name?, Description?), a catalog that enumerates them, and defaults outside the code. The doctrine this standard freezes: a NULL property means \"do not send to the provider\", never \"send the framework default\" — and an empty list is NOT treated as null, it is sent as written. Precedence between the spec api and the alias api lives in ONE method on the record, never inside the factory. Blank Alias/Instructions are rejected at construction. A catalog entry with no runtime consumer is dead weight (measured: a seeded agent with a versioned prompt and zero C# callers).",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/src/Morph.AiKit/Agents/AgentSpec.cs`, `.../Agents/AgentSpecOptions.cs` e `.../Agents/AgentFactory.cs` — o record, o bag de opções e a materialização são exatamente o que o kit compila.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Agents/AgentSpec.cs",
-        ".../Agents/AgentSpecOptions.cs",
-        ".../Agents/AgentFactory.cs"
-      ]
+      "digest": "The agent as DATA: one immutable AgentSpec record per agent (Alias required, Instructions required, Api?, Tools, OutputSchema?, Options, Name?, Description?), a catalog that enumerates them, and defaults outside the code. The doctrine this standard freezes: a NULL property means \"do not send to the provider\", never \"send the framework default\" — and an empty list is NOT treated as null, it is sent as written. Precedence between the spec api and the alias api lives in ONE method on the record, never inside the factory. Blank Alias/Instructions are rejected at construction. A catalog entry with no runtime consumer is dead weight (measured: a seeded agent with a versioned prompt and zero C# callers)."
     },
     {
       "id": "ai-agents-batching",
@@ -137,26 +90,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "batching",
-        "batch api",
-        "bulk prompts",
-        "batch processing",
-        "async batch",
-        "bulk inference",
-        "offline batch",
-        "CreateBatchOperation",
-        "BatchClient"
-      ],
       "anchors": {
         "when": "#quando-usar-batch",
         "api": "#a-api",
         "example": "#exemplo-c-completo",
         "when-not": "#quando-não-usar"
       },
-      "digest": "OpenAI Batch API for N independent prompts with no user waiting: 50% cheaper, up to 24h, separate rate limits. Flow is upload JSONL -> submit -> poll -> download, and the poll belongs in a background job. Measured against OpenAI 2.13.0: Batch is a PROTOCOL API, not a model one — CreateBatchAsync takes BinaryContent (there is no (fileId, endpoint, completionWindow) overload), GetBatchAsync returns a raw ClientResult, BatchJob.Status is a non-exported type, and OpenAIBatch does not exist; read the status from the JSON. GetBatchClient(), OpenAI.Batch, FileUploadPurpose.Batch, UploadFileAsync and DownloadFileAsync are confirmed. Persist CreateBatchOperation.RehydrationToken if the poller can restart. Always handle error_file_id.",
-      "verifiedAgainst": "OpenAI 2.13.0 (ai-pin 2026-09-08) + Microsoft.Extensions.AI 10.9.0. **Verificação documental** do fluxo da Batch API (platform.openai.com/docs/guides/batch, lido 2026-09-08), sem cláusula `provado por`: o ai-kit **referencia** o pacote `OpenAI` no `.csproj` — contrato de versão, régua = restore (`NU1102`) — mas **não o exercita**; não existe um único `using OpenAI` em `src/` (medido 2026-09-08), logo um rename de API não reprova a PR. Ver a tabela \"Dois níveis de garantia\" no README do kit. **Todos os nomes de tipo e assinaturas .NET foram medidos por reflexão sobre a assembly `OpenAI` 2.13.0 em 2026-09-08**, e os 9 marcadores `// VERIFY` desta página foram RESOLVIDOS por essa medição.",
-      "provedBy": []
+      "digest": "OpenAI Batch API for N independent prompts with no user waiting: 50% cheaper, up to 24h, separate rate limits. Flow is upload JSONL -> submit -> poll -> download, and the poll belongs in a background job. Measured against OpenAI 2.13.0: Batch is a PROTOCOL API, not a model one — CreateBatchAsync takes BinaryContent (there is no (fileId, endpoint, completionWindow) overload), GetBatchAsync returns a raw ClientResult, BatchJob.Status is a non-exported type, and OpenAIBatch does not exist; read the status from the JSON. GetBatchClient(), OpenAI.Batch, FileUploadPurpose.Batch, UploadFileAsync and DownloadFileAsync are confirmed. Persist CreateBatchOperation.RehydrationToken if the poller can restart. Always handle error_file_id."
     },
     {
       "id": "ai-agents-context-providers",
@@ -173,28 +113,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "context provider",
-        "dynamic context",
-        "context injection",
-        "AIContextProvider",
-        "memory provider",
-        "inject context",
-        "system prompt injection",
-        "compaction",
-        "MAAI001",
-        "tool before provider",
-        "ordem de escolha"
-      ],
       "anchors": {
         "when": "#quando-usar-context-provider",
         "api": "#a-api",
         "example": "#exemplo-c--context-provider-que-injeta-data-atual-e-perfil-do-tenant",
         "comparison": "#context-provider-vs-tools-vs-rag"
       },
-      "digest": "Order of choice first: a TOOL comes before an AIContextProvider — the provider is for cross-cutting context (memory, compaction, tenant) the LLM must not be able to skip. Passive RAG as a provider is the concrete anti-pattern it prevents (a vector search paid on every \"hi\"). Phase plans (instructions + a tool allow-list per funnel stage) are a deterministic C# composer, not a provider — AIContext only ADDS tools, it cannot remove them. AIContext has exactly Instructions/Messages/Tools; AgentRequestMessageSourceType prevents re-injection loops. Same instance invariant as agent-session (ProviderSessionState<TState>). Compaction is [Experimental(\"MAAI001\")] and where you register it changes the result: on the ChatClientBuilder it compacts only the in-flight request; on ChatClientAgentOptions it skips the tool loop and leaks the summary into persisted history. UseAIContextProviders ships in Microsoft.Agents.AI, not .Hosting.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 (ai-pin 2026-09-08) + doc oficial de context providers e de compaction (learn.microsoft.com, `ms.date` 2026-07-30). **Verificação documental** para o desenho — o ai-kit não registra `AIContextProvider`; os nomes de tipo, o pacote de cada extensão e o atributo `[Experimental]` da compaction foram **medidos por reflexão sobre `Microsoft.Agents.AI` 1.20.0** em 2026-09-08.",
-      "provedBy": []
+      "digest": "Order of choice first: a TOOL comes before an AIContextProvider — the provider is for cross-cutting context (memory, compaction, tenant) the LLM must not be able to skip. Passive RAG as a provider is the concrete anti-pattern it prevents (a vector search paid on every \"hi\"). Phase plans (instructions + a tool allow-list per funnel stage) are a deterministic C# composer, not a provider — AIContext only ADDS tools, it cannot remove them. AIContext has exactly Instructions/Messages/Tools; AgentRequestMessageSourceType prevents re-injection loops. Same instance invariant as agent-session (ProviderSessionState<TState>). Compaction is [Experimental(\"MAAI001\")] and where you register it changes the result: on the ChatClientBuilder it compacts only the in-flight request; on ChatClientAgentOptions it skips the tool loop and leaks the summary into persisted history. UseAIContextProviders ships in Microsoft.Agents.AI, not .Hosting."
     },
     {
       "id": "ai-agents-conversational-agent-with-phases",
@@ -211,16 +136,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "agente conversacional",
-        "fases do agente",
-        "allow-list de tools",
-        "RequireAny",
-        "ChatToolMode",
-        "compositor de turno",
-        "teto de tool calls",
-        "turno de conversa"
-      ],
       "anchors": {
         "quando": "#quando-este-arquétipo",
         "compositor": "#compositor-de-turno-determinístico",
@@ -230,9 +145,7 @@
         "auxiliar": "#agente-auxiliar-em-sequência",
         "checklist": "#checklist-verifiable-in-review"
       },
-      "digest": "ONE agent, phase as turn data — the deep dive on the first archetype, and it DECLARES a single field source in its own body. A deterministic turn composer (pure static class, no I/O) yields the turn plan; the prompt is born decomposed into NAMED BLOCKS and the text sent IS the concatenation, derived without cache ON PURPOSE, \"so telemetry cannot lie\" — the invariant that makes a prompt hash worth anything. Allow-list prunes in two stages (phase, then tenant capability), a tool absent from the map is AVAILABLE, and pruning preserves order. Tool-call ceiling with an exempt tool, at agent level (not ChatOptions). ChatToolMode.RequireAny exists (measured by reflection) and is the default when every action is a tool — but it ships with an EXIT CRITERION, not a blind prescription: the field alternative (a second pass) has 7 tests and a \"recovered\" outcome, so migrate when the recovered rate stops paying for the second paid call. An auxiliary agent runs in sequence, never nested inside a tool call.",
-      "verifiedAgainst": "Microsoft.Extensions.AI 10.9.0 + Microsoft.Agents.AI 1.20.0 (ai-pin 2026-09-08). `ChatToolMode.RequireAny` foi **medido por reflexão sobre `Microsoft.Extensions.AI.Abstractions` 10.9.0** em 2026-09-08. O restante é **verificação documental**, sem cláusula `provado por` — o ai-kit ainda não traz um compositor de turno, e o padrão é destilado de um único repositório de campo (ver a nota de fonte única abaixo).",
-      "provedBy": []
+      "digest": "ONE agent, phase as turn data — the deep dive on the first archetype, and it DECLARES a single field source in its own body. A deterministic turn composer (pure static class, no I/O) yields the turn plan; the prompt is born decomposed into NAMED BLOCKS and the text sent IS the concatenation, derived without cache ON PURPOSE, \"so telemetry cannot lie\" — the invariant that makes a prompt hash worth anything. Allow-list prunes in two stages (phase, then tenant capability), a tool absent from the map is AVAILABLE, and pruning preserves order. Tool-call ceiling with an exempt tool, at agent level (not ChatOptions). ChatToolMode.RequireAny exists (measured by reflection) and is the default when every action is a tool — but it ships with an EXIT CRITERION, not a blind prescription: the field alternative (a second pass) has 7 tests and a \"recovered\" outcome, so migrate when the recovered rate stops paying for the second paid call. An auxiliary agent runs in sequence, never nested inside a tool call."
     },
     {
       "id": "ai-agents-cost-and-budget",
@@ -249,16 +162,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "custo de llm",
-        "cost middleware",
-        "UsageCostMiddleware",
-        "teto de custo",
-        "budget middleware",
-        "tarifa por token",
-        "cost_usd",
-        "orçamento do agente"
-      ],
       "anchors": {
         "tarifa": "#tarifa-no-registry",
         "middleware": "#o-middleware-de-custo",
@@ -269,13 +172,7 @@
         "fronteira": "#fronteira-com-observability-patterns",
         "checklist": "#checklist-verifiable-in-review"
       },
-      "digest": "The only owner of COST as a subject. The SDK gives tokens and does not give money: UsageDetails (measured by reflection on Microsoft.Extensions.AI.Abstractions 10.9.0) exposes Input/Output/Total/Cached/Reasoning counts, the text-audio pairs, AdditionalCounts and Add() — and NO price property. So the tariff lives per alias in the registry, WITH a verification date, and an alias without a tariff must carry a written waiver. One middleware, above function-invocation in the pipeline (measured: above it, Usage already totals every tool round and one line is published per call). Three formula traps: reasoning tokens billed as output, CACHED input is a SUBSET of input (adding them double-counts), and hosted-operation flat fees never appear in UsageDetails. cost_usd is NEVER null: zero with an explicit state — Computed / Waived / UsageMissing. Budget UNIT is a parameter (lead, tenant, operation, day); the measured pain is one of PLACE — a ceiling living inside a tool does not govern the pipeline. Warn before blocking, and the block returns an actionable sentence to the model, never an exception. Two-way delegation with ai-agents-observability-patterns: span attributes stay there, tariff and ceiling live here.",
-      "verifiedAgainst": "Microsoft.Extensions.AI 10.9.0 + Microsoft.Agents.AI 1.20.0 (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/src/Morph.AiKit/Middleware/UsageCostMiddleware.cs`, `.../Middleware/UsageCostRecord.cs` e `.../Providers/ModelAlias.cs` — o middleware, o record de custo não-nulo e a conta de tarifa são o que o kit compila. A ausência de qualquer propriedade de preço em `UsageDetails` foi **medida por reflexão sobre `Microsoft.Extensions.AI.Abstractions` 10.9.0** em 2026-09-08. O teto de orçamento é **verificação documental** — o ai-kit não traz um middleware de orçamento.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Middleware/UsageCostMiddleware.cs",
-        ".../Middleware/UsageCostRecord.cs",
-        ".../Providers/ModelAlias.cs"
-      ]
+      "digest": "The only owner of COST as a subject. The SDK gives tokens and does not give money: UsageDetails (measured by reflection on Microsoft.Extensions.AI.Abstractions 10.9.0) exposes Input/Output/Total/Cached/Reasoning counts, the text-audio pairs, AdditionalCounts and Add() — and NO price property. So the tariff lives per alias in the registry, WITH a verification date, and an alias without a tariff must carry a written waiver. One middleware, above function-invocation in the pipeline (measured: above it, Usage already totals every tool round and one line is published per call). Three formula traps: reasoning tokens billed as output, CACHED input is a SUBSET of input (adding them double-counts), and hosted-operation flat fees never appear in UsageDetails. cost_usd is NEVER null: zero with an explicit state — Computed / Waived / UsageMissing. Budget UNIT is a parameter (lead, tenant, operation, day); the measured pain is one of PLACE — a ceiling living inside a tool does not govern the pipeline. Warn before blocking, and the block returns an actionable sentence to the model, never an exception. Two-way delegation with ai-agents-observability-patterns: span attributes stay there, tariff and ceiling live here."
     },
     {
       "id": "ai-agents-durable-workflows-hitl",
@@ -292,31 +189,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "durable workflow",
-        "checkpoint",
-        "checkpointing",
-        "human in the loop",
-        "hitl",
-        "requestport",
-        "requestinfoevent",
-        "resume workflow",
-        "long running workflow",
-        "approval workflow",
-        "icheckpointstore",
-        "tool approval",
-        "ApprovalRequiredAIFunction",
-        "ToolApprovalAgent"
-      ],
       "anchors": {
         "when": "#quando-usar-este-standard",
         "hitl": "#human-in-the-loop-via-requestport",
         "checkpointing": "#checkpointing--durável-sem-depender-de-azure",
         "durable-task": "#azure-durable-task-extension--escape-hatch-not-default"
       },
-      "digest": "Two DIFFERENT human-in-the-loop mechanisms, with the boundary made explicit. Single agent with an irreversible tool: ApprovalRequiredAIFunction — no workflow at all. The run ENDS emitting ToolApprovalRequestContent (whose ToolCall is a ToolCallContent), you answer with CreateResponse(approved, reason) IN THE SAME SESSION, and you loop until no pending approval remains. ToolApprovalAgent (stable since 1.14) centralises AutoApprovalRules. Since 1.14 approval responses are BOUND to the request — code written against 1.0 must be reviewed, not just recompiled. Graph with a human step or a multi-day wait: RequestPort + CheckpointManager over a custom ICheckpointStore (no Azure). Durable Task was extracted to a separate repo in 1.17 and lags the framework. Approval is not the right guard when the person on the other end is the interested party — use a deterministic guard.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08); `Microsoft.Agents.AI.Workflows` 1.20.0 e `Microsoft.Agents.AI.DurableTask` `1.16.0-preview.260730.1` **não estão no pin** — versões apuradas no nuget.org em 2026-09-08. **Verificação documental**, sem cláusula `provado por`: o ai-kit não exercita workflows nem aprovação de tool. Os nomes de tipo e membros de aprovação foram **medidos por reflexão sobre as assemblies do pin** em 2026-09-08.",
-      "provedBy": []
+      "digest": "Two DIFFERENT human-in-the-loop mechanisms, with the boundary made explicit. Single agent with an irreversible tool: ApprovalRequiredAIFunction — no workflow at all. The run ENDS emitting ToolApprovalRequestContent (whose ToolCall is a ToolCallContent), you answer with CreateResponse(approved, reason) IN THE SAME SESSION, and you loop until no pending approval remains. ToolApprovalAgent (stable since 1.14) centralises AutoApprovalRules. Since 1.14 approval responses are BOUND to the request — code written against 1.0 must be reviewed, not just recompiled. Graph with a human step or a multi-day wait: RequestPort + CheckpointManager over a custom ICheckpointStore (no Azure). Durable Task was extracted to a separate repo in 1.17 and lags the framework. Approval is not the right guard when the person on the other end is the interested party — use a deterministic guard."
     },
     {
       "id": "ai-agents-evals-with-cache",
@@ -330,25 +209,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "eval",
-        "evals",
-        "eval de modelo",
-        "regressao de prompt",
-        "prompt regression",
-        "model swap",
-        "troca de modelo",
-        "cache de respostas",
-        "response cache",
-        "dataset de eval",
-        "EvalFixture",
-        "OfflineChatClient",
-        "DiskBasedResponseCacheProvider",
-        "no evals",
-        "runner evals",
-        "--refresh-cache",
-        "evals.watch"
-      ],
       "anchors": {
         "porque": "#por-que-eval-não-é-teste-unitário",
         "dataset": "#dataset-por-agente-e-por-tenant",
@@ -362,11 +222,7 @@
         "semeadura": "#semeando-a-cache-exemplar-sem-gastar-dinheiro",
         "fronteira": "#fronteira-com-testing-ai"
       },
-      "digest": "Eval de modelo e de prompt lendo de uma cache de respostas COMMITADA: roda no CI sem credencial e sem rede, porque no hit da cache o cliente interno nunca e invocado e o cliente interno e um que RECUSA. Owns: dataset versionado por {agente}/{tenant}; o que entra na chave de cache (ProviderName + DefaultModelId; o endpoint NAO entra, apesar de a doc afirmar que entra - medido na 10.9.0); TTL explicito e longo (o default de 14 dias e DESTRUTIVO NA LEITURA e apaga a arvore commitada); o carimbo .morph-eval-cache.json que distingue cache sem carimbo de cache gravada sob outro pin; o que se commita (cache sim, resultados de execucao nao, por construcao); gate duro so em assercao deterministica, juizo de LLM como metrica reportada (2 dos 4 avaliadores de .Quality sao [Experimental] na 10.9.0); o no runner:evals no project.tests[] e o project.evals.watch[] que alimenta a regra de Gate 3; miss de cache reprova nomeado, JAMAIS skip. Fronteira com testing-ai: la o loop do agente contra fake, aqui o modelo real via cache.",
-      "verifiedAgainst": "Microsoft.Extensions.AI.Evaluation 10.9.0 + `.Quality` + `.Reporting` (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/src/Morph.AiKit/Evals/EvalFixture.cs`, que compila e roda no CI contra exatamente essas versões. A superfície de `DiskBasedReportingConfiguration`, `DiskBasedResponseCacheProvider`, `ReportingConfiguration` e dos avaliadores de `.Quality` foi **medida por reflexão sobre as assemblies `Microsoft.Extensions.AI.Evaluation*` 10.9.0** em 2026-09-08.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Evals/EvalFixture.cs"
-      ]
+      "digest": "Eval de modelo e de prompt lendo de uma cache de respostas COMMITADA: roda no CI sem credencial e sem rede, porque no hit da cache o cliente interno nunca e invocado e o cliente interno e um que RECUSA. Owns: dataset versionado por {agente}/{tenant}; o que entra na chave de cache (ProviderName + DefaultModelId; o endpoint NAO entra, apesar de a doc afirmar que entra - medido na 10.9.0); TTL explicito e longo (o default de 14 dias e DESTRUTIVO NA LEITURA e apaga a arvore commitada); o carimbo .morph-eval-cache.json que distingue cache sem carimbo de cache gravada sob outro pin; o que se commita (cache sim, resultados de execucao nao, por construcao); gate duro so em assercao deterministica, juizo de LLM como metrica reportada (2 dos 4 avaliadores de .Quality sao [Experimental] na 10.9.0); o no runner:evals no project.tests[] e o project.evals.watch[] que alimenta a regra de Gate 3; miss de cache reprova nomeado, JAMAIS skip. Fronteira com testing-ai: la o loop do agente contra fake, aqui o modelo real via cache."
     },
     {
       "id": "ai-agents-guardrails",
@@ -383,15 +239,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "guardrail",
-        "guard de tool",
-        "regra proibida",
-        "validacao de pertinencia",
-        "fail-open guard",
-        "argumento nao confiavel",
-        "choke-point"
-      ],
       "anchors": {
         "codigo": "#regra-proibida-vira-código",
         "chokepoint": "#onde-fica-o-choke-point",
@@ -400,9 +247,7 @@
         "failopen": "#quando-o-guard-não-consegue-decidir",
         "checklist": "#checklist-verifiable-in-review"
       },
-      "digest": "What the CODE guarantees once the prompt has already failed. A rule with real consequence leaves the prompt and becomes a C# condition — the measured reason, written in field code: the model obeys \"one entry per element of this list\" but errs badly when it must judge on its own which blocks have data (10 expected, 2 delivered). Three legitimate choke-points (before the turn in the composer; in the function-invocation middleware, with a CLOSED outcome vocabulary ok/error/invalid_args/limit/unavailable and required arguments read from the function JSON schema; after the run as backstop). Tool arguments are UNTRUSTED input: ids and money come from the turn closure, never from the model. Relevance, not presence: compare against something that did NOT come from the model — a deterministic rubric checked BY EQUALITY against the backend numbers, a provenance lock that demotes an unsupported \"found\" while PRESERVING the reasoning for audit, and a per-source confidence floor. When the guard cannot decide the answer is FAIL-OPEN, ratified with one hard condition: the escape is RECORDED (the anti-pattern is 81 of 83 catch blocks that never read the exception). Verdict is ternary — pass / reject / not_evaluated — because a boolean turns \"could not evaluate\" into \"approved\".",
-      "verifiedAgainst": "Microsoft.Extensions.AI 10.9.0 + Microsoft.Agents.AI 1.20.0 (ai-pin 2026-09-08). **Verificação documental**, sem cláusula `provado por` — o ai-kit não traz um guard de exemplo; o padrão é destilado de dois repositórios em produção, com o local de cada evidência citado na seção correspondente.",
-      "provedBy": []
+      "digest": "What the CODE guarantees once the prompt has already failed. A rule with real consequence leaves the prompt and becomes a C# condition — the measured reason, written in field code: the model obeys \"one entry per element of this list\" but errs badly when it must judge on its own which blocks have data (10 expected, 2 delivered). Three legitimate choke-points (before the turn in the composer; in the function-invocation middleware, with a CLOSED outcome vocabulary ok/error/invalid_args/limit/unavailable and required arguments read from the function JSON schema; after the run as backstop). Tool arguments are UNTRUSTED input: ids and money come from the turn closure, never from the model. Relevance, not presence: compare against something that did NOT come from the model — a deterministic rubric checked BY EQUALITY against the backend numbers, a provenance lock that demotes an unsupported \"found\" while PRESERVING the reasoning for audit, and a per-source confidence floor. When the guard cannot decide the answer is FAIL-OPEN, ratified with one hard condition: the escape is RECORDED (the anti-pattern is 81 of 83 catch blocks that never read the exception). Verdict is ternary — pass / reject / not_evaluated — because a boolean turns \"could not evaluate\" into \"approved\"."
     },
     {
       "id": "ai-agents-llm-runtime-defaults",
@@ -419,16 +264,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "llm defaults",
-        "runtime defaults",
-        "timeout llm",
-        "retry llm",
-        "strict json schema",
-        "temperature reasoning",
-        "capability por alias",
-        "network timeout"
-      ],
       "anchors": {
         "fronteira": "#fronteira-com-o-model-registry",
         "retry": "#retry-herdado",
@@ -438,14 +273,7 @@
         "pin": "#pin-de-sdk-e-compatibilidade-binária",
         "checklist": "#checklist-verifiable-in-review"
       },
-      "digest": "The runtime KNOBS of a model call, with the boundary against ai-agents-providers-model-registry (Layer 0, which owns the SCHEMA) written as the first section. Retry is INHERITED from the System.ClientModel pipeline — do not stack a loop on top (3 x 3 = 9 paid calls). Timeout is NOT inherited and must be created: ChatOptions has no timeout property (measured by reflection) and OpenAIClientOptions declares only Endpoint/OrganizationId/ProjectId/UserAgentApplicationId — the knob comes from the ClientPipelineOptions base. A CancellationToken is not a timeout. StrictJsonSchema DOES NOT EXIST: zero exported types containing \"Strict\" across the 14 pinned assemblies, and ChatResponseFormatJson has no strict field; the real mechanism is a key in ChatOptions.AdditionalProperties, so strict is per alias and NEVER a process-global flag. ReasoningEffort is a first-class enum (None/Low/Medium/High/ExtraHigh). Pin AI packages exactly — a floating 2.* range cost a MissingMethodException after the call was already paid for.",
-      "verifiedAgainst": "Microsoft.Extensions.AI 10.9.0 + Microsoft.Agents.AI 1.20.0 + OpenAI 2.13.0 (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/src/Morph.AiKit/Providers/ModelAlias.cs` e `.../Providers/ModelRegistry.cs` (alias, `api:`, e limite por alias com procedência obrigatória). A superfície do SDK citada aqui — `ChatOptions`, `ChatResponseFormatJson`, `ReasoningEffort`, `OpenAIClientOptions` — foi **medida por reflexão sobre as assemblies do pin** em 2026-09-08. O timeout é **provado por** `.../Agents/AgentSpecOptions.cs` e `.../Agents/AgentFactory.cs`, que o kit compila **por spec** (`TimeoutSeconds` vira um cliente de timeout no pipeline) — e **não** por alias: a allowlist de alias do registry não tem chave de timeout (medido). Os valores default do retry do `System.ClientModel` 1.15.0 são **verificação documental** — essa assembly está fora do conjunto que o probe carrega.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Providers/ModelAlias.cs",
-        ".../Providers/ModelRegistry.cs",
-        ".../Agents/AgentSpecOptions.cs",
-        ".../Agents/AgentFactory.cs"
-      ]
+      "digest": "The runtime KNOBS of a model call, with the boundary against ai-agents-providers-model-registry (Layer 0, which owns the SCHEMA) written as the first section. Retry is INHERITED from the System.ClientModel pipeline — do not stack a loop on top (3 x 3 = 9 paid calls). Timeout is NOT inherited and must be created: ChatOptions has no timeout property (measured by reflection) and OpenAIClientOptions declares only Endpoint/OrganizationId/ProjectId/UserAgentApplicationId — the knob comes from the ClientPipelineOptions base. A CancellationToken is not a timeout. StrictJsonSchema DOES NOT EXIST: zero exported types containing \"Strict\" across the 14 pinned assemblies, and ChatResponseFormatJson has no strict field; the real mechanism is a key in ChatOptions.AdditionalProperties, so strict is per alias and NEVER a process-global flag. ReasoningEffort is a first-class enum (None/Low/Medium/High/ExtraHigh). Pin AI packages exactly — a floating 2.* range cost a MissingMethodException after the call was already paid for."
     },
     {
       "id": "ai-agents-mcp-server",
@@ -462,19 +290,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "mcp server",
-        "expose mcp",
-        "build mcp server",
-        "mcp host",
-        "publish tools",
-        "create mcp server",
-        "ModelContextProtocol server",
-        "request filters",
-        "AddCallToolFilter",
-        "stateless",
-        "spec 2026-07-28"
-      ],
       "anchors": {
         "when": "#quando-criar-um-mcp-server",
         "api": "#a-api",
@@ -482,9 +297,7 @@
         "http": "#exemplo-c--transport-http",
         "security": "#segurança"
       },
-      "digest": "Expose project capabilities as an MCP server. There is NO spec revision called \"MCP 2.0\": the spec is dated (current revision 2026-07-28) and 2.x is the C# SDK major (ModelContextProtocol 2.2.0). That revision removed sessions and Mcp-Session-Id (SEP-2567), removed initialize (version/capabilities travel in _meta per request, SEP-2575), deprecated Roots/Sampling/Logging (SEP-2577), moved Tasks to an extension, replaced elicitation/sampling with MRTR, and deprecated HTTP+SSE. The C# server API kept its names (AddMcpServer, WithStdioServerTransport, WithHttpTransport, [McpServerTool]) but Stateless is now the DEFAULT, not a choice. Multi-tenant needs TWO request filters: AddListToolsFilter hides a tool, only AddCallToolFilter stops the call — and a connected client never re-reads the list. Identity per request via context.User; tool arguments are untrusted input and tenant ids come from the credential, never from the model.",
-      "verifiedAgainst": "ModelContextProtocol 2.2.0 + ModelContextProtocol.AspNetCore 2.2.0 (ai-pin 2026-09-08; o `.AspNetCore` não está no pin — versão apurada no nuget.org em 2026-09-08) + revisão de spec MCP **2026-07-28** (modelcontextprotocol.io/specification/versioning, lido 2026-09-08). **Verificação documental — o ai-kit não exercita MCP**, e por isso este standard NÃO carimba `provado por`. Os nomes de tipo, os defaults e os avisos de obsolescência abaixo foram **medidos por reflexão sobre as assemblies 2.2.0** em 2026-09-08.",
-      "provedBy": []
+      "digest": "Expose project capabilities as an MCP server. There is NO spec revision called \"MCP 2.0\": the spec is dated (current revision 2026-07-28) and 2.x is the C# SDK major (ModelContextProtocol 2.2.0). That revision removed sessions and Mcp-Session-Id (SEP-2567), removed initialize (version/capabilities travel in _meta per request, SEP-2575), deprecated Roots/Sampling/Logging (SEP-2577), moved Tasks to an extension, replaced elicitation/sampling with MRTR, and deprecated HTTP+SSE. The C# server API kept its names (AddMcpServer, WithStdioServerTransport, WithHttpTransport, [McpServerTool]) but Stateless is now the DEFAULT, not a choice. Multi-tenant needs TWO request filters: AddListToolsFilter hides a tool, only AddCallToolFilter stops the call — and a connected client never re-reads the list. Identity per request via context.User; tool arguments are untrusted input and tenant ids come from the credential, never from the model."
     },
     {
       "id": "ai-agents-mcp-tools",
@@ -501,27 +314,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "mcp",
-        "model context protocol",
-        "mcp client",
-        "consume mcp server",
-        "mcp tools",
-        "external tools",
-        "agent mcp client",
-        "McpClient.CreateAsync",
-        "HttpClientTransport",
-        "MRTR"
-      ],
       "anchors": {
         "what": "#o-que-é-no-contexto-de-um-agente-maf",
         "api": "#a-api",
         "example": "#exemplo-c",
         "comparison": "#mcp-server-vs-tool-nativa"
       },
-      "digest": "A MAF agent consuming external MCP servers, against ModelContextProtocol 2.2.0 (out of preview). Renames that break old code: McpClientFactory.CreateAsync became McpClient.CreateAsync, and SseClientTransport became HttpClientTransport with TransportMode = HttpTransportMode.Sse — neither old name exists in 2.2.0. McpClientTool derives from AIFunction, so .Cast<AITool>() is unnecessary. ElicitAsync/SampleAsync/RequestRootsAsync need a persistent session and fail against a stateless server; the cross-configuration path is MRTR (InputRequiredException + InputRequest.ForElicitation). Long-running Tasks moved to ModelContextProtocol.Extensions.Tasks with NO wire compatibility with the 1.3/1.4 implementation. Every discovered tool is re-sent in the definition on each turn — prune.",
-      "verifiedAgainst": "ModelContextProtocol 2.2.0 + Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08) + revisão de spec MCP **2026-07-28**. **Verificação documental — o ai-kit não exercita MCP**, e por isso este standard NÃO carimba `provado por`. Todos os nomes de tipo abaixo foram **medidos por reflexão sobre `ModelContextProtocol.Core` 2.2.0** em 2026-09-08.",
-      "provedBy": []
+      "digest": "A MAF agent consuming external MCP servers, against ModelContextProtocol 2.2.0 (out of preview). Renames that break old code: McpClientFactory.CreateAsync became McpClient.CreateAsync, and SseClientTransport became HttpClientTransport with TransportMode = HttpTransportMode.Sse — neither old name exists in 2.2.0. McpClientTool derives from AIFunction, so .Cast<AITool>() is unnecessary. ElicitAsync/SampleAsync/RequestRootsAsync need a persistent session and fail against a stateless server; the cross-configuration path is MRTR (InputRequiredException + InputRequest.ForElicitation). Long-running Tasks moved to ModelContextProtocol.Extensions.Tasks with NO wire compatibility with the 1.3/1.4 implementation. Every discovered tool is re-sent in the definition on each turn — prune."
     },
     {
       "id": "ai-agents-media-pipeline",
@@ -539,17 +338,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "media pipeline",
-        "media job",
-        "media review",
-        "C2PA",
-        "SynthID",
-        "AI Act",
-        "content provenance",
-        "marcação de IA",
-        "idempotência de mídia"
-      ],
       "anchors": {
         "hard-rule": "#a-regra-dura",
         "states": "#a-máquina-de-estados",
@@ -563,11 +351,7 @@
         "tests": "#testes",
         "reverify": "#como-re-verificar-este-standard"
       },
-      "digest": "Onde mora a regra dura: NUNCA gerar midia dentro de um turno de conversa (WhatsApp, chat, webhook sincrono) — latencia documentada de ate 2 min em imagem e de 11 s a 6 min em video, custo por chamada, e zero revisao possivel dentro do turno. A regra e presa por TIPO e nao por prosa: o que produz bytes e internal ao assembly, a superficie publica devolve id de job. O limite do tipo esta declarado: ele fecha \"obter bytes\" e \"nomear o produtor\", NAO fecha \"aguardar inline\" — o gatilho do worker (IMediaJobRunner.RunAsync) e publico por necessidade, e um await dele dentro de um handler de turno compila e paga a latencia; quem fecha essa porta e a revisao de codigo. Maquina de estados pending/generating/generated/approved|rejected|rejected_by_policy/published + failed, onde bloqueio de moderacao e terminal e NAO retryable. DUAS chaves de idempotencia, distintas de proposito: a de PEDIDO (sha256 de provider+model+prompt+refs+opcoes) dedupe a chamada paga; a de CONTEUDO (sha256 dos bytes) dedupe o storage. Bytes no blob proprio porque URL de provedor expira; banco com caminho relativo + sha256. Proveniencia com nove campos e C2PA preservado sem re-encode. C2PA e SynthID vem embutidos e NAO bastam (caem com screenshot/re-encode; not_detected nao significa humano), entao a marcacao visivel e obrigacao separada no ponto de publicacao — EU AI Act art. 50, com a ressalva de fonte declarada. E ela e presa por TIPO, nao por prosa: Publish tem TRES portas (estado Approved; finalidade publicavel; marcacao presente quando a finalidade a exige) e recebe a marcacao como parametro, com texto E superficie obrigatorios na construcao. O limite e declarado: prova que a decisao foi gravada, nao que o rotulo chegou aos olhos de alguem — renderizar e do aplicativo consumidor. Approve exige humano com carimbo; juiz LLM e pre-filtro. Teto de custo por tenant/dia recusa no enqueue. O mecanismo de job NAO e reescrito: cita backend/integrations/hangfire/hangfire-jobs.md, e durable-workflows-hitl e a outra coisa (HITL dentro de um Workflow MAF).",
-      "verifiedAgainst": "Microsoft.Extensions.AI 10.9.0 + OpenAI 2.13.0 + Google.GenAI 1.21.0 (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/src/Morph.AiKit/Media/` — a máquina de estados (`MediaJob`), a revisão humana (`MediaReview`), a marcação exigida na publicação (`MediaDisclosure` + `MediaJob.Publish`), as duas chaves (`MediaIdempotencyKey` × `MediaHash`), o storage por conteúdo (`MediaStore`) e a acessibilidade `internal` de `IMediaProvider` compilam e são exercitados por teste. Preço, data de desligamento, C2PA/SynthID e o texto legal do AI Act são **verificação documental** contra as páginas de §Como re-verificar este standard.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Media/"
-      ]
+      "digest": "Onde mora a regra dura: NUNCA gerar midia dentro de um turno de conversa (WhatsApp, chat, webhook sincrono) — latencia documentada de ate 2 min em imagem e de 11 s a 6 min em video, custo por chamada, e zero revisao possivel dentro do turno. A regra e presa por TIPO e nao por prosa: o que produz bytes e internal ao assembly, a superficie publica devolve id de job. O limite do tipo esta declarado: ele fecha \"obter bytes\" e \"nomear o produtor\", NAO fecha \"aguardar inline\" — o gatilho do worker (IMediaJobRunner.RunAsync) e publico por necessidade, e um await dele dentro de um handler de turno compila e paga a latencia; quem fecha essa porta e a revisao de codigo. Maquina de estados pending/generating/generated/approved|rejected|rejected_by_policy/published + failed, onde bloqueio de moderacao e terminal e NAO retryable. DUAS chaves de idempotencia, distintas de proposito: a de PEDIDO (sha256 de provider+model+prompt+refs+opcoes) dedupe a chamada paga; a de CONTEUDO (sha256 dos bytes) dedupe o storage. Bytes no blob proprio porque URL de provedor expira; banco com caminho relativo + sha256. Proveniencia com nove campos e C2PA preservado sem re-encode. C2PA e SynthID vem embutidos e NAO bastam (caem com screenshot/re-encode; not_detected nao significa humano), entao a marcacao visivel e obrigacao separada no ponto de publicacao — EU AI Act art. 50, com a ressalva de fonte declarada. E ela e presa por TIPO, nao por prosa: Publish tem TRES portas (estado Approved; finalidade publicavel; marcacao presente quando a finalidade a exige) e recebe a marcacao como parametro, com texto E superficie obrigatorios na construcao. O limite e declarado: prova que a decisao foi gravada, nao que o rotulo chegou aos olhos de alguem — renderizar e do aplicativo consumidor. Approve exige humano com carimbo; juiz LLM e pre-filtro. Teto de custo por tenant/dia recusa no enqueue. O mecanismo de job NAO e reescrito: cita backend/integrations/hangfire/hangfire-jobs.md, e durable-workflows-hitl e a outra coisa (HITL dentro de um Workflow MAF)."
     },
     {
       "id": "ai-agents-media-video",
@@ -585,17 +369,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "media video",
-        "video generation",
-        "text to video",
-        "image to video",
-        "veo",
-        "seedance",
-        "kling",
-        "runway",
-        "GenerateVideosAsync"
-      ],
       "anchors": {
         "when": "#quando-usar",
         "sdk": "#o-caminho-com-sdk",
@@ -608,11 +381,7 @@
         "deprecations": "#deprecações",
         "reverify": "#como-re-verificar-este-standard"
       },
-      "digest": "Geracao de VIDEO em runtime a partir de .NET. A fronteira esta na primeira linha: footage de LP scroll-driven por MCP em tempo de autoria e frontend/design-system/ai-video-generation.md; aqui e o worker do backend. Veo 3.1 via Google.GenAI 1.21.0 (GenerateVideosAsync + Operations.GetAsync em polling ~10 s) e o UNICO caminho com SDK .NET oficial depois do desligamento da Sora — sora-2, sora-2-pro e o VideoClient do openai-dotnet saem sem substituto, entao nao se escreve adaptador para eles. Seedance 2.0, Kling e Runway sao HttpClient tipado com DTOs proprios: criar tarefa, PERSISTIR o id antes de qualquer outra coisa, polling com back-off ou webhook, baixar, gravar. O arquivo do Veo expira em 2 dias, o que torna o download obrigatorio e nao otimizacao. Bloqueio de moderacao NAO cobra e e estado terminal (rejected_by_policy), nunca erro retryable. 8 s e obrigatorio no Veo para 1080p, 4K e imagens de referencia. Nenhum alias default e pinado para Seedance/Kling/Runway porque a faixa de preco medida varia 20x entre canais. Preco em #custo-por-segundo, datas em #deprecacoes.",
-      "verifiedAgainst": "Google.GenAI 1.21.0 + OpenAI 2.13.0 (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/src/Morph.AiKit/Media/Providers/VeoVideoProvider.cs` — `Models.GenerateVideosAsync(model, GenerateVideosSource, GenerateVideosConfig, ct)`, o polling por `Operations.GetAsync` + `operation.Done` e o sinal de bloqueio `RaiMediaFilteredCount` COMPILAM ali. Preço, duração, retenção e data de desligamento são **verificação documental** contra as páginas listadas em §Como re-verificar este standard.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Media/Providers/VeoVideoProvider.cs"
-      ]
+      "digest": "Geracao de VIDEO em runtime a partir de .NET. A fronteira esta na primeira linha: footage de LP scroll-driven por MCP em tempo de autoria e frontend/design-system/ai-video-generation.md; aqui e o worker do backend. Veo 3.1 via Google.GenAI 1.21.0 (GenerateVideosAsync + Operations.GetAsync em polling ~10 s) e o UNICO caminho com SDK .NET oficial depois do desligamento da Sora — sora-2, sora-2-pro e o VideoClient do openai-dotnet saem sem substituto, entao nao se escreve adaptador para eles. Seedance 2.0, Kling e Runway sao HttpClient tipado com DTOs proprios: criar tarefa, PERSISTIR o id antes de qualquer outra coisa, polling com back-off ou webhook, baixar, gravar. O arquivo do Veo expira em 2 dias, o que torna o download obrigatorio e nao otimizacao. Bloqueio de moderacao NAO cobra e e estado terminal (rejected_by_policy), nunca erro retryable. 8 s e obrigatorio no Veo para 1080p, 4K e imagens de referencia. Nenhum alias default e pinado para Seedance/Kling/Runway porque a faixa de preco medida varia 20x entre canais. Preco em #custo-por-segundo, datas em #deprecacoes."
     },
     {
       "id": "ai-agents-middleware-patterns",
@@ -628,28 +397,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "middleware",
-        "agent middleware",
-        "function calling middleware",
-        "retry",
-        "anti-hallucination",
-        "resilience",
-        "telemetry middleware",
-        "agent run middleware",
-        "pipeline order",
-        "streaming downgrade"
-      ],
       "anchors": {
         "levels": "#os-3-níveis-de-middleware",
         "resilience": "#pattern-resilência-retry--rate-limit",
         "anti-hallucination": "#pattern-anti-hallucination"
       },
-      "digest": "The three middleware levels (Agent Run, Function Calling, IChatClient) and where each one belongs. Registration is always .AsBuilder().Use(...).Build(); in a ChatClientBuilder the FIRST registered is the OUTERMOST. Pipeline ORDER is measured, not folklore: timeout -> usage-cost -> FunctionInvokingChatClient -> chat telemetry -> provider client. Usage-cost sits ABOVE the FICC because below it would read the same UsageDetails the FICC mutates to accumulate; chat telemetry sits BELOW it so the chat span closes before the tools. Supplying only the non-streaming delegate silently downgrades streaming calls — use Use(sharedFunc) when the middleware does not care. Patterns: telemetry, resilience (retry + rate limit), anti-hallucination.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08); `provado por templates/dotnet/ai-kit/src/Morph.AiKit/Agents/AgentFactory.cs` para a **ordem do pipeline** — a fábrica do kit é o único lugar que conhece essa ordem, e ela é medida por teste, não herdada de folclore. As assinaturas de `Use(...)` foram **medidas por reflexão sobre `AIAgentBuilder` e `ChatClientBuilder`** em 2026-09-08.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Agents/AgentFactory.cs"
-      ]
+      "digest": "The three middleware levels (Agent Run, Function Calling, IChatClient) and where each one belongs. Registration is always .AsBuilder().Use(...).Build(); in a ChatClientBuilder the FIRST registered is the OUTERMOST. Pipeline ORDER is measured, not folklore: timeout -> usage-cost -> FunctionInvokingChatClient -> chat telemetry -> provider client. Usage-cost sits ABOVE the FICC because below it would read the same UsageDetails the FICC mutates to accumulate; chat telemetry sits BELOW it so the chat span closes before the tools. Supplying only the non-streaming delegate silently downgrades streaming calls — use Use(sharedFunc) when the middleware does not care. Patterns: telemetry, resilience (retry + rate limit), anti-hallucination."
     },
     {
       "id": "ai-agents-modalities-image-gen",
@@ -666,29 +419,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "image generation",
-        "text to image",
-        "dall-e",
-        "gpt-image",
-        "mockup",
-        "image synthesis",
-        "generate image",
-        "image from text",
-        "MEAI001",
-        "IImageGenerator"
-      ],
       "anchors": {
         "when": "#quando-usar-geração-de-imagem",
         "api": "#a-api",
         "example": "#exemplo-c-completo",
         "params": "#parâmetros"
       },
-      "digest": "Text-to-image with the OpenAI SDK: ImageClient.GenerateImageAsync(prompt, options, ct) — signature confirmed in OpenAI 2.13.0, alongside GenerateImagesAsync, GenerateImageEditAsync and GenerateImageVariationAsync. The abstraction path (IImageGenerator, AsIImageGenerator, ImageGeneratorBuilder) is [Experimental(\"MEAI001\")] and needs the diagnostic suppressed; the concrete ImageClient does not. HostedImageGenerationTool lets the MODEL decide to generate, and is documented as mapping to the Responses API — that mapping is internal and was not confirmable by reflection. There is no GetImageClient(alias) in the standard ModelRegistry; register the ImageClient yourself.",
-      "verifiedAgainst": "OpenAI 2.13.0 + Microsoft.Extensions.AI 10.9.0 + Google.GenAI 1.21.0 (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/src/Morph.AiKit/Media/Providers/OpenAIImageProvider.cs` — `IImageGenerator`, `MEAI001`, `ImageGenerationRequest.OriginalImages` e a ausência de propriedade tipada para `quality` COMPILAM ali, e `OPENAI001` em `GeneratedImageQuality` foi medido pelo compilador. `HostedImageGenerationTool` foi medido por reflexão sobre a assembly do pin (existe, não é experimental); preço, data de desligamento e limites de referência são **verificação documental** contra as páginas de §Como re-verificar este standard.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Media/Providers/OpenAIImageProvider.cs"
-      ]
+      "digest": "Text-to-image with the OpenAI SDK: ImageClient.GenerateImageAsync(prompt, options, ct) — signature confirmed in OpenAI 2.13.0, alongside GenerateImagesAsync, GenerateImageEditAsync and GenerateImageVariationAsync. The abstraction path (IImageGenerator, AsIImageGenerator, ImageGeneratorBuilder) is [Experimental(\"MEAI001\")] and needs the diagnostic suppressed; the concrete ImageClient does not. HostedImageGenerationTool lets the MODEL decide to generate, and is documented as mapping to the Responses API — that mapping is internal and was not confirmable by reflection. There is no GetImageClient(alias) in the standard ModelRegistry; register the ImageClient yourself."
     },
     {
       "id": "ai-agents-modalities-speech-to-text",
@@ -706,24 +443,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "speech to text",
-        "transcription",
-        "whisper",
-        "audio to text",
-        "voice transcription",
-        "STT",
-        "audio transcription"
-      ],
       "anchors": {
         "when": "#quando-usar-stt",
         "api": "#a-api",
         "example": "#exemplo-c-completo",
         "formats": "#formatos-e-limites"
       },
-      "digest": "Use STT só quando o input real é áudio; se já é texto, use-o direto. Transcrição é chamada de serviço, não agente: registre o `AudioClient` (OpenAI 2.13.0) UMA vez no DI com modelo (`whisper-1`) e API key vindos de config e injete-o pelo construtor do `TranscriptionService` (nunca `new AudioClient` no chamador), e passe o texto como `string` ao `AIAgent` downstream; NÃO crie `AIAgent` para transcrever. API: `TranscribeAudioAsync(path, options)` NÃO aceita `CancellationToken` — para cancelar, `File.OpenRead` e a sobrecarga `(Stream, fileName, options, ct)`, que exige o nome do arquivo (dele se deduz o formato); `ResponseFormat = Verbose` com `TimestampGranularities = AudioTimestampGranularities.Word | Segment` (enum de flags, não coleção) dá timestamps. Limites: mp3/mp4/mpeg/mpga/m4a/wav/webm, 25 MB por request (acima, erro 413): divida client-side em chunks de ≤20 MB, com alguns segundos de overlap se o corte for crítico. Defina `Language = \"pt\"` quando o idioma é conhecido. Opcional: `ISpeechToTextClient` via `AsISpeechToTextClient()`.",
-      "verifiedAgainst": "OpenAI 2.13.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08). **Verificação documental**, sem cláusula `provado por` — o ai-kit não transcreve áudio. `AudioClient.TranscribeAudioAsync` e a ponte `AsISpeechToTextClient` foram **medidas por reflexão sobre as assemblies do pin** em 2026-09-08. Em 2026-10-03 os blocos da API, do `TranscriptionService`, do agente downstream (dentro de um método-invólucro) e do registro DI compilaram com `TreatWarningsAsErrors` contra `OpenAI` 2.13.0 + `Microsoft.Agents.AI` 1.20.0 (o pin de 2026-09-08, que é a data que este campo carrega).",
-      "provedBy": []
+      "digest": "Use STT só quando o input real é áudio; se já é texto, use-o direto. Transcrição é chamada de serviço, não agente: registre o `AudioClient` (OpenAI 2.13.0) UMA vez no DI com modelo (`whisper-1`) e API key vindos de config e injete-o pelo construtor do `TranscriptionService` (nunca `new AudioClient` no chamador), e passe o texto como `string` ao `AIAgent` downstream; NÃO crie `AIAgent` para transcrever. API: `TranscribeAudioAsync(path, options)` NÃO aceita `CancellationToken` — para cancelar, `File.OpenRead` e a sobrecarga `(Stream, fileName, options, ct)`, que exige o nome do arquivo (dele se deduz o formato); `ResponseFormat = Verbose` com `TimestampGranularities = AudioTimestampGranularities.Word | Segment` (enum de flags, não coleção) dá timestamps. Limites: mp3/mp4/mpeg/mpga/m4a/wav/webm, 25 MB por request (acima, erro 413): divida client-side em chunks de ≤20 MB, com alguns segundos de overlap se o corte for crítico. Defina `Language = \"pt\"` quando o idioma é conhecido. Opcional: `ISpeechToTextClient` via `AsISpeechToTextClient()`."
     },
     {
       "id": "ai-agents-modalities-text-to-speech",
@@ -741,24 +467,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "text to speech",
-        "TTS",
-        "voice synthesis",
-        "audio generation",
-        "speech synthesis",
-        "voice output",
-        "speak text"
-      ],
       "anchors": {
         "when": "#quando-usar-tts",
         "api": "#a-api",
         "example": "#exemplo-c-completo",
         "params": "#parâmetros"
       },
-      "digest": "Use TTS when the agent must return audio output — voice assistants, accessibility narration, podcast generation. MAF uses AudioClient for text-to-speech with configurable voice, speed, and output format (mp3, opus, flac). Covers streaming audio response, voice selection, and integration with blob storage for async delivery. Anti-patterns: synthesizing long texts synchronously in a request handler.",
-      "verifiedAgainst": "OpenAI 2.13.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08). **Verificação documental**, sem cláusula `provado por` — o ai-kit não gera áudio. `AudioClient.GenerateSpeechAsync`, a sobrecarga de streaming e a ponte `AsITextToSpeechClient` foram **medidas por reflexão sobre as assemblies do pin** em 2026-09-08.",
-      "provedBy": []
+      "digest": "Use TTS when the agent must return audio output — voice assistants, accessibility narration, podcast generation. MAF uses AudioClient for text-to-speech with configurable voice, speed, and output format (mp3, opus, flac). Covers streaming audio response, voice selection, and integration with blob storage for async delivery. Anti-patterns: synthesizing long texts synchronously in a request handler."
     },
     {
       "id": "ai-agents-modalities-vision",
@@ -775,25 +490,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "vision",
-        "image to text",
-        "OCR",
-        "image analysis",
-        "multimodal input",
-        "image agent",
-        "PDF analysis",
-        "visual understanding"
-      ],
       "anchors": {
         "when": "#quando-usar-vision",
         "api": "#a-api",
         "example": "#exemplo-c-completo",
         "content-types": "#datacontent-vs-uricontent"
       },
-      "digest": "Vision em MAF usa ChatMessage multimodal (Microsoft.Extensions.AI): new ChatMessage(ChatRole.User, [new TextContent(pergunta), imagem]) passado a agent.RunAsync. Imagem em URL pública: UriContent(uri, mediaType); arquivo local: DataContent.LoadFromAsync(path), o helper canônico e preferido; bytes já em memória: new DataContent(BinaryData, mediaType). Upload de usuário ou imagem privada usa DataContent, nunca URL temporária (pode expirar); CDN estável usa UriContent. O modelo vem do alias vision no Model Registry, pois nem todo provider suporta visão. Dado tipado: RunAsync<T> com sealed record, nunca regex em response.Text. Proibido: base64 manual, imagem 4K sem resize (tokens cobrados por resolução; ex.: 800px para OCR), vision quando já há texto extraído ou um parser/OCR determinístico basta. PDF: confirme application/pdf no provider.",
-      "verifiedAgainst": "Microsoft.Extensions.AI 10.9.0 + Microsoft.Agents.AI 1.20.0 (ai-pin 2026-09-08). **Verificação documental**, sem cláusula `provado por` — o ai-kit não exercita conteúdo multimodal. Os três tipos de conteúdo citados (`TextContent`, `UriContent`, `DataContent`) foram **conferidos por reflexão sobre `Microsoft.Extensions.AI.Abstractions` 10.9.0** em 2026-09-08 e continuam existindo com esses nomes.",
-      "provedBy": []
+      "digest": "Vision em MAF usa ChatMessage multimodal (Microsoft.Extensions.AI): new ChatMessage(ChatRole.User, [new TextContent(pergunta), imagem]) passado a agent.RunAsync. Imagem em URL pública: UriContent(uri, mediaType); arquivo local: DataContent.LoadFromAsync(path), o helper canônico e preferido; bytes já em memória: new DataContent(BinaryData, mediaType). Upload de usuário ou imagem privada usa DataContent, nunca URL temporária (pode expirar); CDN estável usa UriContent. O modelo vem do alias vision no Model Registry, pois nem todo provider suporta visão. Dado tipado: RunAsync<T> com sealed record, nunca regex em response.Text. Proibido: base64 manual, imagem 4K sem resize (tokens cobrados por resolução; ex.: 800px para OCR), vision quando já há texto extraído ou um parser/OCR determinístico basta. PDF: confirme application/pdf no provider."
     },
     {
       "id": "ai-agents-multi-agent-patterns",
@@ -808,26 +511,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "multi-agent",
-        "agent as tool",
-        "agent composition",
-        "sequential agents",
-        "handoff",
-        "sub-agent",
-        "agent orchestration",
-        "nested agent",
-        "agente auxiliar",
-        "AsAIFunction"
-      ],
       "anchors": {
         "agent-as-tool": "#agent-as-tool-padrão-recomendado",
         "sequential": "#sequential-cadeia-fixa",
         "decision-tree": "#decision-tree"
       },
-      "digest": "Composing agents, cheapest first: Agent-as-Tool (agent.AsAIFunction(), nesting <= 2) before Sequential before Workflow. Handoff has GRADUATED — HandoffWorkflowBuilder carries no [Experimental] in 1.20.0 — but still comes after agent-as-tool; it needs a stable Id per agent plus WithAutonomousMode(turnLimit:) or a termination condition, and group chat stays at <= 3 agents. Field-measured anti-pattern: a helper agent nested INSIDE a tool — two function-calling loops overlap in the same turn (CallId reconciliation) and the main turn stays open while the helper runs. The correct contract is two visible calls, helper in sequence, orchestrated by code. Structured output between agents; no deep cascades.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 (ai-pin 2026-09-08) + Microsoft.Agents.AI.Workflows 1.20.0 (**fora do pin**; versão apurada no nuget.org em 2026-09-08). **Verificação documental**, sem cláusula `provado por` — o ai-kit não compõe agentes. As assinaturas de `AgentWorkflowBuilder`/`HandoffWorkflowBuilder` e a **ausência** do atributo `[Experimental]` no Handoff foram **medidas por reflexão sobre a assembly 1.20.0** em 2026-09-08.",
-      "provedBy": []
+      "digest": "Composing agents, cheapest first: Agent-as-Tool (agent.AsAIFunction(), nesting <= 2) before Sequential before Workflow. Handoff has GRADUATED — HandoffWorkflowBuilder carries no [Experimental] in 1.20.0 — but still comes after agent-as-tool; it needs a stable Id per agent plus WithAutonomousMode(turnLimit:) or a termination condition, and group chat stays at <= 3 agents. Field-measured anti-pattern: a helper agent nested INSIDE a tool — two function-calling loops overlap in the same turn (CallId reconciliation) and the main turn stays open while the helper runs. The correct contract is two visible calls, helper in sequence, orchestrated by code. Structured output between agents; no deep cascades."
     },
     {
       "id": "ai-agents-observability-patterns",
@@ -843,22 +532,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "observability",
-        "opentelemetry",
-        "telemetry",
-        "logging",
-        "tracing",
-        "log investigation",
-        "troubleshooting",
-        "aspire dashboard",
-        "correlation id",
-        "agent observability",
-        "agent telemetry",
-        "EnableSensitiveData",
-        "span duplication",
-        "invoke_agent"
-      ],
       "anchors": {
         "setup": "#setup--opentelemetry",
         "enrichment": "#enrichment--o-que-preencher-em-spans-e-logs",
@@ -866,11 +539,7 @@
         "rastreabilidade": "#rastreabilidade-do-que-foi-ao-provedor",
         "convencao": "#estabilidade-da-convenção-genai--a-ressalva-que-muda-como-ler-a-tabela-acima"
       },
-      "digest": "Canonical treatment of OpenTelemetry for MAF agents: setup, enrichment, investigation. Two DIFFERENT ActivitySources must be registered — Experimental.Microsoft.Agents.AI (span invoke_agent) and Experimental.Microsoft.Extensions.AI (spans chat and execute_tool, metrics gen_ai.client.operation.duration and gen_ai.client.token.usage). AgentOpenTelemetryConsts and agent.WithOpenTelemetry() do NOT exist in 1.20.0; the API is builder.UseOpenTelemetry(sourceName, configure) and the sensitive-data switch is EnableSensitiveData (same name on OpenTelemetryAgent and OpenTelemetryChatClient). Duplication rule, measured: instrumenting the two LEVELS is normal and does not duplicate; instrumenting the same level twice does. With a custom pipeline (UseProvidedChatClientAsIs) the MAF guard does not reach it and chat instrumentation becomes mandatory. Issue 3637 (no GenAI ActivityEvents) is a known open limitation. TRACEABILITY (added 2026-09-08): the question the instrumentation exists to answer is whether the turn can be RECONSTRUCTED — raw prompt only in dev/harness with opt-in, HASH in production, and the invariant that makes the hash worth anything is that the text sent is derived from named blocks WITHOUT cache (a cache between assembly and send lets telemetry and request diverge in silence). Two closing assertions: the offered tool list came from the real turn list, and a CANCELLED turn writes nothing. CONVENTION STABILITY: the GenAI semantic conventions LEFT the main OpenTelemetry repo — semconv v1.42.0 (2026-06-12) deprecated and moved all of gen_ai.*, v1.43.0 carries none, the content lives in open-telemetry/semantic-conventions-genai where NOTHING GenAI is Stable (all Development; only error.type/server.address/server.port are stable, and those are common attributes), while OpenTelemetryChatClient declares v1.37 — behind the split. Instrument anyway, but do not build an alert whose only identifier is a gen_ai.* name without a rename plan. Cost delegation is two-way: tariff, cost formula and budget ceiling live in ai-agents-cost-and-budget; span attributes stay here. The Gate 3 ruler for this property is evals/review-checklist.md.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08); `provado por templates/dotnet/ai-kit/src/Morph.AiKit/Observability/MorphOpenTelemetryExtensions.cs` — o guard de span duplicado, a regra de \"um nível, uma instrumentação\" e o default `EnableSensitiveData = false` são exatamente o que o kit compila, com os spans contados em `tests/Morph.AiKit.Tests/TelemetryTests.cs`. Nomes de símbolo, de span, de métrica e das duas `ActivitySource` foram **medidos por reflexão e por leitura dos literais das assemblies do pin** em 2026-09-08, e em 2026-09-09 **todos os treze nomes `gen_ai.*` desta página** foram remedidos, um a um, por **teste de exclusividade**: os quatro `SetTag` da seção *Enrichment* e os nove das seções de span, métrica e atributo de agente. **Os treze existem** — depois de uma correção: `gen_ai.response.finish_reason`, no **singular**, não existia, só aparecia como cabeça de `finish_reason`**s**, e sobreviveu a duas varreduras porque as duas usaram `includes` — e **`includes` de um prefixo não prova o literal autônomo**. Os treze estão tabelados, em **duas** tabelas com propósitos diferentes: a de *Enrichment* registra os **4** `SetTag` daquele bloco (mais os **cinco** nomes rejeitados: o `finish_reason` singular, `PromptTokens`, `CompletionTokens`, `prompt_tokens` e `completion_tokens`), e a de distribuição, na seção *Nomes de span, métricas e atributos — medidos*, registra os **13** por assembly. A conferência é reproduzível por `node scripts/api-probe/probe.mjs tags` sobre este arquivo. A **instabilidade da convenção** — o split do semconv **v1.42.0 (2026-06-12)**, que depreciou e moveu todo `gen_ai.*` para `open-telemetry/semantic-conventions-genai`, onde nada GenAI está `Stable`, contra a v1.37 que o `OpenTelemetryChatClient` declara implementar — é **verificação documental**, apurada em 2026-09-08.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Observability/MorphOpenTelemetryExtensions.cs"
-      ]
+      "digest": "Canonical treatment of OpenTelemetry for MAF agents: setup, enrichment, investigation. Two DIFFERENT ActivitySources must be registered — Experimental.Microsoft.Agents.AI (span invoke_agent) and Experimental.Microsoft.Extensions.AI (spans chat and execute_tool, metrics gen_ai.client.operation.duration and gen_ai.client.token.usage). AgentOpenTelemetryConsts and agent.WithOpenTelemetry() do NOT exist in 1.20.0; the API is builder.UseOpenTelemetry(sourceName, configure) and the sensitive-data switch is EnableSensitiveData (same name on OpenTelemetryAgent and OpenTelemetryChatClient). Duplication rule, measured: instrumenting the two LEVELS is normal and does not duplicate; instrumenting the same level twice does. With a custom pipeline (UseProvidedChatClientAsIs) the MAF guard does not reach it and chat instrumentation becomes mandatory. Issue 3637 (no GenAI ActivityEvents) is a known open limitation. TRACEABILITY (added 2026-09-08): the question the instrumentation exists to answer is whether the turn can be RECONSTRUCTED — raw prompt only in dev/harness with opt-in, HASH in production, and the invariant that makes the hash worth anything is that the text sent is derived from named blocks WITHOUT cache (a cache between assembly and send lets telemetry and request diverge in silence). Two closing assertions: the offered tool list came from the real turn list, and a CANCELLED turn writes nothing. CONVENTION STABILITY: the GenAI semantic conventions LEFT the main OpenTelemetry repo — semconv v1.42.0 (2026-06-12) deprecated and moved all of gen_ai.*, v1.43.0 carries none, the content lives in open-telemetry/semantic-conventions-genai where NOTHING GenAI is Stable (all Development; only error.type/server.address/server.port are stable, and those are common attributes), while OpenTelemetryChatClient declares v1.37 — behind the split. Instrument anyway, but do not build an alert whose only identifier is a gen_ai.* name without a rename plan. Cost delegation is two-way: tariff, cost formula and budget ceiling live in ai-agents-cost-and-budget; span attributes stay here. The Gate 3 ruler for this property is evals/review-checklist.md."
     },
     {
       "id": "ai-agents-production",
@@ -884,28 +553,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "agent middleware",
-        "production agent",
-        "a2a protocol",
-        "mcp integration",
-        "agent observability",
-        "agent telemetry",
-        "anti-hallucination",
-        "semantic caching",
-        "multi-tenant isolation",
-        "AgentIsolationKeyProvider",
-        "concurrent tool invocation"
-      ],
       "anchors": {
         "middleware": "#middleware-pipeline",
         "a2a": "#a2a-protocol-agent-to-agent",
         "mcp": "#mcp-integration-model-context-protocol",
         "observability": "#observability--opentelemetry"
       },
-      "digest": "Production panorama for MAF agents. Middleware, MCP integration and observability are summarized here and treated canonically in ai-agents-middleware-patterns / ai-agents-mcp-tools / ai-agents-mcp-server / ai-agents-observability-patterns. Owns: A2A protocol via Microsoft.Agents.AI.A2A (PRERELEASE, not GA — corrected 2026-09-08); Redis semantic + HybridCache caching; multi-tenant isolation renamed in 1.18 to AgentIsolationKeyProvider / IsolationKeyScopedAgentSessionStore / UseClaimsBasedAgentIsolation, all in the prerelease Microsoft.Agents.AI.Hosting, with the isolation key coming from the credential and never from the payload; concurrent tool invocation is opt-in (AllowConcurrentInvocation defaults to false) and is unsafe with a scoped DbContext. Security and production checklists.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 (ai-pin 2026-09-08) + Microsoft.Agents.AI.Hosting `1.20.0-preview.260831.1` e Microsoft.Agents.AI.A2A `1.20.0-preview.260831.1` (**fora do pin**; versões apuradas no nuget.org em 2026-09-08). **Verificação documental**, sem cláusula `provado por` — este standard é panorama, e cada tema tem dono canônico noutro standard. Os nomes de isolamento multi-tenant foram **medidos por reflexão sobre `Microsoft.Agents.AI.Hosting`** em 2026-09-08.",
-      "provedBy": []
+      "digest": "Production panorama for MAF agents. Middleware, MCP integration and observability are summarized here and treated canonically in ai-agents-middleware-patterns / ai-agents-mcp-tools / ai-agents-mcp-server / ai-agents-observability-patterns. Owns: A2A protocol via Microsoft.Agents.AI.A2A (PRERELEASE, not GA — corrected 2026-09-08); Redis semantic + HybridCache caching; multi-tenant isolation renamed in 1.18 to AgentIsolationKeyProvider / IsolationKeyScopedAgentSessionStore / UseClaimsBasedAgentIsolation, all in the prerelease Microsoft.Agents.AI.Hosting, with the isolation key coming from the credential and never from the payload; concurrent tool invocation is opt-in (AllowConcurrentInvocation defaults to false) and is unsafe with a scoped DbContext. Security and production checklists."
     },
     {
       "id": "ai-agents-prompt-sources",
@@ -921,18 +575,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "prompts in db",
-        "agent prompts",
-        "prompt versioning",
-        "prompt hot-reload",
-        "editable instructions",
-        "prompt management",
-        "prompt sources",
-        "prompt por tenant",
-        "spec publicado",
-        "reconciliação de prompt"
-      ],
       "anchors": {
         "pattern": "#o-pattern",
         "schema": "#schema-da-tabela",
@@ -941,9 +583,7 @@
         "tenant": "#fonte-2-yaml-por-tenant",
         "reconciliacao": "#reconciliação"
       },
-      "digest": "WHERE an agent prompt lives, and how to prove which version actually ran. Two legitimate sources, and the one-sentence rule that picks between them: if the text varies per customer, the prompt is not a record — it is the OUTPUT OF A COMPOSITION, and what you version is the source. (1) Versioned table agent_prompts (id app-assigned with Guid.CreateVersion7(), no gen_random_uuid() default; agent_key + version + is_active, INSERT + flip in one transaction, never UPDATE, unique partial index, IMemoryCache with a short TTL) for single-tenant. (2) Repo YAML per tenant + a product frame with named holes -> a deterministic composer -> a rendered spec published to a jsonb column, for product x tenant; editing prompts then costs a repo cycle, which is a product trade-off, not a free upgrade. RECONCILIATION is the section that was missing: versioning and publishing do NOT prove the active version ran (measured: v7/v8 ignored in 6 of 9 executions). The execution record must carry the EFFECTIVE version, plus the hash of the rendered blob on the composed path; the two field-proven techniques are byte-identity equivalence between source and published blob, and a single structural prompt-as-text test asserting the ABSENCE of a revoked instruction.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08). **Verificação documental**, sem cláusula `provado por` — o ai-kit não traz loader de prompt, e os dois mecanismos descritos aqui são destilados de três produtos em produção. As **quatro** superfícies de API que este standard cita foram medidas por reflexão, e vivem em **três assemblies diferentes** — o carimbo diz onde remedir, então o nome importa: `IChatClient.AsAIAgent(instructions:, name:)` é `Microsoft.Extensions.AI.ChatClientExtensions`, em **`Microsoft.Agents.AI` 1.20.0** (medida em 2026-09-08); `AIAgent.RunAsync` (as oito sobrecargas) e `AIAgent.CreateSessionAsync` são de `Microsoft.Agents.AI.AIAgent`, na assembly **`Microsoft.Agents.AI.Abstractions` 1.20.0** — **remedidas** em 2026-09-09, porque a leitura de 2026-09-08 estava errada no *quê*, e a de 2026-09-09 estava errada no *onde* (as duas retificações estão no callout abaixo); e `builder.AddAIAgent` (§Keyed singleton) é `Microsoft.Agents.AI.Hosting.HostApplicationBuilderAgentExtensions` — cinco sobrecargas, na assembly **`Microsoft.Agents.AI.Hosting` 1.20.0.0**, que vem do pacote **`Microsoft.Agents.AI.Hosting` `1.20.0-preview.260831.1`**: ele é **prerelease** e está **FORA do `ai-pin.json`** (apurado em `scripts/api-probe/companions.json`, 2026-09-08) — quem adotar esta seção registra a dependência prerelease em `decisions.md`, como manda `ai-agents-production`. **Duas ressalvas de escopo**, porque um carimbo que não as diz promete mais do que mediu: `Microsoft.Agents.AI.Abstractions` e `Microsoft.Extensions.AI.Abstractions` são nomes de **assembly** (elas viajam dentro dos pacotes `Microsoft.Agents.AI` e `Microsoft.Extensions.AI`), não ids de pacote; e `IMemoryCache`/`DbContext`, usados no padrão de cache e na §Keyed singleton, são superfícies de ASP.NET Core e EF Core — **fora do pin, não medidas aqui, verificação documental**.",
-      "provedBy": []
+      "digest": "WHERE an agent prompt lives, and how to prove which version actually ran. Two legitimate sources, and the one-sentence rule that picks between them: if the text varies per customer, the prompt is not a record — it is the OUTPUT OF A COMPOSITION, and what you version is the source. (1) Versioned table agent_prompts (id app-assigned with Guid.CreateVersion7(), no gen_random_uuid() default; agent_key + version + is_active, INSERT + flip in one transaction, never UPDATE, unique partial index, IMemoryCache with a short TTL) for single-tenant. (2) Repo YAML per tenant + a product frame with named holes -> a deterministic composer -> a rendered spec published to a jsonb column, for product x tenant; editing prompts then costs a repo cycle, which is a product trade-off, not a free upgrade. RECONCILIATION is the section that was missing: versioning and publishing do NOT prove the active version ran (measured: v7/v8 ignored in 6 of 9 executions). The execution record must carry the EFFECTIVE version, plus the hash of the rendered blob on the composed path; the two field-proven techniques are byte-identity equivalence between source and published blob, and a single structural prompt-as-text test asserting the ABSENCE of a revoked instruction."
     },
     {
       "id": "ai-agents-providers-model-registry",
@@ -960,36 +600,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "model registry",
-        "provider agnostic",
-        "model alias",
-        "IChatClient factory",
-        "multi-model",
-        "model selection",
-        "model config",
-        "switch provider",
-        "openai google anthropic ollama",
-        "direct model",
-        "api per alias",
-        "responses vs chat",
-        "reasoning effort",
-        "temperature vs reasoning",
-        "model pricing"
-      ],
       "anchors": {
         "schema": "#schema-canonical",
         "providers": "#providers-first-class",
         "implementation": "#implementation-pattern",
         "checklist": "#checklist-verifiable-in-review"
       },
-      "digest": "Single JSON file (model-registry.json v2) maps aliases to { provider, model, api, options, constraints }. Agents reference aliases, never model strings. EVERY alias declares `api`: `responses` (default when omitted) or `chat` (explicit opt-in); Ollama/OpenAI-compatible providers ignore the field but never travel the Responses path. `temperature` and `reasoningEffort` are mutually exclusive per alias, with the two origins labelled separately: the documented one (Chat Completions rejects tool calling with reasoning_effort != none from GPT-5.4) and the field-measured one (temperature on reasoning models — no primary source, so it is a per-alias constraint with mandatory provenance). .NET path: ChatOptions.Reasoning = new ReasoningOptions { Effort = ReasoningEffort.* } is CONFIRMED in M.E.AI 10.9.0; RawRepresentationFactory is the escape hatch for values the enum lacks. OPENAI001 still applies to the Responses types. No floating PackageReference ranges.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 + OpenAI 2.13.0 (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/src/Morph.AiKit/Providers/ModelRegistry.cs` e `.../Providers/ModelAlias.cs` e `.../Agents/AgentApi.cs`. Nomes de tipo do `Microsoft.Extensions.AI` e do `OpenAI` medidos por reflexão sobre as assemblies do pin em 2026-09-08.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Providers/ModelRegistry.cs",
-        ".../Providers/ModelAlias.cs",
-        ".../Agents/AgentApi.cs"
-      ]
+      "digest": "Single JSON file (model-registry.json v2) maps aliases to { provider, model, api, options, constraints }. Agents reference aliases, never model strings. EVERY alias declares `api`: `responses` (default when omitted) or `chat` (explicit opt-in); Ollama/OpenAI-compatible providers ignore the field but never travel the Responses path. `temperature` and `reasoningEffort` are mutually exclusive per alias, with the two origins labelled separately: the documented one (Chat Completions rejects tool calling with reasoning_effort != none from GPT-5.4) and the field-measured one (temperature on reasoning models — no primary source, so it is a per-alias constraint with mandatory provenance). .NET path: ChatOptions.Reasoning = new ReasoningOptions { Effort = ReasoningEffort.* } is CONFIRMED in M.E.AI 10.9.0; RawRepresentationFactory is the escape hatch for values the enum lacks. OPENAI001 still applies to the Responses types. No floating PackageReference ranges."
     },
     {
       "id": "ai-agents-rag-custom-pgvector",
@@ -1006,31 +623,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "rag",
-        "vector search",
-        "pgvector",
-        "embeddings",
-        "custom rag",
-        "retrieval",
-        "semantic search",
-        "knowledge base",
-        "RAG tool",
-        "delta ingestion",
-        "incremental ingestion",
-        "lookup key",
-        "content hash"
-      ],
       "anchors": {
         "architecture": "#arquitetura",
         "tool": "#vectorsearchtool-tool-maf",
         "multi-tenant": "#multi-tenant"
       },
-      "digest": "Custom RAG on pgvector/Neon you control: chunking, embedding model via the Model Registry `embeddings` alias with `IEmbeddingGenerator<string, Embedding<float>>` injected directly into the ingestion handler and the VectorSearchTool (no EmbeddingService wrapper; batch GenerateAsync at ingestion, GenerateVectorAsync per query), the tool querying through EF Core (`CosineDistance` LINQ, raw NpgsqlDataSource only with a decisions.md reason), ids app-assigned (deterministic V5 for delta chunks, else Guid.CreateVersion7(); no gen_random_uuid() default), HNSW with vector_cosine_ops, tenant_id filtered in every query and never exposed to the LLM. Owns DELTA INGESTION by lookup-key: a pure Plan(incoming, lookupKey, contentHash, existingHashes) returning Added/Updated/Removed/Unchanged, where Unchanged is never re-embedded, Updated is an upsert on a deterministic id, Removed is applied AFTER the writes (no empty window), and a duplicate lookup-key fails the run naming both positions. Microsoft.Extensions.DataIngestion (still preview) solves hygiene, not embedding cost — its IncrementalIngestion deletes all pre-existing chunks of a document before rewriting. Open item: similarity threshold and k per scope.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08); `provado por templates/dotnet/ai-kit/src/Morph.AiKit/Rag/DeltaIngest.cs` **restrito à seção \"Ingestão delta por lookup-key\"** — é a única parte deste standard que o ai-kit compila. Todo o resto (pgvector, SQL, HNSW, embeddings, multi-tenant) é **verificação documental**; a versão e o status de `Microsoft.Extensions.DataIngestion` foram apurados no nuget.org em 2026-09-08. Em 2026-10-03, contra o mesmo pin, compilaram com `TreatWarningsAsErrors` os blocos de registro do `IEmbeddingGenerator`, do `VectorSearchTool` (EF Core + Pgvector.EntityFrameworkCore 0.3.0) e do *Exemplo de uso* (a ponte `Microsoft.Extensions.AI.OpenAI` 10.9.0 resolveu `OpenAI` 2.12.0); a forma anterior `RunAsync(question, ct)` não compilava (CS1503).",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Rag/DeltaIngest.cs"
-      ]
+      "digest": "Custom RAG on pgvector/Neon you control: chunking, embedding model via the Model Registry `embeddings` alias with `IEmbeddingGenerator<string, Embedding<float>>` injected directly into the ingestion handler and the VectorSearchTool (no EmbeddingService wrapper; batch GenerateAsync at ingestion, GenerateVectorAsync per query), the tool querying through EF Core (`CosineDistance` LINQ, raw NpgsqlDataSource only with a plan.md (## Decisões) reason), ids app-assigned (deterministic V5 for delta chunks, else Guid.CreateVersion7(); no gen_random_uuid() default), HNSW with vector_cosine_ops, tenant_id filtered in every query and never exposed to the LLM. Owns DELTA INGESTION by lookup-key: a pure Plan(incoming, lookupKey, contentHash, existingHashes) returning Added/Updated/Removed/Unchanged, where Unchanged is never re-embedded, Updated is an upsert on a deterministic id, Removed is applied AFTER the writes (no empty window), and a duplicate lookup-key fails the run naming both positions. Microsoft.Extensions.DataIngestion (still preview) solves hygiene, not embedding cost — its IncrementalIngestion deletes all pre-existing chunks of a document before rewriting. Open item: similarity threshold and k per scope."
     },
     {
       "id": "ai-agents-service-tier-flex",
@@ -1047,25 +645,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "service tier",
-        "flex tier",
-        "cost optimization",
-        "async tier",
-        "priority tier",
-        "tier flex",
-        "background inference",
-        "ChatServiceTier"
-      ],
       "anchors": {
         "when": "#quando-usar-tier-flex",
         "api": "#a-api",
         "example": "#exemplo-c",
         "decision": "#decision"
       },
-      "digest": "Service tier trades latency for cost on async work (workers, Hangfire, nightly reports) — if the result goes to a database or a queue, use flex. OpenAI-specific: Microsoft.Extensions.AI.ChatOptions has no service-tier property (measured), so it goes through the concrete client or AdditionalProperties + RawRepresentationFactory. Measured in OpenAI 2.13.0: the property is ChatCompletionOptions.ServiceTier of type ChatServiceTier? (and CreateResponseOptions.ServiceTier of ResponseServiceTier?), with values Auto/Default/Flex/Scale — it is NOT a string, and there is no `priority` value. Never use flex on an interactive completion.",
-      "verifiedAgainst": "OpenAI 2.13.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08). **Verificação documental** da política de tiers (platform.openai.com/docs/guides/service-tiers, lido 2026-09-08), sem cláusula `provado por`: o ai-kit **referencia** o pacote `OpenAI` no `.csproj` — contrato de versão, régua = restore (`NU1102`) — mas **não o exercita**; não existe um único `using OpenAI` em `src/` (medido 2026-09-08), logo um rename de API não reprova a PR. Ver a tabela \"Dois níveis de garantia\" no README do kit. **O nome e o tipo da propriedade C# foram medidos por reflexão sobre a assembly `OpenAI` 2.13.0 em 2026-09-08**, e o marcador `// VERIFY` desta página foi RESOLVIDO por essa medição.",
-      "provedBy": []
+      "digest": "Service tier trades latency for cost on async work (workers, Hangfire, nightly reports) — if the result goes to a database or a queue, use flex. OpenAI-specific: Microsoft.Extensions.AI.ChatOptions has no service-tier property (measured), so it goes through the concrete client or AdditionalProperties + RawRepresentationFactory. Measured in OpenAI 2.13.0: the property is ChatCompletionOptions.ServiceTier of type ChatServiceTier? (and CreateResponseOptions.ServiceTier of ResponseServiceTier?), with values Auto/Default/Flex/Scale — it is NOT a string, and there is no `priority` value. Never use flex on an interactive completion."
     },
     {
       "id": "ai-agents-setup",
@@ -1079,31 +665,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "MAF setup",
-        "Microsoft Agents AI",
-        "ChatClient",
-        "AsAIAgent",
-        "AIAgent dotnet",
-        "agent framework setup",
-        "MAF packages",
-        "MAF nuget",
-        "responses api",
-        "GetResponsesClient",
-        "store false",
-        "chat completions"
-      ],
       "anchors": {
         "packages": "#1-packages-nuget",
         "quickstart": "#2-quick-start-canonical-minimal-agent",
         "providers": "#3-setup-by-provider",
         "telemetry": "#5-opentelemetry"
       },
-      "digest": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 + OpenAI 2.13.0, exact versions, no floating ranges. For OpenAI the DEFAULT path is the Responses API: new OpenAIClient(key).GetResponsesClient().AsAIAgent(model:, instructions:) — Chat Completions stays legitimate but is an explicit opt-in (`\"api\": \"chat\"` on the alias). `store: false` is the house rule (AsIChatClientWithStoredOutputDisabled) because the project owns its own conversation history. AsIChatClient comes from Microsoft.Extensions.AI.OpenAI; AsAIAgent from Microsoft.Agents.AI.OpenAI. Telemetry needs BOTH ActivitySources (Experimental.Microsoft.Agents.AI and Experimental.Microsoft.Extensions.AI) — AgentOpenTelemetryConsts does not exist. Do NOT use Semantic Kernel orchestration.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 + OpenAI 2.13.0 (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/src/Morph.AiKit/Agents/AgentFactory.cs` (pipeline e escolha de protocolo). A superfície do SDK `OpenAI` e das pontes `Microsoft.Agents.AI.OpenAI` / `Microsoft.Extensions.AI.OpenAI` foi **medida por reflexão sobre as assemblies do pin** em 2026-09-08 — o ai-kit **não exercita** o cliente concreto da OpenAI — referencia o pacote no `.csproj`, mas não há `using OpenAI` em `src/` (medido 2026-09-08); ver a tabela \"Dois níveis de garantia\" no README do kit.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Agents/AgentFactory.cs"
-      ]
+      "digest": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 + OpenAI 2.13.0, exact versions, no floating ranges. For OpenAI the DEFAULT path is the Responses API: new OpenAIClient(key).GetResponsesClient().AsAIAgent(model:, instructions:) — Chat Completions stays legitimate but is an explicit opt-in (`\"api\": \"chat\"` on the alias). `store: false` is the house rule (AsIChatClientWithStoredOutputDisabled) because the project owns its own conversation history. AsIChatClient comes from Microsoft.Extensions.AI.OpenAI; AsAIAgent from Microsoft.Agents.AI.OpenAI. Telemetry needs BOTH ActivitySources (Experimental.Microsoft.Agents.AI and Experimental.Microsoft.Extensions.AI) — AgentOpenTelemetryConsts does not exist. Do NOT use Semantic Kernel orchestration."
     },
     {
       "id": "ai-agents-structured-output",
@@ -1119,28 +687,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "structured output",
-        "typed response",
-        "response format",
-        "schema validated output",
-        "record output",
-        "JSON schema agent",
-        "RunAsync generic",
-        "typed agent output",
-        "ToAgentResponseAsync",
-        "response format limits"
-      ],
       "anchors": {
         "api": "#a-api-maf-10-ga",
         "type": "#definindo-o-tipo-de-saída",
         "validation": "#validação-pós-call"
       },
-      "digest": "Every agent whose output feeds another system returns a typed record, never free text. Form 1 is RunAsync<T>; Form 2 is ResponseFormat = ChatResponseFormat.ForJsonSchema<T>() in ChatOptions. Type is a sealed record with [Description] on the type and [JsonPropertyName] on every property. Documented limits: ResponseFormat does not accept a primitive or an array at the root (use a wrapper), and in streaming you must build the whole response with ToAgentResponseAsync() before deserialising. Schema validates shape, not semantics — always validate business rules after the call. Do not use temperature as the example of a normal ChatOption.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08); `provado por templates/dotnet/ai-kit/src/Morph.AiKit/Agents/AgentFactory.cs` **apenas** para o mapeamento de `AgentSpec.OutputSchema` → `ChatOptions.ResponseFormat = ChatResponseFormat.ForJsonSchema(...)`, que é o que o kit compila. `RunAsync<T>`, `Deserialize<T>` e os limites do `ResponseFormat` são **verificação documental**, com os nomes de tipo medidos por reflexão sobre `Microsoft.Extensions.AI.Abstractions` 10.9.0 em 2026-09-08.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/src/Morph.AiKit/Agents/AgentFactory.cs"
-      ]
+      "digest": "Every agent whose output feeds another system returns a typed record, never free text. Form 1 is RunAsync<T>; Form 2 is ResponseFormat = ChatResponseFormat.ForJsonSchema<T>() in ChatOptions. Type is a sealed record with [Description] on the type and [JsonPropertyName] on every property. Documented limits: ResponseFormat does not accept a primitive or an array at the root (use a wrapper), and in streaming you must build the whole response with ToAgentResponseAsync() before deserialising. Schema validates shape, not semantics — always validate business rules after the call. Do not use temperature as the example of a normal ChatOption."
     },
     {
       "id": "ai-agents-sweet-spot",
@@ -1156,26 +708,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "sweet spot",
-        "when to use agent",
-        "agent vs workflow",
-        "when not to use workflow",
-        "MAF decision",
-        "simple agent default",
-        "4 feature rule",
-        "single agent default",
-        "tool budget",
-        "how many tools"
-      ],
       "anchors": {
         "rule": "#the-4-feature-rule",
         "decision-tree": "#decision-tree-claude-reads-this-in-plan-phase",
         "anti-patterns": "#anti-patterns-what-claude-should-not-do"
       },
-      "digest": "The 4-feature rule (Chat + Structured Output + Tools + RAG Custom) covers 95% of agents. Single-agent is the default; reach for multi-agent or workflow only when fan-in/out or genuine handoff is needed. Fifth signal: HOW MANY tools the agent carries — every registered tool re-sends its name, description and JSON Schema on every turn, so the practical ceiling is ~12 tools; above it prune, then use a per-phase allow-list, then agent-as-tool. Handoff has graduated out of experimental in 1.20.0, which changes the reason but not the order of preference. Read in plan phase before deciding architecture.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 + Microsoft.Agents.AI.Workflows 1.20.0 (ai-pin 2026-09-08 para o primeiro; o segundo está **fora do pin**, versão apurada no nuget.org em 2026-09-08). **Verificação documental**, sem cláusula `provado por` — este standard é decisão de arquitetura, não API. A escada de complexidade foi reconferida e **continua correta**; o que entrou de novo é o custo de definição de tool por turno e o status do Handoff.",
-      "provedBy": []
+      "digest": "The 4-feature rule (Chat + Structured Output + Tools + RAG Custom) covers 95% of agents. Single-agent is the default; reach for multi-agent or workflow only when fan-in/out or genuine handoff is needed. Fifth signal: HOW MANY tools the agent carries — every registered tool re-sends its name, description and JSON Schema on every turn, so the practical ceiling is ~12 tools; above it prune, then use a per-phase allow-list, then agent-as-tool. Handoff has graduated out of experimental in 1.20.0, which changes the reason but not the order of preference. Read in plan phase before deciding architecture."
     },
     {
       "id": "ai-agents-testing-ai",
@@ -1192,15 +730,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "testar agente",
-        "fake IChatClient",
-        "ScriptedChatClient",
-        "harness de turno",
-        "eval de agente",
-        "teste sem rede",
-        "golden de prompt"
-      ],
       "anchors": {
         "fronteira": "#fronteira-com-o-testing-genérico",
         "fake": "#fake-de-ichatclient",
@@ -1210,12 +739,7 @@
         "golden": "#golden-com-parcimônia",
         "checklist": "#checklist-verifiable-in-review"
       },
-      "digest": "Only what is agent-specific — backend-dotnet-testing keeps xUnit, FakeTimeProvider and isolation. The single point where code touches a provider is an IChatClient, so everything follows from replacing it: a SCRIPTED and DUMB fake (a queue of hand-written responses, capture of messages/options/call count) that THROWS when the queue runs out — a silent empty response makes a test pass by accident. Two independent products converged on this shape; the kit compiles the third. Run the REAL function-invocation loop on top of the fake: tool choice, arguments, guard and ceiling are only observable through the loop. The seam keeps classes sealed (a one-operation interface, or an internal constructor taking alias -> IChatClient). ZERO real provider calls inside dotnet test, verified by a sweep of tests/ for API keys, environment reads and HTTP clients — and the standard records the price of leaving the real harness outside the suite: 11 scenarios that were never run end to end. Eval means DETERMINISTIC eval over the full real path with the model scripted; a hard gate only over deterministic properties. Raw prompt only in dev/harness with opt-in, hash in production. Golden proves FORM, not content (counter-example: 13.6 KB frozen to prove two lines of concatenation, deliberately deleted). A versioned prompt gets AT MOST ONE structural test (keys the consumer reads, absence of a revoked instruction); what the model answers is proven at runtime by evals-with-cache, never by Contains over the prompt source.",
-      "verifiedAgainst": "Microsoft.Extensions.AI 10.9.0 + Microsoft.Agents.AI 1.20.0 (ai-pin 2026-09-08); provado por `templates/dotnet/ai-kit/tests/Morph.AiKit.Tests/Fakes/FakeChatClient.cs` e `.../src/Morph.AiKit/Providers/IProviderClientFactory.cs` — o fake roteirizado e a costura que dispensa rede são o que o kit compila e exercita. Harness de turno completo e evals com cache de resposta são **verificação documental** — o ai-kit não os traz.",
-      "provedBy": [
-        "templates/dotnet/ai-kit/tests/Morph.AiKit.Tests/Fakes/FakeChatClient.cs",
-        ".../src/Morph.AiKit/Providers/IProviderClientFactory.cs"
-      ]
+      "digest": "Only what is agent-specific — backend-dotnet-testing keeps xUnit, FakeTimeProvider and isolation. The single point where code touches a provider is an IChatClient, so everything follows from replacing it: a SCRIPTED and DUMB fake (a queue of hand-written responses, capture of messages/options/call count) that THROWS when the queue runs out — a silent empty response makes a test pass by accident. Two independent products converged on this shape; the kit compiles the third. Run the REAL function-invocation loop on top of the fake: tool choice, arguments, guard and ceiling are only observable through the loop. The seam keeps classes sealed (a one-operation interface, or an internal constructor taking alias -> IChatClient). ZERO real provider calls inside dotnet test, verified by a sweep of tests/ for API keys, environment reads and HTTP clients — and the standard records the price of leaving the real harness outside the suite: 11 scenarios that were never run end to end. Eval means DETERMINISTIC eval over the full real path with the model scripted; a hard gate only over deterministic properties. Raw prompt only in dev/harness with opt-in, hash in production. Golden proves FORM, not content (counter-example: 13.6 KB frozen to prove two lines of concatenation, deliberately deleted). A versioned prompt gets AT MOST ONE structural test (keys the consumer reads, absence of a revoked instruction); what the model answers is proven at runtime by evals-with-cache, never by Contains over the prompt source."
     },
     {
       "id": "ai-agents-vector-data-extensions",
@@ -1232,27 +756,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "microsoft extensions vectordata",
-        "vectorstorecollection",
-        "vector store abstraction",
-        "data ingestion",
-        "ingestion pipeline",
-        "semantic kernel connectors exception",
-        "pgvector connector",
-        "vectorstorewriter",
-        "CommunityToolkit VectorData",
-        "connector rename"
-      ],
       "anchors": {
         "naming-trap": "#a-pegadinha-de-nomenclatura-crítico--leia-antes-de-tudo",
         "maturity": "#maturidade-atual-verificado-2026-07-06",
         "decision-matrix": "#decision-matrix--custom-pgvector-vs-vectordata",
         "data-ingestion": "#microsoftextensionsdataingestion-preview--pipeline-pattern-para-adoção-futura"
       },
-      "digest": "Microsoft.Extensions.VectorData.Abstractions (10.9.0, GA) is the provider-agnostic vector-store abstraction. The concrete connectors MOVED: the Microsoft.SemanticKernel.Connectors.* names are a dead end (PgVector stopped at 1.74.0-preview, 2026-03-20, never stable) and the successor is CommunityToolkit.VectorData.* (PgVector 1.0.1, stable, 2026-08-31). The old naming trap — SK-named packages carrying zero SK orchestration — still matters for legacy projects. Microsoft.Extensions.DataIngestion remains preview. Decision matrix: keep ai-agents-rag-custom-pgvector where it already works (the \"it is preview\" argument has expired; \"do not rewrite what works\" has not); reach for VectorData on new projects or genuine multi-backend portability.",
-      "verifiedAgainst": "Microsoft.Extensions.VectorData.Abstractions **10.9.0** + CommunityToolkit.VectorData.PgVector **1.0.1** + Microsoft.Extensions.DataIngestion **10.9.0-preview.1.26411.16** — nenhum deles está no `framework/ai-pin.json` (que cobre os 5 pacotes de agente), portanto **todas as versões acima foram apuradas na API do nuget.org em 2026-09-08** e são citadas com essa data, não como pin. **Verificação documental**, sem cláusula `provado por`: o ai-kit **não referencia nem exercita** VectorData — o pacote não está no `Morph.AiKit.csproj`, cujos cinco `PackageReference` são exatamente os do pin (medido 2026-09-08). Aqui nem a régua fraca do restore existe.",
-      "provedBy": []
+      "digest": "Microsoft.Extensions.VectorData.Abstractions (10.9.0, GA) is the provider-agnostic vector-store abstraction. The concrete connectors MOVED: the Microsoft.SemanticKernel.Connectors.* names are a dead end (PgVector stopped at 1.74.0-preview, 2026-03-20, never stable) and the successor is CommunityToolkit.VectorData.* (PgVector 1.0.1, stable, 2026-08-31). The old naming trap — SK-named packages carrying zero SK orchestration — still matters for legacy projects. Microsoft.Extensions.DataIngestion remains preview. Decision matrix: keep ai-agents-rag-custom-pgvector where it already works (the \"it is preview\" argument has expired; \"do not rewrite what works\" has not); reach for VectorData on new projects or genuine multi-backend portability."
     },
     {
       "id": "ai-agents-workflows",
@@ -1266,26 +776,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "workflow",
-        "agent workflow",
-        "fan-in",
-        "fan-out",
-        "when not to use workflow",
-        "orchestration",
-        "AgentWorkflowBuilder",
-        "concurrent workflow",
-        "Microsoft.Agents.AI.Workflows",
-        "declarative workflow"
-      ],
       "anchors": {
         "when-not": "#quando-não-usar-um-workflow",
         "when-justified": "#quando-um-workflow-é-justificado",
         "canonical-example": "#exemplo-canônico--fan-in-concurrent"
       },
-      "digest": "Workflows are advanced and rare — 95% of agents need only a single agent (see ai-agents-sweet-spot). Reach for a Workflow ONLY for genuine fan-in/out over many inputs or long-running human-in-the-loop; a foreach + LINQ aggregate usually beats one. PACKAGE CORRECTION: AgentWorkflowBuilder, WorkflowBuilder, InProcessExecution and CheckpointManager are NOT in Microsoft.Agents.AI — they live in the SEPARATE package Microsoft.Agents.AI.Workflows (1.20.0, stable). Declarative workflows (Microsoft.Agents.AI.Workflows.Declarative 1.20.0) are stable; declarative AGENTS (Microsoft.Agents.AI.Declarative 1.20.0-rc1) still need --prerelease. Since 1.17 a workflow fails when a participating agent returns an error.",
-      "verifiedAgainst": "Microsoft.Agents.AI 1.20.0 (ai-pin 2026-09-08) + Microsoft.Agents.AI.Workflows 1.20.0, Microsoft.Agents.AI.Workflows.Declarative 1.20.0 e Microsoft.Agents.AI.Declarative `1.20.0-rc1` (**os três fora do pin**; versões apuradas no nuget.org em 2026-09-08). **Verificação documental**, sem cláusula `provado por` — o ai-kit não monta workflows. **A localização dos tipos de workflow foi medida por reflexão em 2026-09-08 e CORRIGE este standard**: eles não estão no pacote base.",
-      "provedBy": []
+      "digest": "Workflows are advanced and rare — 95% of agents need only a single agent (see ai-agents-sweet-spot). Reach for a Workflow ONLY for genuine fan-in/out over many inputs or long-running human-in-the-loop; a foreach + LINQ aggregate usually beats one. PACKAGE CORRECTION: AgentWorkflowBuilder, WorkflowBuilder, InProcessExecution and CheckpointManager are NOT in Microsoft.Agents.AI — they live in the SEPARATE package Microsoft.Agents.AI.Workflows (1.20.0, stable). Declarative workflows (Microsoft.Agents.AI.Workflows.Declarative 1.20.0) are stable; declarative AGENTS (Microsoft.Agents.AI.Declarative 1.20.0-rc1) still need --prerelease. Since 1.17 a workflow fails when a participating agent returns an error."
     },
     {
       "id": "architecture-vertical-slice-vertical-slice",
@@ -1300,21 +796,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "vertical slice",
-        "VSA",
-        "slice architecture",
-        "feature slice",
-        "CQRS slice"
-      ],
       "anchors": {
         "structure": "#estrutura-de-pastas",
         "rules": "#padrões-obrigatórios",
         "cqrs": "#anti-patterns-nunca-fazer-em-vsa"
       },
-      "digest": "Uma slice por operação em Features/{Entity}Feature/{Verb}{Entity}/: Request e Response (sealed records) no mesmo arquivo do Handler, Validator FluentValidation (nenhum em GetAll) e Endpoint `IApiEndpoint` `internal sealed`. O handler implementa o `IHandler<TRequest, TResponse>` próprio, devolve `Result<T>` (erros em `{Entity}Errors`, 1 por feature), injeta `ApplicationDbContext` direto e chama `SaveChangesAsync` nas escritas; IDs com `Guid.CreateVersion7()`, nunca `Guid.NewGuid()`; o endpoint usa `result.Match()`: o sucesso recebe o valor no lambda (nunca `result.Value`) e a falha vira `error.ToHttpResult()` (status pelo `ErrorType`, ProblemDetails), nunca `Results.BadRequest` para todo erro, declarando cada status com `.ProducesProblem`. Decorators Scrutor: Logging -> Validation -> Handler. PROIBIDO: MediatR/IRequest, AggregateRoot, DomainEvent, CQRS formal, Application Service layer, DTOs compartilhados entre features e `IRepository<T>`/`IUnitOfWork` (DbSet já é repository, vira código morto); store dedicado só com justificativa em `decisions.md`. Não misture VSA com DDD.",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview) + EF Core 10.0.12 + FluentValidation 12.1.1 + Scrutor 7. Os blocos da slice (Handler, Validator, Endpoint) compilam com `TreatWarningsAsErrors` sobre o `Result`/`Error`/`ErrorHttpMapping` de `result-pattern.md` nos namespaces da árvore acima (`{ProjectName}` substituído; o Handler com `global using` de Abstractions/Database/Entities, o Endpoint só com os próprios `using`); Abstractions, Pipelines e DI são verificação documental.",
-      "provedBy": []
+      "digest": "Uma slice por operação em Features/{Entity}Feature/{Verb}{Entity}/: Request e Response (sealed records) no mesmo arquivo do Handler, Validator FluentValidation (nenhum em GetAll) e Endpoint `IApiEndpoint` `internal sealed`. O handler implementa o `IHandler<TRequest, TResponse>` próprio, devolve `Result<T>` (erros em `{Entity}Errors`, 1 por feature), injeta `ApplicationDbContext` direto e chama `SaveChangesAsync` nas escritas; IDs com `Guid.CreateVersion7()`, nunca `Guid.NewGuid()`; o endpoint usa `result.Match()`: o sucesso recebe o valor no lambda (nunca `result.Value`) e a falha vira `error.ToHttpResult()` (status pelo `ErrorType`, ProblemDetails), nunca `Results.BadRequest` para todo erro, declarando cada status com `.ProducesProblem`. Decorators Scrutor: Logging -> Validation -> Handler. PROIBIDO: MediatR/IRequest, AggregateRoot, DomainEvent, CQRS formal, Application Service layer, DTOs compartilhados entre features e `IRepository<T>`/`IUnitOfWork` (DbSet já é repository, vira código morto); store dedicado só com justificativa em `plan.md` (`## Decisões`). Não misture VSA com DDD."
     },
     {
       "id": "backend-api-validation",
@@ -1329,21 +816,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "FluentValidation",
-        "input validation",
-        "request validation",
-        "API validation",
-        "model validation"
-      ],
       "anchors": {
         "fluent": "#fluentvalidation-validator-in-the-slice",
         "rules": "#validation-patterns",
         "state": "#state-checks-in-the-handler"
       },
-      "digest": "Request/DTO validation in the VSA slice: one sealed `AbstractValidator<TRequest>` (FluentValidation) next to the handler, checking SHAPE only (required, length, range, format, child items via RuleForEach/ChildRules; no DbContext; time rules read an injected TimeProvider inside the rule). The ValidationDecorator runs it before the handler and short-circuits with `Result.Failure(new ValidationError([...]))`; the endpoint maps it with `error.ToHttpResult()` to 400 ProblemDetails with `errors[]` (decorator and conversion in fluent-validation-vsa.md, ValidationError/ErrorHttpMapping in result-pattern.md). Never throw (ValidationException/InvalidOperationException), never validate in the endpoint lambda, never mix DataAnnotations with FluentValidation (minimal APIs have no ModelState). Existence/uniqueness/state checks live in the handler and return typed `{Entity}Errors` (NotFound 404, Conflict 409, Failure 400), never `Result.Failure(\"string\")`. State checks validate what is INVALID, not what is valid, so a new flow (e.g. a free flow that skips PendingPayment) does not break: ordered status enum (Created=0 ... EmailSent=4) with error states at 100+ (Failed=100, Cancelled=101, Refunded=102), blocked by `status >= Completed`, an error-state list, or `status >= Failed`. FORBIDDEN: `if (status != Expected)`, exhaustive switches over valid states, business rules mixed into the state check (keep `RequiresPayment && !IsPaid` separate). Document all flows in decisions.md and test each.",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview) + FluentValidation 12.1.1 + EF Core 10.0.12. The validator, `OrderStatus`, `OrderErrors` and state-check handler blocks compile with `TreatWarningsAsErrors` over the `Result`/`Error`/`ValidationError` of `result-pattern.md`.",
-      "provedBy": []
+      "digest": "Request/DTO validation in the VSA slice: one sealed `AbstractValidator<TRequest>` (FluentValidation) next to the handler, checking SHAPE only (required, length, range, format, child items via RuleForEach/ChildRules; no DbContext; time rules read an injected TimeProvider inside the rule). The ValidationDecorator runs it before the handler and short-circuits with `Result.Failure(new ValidationError([...]))`; the endpoint maps it with `error.ToHttpResult()` to 400 ProblemDetails with `errors[]` (decorator and conversion in fluent-validation-vsa.md, ValidationError/ErrorHttpMapping in result-pattern.md). Never throw (ValidationException/InvalidOperationException), never validate in the endpoint lambda, never mix DataAnnotations with FluentValidation (minimal APIs have no ModelState). Existence/uniqueness/state checks live in the handler and return typed `{Entity}Errors` (NotFound 404, Conflict 409, Failure 400), never `Result.Failure(\"string\")`. State checks validate what is INVALID, not what is valid, so a new flow (e.g. a free flow that skips PendingPayment) does not break: ordered status enum (Created=0 ... EmailSent=4) with error states at 100+ (Failed=100, Cancelled=101, Refunded=102), blocked by `status >= Completed`, an error-state list, or `status >= Failed`. FORBIDDEN: `if (status != Expected)`, exhaustive switches over valid states, business rules mixed into the state check (keep `RequiresPayment && !IsPaid` separate). Document all flows in plan.md (## Decisões) and test each."
     },
     {
       "id": "backend-database-postgresql-database",
@@ -1359,20 +837,11 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "PostgreSQL",
-        "postgres",
-        "pg",
-        "database design",
-        "SQL schema"
-      ],
       "anchors": {
         "schema": "#schema-design",
         "indexes": "#indexes"
       },
-      "digest": "Neon PostgreSQL schema rules: snake_case plural tables and snake_case columns, PK 'id uuid primary key' with NO column default -- the app sets it with Guid.CreateVersion7() (rows inserted outside the app pass an explicit id; never gen_random_uuid() defaults for app ids), FK '{table}_id', booleans prefixed is_/has_, indexes 'idx_{table}_{column}'. Always include created_at/updated_at as timestamptz default now() not null, kept fresh by a handle_updated_at trigger. Always enable RLS on user-facing tables, with policies like 'auth.user_id() = user_id' (update takes both using and with check). Migrations via EF Core: dotnet ef migrations add, database update, and migrations script --idempotent to review the SQL; hand-written SQL migrations enable RLS, create indexes and always include a rollback. Index FKs and WHERE/ORDER BY/GROUP BY columns; GIN for full-text search. Select only needed columns, limit results, batch inserts, set a statement timeout, keep RLS policies simple. The Next.js frontend reads through the .NET API (proxy + TanStack Query); @neondatabase/serverless is only for Node-side tooling.",
-      "verifiedAgainst": "PostgreSQL 16/17 + EF Core 10.0.12 (Npgsql provider 10.0.3) + @neondatabase/serverless. The EF Core query blocks compile with `TreatWarningsAsErrors` inside a wrapper method over stand-in entities; the SQL is documentary.",
-      "provedBy": []
+      "digest": "Neon PostgreSQL schema rules: snake_case plural tables and snake_case columns, PK 'id uuid primary key' with NO column default -- the app sets it with Guid.CreateVersion7() (rows inserted outside the app pass an explicit id; never gen_random_uuid() defaults for app ids), FK '{table}_id', booleans prefixed is_/has_, indexes 'idx_{table}_{column}'. Always include created_at/updated_at as timestamptz default now() not null, kept fresh by a handle_updated_at trigger. Always enable RLS on user-facing tables, with policies like 'auth.user_id() = user_id' (update takes both using and with check). Migrations via EF Core: dotnet ef migrations add, database update, and migrations script --idempotent to review the SQL; hand-written SQL migrations enable RLS, create indexes and always include a rollback. Index FKs and WHERE/ORDER BY/GROUP BY columns; GIN for full-text search. Select only needed columns, limit results, batch inserts, set a statement timeout, keep RLS policies simple. The Next.js frontend reads through the .NET API (proxy + TanStack Query); @neondatabase/serverless is only for Node-side tooling."
     },
     {
       "id": "backend-database-vector-search-rag",
@@ -1389,20 +858,11 @@
         "nextjs",
         "neon"
       ],
-      "aliases": [
-        "vector search",
-        "RAG",
-        "embeddings",
-        "pgvector",
-        "semantic search"
-      ],
       "anchors": {
         "chunking": "#📥-indexação-de-documentos",
         "retrieval": "#🔍-vector-search-com-ef-core-10"
       },
-      "digest": "Pipeline RAG em slices VSA sobre EF Core 10 + PostgreSQL/pgvector (Npgsql.EntityFrameworkCore.PostgreSQL 10.0.3, Pgvector.EntityFrameworkCore 0.3.0; Microsoft.Extensions.AI 10.9.0 e Microsoft.Agents.AI 1.20.0 do pin). Mapeamento (Document com `Pgvector.Vector` `vector(1536)`, EF não mapeia `float[]`; `UseVector()` no `UseNpgsql`; HNSW `vector_cosine_ops`) vem de neon-pgvector.md. Cada operação é um handler que injeta `ApplicationDbContext` e `IEmbeddingGenerator<string, Embedding<float>>` direto — sem EmbeddingService/SearchService; ids `Guid.CreateVersion7()`, `CreatedAt` do `TimeProvider`. Busca: `d.Embedding!.CosineDistance(query)` + OrderBy da distância (traduz para `<=>` ASC e usa o índice; o `HasOperators` tem de casar com a função ou cai em seq scan), similaridade = 1 - distância. Slice AskDocuments: top 3 por distância, `NotFound` (Result) antes de chamar o LLM quando nada é relevante, contexto no `instructions` de `chatClient.AsAIAgent(...)`, `RunAsync(...).Text`; prompt manda usar APENAS os documentos e citar o id; endpoint via `error.ToHttpResult()`. Indexação em lote com uma chamada `GenerateAsync(IEnumerable<string>)` e um SaveChanges; job Hangfire só com razão real, como entrada fina que chama o handler. text-embedding-3-small (1536) recomendado, large 3072; HNSW (m=16, ef_construction=64) padrão; IVFFlat só após popular (lists 50/100/500+).",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview) + Npgsql.EntityFrameworkCore.PostgreSQL 10.0.3 + Pgvector.EntityFrameworkCore 0.3.0 + Microsoft.Extensions.AI 10.9.0 + Microsoft.Agents.AI 1.20.0 (ai-pin 2026-09-08). Os blocos de indexação, indexação em lote, busca+geração (RAG), endpoint e job compilam com `TreatWarningsAsErrors` sobre o `Result`/`IHandler`/`ErrorHttpMapping` de `result-pattern.md`/`vertical-slice.md` e o `Document`/`ApplicationDbContext` de `neon-pgvector.md`; o registro do `IEmbeddingGenerator` por provedor, os custos e o SQL são verificação documental.",
-      "provedBy": []
+      "digest": "Pipeline RAG em slices VSA sobre EF Core 10 + PostgreSQL/pgvector (Npgsql.EntityFrameworkCore.PostgreSQL 10.0.3, Pgvector.EntityFrameworkCore 0.3.0; Microsoft.Extensions.AI 10.9.0 e Microsoft.Agents.AI 1.20.0 do pin). Mapeamento (Document com `Pgvector.Vector` `vector(1536)`, EF não mapeia `float[]`; `UseVector()` no `UseNpgsql`; HNSW `vector_cosine_ops`) vem de neon-pgvector.md. Cada operação é um handler que injeta `ApplicationDbContext` e `IEmbeddingGenerator<string, Embedding<float>>` direto — sem EmbeddingService/SearchService; ids `Guid.CreateVersion7()`, `CreatedAt` do `TimeProvider`. Busca: `d.Embedding!.CosineDistance(query)` + OrderBy da distância (traduz para `<=>` ASC e usa o índice; o `HasOperators` tem de casar com a função ou cai em seq scan), similaridade = 1 - distância. Slice AskDocuments: top 3 por distância, `NotFound` (Result) antes de chamar o LLM quando nada é relevante, contexto no `instructions` de `chatClient.AsAIAgent(...)`, `RunAsync(...).Text`; prompt manda usar APENAS os documentos e citar o id; endpoint via `error.ToHttpResult()`. Indexação em lote com uma chamada `GenerateAsync(IEnumerable<string>)` e um SaveChanges; job Hangfire só com razão real, como entrada fina que chama o handler. text-embedding-3-small (1536) recomendado, large 3072; HNSW (m=16, ef_construction=64) padrão; IVFFlat só após popular (lists 50/100/500+)."
     },
     {
       "id": "backend-dotnet-fluent-validation-vsa",
@@ -1418,21 +878,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "FluentValidation VSA",
-        "validation decorator",
-        "validation pipeline",
-        "AbstractValidator",
-        "ValidationDecorator"
-      ],
       "anchors": {
         "validator": "#validator-structure",
         "decorator": "#validationdecorator-pattern",
         "conversion": "#fluentvalidation-to-validationerror-conversion"
       },
-      "digest": "One sealed `AbstractValidator<TRequest>` per request DTO (FluentValidation 12), in the same feature folder as the handler; no `RuleSet` grouping and no `IValidateOptions<T>`. Never validate request shape inside the handler or endpoint (existence/state checks do belong in the handler): `ValidationDecorator<TRequest, TResponse>` wraps every `IHandler` via Scrutor, collects all `IValidator<TRequest>`, runs them in parallel (`Task.WhenAll`) and on failure short-circuits to `Result.Failure(ValidationError)` (an array of `Error.Validation(code, message)`), supporting both `Result` and `Result<T>`. Never throw `ValidationException`. In Program.cs call `AddValidatorsFromAssembly()` BEFORE `AddHandlersFromAssembly()` so the decorator can resolve validators. Always give user-facing `.WithMessage()` text. Inject `TimeProvider` instead of reading `DateTime.UtcNow` and read it INSIDE the rule (`LessThanOrEqualTo(_ => timeProvider.GetUtcNow().Year)`), so the year is evaluated per validation (a value captured in the constructor goes stale in a singleton/cached validator; AddValidatorsFromAssembly defaults to Scoped) and stays testable with `FakeTimeProvider`.",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview) + FluentValidation 12.1.1. The validator block and the decorator (its three blocks assembled into one class) compile with `TreatWarningsAsErrors` over the `Result`/`ValidationError` of `result-pattern.md`, and the validator was run with `FakeTimeProvider` across a year change to show the year is read per validation.",
-      "provedBy": []
+      "digest": "One sealed `AbstractValidator<TRequest>` per request DTO (FluentValidation 12), in the same feature folder as the handler; no `RuleSet` grouping and no `IValidateOptions<T>`. Never validate request shape inside the handler or endpoint (existence/state checks do belong in the handler): `ValidationDecorator<TRequest, TResponse>` wraps every `IHandler` via Scrutor, collects all `IValidator<TRequest>`, runs them in parallel (`Task.WhenAll`) and on failure short-circuits to `Result.Failure(ValidationError)` (an array of `Error.Validation(code, message)`), supporting both `Result` and `Result<T>`. Never throw `ValidationException`. In Program.cs call `AddValidatorsFromAssembly()` BEFORE `AddHandlersFromAssembly()` so the decorator can resolve validators. Always give user-facing `.WithMessage()` text. Inject `TimeProvider` instead of reading `DateTime.UtcNow` and read it INSIDE the rule (`LessThanOrEqualTo(_ => timeProvider.GetUtcNow().Year)`), so the year is evaluated per validation (a value captured in the constructor goes stale in a singleton/cached validator; AddValidatorsFromAssembly defaults to Scoped) and stays testable with `FakeTimeProvider`."
     },
     {
       "id": "backend-dotnet-result-pattern",
@@ -1448,21 +899,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "Result<T>",
-        "railway oriented",
-        "error handling",
-        "Match pattern",
-        "Result monad"
-      ],
       "anchors": {
         "anatomy": "#result-anatomy",
         "errors": "#error-types-7--custom",
         "match": "#match-pattern"
       },
-      "digest": "Expected failures are Result/Result<T> values, never exceptions. Endpoints convert with result.Match(onSuccess: value => Results.Ok(value), onFailure: error => error.ToHttpResult()); never read .Value outside Match (it throws on failure). Implicit conversions let a handler return the value or the Error directly. Error = record(Code, Description, ErrorType) from factories Failure/Unexpected/Validation/Conflict/NotFound/Unauthorized/Forbidden; ValidationError aggregates FluentValidation errors. Status comes from ErrorType, never a blanket BadRequest: Failure/Validation/Custom 400, NotFound 404, Conflict 409, Unauthorized 401, Forbidden 403, Unexpected 500, via Results.Problem. Each feature owns a static {Feature}Errors class. FORBIDDEN: try/catch in handlers (unexpected exceptions bubble to the global handler), returning null, codeless string errors.",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview) + the shared framework `Microsoft.AspNetCore.App` 10 — the HTTP mapping uses `Results`/`IResult`/`StatusCodes`; the `Error`, `ValidationError`, `ResultExtensions`, `ErrorHttpMapping`, endpoint usage and `BookErrors` blocks compile with `TreatWarningsAsErrors` (the Anatomy blocks carry `{ ... }` placeholders and were compiled through a concrete stand-in).",
-      "provedBy": []
+      "digest": "Expected failures are Result/Result<T> values, never exceptions. Endpoints convert with result.Match(onSuccess: value => Results.Ok(value), onFailure: error => error.ToHttpResult()); never read .Value outside Match (it throws on failure). Implicit conversions let a handler return the value or the Error directly. Error = record(Code, Description, ErrorType) from factories Failure/Unexpected/Validation/Conflict/NotFound/Unauthorized/Forbidden; ValidationError aggregates FluentValidation errors. Status comes from ErrorType, never a blanket BadRequest: Failure/Validation/Custom 400, NotFound 404, Conflict 409, Unauthorized 401, Forbidden 403, Unexpected 500, via Results.Problem. Each feature owns a static {Feature}Errors class. FORBIDDEN: try/catch in handlers (unexpected exceptions bubble to the global handler), returning null, codeless string errors."
     },
     {
       "id": "backend-dotnet-scalar-ui",
@@ -1478,21 +920,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "Scalar",
-        "API documentation",
-        "OpenAPI UI",
-        "Swagger replacement",
-        "Scalar.AspNetCore"
-      ],
       "anchors": {
         "setup": "#programcs-configuration",
         "tags": "#apitags-organization",
         "metadata": "#endpoint-metadata"
       },
-      "digest": "Scalar replaces Swagger UI: packages Microsoft.AspNetCore.OpenApi 10.0.0 + Scalar.AspNetCore 2.12.40, never Swashbuckle (ASP.NET Core 9+ generates OpenAPI natively). Program.cs order: builder.Services.AddOpenApi(); app.MapOpenApi() only inside IsDevelopment() (never expose OpenAPI in production); then app.MapScalarApiReference with WithTheme(ScalarTheme.DeepSpace) and WithDefaultHttpClient(ScalarTarget.CSharp, ScalarClient.HttpClient). MapOpenApi must come before Scalar; the UI is served at /scalar/v1. Every endpoint needs .WithTags(ApiTags.X), with tags as constants in Constants/ApiTags.cs (no magic strings), and .Produces<T>(status) for success plus .ProducesProblem(status) for every failure status the slice can return (failures go out as ProblemDetails via error.ToHttpResult()), so the docs show accurate response types. Also available: .WithName (operation id), .WithSummary, .WithDescription, .ProducesProblem, .RequireAuthorization.",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview) + Scalar.AspNetCore 2.x + Microsoft.AspNetCore.OpenApi 10. The `ApiTags` and tagged-endpoint blocks compile with `TreatWarningsAsErrors` over the `Result`/`ErrorHttpMapping` of `result-pattern.md` (ApiTags placed in `ProjectName.Constants`); the startup and metadata snippets (`async (...) => { ... }`) are fragments, checked against the docs only.",
-      "provedBy": []
+      "digest": "Scalar replaces Swagger UI: packages Microsoft.AspNetCore.OpenApi 10.0.0 + Scalar.AspNetCore 2.12.40, never Swashbuckle (ASP.NET Core 9+ generates OpenAPI natively). Program.cs order: builder.Services.AddOpenApi(); app.MapOpenApi() only inside IsDevelopment() (never expose OpenAPI in production); then app.MapScalarApiReference with WithTheme(ScalarTheme.DeepSpace) and WithDefaultHttpClient(ScalarTarget.CSharp, ScalarClient.HttpClient). MapOpenApi must come before Scalar; the UI is served at /scalar/v1. Every endpoint needs .WithTags(ApiTags.X), with tags as constants in Constants/ApiTags.cs (no magic strings), and .Produces<T>(status) for success plus .ProducesProblem(status) for every failure status the slice can return (failures go out as ProblemDetails via error.ToHttpResult()), so the docs show accurate response types. Also available: .WithName (operation id), .WithSummary, .WithDescription, .ProducesProblem, .RequireAuthorization."
     },
     {
       "id": "backend-dotnet-scrutor",
@@ -1508,21 +941,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "Scrutor",
-        "auto-discovery",
-        "assembly scanning",
-        "decorator registration",
-        "handler registration"
-      ],
       "anchors": {
         "handlers": "#handler-auto-discovery",
         "decorators": "#decorator-order",
         "endpoints": "#endpoint-auto-discovery"
       },
-      "digest": "Scrutor 7 (.NET 10) handler/decorator registration for VSA. `AddHandlersFromAssembly` reflects over concrete classes filtered by `!t.ContainsGenericParameters` (so open-generic decorators are excluded), registers each `IHandler<,>` as `AddScoped` (handlers use DbContext, never Singleton), then calls `Decorate` for `ValidationDecorator<,>` first and `LoggingDecorator<,>` second: the last registered wraps outermost, so execution is Logging -> Validation -> Handler and logging sees validation failures. `RegisterApiEndpointsFromAssembly` adds every `IApiEndpoint` as Transient via `TryAddEnumerable`; `MapApiEndpoints` calls `MapEndpoint` on each. Program.cs order: DbContext, endpoints, `AddValidatorsFromAssembly` (must precede handlers so the ValidationDecorator can resolve validators), handlers + decorators, cross-cutting. Never register handlers one by one.",
-      "verifiedAgainst": ".NET 10 + Scrutor 7 (`Scan`/`Decorate` API).",
-      "provedBy": []
+      "digest": "Scrutor 7 (.NET 10) handler/decorator registration for VSA. `AddHandlersFromAssembly` reflects over concrete classes filtered by `!t.ContainsGenericParameters` (so open-generic decorators are excluded), registers each `IHandler<,>` as `AddScoped` (handlers use DbContext, never Singleton), then calls `Decorate` for `ValidationDecorator<,>` first and `LoggingDecorator<,>` second: the last registered wraps outermost, so execution is Logging -> Validation -> Handler and logging sees validation failures. `RegisterApiEndpointsFromAssembly` adds every `IApiEndpoint` as Transient via `TryAddEnumerable`; `MapApiEndpoints` calls `MapEndpoint` on each. Program.cs order: DbContext, endpoints, `AddValidatorsFromAssembly` (must precede handlers so the ValidationDecorator can resolve validators), handlers + decorators, cross-cutting. Never register handlers one by one."
     },
     {
       "id": "backend-dotnet-testing",
@@ -1537,26 +961,12 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "xunit",
-        "TimeProvider",
-        "FakeTimeProvider",
-        "fake clock",
-        "integration test",
-        "ProblemDetails",
-        "error body assertion",
-        "test budget",
-        "orçamento de teste",
-        "[Theory] table"
-      ],
       "anchors": {
         "clock": "#rule-1--inject-timeprovider-fake-it-with-faketimeprovider-in-tests",
         "errorbody": "#rule-2--error-path-tests-assert-the-response-body-not-just-the-status-code",
         "test-budget": "#test-budget"
       },
-      "digest": "Inject TimeProvider (never DateTime.UtcNow / DateOnly.FromDateTime(DateTime.UtcNow) directly in a handler or validator) and fake it with FakeTimeProvider (Microsoft.Extensions.TimeProvider.Testing) in integration tests — deterministic, no midnight-UTC flake, boundary dates (today vs. yesterday) become facts about the fake clock instead of when the suite happens to run. xUnit + WebApplicationFactory error-path tests (400/404/409) must assert the ProblemDetails response BODY (title/detail/violated field or error code), never just the HTTP status code — a status-only assertion lets the wrong validation rule or the wrong error branch pass silently as long as the status matches. Test budget per task: one test per postcondition plus one regression test per bug, more only with a one-line justification in the task; scenarios of the same behavior (edge cases included) are rows of one [Theory], never copied [Fact]s; no test whose only assertion is a copy, config or prose string (that is an analyzer or a publish-time validation, outside the suite count); shared fixtures before new helpers; bugs and pure logic get tests in any order — the implementer runs its own filter once, never red-green cycles nor production mutation (the Gate 3 mutation proof shows the test bites); a surviving mutant is killed by tightening an assertion or adding a row, not by a new test.",
-      "verifiedAgainst": ".NET 10 + xUnit 2 + `Microsoft.Extensions.TimeProvider.Testing`.",
-      "provedBy": []
+      "digest": "Inject TimeProvider (never DateTime.UtcNow / DateOnly.FromDateTime(DateTime.UtcNow) directly in a handler or validator) and fake it with FakeTimeProvider (Microsoft.Extensions.TimeProvider.Testing) in integration tests — deterministic, no midnight-UTC flake, boundary dates (today vs. yesterday) become facts about the fake clock instead of when the suite happens to run. xUnit + WebApplicationFactory error-path tests (400/404/409) must assert the ProblemDetails response BODY (title/detail/violated field or error code), never just the HTTP status code — a status-only assertion lets the wrong validation rule or the wrong error branch pass silently as long as the status matches. Test budget per task: one test per postcondition plus one regression test per bug, more only with a one-line justification in the task; scenarios of the same behavior (edge cases included) are rows of one [Theory], never copied [Fact]s; no test whose only assertion is a copy, config or prose string (that is an analyzer or a publish-time validation, outside the suite count); shared fixtures before new helpers; bugs and pure logic get tests in any order — the implementer runs its own filter once, never red-green cycles nor production mutation (the Gate 3 mutation proof shows the test bites); a surviving mutant is killed by tightening an assertion or adding a row, not by a new test."
     },
     {
       "id": "backend-dotnet-vsa-handler-patterns",
@@ -1572,22 +982,13 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "VSA handler",
-        "vertical slice handler",
-        "feature slice",
-        "IHandler pattern",
-        "handler endpoint"
-      ],
       "anchors": {
         "handler": "#ihandlertrequest-tresponse",
         "folder": "#feature-folder-structure-5-files-per-slice",
         "endpoint": "#complete-endpoint-example",
         "registration": "#programcs-di-registration-order"
       },
-      "digest": "Each VSA feature is a slice in `Features/{Feature}/{UseCase}/` with 5 files: Request, Response (sealed records, may be inline), Handler, Validator, Endpoint; feature errors in `{Feature}Errors.cs` (`Error.NotFound/Conflict/Failure`). Handlers implement `IHandler<TRequest, TResponse>` (resolved from DI; NOT MediatR, decorators via Scrutor), are `sealed class` with primary constructors, inject `ApplicationDbContext` directly (`DbSet<T>` is the repository, `DbContext` the unit of work: no service layer, no `IRepository<T>`/`IUnitOfWork`), use `Guid.CreateVersion7()` (never `Guid.NewGuid()`), pass `CancellationToken` everywhere and return `Result<T>` instead of throwing for expected failures. Endpoints are `internal sealed` `IApiEndpoint`, only map HTTP and call `Match()`: success lambda receives the value (never read `.Value`), failure is `error.ToHttpResult()` (status by `ErrorType`, never `Results.BadRequest` for every error), with `.ProducesProblem` per failure status. Raw SQL or a dedicated hand-written store (outbox, lease) only with a `decisions.md` justification.",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview; minimal APIs, primary constructors, `Guid.CreateVersion7()`). The \"Complete Endpoint Example\" block compiles with `TreatWarningsAsErrors` over the `Result`/`ErrorHttpMapping` of `result-pattern.md` (in `ProjectName.Abstractions`/`ProjectName.Extensions`, reached only through the block's own `using`s); the other blocks are documentary.",
-      "provedBy": []
+      "digest": "Each VSA feature is a slice in `Features/{Feature}/{UseCase}/` with 5 files: Request, Response (sealed records, may be inline), Handler, Validator, Endpoint; feature errors in `{Feature}Errors.cs` (`Error.NotFound/Conflict/Failure`). Handlers implement `IHandler<TRequest, TResponse>` (resolved from DI; NOT MediatR, decorators via Scrutor), are `sealed class` with primary constructors, inject `ApplicationDbContext` directly (`DbSet<T>` is the repository, `DbContext` the unit of work: no service layer, no `IRepository<T>`/`IUnitOfWork`), use `Guid.CreateVersion7()` (never `Guid.NewGuid()`), pass `CancellationToken` everywhere and return `Result<T>` instead of throwing for expected failures. Endpoints are `internal sealed` `IApiEndpoint`, only map HTTP and call `Match()`: success lambda receives the value (never read `.Value`), failure is `error.ToHttpResult()` (status by `ErrorType`, never `Results.BadRequest` for every error), with `.ProducesProblem` per failure status. Raw SQL or a dedicated hand-written store (outbox, lease) only with a `plan.md` (`## Decisões`) justification."
     },
     {
       "id": "backend-integrations-asaas-asaas-api",
@@ -1603,20 +1004,11 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "asaas",
-        "payment",
-        "PIX",
-        "boleto",
-        "Brazilian payment"
-      ],
       "anchors": {
         "payments": "#create-pix-payment",
         "webhooks": "#webhook-handler"
       },
-      "digest": "Asaas from the .NET 10 backend (the Next.js frontend never calls Asaas; it calls the backend through the proxy). No official .NET SDK: REST v3 through a typed HttpClient `AsaasClient` (an external-API port, injected into the slice handler next to the DbContext), registered with AddHttpClient + options bound from config `Asaas` (ValidateOnStart; key in user-secrets/Coolify env, never in code). Base URL https://api.asaas.com/v3/ or https://api-sandbox.asaas.com/v3/ WITH trailing slash and relative paths without leading slash (otherwise HttpClient drops /v3). Every request sends `access_token` (not Bearer), Content-Type and `User-Agent` (mandatory for root accounts created from 06/11/2024). Responses become Result: 400 `{ errors: [{ code, description }] }` -> Error.Validation (ValidationError if several, e.g. invalid_cpfCnpj), 404 -> NotFound, other non-success -> Unexpected; endpoints map with error.ToHttpResult(); no try/catch, network failures propagate. No duplicate charges: Asaas documents no idempotency-key header and create is not idempotent, so set `externalReference` to your id and `GET /payments?externalReference=` before creating; never auto-retry payWithCreditCard. PIX: POST /payments billingType PIX with dueDate as today in America/Sao_Paulo via TimeProvider, then GET /payments/{id}/pixQrCode (payload + encodedImage). Webhooks are not HMAC-signed: compare the `asaas-access-token` header to the configured authToken with CryptographicOperations.FixedTimeEquals, 401 on mismatch; delivery is at-least-once, so store processed event ids (unique) and answer 200 (only 200 counts; 15 consecutive failures interrupt the queue). Validate CPF (11 digits) and CNPJ (14, alphanumeric from July 2026, ASCII-48 mod-11), never store card data; local ids via Guid.CreateVersion7(), no gen_random_uuid defaults.",
-      "verifiedAgainst": "Asaas REST API v3 (docs read via context7 on 2026-10-03: headers, `POST /payments`, `GET /payments?externalReference=`, `pixQrCode`, webhook payload, delivery and error rules) + .NET 10 (SDK 10.0.400-preview, `IHttpClientFactory` from the ASP.NET Core shared framework) + EF Core 10.0.12. The options, client, registration, PIX slice, webhook slice/endpoint and CPF/CNPJ blocks compile with `TreatWarningsAsErrors` over the `Result`/`ErrorHttpMapping` of `result-pattern.md`; the CPF/CNPJ validator was run against valid and invalid documents (numeric and the alphanumeric `12.ABC.345/01DE-35`), and the `BaseUrl` trailing-slash rule and the `dueDate` JSON shape were checked by running them; the SQL is documentary.",
-      "provedBy": []
+      "digest": "Asaas from the .NET 10 backend (the Next.js frontend never calls Asaas; it calls the backend through the proxy). No official .NET SDK: REST v3 through a typed HttpClient `AsaasClient` (an external-API port, injected into the slice handler next to the DbContext), registered with AddHttpClient + options bound from config `Asaas` (ValidateOnStart; key in user-secrets/Coolify env, never in code). Base URL https://api.asaas.com/v3/ or https://api-sandbox.asaas.com/v3/ WITH trailing slash and relative paths without leading slash (otherwise HttpClient drops /v3). Every request sends `access_token` (not Bearer), Content-Type and `User-Agent` (mandatory for root accounts created from 06/11/2024). Responses become Result: 400 `{ errors: [{ code, description }] }` -> Error.Validation (ValidationError if several, e.g. invalid_cpfCnpj), 404 -> NotFound, other non-success -> Unexpected; endpoints map with error.ToHttpResult(); no try/catch, network failures propagate. No duplicate charges: Asaas documents no idempotency-key header and create is not idempotent, so set `externalReference` to your id and `GET /payments?externalReference=` before creating; never auto-retry payWithCreditCard. PIX: POST /payments billingType PIX with dueDate as today in America/Sao_Paulo via TimeProvider, then GET /payments/{id}/pixQrCode (payload + encodedImage). Webhooks are not HMAC-signed: compare the `asaas-access-token` header to the configured authToken with CryptographicOperations.FixedTimeEquals, 401 on mismatch; delivery is at-least-once, so store processed event ids (unique) and answer 200 (only 200 counts; 15 consecutive failures interrupt the queue). Validate CPF (11 digits) and CNPJ (14, alphanumeric from July 2026, ASCII-48 mod-11), never store card data; local ids via Guid.CreateVersion7(), no gen_random_uuid defaults."
     },
     {
       "id": "backend-integrations-hangfire-hangfire-jobs",
@@ -1632,21 +1024,11 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "hangfire",
-        "background jobs",
-        "scheduled jobs",
-        "recurring",
-        "cron",
-        "fire and forget"
-      ],
       "anchors": {
         "jobs": "#job-types",
         "retry": "#retry--error-handling"
       },
-      "digest": "Hangfire 1.8.25 on .NET 10, only with a real reason (survive restarts, schedules, deferred retries) recorded in decisions.md; work that fits in the request stays in the slice handler. Storage is Neon Postgres via Hangfire.PostgreSql 1.21.1 with `UsePostgreSqlStorage(o => o.UseNpgsqlConnection(cs))` (the string overloads are [Obsolete]) and `HangfireConnection` on the direct/unpooled endpoint (schema install at startup is a migration, which Neon routes to the direct string; EnableLongPolling uses LISTEN/NOTIFY, unsupported by Neon's PgBouncer transaction mode); reference Newtonsoft.Json 13.0.4 explicitly or restore fails with NU1903 (Hangfire.Core pulls 11.0.1). A job is a thin sealed class in the slice that calls the slice handler (`IHandler<TRequest, Result>`); no XService layer. Hangfire.AspNetCore's AspNetCoreJobActivator opens a DI scope per job, so inject the ApplicationDbContext/handler directly (IDbContextFactory only for parallel work inside one job); never capture request-scoped services into Enqueue. Jobs are idempotent (check state, return). Expected failures come back as Result and the job logs and completes; unexpected ones are the exceptions EF/HttpClient already throw, uncaught, which `[AutomaticRetry(Attempts = 3, DelaysInSeconds = [60, 300, 900])]` retries; no try/catch, no manual retry loops. API: `BackgroundJob.Enqueue<TJob>(j => j.RunAsync(id, CancellationToken.None))`, `Schedule`, `RecurringJob.AddOrUpdate` with a stable id and cron (UTC), `ContinueJobWith`. Dashboard: IDashboardAuthorizationFilter requiring authenticated Admin, dev bypass only via IHostEnvironment.IsDevelopment() (never Request.Host, which the client controls).",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview) + Hangfire.Core/Hangfire.AspNetCore 1.8.25 + Hangfire.PostgreSql 1.21.1 + Newtonsoft.Json 13.0.4. The startup, job/handler, dashboard-filter and idempotency blocks compile with `TreatWarningsAsErrors`; the Job Types calls compile inside a wrapper method; the per-job DI scope (`AspNetCoreJobActivator` → `IServiceScopeFactory`) and the `PostgreSqlStorageOptions` defaults were read by reflection on those assemblies; the pooled-endpoint limits (LISTEN/NOTIFY, migrations on the direct string) come from the Neon connection-pooling docs. Cron strings are documentary.",
-      "provedBy": []
+      "digest": "Hangfire 1.8.25 on .NET 10, only with a real reason (survive restarts, schedules, deferred retries) recorded in plan.md (## Decisões); work that fits in the request stays in the slice handler. Storage is Neon Postgres via Hangfire.PostgreSql 1.21.1 with `UsePostgreSqlStorage(o => o.UseNpgsqlConnection(cs))` (the string overloads are [Obsolete]) and `HangfireConnection` on the direct/unpooled endpoint (schema install at startup is a migration, which Neon routes to the direct string; EnableLongPolling uses LISTEN/NOTIFY, unsupported by Neon's PgBouncer transaction mode); reference Newtonsoft.Json 13.0.4 explicitly or restore fails with NU1903 (Hangfire.Core pulls 11.0.1). A job is a thin sealed class in the slice that calls the slice handler (`IHandler<TRequest, Result>`); no XService layer. Hangfire.AspNetCore's AspNetCoreJobActivator opens a DI scope per job, so inject the ApplicationDbContext/handler directly (IDbContextFactory only for parallel work inside one job); never capture request-scoped services into Enqueue. Jobs are idempotent (check state, return). Expected failures come back as Result and the job logs and completes; unexpected ones are the exceptions EF/HttpClient already throw, uncaught, which `[AutomaticRetry(Attempts = 3, DelaysInSeconds = [60, 300, 900])]` retries; no try/catch, no manual retry loops. API: `BackgroundJob.Enqueue<TJob>(j => j.RunAsync(id, CancellationToken.None))`, `Schedule`, `RecurringJob.AddOrUpdate` with a stable id and cron (UTC), `ContinueJobWith`. Dashboard: IDashboardAuthorizationFilter requiring authenticated Admin, dev bypass only via IHostEnvironment.IsDevelopment() (never Request.Host, which the client controls)."
     },
     {
       "id": "backend-integrations-neon-auth-neon-auth",
@@ -1663,26 +1045,6 @@
       "stacks": [
         "neon"
       ],
-      "aliases": [
-        "neon auth",
-        "better auth",
-        "authentication",
-        "OAuth",
-        "JWT",
-        "session management",
-        "trusted origins",
-        "EdDSA",
-        "Ed25519",
-        "BouncyCastle",
-        "signature validator",
-        "jwks",
-        "middleware runtime",
-        "api prefix",
-        "data api",
-        "postgrest",
-        "bypass backend",
-        "direct database access"
-      ],
       "anchors": {
         "setup": "#installation--setup",
         "data-access-boundary": "#data-access-boundary--backend-first-by-default",
@@ -1693,9 +1055,7 @@
         "rls": "#row-level-security-integration",
         "postmortem": "#known-failure-modes-postmortem"
       },
-      "digest": "Use @neondatabase/auth SDK for Next.js. Auth data lives in neon_auth schema — no external provider, no webhooks. Server: createNeonAuth() with NEON_AUTH_BASE_URL + NEON_AUTH_COOKIE_SECRET. Client: createAuthClient(). Pages: AuthView component. Protection: auth.middleware() with runtime='nodejs' (Edge times out minting the session cookie). Register every dev/preview origin in trusted_origins before testing login. Two named prefix constants (BACKEND_API_PREFIX / PROXY_API_PREFIX) — never share one between server-direct and client-proxy calls. Frontend never queries Neon directly for business data by default — only its own auth/session SDK; a Data API bypass requires a decisions.md ADR. .NET: tokens are EdDSA/Ed25519 (OKP) — Microsoft.IdentityModel.Tokens can't verify OKP keys and there's no OIDC discovery; fetch+cache the JWKS yourself and verify signatures manually via BouncyCastle.Cryptography + TokenValidationParameters.SignatureValidator (must return Microsoft.IdentityModel.JsonWebTokens.JsonWebToken, not JwtSecurityToken — else IDX10506). NeonAuth:BaseUrl is mandatory in appsettings.Development.json (public value). RLS: auth.user_id() via pg_session_jwt.",
-      "verifiedAgainst": "Neon Auth — @neondatabase/auth + @neondatabase/auth-ui (Better Auth).",
-      "provedBy": []
+      "digest": "Use @neondatabase/auth SDK for Next.js. Auth data lives in neon_auth schema — no external provider, no webhooks. Server: createNeonAuth() with NEON_AUTH_BASE_URL + NEON_AUTH_COOKIE_SECRET. Client: createAuthClient(). Pages: AuthView component. Protection: auth.middleware() with runtime='nodejs' (Edge times out minting the session cookie). Register every dev/preview origin in trusted_origins before testing login. Two named prefix constants (BACKEND_API_PREFIX / PROXY_API_PREFIX) — never share one between server-direct and client-proxy calls. Frontend never queries Neon directly for business data by default — only its own auth/session SDK; a Data API bypass requires a plan.md (## Decisões) ADR. .NET: tokens are EdDSA/Ed25519 (OKP) — Microsoft.IdentityModel.Tokens can't verify OKP keys and there's no OIDC discovery; fetch+cache the JWKS yourself and verify signatures manually via BouncyCastle.Cryptography + TokenValidationParameters.SignatureValidator (must return Microsoft.IdentityModel.JsonWebTokens.JsonWebToken, not JwtSecurityToken — else IDX10506). NeonAuth:BaseUrl is mandatory in appsettings.Development.json (public value). RLS: auth.user_id() via pg_session_jwt."
     },
     {
       "id": "backend-integrations-resend-resend-email",
@@ -1711,20 +1071,11 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "resend",
-        "email",
-        "transactional email",
-        "SMTP",
-        "email notification"
-      ],
       "anchors": {
         "sending": "#send-email-api-route",
         "templates": "#common-email-templates"
       },
-      "digest": "Resend transactional email via REST API (not SMTP; 100 free emails/day) for Next.js and .NET. Next.js: `resend` + React Email templates, one `new Resend(process.env.RESEND_API_KEY)` in `lib/resend.ts`. .NET: `Resend` package, `AddHttpClient<ResendClient>()` plus `IResend` registered transient, token from the `Resend:ApiKey` config. Always send asynchronously: do not block HTTP requests, enqueue with Hangfire (`BackgroundJob.Enqueue`); retry with Polly (3 attempts, exponential backoff); rate-limit sends (Upstash sliding window, 10/hour). Webhooks are signed with Svix: verify the RAW body with `resend.webhooks.verify()` using the `svix-id`/`svix-timestamp`/`svix-signature` headers and `RESEND_WEBHOOK_SECRET`; do NOT hand-roll an HMAC (it rejects valid webhooks). Handle `email.delivered`/`bounced`/`complained`. Verify the sending domain first (SPF, DKIM, DMARC; up to 72 hours).",
-      "verifiedAgainst": "Resend Node SDK 4 + Resend .NET SDK + React Email.",
-      "provedBy": []
+      "digest": "Resend transactional email via REST API (not SMTP; 100 free emails/day) for Next.js and .NET. Next.js: `resend` + React Email templates, one `new Resend(process.env.RESEND_API_KEY)` in `lib/resend.ts`. .NET: `Resend` package, `AddHttpClient<ResendClient>()` plus `IResend` registered transient, token from the `Resend:ApiKey` config. Always send asynchronously: do not block HTTP requests, enqueue with Hangfire (`BackgroundJob.Enqueue`); retry with Polly (3 attempts, exponential backoff); rate-limit sends (Upstash sliding window, 10/hour). Webhooks are signed with Svix: verify the RAW body with `resend.webhooks.verify()` using the `svix-id`/`svix-timestamp`/`svix-signature` headers and `RESEND_WEBHOOK_SECRET`; do NOT hand-roll an HMAC (it rejects valid webhooks). Handle `email.delivered`/`bounced`/`complained`. Verify the sending domain first (SPF, DKIM, DMARC; up to 72 hours)."
     },
     {
       "id": "data-nosql-cache-redis",
@@ -1741,21 +1092,11 @@
         "dotnet",
         "azure"
       ],
-      "aliases": [
-        "redis",
-        "cache",
-        "distributed cache",
-        "IDistributedCache",
-        "cache-aside",
-        "StackExchange.Redis"
-      ],
       "anchors": {
         "patterns": "#cache-aside-pattern",
         "invalidation": "#ttl-strategy"
       },
-      "digest": "Redis (on the Coolify VPS or managed) is a distributed cache for sessions, rate limiting and hot reads, never the primary store. Packages: Microsoft.Extensions.Caching.StackExchangeRedis 10.0.12 (depends on StackExchange.Redis >= 2.7.27); reference StackExchange.Redis explicitly at the latest 2.x (2.13.17) only when injecting IConnectionMultiplexer -- 3.x is a new major the caching package has not adopted. Register one shared IConnectionMultiplexer as a LAZY singleton and hand it to the cache via AddOptions<RedisCacheOptions>().Configure<IServiceProvider>(... ConnectionMultiplexerFactory ...) -- never Connect during registration (an unreachable Redis would block boot) and never BuildServiceProvider inside the factory, InstanceName prefix (e.g. 'myapp:'), connection string from configuration (user-secrets / Coolify env ConnectionStrings__Redis). Cache-aside lives in the slice handler with IDistributedCache next to the ApplicationDbContext (no CachedXService/repository wrapper): read the key, on a miss project the response DTO from the DbContext, return Result NotFound (never null) when absent, write with DistributedCacheEntryOptions; the writing handler invalidates the exact key with RemoveAsync after SaveChangesAsync; key builders in one static class per feature. TTLs: user session 30 min sliding, product catalog 15 min absolute, rate-limit counters 1 min, computed aggregates 1 h, reference data 24 h. Rate limit across instances: StringIncrementAsync, KeyExpireAsync 1 min when count == 1, minute from TimeProvider (single instance: built-in AddRateLimiter). FORBIDDEN: caching passwords/tokens/PII without encryption, omitting TTL, swallowing RedisConnectionException in an empty catch (DB fallback during an outage is a decisions.md decision, implemented once at the cache boundary).",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview) + Microsoft.Extensions.Caching.StackExchangeRedis 10.0.12 + StackExchange.Redis 2.13.17 + EF Core 10.0.12. The registration, cache-aside handler, invalidation and rate-limit blocks compile with `TreatWarningsAsErrors` over the `Result` of `result-pattern.md`; package dependencies read from the nuget.org nuspec on 2026-10-03.",
-      "provedBy": []
+      "digest": "Redis (on the Coolify VPS or managed) is a distributed cache for sessions, rate limiting and hot reads, never the primary store. Packages: Microsoft.Extensions.Caching.StackExchangeRedis 10.0.12 (depends on StackExchange.Redis >= 2.7.27); reference StackExchange.Redis explicitly at the latest 2.x (2.13.17) only when injecting IConnectionMultiplexer -- 3.x is a new major the caching package has not adopted. Register one shared IConnectionMultiplexer as a LAZY singleton and hand it to the cache via AddOptions<RedisCacheOptions>().Configure<IServiceProvider>(... ConnectionMultiplexerFactory ...) -- never Connect during registration (an unreachable Redis would block boot) and never BuildServiceProvider inside the factory, InstanceName prefix (e.g. 'myapp:'), connection string from configuration (user-secrets / Coolify env ConnectionStrings__Redis). Cache-aside lives in the slice handler with IDistributedCache next to the ApplicationDbContext (no CachedXService/repository wrapper): read the key, on a miss project the response DTO from the DbContext, return Result NotFound (never null) when absent, write with DistributedCacheEntryOptions; the writing handler invalidates the exact key with RemoveAsync after SaveChangesAsync; key builders in one static class per feature. TTLs: user session 30 min sliding, product catalog 15 min absolute, rate-limit counters 1 min, computed aggregates 1 h, reference data 24 h. Rate limit across instances: StringIncrementAsync, KeyExpireAsync 1 min when count == 1, minute from TimeProvider (single instance: built-in AddRateLimiter). FORBIDDEN: caching passwords/tokens/PII without encryption, omitting TTL, swallowing RedisConnectionException in an empty catch (DB fallback during an outage is a plan.md (## Decisões) decision, implemented once at the cache boundary)."
     },
     {
       "id": "data-nosql-cosmos-db",
@@ -1771,20 +1112,11 @@
         "dotnet",
         "azure"
       ],
-      "aliases": [
-        "cosmos",
-        "CosmosDB",
-        "document database",
-        "partition key",
-        "RUs"
-      ],
       "anchors": {
         "modeling": "#container-design",
         "queries": "#handler-in-the-slice"
       },
-      "digest": "OPTIONAL — outside the baked-in stack. The default store is Neon (Postgres) via EF Core; Cosmos needs a decisions.md entry saying why Neon does not serve (multi-region writes, event-stream throughput, per-tenant schema never joined) — never for joined data, small datasets or 'flexible schema' (jsonb covers it). Stack rules still hold: one singleton CosmosClient with System.Text.Json, the Container as a keyed singleton injected straight into the slice handler (no CosmosRepository<T>), ids from Guid.CreateVersion7(), time from TimeProvider. Use ReadItemStreamAsync/CreateItemStreamAsync and map StatusCode 404/409 to Result errors instead of catching CosmosException. Parameterized queries with the PartitionKey pinned in QueryRequestOptions (no fan-out). Microsoft.Azure.Cosmos 3.x needs an explicit Newtonsoft.Json reference or the build fails.",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview) + Microsoft.Azure.Cosmos 3.63.2 + Newtonsoft.Json 13.0.4 — every `csharp` block below compiles with `TreatWarningsAsErrors` against the `Result`/`Error` types of `backend-dotnet-result-pattern`.",
-      "provedBy": []
+      "digest": "OPTIONAL — outside the baked-in stack. The default store is Neon (Postgres) via EF Core; Cosmos needs a plan.md (## Decisões) entry saying why Neon does not serve (multi-region writes, event-stream throughput, per-tenant schema never joined) — never for joined data, small datasets or 'flexible schema' (jsonb covers it). Stack rules still hold: one singleton CosmosClient with System.Text.Json, the Container as a keyed singleton injected straight into the slice handler (no CosmosRepository<T>), ids from Guid.CreateVersion7(), time from TimeProvider. Use ReadItemStreamAsync/CreateItemStreamAsync and map StatusCode 404/409 to Result errors instead of catching CosmosException. Parameterized queries with the PartitionKey pinned in QueryRequestOptions (no fan-out). Microsoft.Azure.Cosmos 3.x needs an explicit Newtonsoft.Json reference or the build fails."
     },
     {
       "id": "data-vector-search-rag-chunking",
@@ -1800,20 +1132,11 @@
         "dotnet",
         "azure"
       ],
-      "aliases": [
-        "RAG chunking",
-        "document chunking",
-        "text splitting",
-        "chunk overlap",
-        "embedding chunks"
-      ],
       "anchors": {
         "strategies": "#chunking-strategies",
         "retrieval": "#chunking-strategies"
       },
-      "digest": "Strategies: fixed-size baseline (sample defaults size 512, overlap 50, applied to characters), sentence-aware (recommended for prose, `maxTokens` 256) and semantic (best quality, higher cost; split at markdown headers `^#{1,3} `). By document type: legal -> sentence-aware 256 tokens; technical docs -> semantic by headers; Q&A -> keep whole Q+A; code -> whole function; news -> paragraph, 512 tokens. Estimate tokens as chars/4 for English (about 3 chars per token for Portuguese), or tiktoken if available. Always store chunk metadata (DocumentId, DocumentTitle, SourceUrl, ChunkIndex, StartCharIndex, Section, IndexedAt) for filtering and citation. Checklist: overlap 10-20% so boundaries do not cut context, minimum 50 tokens, maximum about 512 (far below the 8192-token embedding input limit), and re-index when a document changes, detected via a content hash.",
-      "verifiedAgainst": ".NET 10 (chunking algorithms — language-level, no external package).",
-      "provedBy": []
+      "digest": "Strategies: fixed-size baseline (sample defaults size 512, overlap 50, applied to characters), sentence-aware (recommended for prose, `maxTokens` 256) and semantic (best quality, higher cost; split at markdown headers `^#{1,3} `). By document type: legal -> sentence-aware 256 tokens; technical docs -> semantic by headers; Q&A -> keep whole Q+A; code -> whole function; news -> paragraph, 512 tokens. Estimate tokens as chars/4 for English (about 3 chars per token for Portuguese), or tiktoken if available. Always store chunk metadata (DocumentId, DocumentTitle, SourceUrl, ChunkIndex, StartCharIndex, Section, IndexedAt) for filtering and citation. Checklist: overlap 10-20% so boundaries do not cut context, minimum 50 tokens, maximum about 512 (far below the 8192-token embedding input limit), and re-index when a document changes, detected via a content hash."
     },
     {
       "id": "frontend-design-system-ai-image-generation",
@@ -1832,16 +1155,6 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "Image Generation",
-        "AI Assets",
-        "Gemini Images",
-        "brand fidelity",
-        "reference images",
-        "favicon",
-        "og image",
-        "asset generation"
-      ],
       "anchors": {
         "when-to-use": "#when-to-use-ai-generated-images",
         "prompt-patterns": "#prompt-engineering-patterns",
@@ -1853,9 +1166,7 @@
         "favicon-og": "#the-two-assets-everyone-forgets",
         "variations": "#variations-and-cost"
       },
-      "digest": "Guidelines for generating project images with the morph-assets MCP (OpenRouter; default openai/gpt-image-2.5-flare, drafts on mai-image-2.6-flash, gemini-3.1-flash-image for 2K/4K or 6-14 refs; models: [...] compares): when to use AI versus stock versus SVG, prompt patterns, aspect ratios, iterative editing and assets.md format. Core principle is brand fidelity over invention: always pass the client's real assets as references (or @brand with a project) via edit_image rather than generating in a vacuum, never AI-recreate a property developer's architectural render or a physical product (animate or reference the real one), and chain derivatives from an approved hero so the whole set shares light, palette and identity. Frame anything destined to become video WITHOUT a face, because video moderation is stricter (E005), and generate scrub frames at the video's exact ratio with the subject opposite the copy. Always produce the two forgotten assets: a favicon derived from the real logo (never a new one) and a 1200x630 OG share image. Offer two to three genuinely different variations per image (variants returns a contact sheet), varying angle, light or composition since seed is not supported by the GPT Image/Gemini models, and never advance with a weak image because every derivative inherits it. Copy to render goes between double quotes; CONFIRMATION_REQUIRED needs human approval and a confirmToken.",
-      "verifiedAgainst": "morph-assets MCP (OpenRouter; default model `openai/gpt-image-2.5-flare`) + Next.js 15 `next/image`.",
-      "provedBy": []
+      "digest": "Guidelines for generating project images with the morph-assets MCP (OpenRouter; default openai/gpt-image-2.5-flare, drafts on mai-image-2.6-flash, gemini-3.1-flash-image for 2K/4K or 6-14 refs; models: [...] compares): when to use AI versus stock versus SVG, prompt patterns, aspect ratios, iterative editing and assets.md format. Core principle is brand fidelity over invention: always pass the client's real assets as references (or @brand with a project) via edit_image rather than generating in a vacuum, never AI-recreate a property developer's architectural render or a physical product (animate or reference the real one), and chain derivatives from an approved hero so the whole set shares light, palette and identity. Frame anything destined to become video WITHOUT a face, because video moderation is stricter (E005), and generate scrub frames at the video's exact ratio with the subject opposite the copy. Always produce the two forgotten assets: a favicon derived from the real logo (never a new one) and a 1200x630 OG share image. Offer two to three genuinely different variations per image (variants returns a contact sheet), varying angle, light or composition since seed is not supported by the GPT Image/Gemini models, and never advance with a weak image because every derivative inherits it. Copy to render goes between double quotes; CONFIRMATION_REQUIRED needs human approval and a confirmToken."
     },
     {
       "id": "frontend-design-system-ai-video-generation",
@@ -1874,17 +1185,6 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "video generation",
-        "seedance",
-        "img2vid",
-        "endImage",
-        "directional footage",
-        "loop video",
-        "E005",
-        "animate render",
-        "scroll scrub footage"
-      ],
       "anchors": {
         "loop-vs-directional": "#section-1-the-distinction-that-decides-everything",
         "directional": "#section-2-building-directional-footage",
@@ -1892,9 +1192,7 @@
         "cost-ladder": "#section-4-the-cost-ladder",
         "prompt-skeleton": "#section-5-prompt-skeleton"
       },
-      "digest": "The decisive rule: a perfect loop has an end frame identical to its start, which is right for a self-playing ambient background and WRONG for scroll scrubbing, because start and end look the same and the page reads as frozen while the user scrolls. Scroll-driven footage needs directional movement via generate_video with an endImage (push-in/dolly is the most reliable, then reveal, pull-back, slow tilt); avoid orbits and any movement that returns to its origin. Client architectural renders are animated with img2vid, never AI-recreated. Human faces repeatedly trip moderation (E005), so crop the face out of frame (neck down, hands, product) and reserve faces for static image generation. Always climb the cost ladder: seedance-1-5-pro 480p draft to judge framing and movement, then promoteFrom to seedance-2.0 1080p only after approval (same prompt, frames and seed), then re-extract frames with a bumped cache-bust. seedance-2.0-mini does NOT respect endImage and Veo 3.1 Lite/Fast are inconclusive, so scrub only on Seedance 1.5 Pro/2.0 and check the last-frame SSIM QA. Video has no ZDR on OpenRouter: nothing sensitive in the frames. Prompts read like director notes with no hype words, and must reserve a calm dark region for the page copy with the subject on the opposite side. Generation is async via the morph-assets MCP (OpenRouter): a running job is polled with get_video (several ids at once), never by resending generate_video; library reads local history and spends no credits; media_tool extracts scrub frames and posters.",
-      "verifiedAgainst": "morph-assets MCP (generate_video, generate_loop_video, get_video, library, media_tool) over OpenRouter; models `bytedance/seedance-1-5-pro` and `bytedance/seedance-2.0`.",
-      "provedBy": []
+      "digest": "The decisive rule: a perfect loop has an end frame identical to its start, which is right for a self-playing ambient background and WRONG for scroll scrubbing, because start and end look the same and the page reads as frozen while the user scrolls. Scroll-driven footage needs directional movement via generate_video with an endImage (push-in/dolly is the most reliable, then reveal, pull-back, slow tilt); avoid orbits and any movement that returns to its origin. Client architectural renders are animated with img2vid, never AI-recreated. Human faces repeatedly trip moderation (E005), so crop the face out of frame (neck down, hands, product) and reserve faces for static image generation. Always climb the cost ladder: seedance-1-5-pro 480p draft to judge framing and movement, then promoteFrom to seedance-2.0 1080p only after approval (same prompt, frames and seed), then re-extract frames with a bumped cache-bust. seedance-2.0-mini does NOT respect endImage and Veo 3.1 Lite/Fast are inconclusive, so scrub only on Seedance 1.5 Pro/2.0 and check the last-frame SSIM QA. Video has no ZDR on OpenRouter: nothing sensitive in the frames. Prompts read like director notes with no hype words, and must reserve a calm dark region for the page copy with the subject on the opposite side. Generation is async via the morph-assets MCP (OpenRouter): a running job is polled with get_video (several ids at once), never by resending generate_video; library reads local history and spends no credits; media_tool extracts scrub frames and posters."
     },
     {
       "id": "frontend-design-system-animations",
@@ -1909,21 +1207,11 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "animations",
-        "transitions",
-        "motion",
-        "CSS animations",
-        "keyframes",
-        "prefers-reduced-motion"
-      ],
       "anchors": {
         "tokens": "#stagger--timing",
         "principles": "#css-animation-patterns"
       },
-      "digest": "CSS animation library for design-system.css: keyframes (fadeIn/Out, slideIn Up/Down/Left/Right, scaleIn, bounce, pulse, spin, shimmer) exposed as `.animate-*` classes (0.3s fade/scale, 0.5s slides; bounce 1s, pulse 2s, spin 1s infinite) plus `.duration-fast/normal/slow` (150/300/500ms), `.stagger-1..10` (0.1s steps) and `.ease-bounce`. For staggered lists set `animation-delay` AND `animation-fill-mode: backwards` (marked CRITICAL: otherwise elements flash before the delay). Skeletons use `.shimmer` (1.5s infinite). Hover/focus transitions run 0.15s to 0.3s. Always include the `@media (prefers-reduced-motion: reduce)` block (0.01ms durations, one iteration). Beyond CSS: Motion (formerly Framer Motion) for simple enter/exit, layout and gesture transitions (`frontend/nextjs/motion-patterns.md`); GSAP for ScrollTrigger, SVG morph, timelines (`frontend/gsap/gsap-core.md`).",
-      "verifiedAgainst": "CSS animations/transitions (language-level, no framework).",
-      "provedBy": []
+      "digest": "CSS animation library for design-system.css: keyframes (fadeIn/Out, slideIn Up/Down/Left/Right, scaleIn, bounce, pulse, spin, shimmer) exposed as `.animate-*` classes (0.3s fade/scale, 0.5s slides; bounce 1s, pulse 2s, spin 1s infinite) plus `.duration-fast/normal/slow` (150/300/500ms), `.stagger-1..10` (0.1s steps) and `.ease-bounce`. For staggered lists set `animation-delay` AND `animation-fill-mode: backwards` (marked CRITICAL: otherwise elements flash before the delay). Skeletons use `.shimmer` (1.5s infinite). Hover/focus transitions run 0.15s to 0.3s. Always include the `@media (prefers-reduced-motion: reduce)` block (0.01ms durations, one iteration). Beyond CSS: Motion (formerly Framer Motion) for simple enter/exit, layout and gesture transitions (`frontend/nextjs/motion-patterns.md`); GSAP for ScrollTrigger, SVG morph, timelines (`frontend/gsap/gsap-core.md`)."
     },
     {
       "id": "frontend-design-system-naming",
@@ -1938,20 +1226,11 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "BEM",
-        "CSS naming",
-        "class naming",
-        "design token naming",
-        "component naming"
-      ],
       "anchors": {
         "blocks": "#bem-for-reusable-components",
         "tokens": "#css-variables-with-namespace"
       },
-      "digest": "CSS naming rests on four principles: a page prefix prevents conflicts, BEM for components gives clear hierarchy, namespaced variables avoid library collisions, and state suffixes keep modifiers consistent. Page-specific elements take the page name as prefix (.home-hero, .checkout-form, .dashboard-stats, .auth-form); reusable components use BEM: block .card, element .card__header, modifier .card--featured. Rule: BEM for reusable components, page prefix for page-specific elements. Custom properties go in :root under the --app- namespace (--app-primary, --app-spacing-md, --app-font-heading). State modifiers use fixed suffixes: --active, --disabled, --loading, --error (.button, .button--active, .button--disabled).",
-      "verifiedAgainst": "CSS (BEM + custom properties — language-level, no framework).",
-      "provedBy": []
+      "digest": "CSS naming rests on four principles: a page prefix prevents conflicts, BEM for components gives clear hierarchy, namespaced variables avoid library collisions, and state suffixes keep modifiers consistent. Page-specific elements take the page name as prefix (.home-hero, .checkout-form, .dashboard-stats, .auth-form); reusable components use BEM: block .card, element .card__header, modifier .card--featured. Rule: BEM for reusable components, page prefix for page-specific elements. Custom properties go in :root under the --app- namespace (--app-primary, --app-spacing-md, --app-font-heading). State modifiers use fixed suffixes: --active, --disabled, --loading, --error (.button, .button--active, .button--disabled)."
     },
     {
       "id": "frontend-design-system-premium-finish",
@@ -1966,27 +1245,15 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "premium finish",
-        "polish layer",
-        "film grain",
-        "atmosphere",
-        "load-in stagger",
-        "scrim",
-        "text over video",
-        "metallic accent",
-        "looks like a template"
-      ],
       "anchors": {
         "typography": "#section-1-typography-with-character",
         "atmosphere": "#section-2-atmosphere-never-flat-color",
         "loadin": "#section-3-one-orchestrated-load-in-beats-ten-micro-interactions",
         "legibility": "#section-4-legibility-over-video-close-to-a-hard-rule",
-        "order": "#section-7-order-of-application"
+        "order": "#section-7-order-of-application",
+        "apppatterns": "#section-8-patterns-for-app-screens"
       },
-      "digest": "The finish layer that separates a working build from one a client reads as expensive, applied from the start rather than as a final polish pass. Principles, never a fixed recipe, and never converge on the same choices across projects: commit to a display font chosen from the brand (stack defaults and the AI-tell faces like Space Grotesk/Playfair announce machine-generated); use atmosphere instead of flat color (feTurbulence film grain at low opacity, radial brand glow, vignette); concentrate effort on ONE orchestrated hero load-in with staggered animation-delay rather than scattered micro-interactions; text over media always gets a DIRECTIONAL scrim (dark where the copy lives, clear over the subject) plus text-shadow as insurance against bright frames; one precious accent used in three places or fewer. Define brand tokens as CSS variables first, then atmosphere, then hero, then accent, then details.",
-      "verifiedAgainst": "Production landing pages, CSS-only techniques, no runtime dependency.",
-      "provedBy": []
+      "digest": "The finish layer that separates a working build from one a client reads as expensive, applied from the start rather than as a final polish pass. Principles, never a fixed recipe, and never converge on the same choices across projects: commit to a display font chosen from the brand (stack defaults and the AI-tell faces like Space Grotesk/Playfair announce machine-generated); use atmosphere instead of flat color (feTurbulence film grain at low opacity, radial brand glow, vignette); concentrate effort on ONE orchestrated hero load-in with staggered animation-delay rather than scattered micro-interactions; text over media always gets a DIRECTIONAL scrim (dark where the copy lives, clear over the subject) plus text-shadow as insurance against bright frames; one precious accent used in three places or fewer. Define brand tokens as CSS variables first, then atmosphere, then hero, then accent, then details. App screens too (every ui-designer surface): bottom sheet on mobile with 44px targets, stories-style progress and synchronized highlight sharing --i/--beat via animation-delay, scene cards without real data (never a made-up number), dot grid faded with mask-image, and a composed static frame for prefers-reduced-motion."
     },
     {
       "id": "frontend-gsap-core",
@@ -2003,16 +1270,6 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "GSAP",
-        "GreenSock",
-        "gsap.to",
-        "gsap.from",
-        "useGSAP",
-        "gsap timeline",
-        "gsap utils",
-        "gsap performance"
-      ],
       "anchors": {
         "apis": "#section-3-core-animation-apis",
         "react": "#section-4-reactnextjs-integration",
@@ -2020,9 +1277,7 @@
         "performance": "#section-7-performance",
         "accessibility": "#section-8-accessibility"
       },
-      "digest": "GSAP 3.13 + `@gsap/react` in Next.js. Use GSAP for ScrollTrigger, SVG morph/draw, complex timelines, SplitText and Draggable+Inertia; use Framer Motion for simple enter/exit, layout, gestures and AnimatePresence. NEVER animate one DOM element with both (they fight over inline styles). All GSAP code lives in `'use client'` components, inside `useGSAP()` (never `useEffect`) with ALWAYS `{ scope: containerRef }`, which cleans up automatically; handlers outside the callback need `contextSafe()`. Register plugins once at app init (`layout.tsx`/`providers.tsx`), not in components. Prefer `autoAlpha` over `opacity`; animate only transforms and opacity, never width/height/top/left; `gsap.quickTo()` for cursor followers. Honoring `prefers-reduced-motion` is MANDATORY (`gsap.matchMedia()`). Never hardcode durations or easings: import `durations`/`easings` from `@/lib/design-tokens`.",
-      "verifiedAgainst": "GSAP 3.13 + @gsap/react.",
-      "provedBy": []
+      "digest": "GSAP 3.13 + `@gsap/react` in Next.js. Use GSAP for ScrollTrigger, SVG morph/draw, complex timelines, SplitText and Draggable+Inertia; use Framer Motion for simple enter/exit, layout, gestures and AnimatePresence. NEVER animate one DOM element with both (they fight over inline styles). All GSAP code lives in `'use client'` components, inside `useGSAP()` (never `useEffect`) with ALWAYS `{ scope: containerRef }`, which cleans up automatically; handlers outside the callback need `contextSafe()`. Register plugins once at app init (`layout.tsx`/`providers.tsx`), not in components. Prefer `autoAlpha` over `opacity`; animate only transforms and opacity, never width/height/top/left; `gsap.quickTo()` for cursor followers. Honoring `prefers-reduced-motion` is MANDATORY (`gsap.matchMedia()`). Never hardcode durations or easings: import `durations`/`easings` from `@/lib/design-tokens`."
     },
     {
       "id": "frontend-gsap-plugins",
@@ -2038,25 +1293,13 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "Flip",
-        "SplitText",
-        "MorphSVG",
-        "DrawSVG",
-        "MotionPath",
-        "Draggable",
-        "Observer",
-        "ScrollToPlugin"
-      ],
       "anchors": {
         "flip": "#flip-plugin-free",
         "splittext": "#splittext",
         "morphsvg": "#morphsvg",
         "drawsvg": "#drawsvg"
       },
-      "digest": "GSAP 3.13 + @gsap/react: core and every plugin (Flip, SplitText, MorphSVG, DrawSVG, MotionPath, Draggable...) are free from the public `gsap` package (`npm install gsap @gsap/react`); the old `gsap@npm:@gsap/shockingly` private-registry instruction is obsolete. Call `gsap.registerPlugin(...)` ONCE at app init (`'use client'`); animate with `useGSAP` + `scope`. Flip: `Flip.getState()`, change the DOM, `Flip.from(state, { absolute: true })`; with ScrollTrigger, call `ScrollTrigger.refresh()` after the layout change. SplitText: `SplitText.create` with `autoSplit: true`, animate inside `onSplit`; it adds `<div>` wrappers that affect layout, and `useGSAP` reverts it. MorphSVG needs `<path>` elements (`convertToPath` for others); DrawSVG needs a visible stroke (not fill); ScrollToPlugin `autoKill: true`; Draggable `throwProps` needs InertiaPlugin; Observer normalizes wheel/touch/pointer.",
-      "verifiedAgainst": "GSAP 3.13 + @gsap/react.",
-      "provedBy": []
+      "digest": "GSAP 3.13 + @gsap/react: core and every plugin (Flip, SplitText, MorphSVG, DrawSVG, MotionPath, Draggable...) are free from the public `gsap` package (`npm install gsap @gsap/react`); the old `gsap@npm:@gsap/shockingly` private-registry instruction is obsolete. Call `gsap.registerPlugin(...)` ONCE at app init (`'use client'`); animate with `useGSAP` + `scope`. Flip: `Flip.getState()`, change the DOM, `Flip.from(state, { absolute: true })`; with ScrollTrigger, call `ScrollTrigger.refresh()` after the layout change. SplitText: `SplitText.create` with `autoSplit: true`, animate inside `onSplit`; it adds `<div>` wrappers that affect layout, and `useGSAP` reverts it. MorphSVG needs `<path>` elements (`convertToPath` for others); DrawSVG needs a visible stroke (not fill); ScrollToPlugin `autoKill: true`; Draggable `throwProps` needs InertiaPlugin; Observer normalizes wheel/touch/pointer."
     },
     {
       "id": "frontend-gsap-scrolltrigger",
@@ -2073,23 +1316,13 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "ScrollTrigger",
-        "scroll animation",
-        "pinning",
-        "scrubbing",
-        "parallax",
-        "scroll-driven"
-      ],
       "anchors": {
         "basic": "#section-2-basic-scrolltrigger",
         "scrub": "#section-3-scrubbing",
         "pin": "#section-4-pinning",
         "batch": "#section-5-batch-processing"
       },
-      "digest": "GSAP 3.13 ScrollTrigger in Next.js: all code lives in 'use client' components inside useGSAP(() => {...}, { scope }), which auto-kills tweens and triggers on unmount (without it, use gsap.context() and ctx.revert()); orphaned triggers leak memory and break later routes. gsap.registerPlugin(ScrollTrigger) once at app init, never inside useEffect or loops; never ScrollTrigger.create() at module scope. Scrub needs ease 'none'; scrub: true is 1:1, use 0.3-1 in production. Pin: pin: true with anticipatePin: 1; pinSpacing: false only for intentional overlap; never nest pins. Use ScrollTrigger.batch for grids (20+ items), snap durations under 0.8s. Responsive: define both desktop and mobile cases, exclusive breakpoints (767/768). Call ScrollTrigger.refresh() after dynamic content, layout shifts, route changes and image onLoad; normalizeScroll(true) helps iOS Safari.",
-      "verifiedAgainst": "GSAP 3.13 ScrollTrigger + @gsap/react.",
-      "provedBy": []
+      "digest": "GSAP 3.13 ScrollTrigger in Next.js: all code lives in 'use client' components inside useGSAP(() => {...}, { scope }), which auto-kills tweens and triggers on unmount (without it, use gsap.context() and ctx.revert()); orphaned triggers leak memory and break later routes. gsap.registerPlugin(ScrollTrigger) once at app init, never inside useEffect or loops; never ScrollTrigger.create() at module scope. Scrub needs ease 'none'; scrub: true is 1:1, use 0.3-1 in production. Pin: pin: true with anticipatePin: 1; pinSpacing: false only for intentional overlap; never nest pins. Use ScrollTrigger.batch for grids (20+ items), snap durations under 0.8s. Responsive: define both desktop and mobile cases, exclusive breakpoints (767/768). Call ScrollTrigger.refresh() after dynamic content, layout shifts, route changes and image onLoad; normalizeScroll(true) helps iOS Safari."
     },
     {
       "id": "frontend-nextjs-app-router",
@@ -2104,20 +1337,11 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "app router",
-        "Next.js 14",
-        "server components",
-        "app directory",
-        "RSC"
-      ],
       "anchors": {
         "layout": "#root-layout--required-providers",
         "routing": "#app-directory-structure"
       },
-      "digest": "Next.js 15 App Router, TypeScript only (no .js/.jsx). Server Components by default; add `'use client'` only for interaction (onClick, useState/useEffect/useRef), browser APIs, TanStack Query hooks and interactive shadcn/ui. `app/` is for routing only: business logic goes to `features/`, never in `page.tsx`. Never fetch data in a Client Component when a Server Component can, and never fetch in `useEffect`: use a Server Component or TanStack Query. Co-locate `loading.tsx` and `error.tsx` (`error.tsx` must be a Client Component) beside `page.tsx`. Server Components call the .NET backend directly using the dedicated `BACKEND_API_PREFIX` from `@/lib/api/prefixes`, never the same-origin proxy prefix used by Client Components; always check `res.ok`. Avoid `route.ts` API routes (use the .NET API). The root `layout.tsx` wraps children in `QueryProvider` and the sonner `Toaster`.",
-      "verifiedAgainst": "Next.js 15.",
-      "provedBy": []
+      "digest": "Next.js 15 App Router, TypeScript only (no .js/.jsx). Server Components by default; add `'use client'` only for interaction (onClick, useState/useEffect/useRef), browser APIs, TanStack Query hooks and interactive shadcn/ui. `app/` is for routing only: business logic goes to `features/`, never in `page.tsx`. Never fetch data in a Client Component when a Server Component can, and never fetch in `useEffect`: use a Server Component or TanStack Query. Co-locate `loading.tsx` and `error.tsx` (`error.tsx` must be a Client Component) beside `page.tsx`. Server Components call the .NET backend directly using the dedicated `BACKEND_API_PREFIX` from `@/lib/api/prefixes`, never the same-origin proxy prefix used by Client Components; always check `res.ok`. Avoid `route.ts` API routes (use the .NET API). The root `layout.tsx` wraps children in `QueryProvider` and the sonner `Toaster`."
     },
     {
       "id": "frontend-nextjs-components",
@@ -2132,20 +1356,11 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "react components",
-        "server component",
-        "client component",
-        "shadcn/ui",
-        "UI components"
-      ],
       "anchors": {
         "patterns": "#three-tier-hierarchy",
         "shadcn": "#tier-1--shadcnui-primitives"
       },
-      "digest": "Three tiers (Next.js 16 + shadcn 4 CLI): `components/ui/` is shadcn CLI output (add via `npx shadcn@latest add`, NEVER edit because the CLI regenerates it; wrap it in `components/` instead); `components/` holds shared composed components with no business logic and NEVER imports from `features/`; `features/*/components/` is feature-scoped and may know the domain. Add `'use client'` only if the component uses hooks, events or browser APIs (not on every component: unnecessary client JS). Never pass raw API/fetch data as props: transform it into typed props and validate with Zod first. Props interfaces always accept an optional `className` for Tailwind override. The shared data table is specified once in `admin-app/data-table.md`: do not write a second `components/data-table.tsx`; a feature list is a Tier 3 component that owns the columns and the URL-to-table mapping.",
-      "verifiedAgainst": "Next.js 16 + shadcn 4 CLI (the code blocks typecheck under `tsc --strict`).",
-      "provedBy": []
+      "digest": "Three tiers (Next.js 16 + shadcn 4 CLI): `components/ui/` is shadcn CLI output (add via `npx shadcn@latest add`, NEVER edit because the CLI regenerates it; wrap it in `components/` instead); `components/` holds shared composed components with no business logic and NEVER imports from `features/`; `features/*/components/` is feature-scoped and may know the domain. Add `'use client'` only if the component uses hooks, events or browser APIs (not on every component: unnecessary client JS). Never pass raw API/fetch data as props: transform it into typed props and validate with Zod first. Props interfaces always accept an optional `className` for Tailwind override. The shared data table is specified once in `admin-app/data-table.md`: do not write a second `components/data-table.tsx`; a feature list is a Tier 3 component that owns the columns and the URL-to-table mapping."
     },
     {
       "id": "frontend-nextjs-data-fetching",
@@ -2160,20 +1375,11 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "TanStack Query",
-        "react-query",
-        "server actions",
-        "data fetching",
-        "useQuery"
-      ],
       "anchors": {
         "server": "#server-component--tanstack-query-handoff",
         "client": "#usequery-hook-pattern"
       },
-      "digest": "Server Components do the initial load and call the .NET backend directly with BACKEND_API_PREFIX; Client Components never call the backend — they hit a same-origin proxy route with PROXY_API_PREFIX. Two named constants, never one shared API_PREFIX: the side that drifts breaks silently at runtime. Client data is TanStack Query 5: useQuery for reads, useMutation for writes, then invalidateQueries({ queryKey: userKeys.lists() }) (object syntax). Keys come from a per-feature key factory, never hardcoded ['users']. Every response is parsed with a Zod schema. QueryClient: staleTime 60s, retry 1, created once in useState; the Server Component passes initialData to the client hook. FORBIDDEN: useEffect(() => fetch…, []) and fetching a whole collection to page/sort/filter in the browser — page on the server, query in the URL.",
-      "verifiedAgainst": "Next.js 15 + TanStack Query 5 + Zod 4.",
-      "provedBy": []
+      "digest": "Server Components do the initial load and call the .NET backend directly with BACKEND_API_PREFIX; Client Components never call the backend — they hit a same-origin proxy route with PROXY_API_PREFIX. Two named constants, never one shared API_PREFIX: the side that drifts breaks silently at runtime. Client data is TanStack Query 5: useQuery for reads, useMutation for writes, then invalidateQueries({ queryKey: userKeys.lists() }) (object syntax). Keys come from a per-feature key factory, never hardcoded ['users']. Every response is parsed with a Zod schema. QueryClient: staleTime 60s, retry 1, created once in useState; the Server Component passes initialData to the client hook. FORBIDDEN: useEffect(() => fetch…, []) and fetching a whole collection to page/sort/filter in the browser — page on the server, query in the URL."
     },
     {
       "id": "frontend-nextjs-forms",
@@ -2188,20 +1394,11 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "react-hook-form",
-        "Zod",
-        "form validation",
-        "shadcn Field",
-        "Controller"
-      ],
       "anchors": {
         "validation": "#schema-composition",
         "submission": "#complete-form-pattern"
       },
-      "digest": "react-hook-form + Zod + shadcn Field components wired through Controller. Define the Zod schema first and derive the type with z.infer (z.input/z.output when it coerces); zodResolver connects it; Field/FieldLabel/FieldError render each field and its error; never useState per field; submit through TanStack Query useMutation and put a failed submit on root. Edit forms reuse the create schema (.partial()). Zod 4: z.email(), a single `error` param. A legacy shadcn Form/FormField screen is migrated when touched, never extended. Admin CRUD forms add the deltas of admin-app/forms.md.",
-      "verifiedAgainst": "Next.js 16 + react-hook-form 7 + Zod 4 + @hookform/resolvers 5 + shadcn 4 `Field` (the code blocks typecheck under `tsc --strict`).",
-      "provedBy": []
+      "digest": "react-hook-form + Zod + shadcn Field components wired through Controller. Define the Zod schema first and derive the type with z.infer (z.input/z.output when it coerces); zodResolver connects it; Field/FieldLabel/FieldError render each field and its error; never useState per field; submit through TanStack Query useMutation and put a failed submit on root. Edit forms reuse the create schema (.partial()). Zod 4: z.email(), a single `error` param. A legacy shadcn Form/FormField screen is migrated when touched, never extended. Admin CRUD forms add the deltas of admin-app/forms.md."
     },
     {
       "id": "frontend-nextjs-motion-patterns",
@@ -2217,22 +1414,13 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "framer-motion",
-        "animation variants",
-        "motion design",
-        "page transition",
-        "AnimatePresence"
-      ],
       "anchors": {
         "variants": "#section-1-core-variants-library",
         "tokens": "#section-2-design-token-bridge",
         "scroll": "#section-3-scroll-animations",
         "accessibility": "#section-7-wcag-accessibility-mandatory"
       },
-      "digest": "Component-level motion with Motion for React (the stack table's 'Framer Motion', its former name; motion 12+, current npm major 14): npm install motion and import from 'motion/react'. framer-motion is not deprecated (motion depends on it and re-exports it), but a codebase keeps one import path, motion/react, and never adds framer-motion alongside it. Variants live in motion/variants.ts (fadeIn, slideInUp/Down/Left/Right, scaleIn, staggerContainer, staggerItem, pageTransition) and take durations and easings from @/lib/design-tokens (fast 0.15, base 0.3); never hardcode duration numbers or easing arrays. Scroll reveals: whileInView with viewport once: true for simple cases, useInView for control. Page transitions: AnimatePresence mode='wait' keyed by usePathname(), subtle (y: 8), inside a 'use client' PageTransition provider -- the root app/layout.tsx stays a Server Component (no 'use client', keeps metadata) and just renders the provider. WCAG is mandatory: useReducedMotion() strips x/y/scale and keeps opacity, plus a prefers-reduced-motion CSS fallback. Skeletons use CSS animate-pulse, not motion. Limit motion to 3-5 moments per page. Scroll-driven scenes (ScrollTrigger, Lenis) belong to GSAP; never share an element with it.",
-      "verifiedAgainst": "Motion for React 12+ (`motion`, imports from `motion/react`); the npm registry and the `motion`/`framer-motion`/`motion-dom` 14.0.0 typings were read on 2026-10-03 (`motion/react` re-exports `framer-motion`, which re-exports `motion-dom`: `Variants`, `useInView`, `AnimatePresence`, `useReducedMotion`, `staggerChildren`/`delayChildren` all present). The TSX snippets are documentary.",
-      "provedBy": []
+      "digest": "Component-level motion with Motion for React (the stack table's 'Framer Motion', its former name; motion 12+, current npm major 14): npm install motion and import from 'motion/react'. framer-motion is not deprecated (motion depends on it and re-exports it), but a codebase keeps one import path, motion/react, and never adds framer-motion alongside it. Variants live in motion/variants.ts (fadeIn, slideInUp/Down/Left/Right, scaleIn, staggerContainer, staggerItem, pageTransition) and take durations and easings from @/lib/design-tokens (fast 0.15, base 0.3); never hardcode duration numbers or easing arrays. Scroll reveals: whileInView with viewport once: true for simple cases, useInView for control. Page transitions: AnimatePresence mode='wait' keyed by usePathname(), subtle (y: 8), inside a 'use client' PageTransition provider -- the root app/layout.tsx stays a Server Component (no 'use client', keeps metadata) and just renders the provider. WCAG is mandatory: useReducedMotion() strips x/y/scale and keeps opacity, plus a prefers-reduced-motion CSS fallback. Skeletons use CSS animate-pulse, not motion. Limit motion to 3-5 moments per page. Scroll-driven scenes (ScrollTrigger, Lenis) belong to GSAP; never share an element with it."
     },
     {
       "id": "frontend-nextjs-naming-conventions",
@@ -2247,20 +1435,11 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "naming conventions",
-        "file naming",
-        "component naming",
-        "Next.js naming",
-        "TypeScript naming"
-      ],
       "anchors": {
         "files": "#complete-reference-table",
         "components": "#complete-reference-table"
       },
-      "digest": "Next.js naming (prevents Linux case-sensitivity bugs). File names are ALWAYS kebab-case (`user-card.tsx`, never `UserCard.tsx`); exports are PascalCase for components (`UserCard`) and camelCase with a `use` prefix for hooks, whose files are kebab-case too (`use-users.ts` -> `useUsers`, `use-user.ts` for a single GET, `use-create-user.ts`, `use-update-user.ts`, `use-delete-user.ts`). Zod schema files end in `.schemas.ts` (`createUserSchema`) and type files in `.types.ts`, with types derived via `z.infer` instead of hand-written duplicates. Components use named exports (`export function UserCard`, not `export default`); `page.tsx` exports `default`. A feature `index.ts` re-exports. Never mix cases within a category (no `UserCard.tsx` next to `user-profile.tsx`).",
-      "verifiedAgainst": "Next.js 15 + Zod 4.",
-      "provedBy": []
+      "digest": "Next.js naming (prevents Linux case-sensitivity bugs). File names are ALWAYS kebab-case (`user-card.tsx`, never `UserCard.tsx`); exports are PascalCase for components (`UserCard`) and camelCase with a `use` prefix for hooks, whose files are kebab-case too (`use-users.ts` -> `useUsers`, `use-user.ts` for a single GET, `use-create-user.ts`, `use-update-user.ts`, `use-delete-user.ts`). Zod schema files end in `.schemas.ts` (`createUserSchema`) and type files in `.types.ts`, with types derived via `z.infer` instead of hand-written duplicates. Components use named exports (`export function UserCard`, not `export default`); `page.tsx` exports `default`. A feature `index.ts` re-exports. Never mix cases within a category (no `UserCard.tsx` next to `user-profile.tsx`)."
     },
     {
       "id": "frontend-nextjs-nextjs-patterns",
@@ -2275,20 +1454,11 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "Next.js patterns",
-        "middleware",
-        "auth patterns",
-        "caching patterns",
-        "image optimization"
-      ],
       "anchors": {
         "auth": "#route-handlers-bff-pattern",
         "caching": "#react-query--neon"
       },
-      "digest": "Next.js 15 App Router (not Pages Router): Server Components by default, `'use client'` only for state, effects, events or browser APIs; colocate `loading.tsx` and `error.tsx` (the latter MUST be `'use client'`) with `page.tsx`. Route Handlers act as a BFF: check `auth.getSession()` (401 if absent) and delegate to the .NET API; database access lives in the .NET backend via EF Core, NEVER in Next.js route handlers. Validate input with Zod on client and server (`safeParse`, 400). Fetch with TanStack Query (`useQuery`/`useMutation`, `staleTime: 60_000`, `retry: 1`, `invalidateQueries` on success), never `useEffect` for data fetching. Forms: react-hook-form + `zodResolver`. shadcn is copied via `npx shadcn@latest add`, not an npm dependency. Keep `\"strict\": true` plus `noUncheckedIndexedAccess` (agents self-correct from compiler errors); no `any` for API responses (Zod schema + `z.infer`).",
-      "verifiedAgainst": "Next.js 15 + TanStack Query 5 + Zod 4 + react-hook-form 7.",
-      "provedBy": []
+      "digest": "Next.js 15 App Router (not Pages Router): Server Components by default, `'use client'` only for state, effects, events or browser APIs; colocate `loading.tsx` and `error.tsx` (the latter MUST be `'use client'`) with `page.tsx`. Route Handlers act as a BFF: check `auth.getSession()` (401 if absent) and delegate to the .NET API; database access lives in the .NET backend via EF Core, NEVER in Next.js route handlers. Validate input with Zod on client and server (`safeParse`, 400). Fetch with TanStack Query (`useQuery`/`useMutation`, `staleTime: 60_000`, `retry: 1`, `invalidateQueries` on success), never `useEffect` for data fetching. Forms: react-hook-form + `zodResolver`. shadcn is copied via `npx shadcn@latest add`, not an npm dependency. Keep `\"strict\": true` plus `noUncheckedIndexedAccess` (agents self-correct from compiler errors); no `any` for API responses (Zod schema + `z.infer`)."
     },
     {
       "id": "frontend-nextjs-project-structure",
@@ -2303,19 +1473,11 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "project structure",
-        "folder structure",
-        "src directory",
-        "app directory organization"
-      ],
       "anchors": {
         "structure": "#canonical-folder-tree",
         "organization": "#feature-index-pattern"
       },
-      "digest": "Next.js 15 App Router, src/ layout with the @/ alias, feature-based. src/app/ is routing only (layout, page, loading, error) and imports from features/, never the reverse. Each src/features/{feature-name}/ holds components/, hooks/ (TanStack Query hooks such as use-users.ts, use-create-user.ts), types/ (*.types.ts plus *.schemas.ts with Zod and z.infer) and an index.ts that is the explicit public API: import from '@/features/users', never from deep paths. NEVER import one feature from another (extract to components/ or lib/); components/ must not import features/, is presentation only with NO business logic, and components/ui/ is shadcn, never edited directly. Shared hooks/ make no API calls. lib/ holds api-client.ts (typed fetch wrapper for the .NET API) and query-client.tsx; types/api.ts has PaginatedResponse<T> and ApiError; env.mjs validates env vars with Zod.",
-      "verifiedAgainst": "Next.js 15 (App Router, `src/` layout).",
-      "provedBy": []
+      "digest": "Next.js 15 App Router, src/ layout with the @/ alias, feature-based. src/app/ is routing only (layout, page, loading, error) and imports from features/, never the reverse. Each src/features/{feature-name}/ holds components/, hooks/ (TanStack Query hooks such as use-users.ts, use-create-user.ts), types/ (*.types.ts plus *.schemas.ts with Zod and z.infer) and an index.ts that is the explicit public API: import from '@/features/users', never from deep paths. NEVER import one feature from another (extract to components/ or lib/); components/ must not import features/, is presentation only with NO business logic, and components/ui/ is shadcn, never edited directly. Shared hooks/ make no API calls. lib/ holds api-client.ts (typed fetch wrapper for the .NET API) and query-client.tsx; types/api.ts has PaginatedResponse<T> and ApiError; env.mjs validates env vars with Zod."
     },
     {
       "id": "frontend-nextjs-state-management",
@@ -2330,20 +1492,11 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "zustand",
-        "React context",
-        "global state",
-        "state management",
-        "client state"
-      ],
       "anchors": {
         "patterns": "#state-decision-tree",
         "server": "#server-state-tanstack-query"
       },
-      "digest": "Server state (anything from the .NET API) lives in TanStack Query, never copied into `useState` via `useEffect`; derive state from server data instead of syncing it. Local UI state (modal open, form step, selected id) uses `useState`. A list's page, sort and filters, and a page's active tab, go in the URL (`searchParams`), never `useState`, so a refresh or shared link reopens the same view. Do not use React Context for server state (no caching or dedup); Context is for truly global theme, auth user or locale, and prop drilling 2-3 levels is fine. NEVER install Zustand or Redux before exhausting Server Components + TanStack Query. Zustand is justified only if ALL hold: state needed in 5+ unrelated components, complex update logic, Context causes measurable re-render problems, and the state is not from the server.",
-      "verifiedAgainst": "Next.js 15 + TanStack Query 5 + Zustand 5.",
-      "provedBy": []
+      "digest": "Server state (anything from the .NET API) lives in TanStack Query, never copied into `useState` via `useEffect`; derive state from server data instead of syncing it. Local UI state (modal open, form step, selected id) uses `useState`. A list's page, sort and filters, and a page's active tab, go in the URL (`searchParams`), never `useState`, so a refresh or shared link reopens the same view. Do not use React Context for server state (no caching or dedup); Context is for truly global theme, auth user or locale, and prop drilling 2-3 levels is fine. NEVER install Zustand or Redux before exhausting Server Components + TanStack Query. Zustand is justified only if ALL hold: state needed in 5+ unrelated components, complex update logic, Context causes measurable re-render problems, and the state is not from the server."
     },
     {
       "id": "frontend-nextjs-testing",
@@ -2358,25 +1511,12 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "vitest",
-        "jest",
-        "testing-library",
-        "Playwright",
-        "Next.js testing",
-        "component tests",
-        "test budget",
-        "orçamento de teste",
-        "it.each table"
-      ],
       "anchors": {
         "unit": "#component-test-pattern",
         "e2e": "#test-file-co-location",
         "test-budget": "#test-budget"
       },
-      "digest": "Vitest for unit tests, React Testing Library for component tests. Mock next/navigation with vi.mock. Test Server Actions with direct function calls. Use MSW for API mocking in component tests. Playwright for E2E tests against running app. Never test implementation details — test user behavior and output. Test budget per task: one test per postcondition plus one regression test per bug, more only with a one-line justification in the task; scenarios of the same behavior are rows of one it.each, never copied it() blocks; no test whose only assertion is a copy string (lint or publish-time validation instead); shared wrappers, MSW handlers and factories before new helpers; bugs and pure logic get tests in any order — the implementer runs its own filter once, never red-green cycles nor production mutation.",
-      "verifiedAgainst": "Vitest 3 + React Testing Library 16 + MSW 2.",
-      "provedBy": []
+      "digest": "Vitest for unit tests, React Testing Library for component tests. Mock next/navigation with vi.mock. Test Server Actions with direct function calls. Use MSW for API mocking in component tests. Playwright for E2E tests against running app. Never test implementation details — test user behavior and output. Test budget per task: one test per postcondition plus one regression test per bug, more only with a one-line justification in the task; scenarios of the same behavior are rows of one it.each, never copied it() blocks; no test whose only assertion is a copy string (lint or publish-time validation instead); shared wrappers, MSW handlers and factories before new helpers; bugs and pure logic get tests in any order — the implementer runs its own filter once, never red-green cycles nor production mutation."
     },
     {
       "id": "frontend-scroll-driven-frame-scrub",
@@ -2392,15 +1532,6 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "frame scrub",
-        "canvas scrub",
-        "scroll-driven video",
-        "scrollytelling video",
-        "apple scroll video",
-        "ffmpeg frames",
-        "poster fallback"
-      ],
       "anchors": {
         "why": "#section-1-canvas-not-video-currenttime",
         "extraction": "#section-2-frame-extraction",
@@ -2409,9 +1540,7 @@
         "responsive": "#section-6-responsive-and-reduced-motion",
         "verify": "#section-8-verify-with-motion-never-with-a-still"
       },
-      "digest": "Scroll-driven video is a preloaded JPG sequence drawn into a <canvas>, never a <video currentTime> driven by scroll (unreliable seek on iOS Safari, black-frame flashes) and never an autoplay loop (reads as a demo, not as user-driven). Extract with ffmpeg (fps=30, ~120-300 frames, -q:v 5), always extract a poster, hflip when the subject collides with the copy, and treat total sequence weight as a performance budget. Always cache-bust the frame URL (?v=N) when re-extracting under the same filenames. Known bug: a section starting hidden measures 0 and the canvas becomes 1x1 drawing one stretched pixel, so keep the canvas display:none and resize on the first loaded frame. Mobile and prefers-reduced-motion collapse to the static poster in both the JS guard and the CSS. Verify by driving the scroll through positions and comparing captured frames (allow ~350ms for scrub:0.4 to settle), never with a single screenshot.",
-      "verifiedAgainst": "GSAP 3.13 ScrollTrigger + Lenis 1.x + ffmpeg 6.x, shipped to production.",
-      "provedBy": []
+      "digest": "Scroll-driven video is a preloaded JPG sequence drawn into a <canvas>, never a <video currentTime> driven by scroll (unreliable seek on iOS Safari, black-frame flashes) and never an autoplay loop (reads as a demo, not as user-driven). Extract with ffmpeg (fps=30, ~120-300 frames, -q:v 5), always extract a poster, hflip when the subject collides with the copy, and treat total sequence weight as a performance budget. Always cache-bust the frame URL (?v=N) when re-extracting under the same filenames. Known bug: a section starting hidden measures 0 and the canvas becomes 1x1 drawing one stretched pixel, so keep the canvas display:none and resize on the first loaded frame. Mobile and prefers-reduced-motion collapse to the static poster in both the JS guard and the CSS. Verify by driving the scroll through positions and comparing captured frames (allow ~350ms for scrub:0.4 to settle), never with a single screenshot."
     },
     {
       "id": "frontend-scroll-driven-scroll-components",
@@ -2427,16 +1556,6 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "pinned gallery",
-        "horizontal scroll",
-        "scroll reveal",
-        "parallax drift",
-        "count-up",
-        "lightbox",
-        "scroll progress",
-        "expanding modal"
-      ],
       "anchors": {
         "reveal": "#section-1-usereveal-the-base-brick",
         "pinned": "#section-2-pinned-horizontal-gallery",
@@ -2444,9 +1563,7 @@
         "parallax": "#section-5-parallax-drift",
         "rules": "#section-9-cross-cutting-rules"
       },
-      "digest": "Toolbox of scroll-driven interaction patterns, not a mandatory list: useReveal (fade/rise with once:true) covers most content; pinned horizontal gallery needs invalidateOnRefresh:true or the travel distance stays frozen after a resize; expanding modal and lightbox mount then add an .in class on the next frame, pause the scroller via window.__lenis?.stop(), and must render OUTSIDE any pinned section because the pin transform breaks position:fixed inside it; parallax drift stays subtle at 5-8% with overflow:hidden on the figure; count-up animates a plain object and formats per locale; scroll progress uses scaleX with transform-origin 0 50% to stay on the compositor; accordions use native <details>. Cross-cutting: anything clickable that is not a button or anchor gets role=button, tabIndex 0 and Enter/Space, Escape closes overlays, every effect has a static reduced-motion fallback and reverts on cleanup.",
-      "verifiedAgainst": "GSAP 3.13 (ScrollTrigger, matchMedia, context) + React 18 + Lenis 1.x, shipped to production.",
-      "provedBy": []
+      "digest": "Toolbox of scroll-driven interaction patterns, not a mandatory list: useReveal (fade/rise with once:true) covers most content; pinned horizontal gallery needs invalidateOnRefresh:true or the travel distance stays frozen after a resize; expanding modal and lightbox mount then add an .in class on the next frame, pause the scroller via window.__lenis?.stop(), and must render OUTSIDE any pinned section because the pin transform breaks position:fixed inside it; parallax drift stays subtle at 5-8% with overflow:hidden on the figure; count-up animates a plain object and formats per locale; scroll progress uses scaleX with transform-origin 0 50% to stay on the compositor; accordions use native <details>. Cross-cutting: anything clickable that is not a button or anchor gets role=button, tabIndex 0 and Enter/Space, Escape closes overlays, every effect has a static reduced-motion fallback and reverts on cleanup."
     },
     {
       "id": "frontend-scroll-driven-smooth-scroll",
@@ -2462,24 +1579,13 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "lenis",
-        "smooth scroll",
-        "scroll wiring",
-        "gsap ticker",
-        "window.__lenis",
-        "scrolltrigger refresh",
-        "HMR stale triggers"
-      ],
       "anchors": {
         "registry": "#section-1-central-motion-registry",
         "raf": "#section-2-the-raf-handoff",
         "expose": "#section-3-expose-the-instance-on-window",
         "hmr": "#section-4-the-hmr-staleness-trap"
       },
-      "digest": "Register GSAP plugins once in a shared lib/motion module that also exports prefersReducedMotion. Drive Lenis from gsap.ticker (never its own RAF loop), bind lenis.on(scroll, ScrollTrigger.update), set gsap.ticker.lagSmoothing(0), and call ScrollTrigger.refresh() on window load so triggers re-measure after fonts and images settle. Expose window.__lenis deliberately: overlays need stop()/start() to freeze the background, and automated verification needs scrollTo(y, {immediate:true}) to step through positions; consumers must use optional chaining because the instance is never created under reduced motion. After many hot reloads ScrollTrigger accumulates stale instances and pins/scrubs silently die, so full-reload before debugging, wrap every effect in gsap.context()/matchMedia() with revert on cleanup, and set invalidateOnRefresh on viewport-dependent triggers.",
-      "verifiedAgainst": "Lenis 1.x + GSAP 3.13 ScrollTrigger + Vite 5, shipped to production.",
-      "provedBy": []
+      "digest": "Register GSAP plugins once in a shared lib/motion module that also exports prefersReducedMotion. Drive Lenis from gsap.ticker (never its own RAF loop), bind lenis.on(scroll, ScrollTrigger.update), set gsap.ticker.lagSmoothing(0), and call ScrollTrigger.refresh() on window load so triggers re-measure after fonts and images settle. Expose window.__lenis deliberately: overlays need stop()/start() to freeze the background, and automated verification needs scrollTo(y, {immediate:true}) to step through positions; consumers must use optional chaining because the instance is never created under reduced motion. After many hot reloads ScrollTrigger accumulates stale instances and pins/scrubs silently die, so full-reload before debugging, wrap every effect in gsap.context()/matchMedia() with revert on cleanup, and set invalidateOnRefresh on viewport-dependent triggers."
     },
     {
       "id": "frontend-seo-meta-schema-audit",
@@ -2495,18 +1601,6 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "seo",
-        "meta tags",
-        "open graph",
-        "og:image",
-        "schema.org",
-        "json-ld",
-        "rich results",
-        "lighthouse",
-        "go-live audit",
-        "canonical"
-      ],
       "anchors": {
         "meta": "#section-1-essential-meta",
         "opengraph": "#section-2-open-graph-and-twitter-cards",
@@ -2514,9 +1608,7 @@
         "a11y": "#section-4-accessibility-also-an-seo-signal",
         "audit": "#section-5-pre-launch-audit"
       },
-      "digest": "Head-level SEO is cheap and pays for itself: title/description/canonical/theme-color/favicon, correct lang, font preconnects, and a full Open Graph set with an absolute 1200x630 og:image (without it a pasted link renders as a bare card). Pick the JSON-LD @type from the business (ClothingStore/Store for retail, LocalBusiness for services, RealEstateAgent or Residence for property, SoftwareApplication for SaaS) and include ONLY true fields: aggregateRating goes in only with a real rating and review count from a real source, otherwise omit the block, because fabricated structured data is a trust and manual-action risk. Accessibility doubles as an SEO signal (alt text, contrast checked against the brightest frames, focus order, one h1, reduced-motion honored). Before go-live run Lighthouse, a clean-console check, a share-card check and cross-device; if a heavy frame sequence costs Performance, confirm the cost sits in the scrub and state the trade rather than letting a low score pass unexamined.",
-      "verifiedAgainst": "Schema.org vocabulary + Lighthouse via Chrome DevTools MCP, shipped to production.",
-      "provedBy": []
+      "digest": "Head-level SEO is cheap and pays for itself: title/description/canonical/theme-color/favicon, correct lang, font preconnects, and a full Open Graph set with an absolute 1200x630 og:image (without it a pasted link renders as a bare card). Pick the JSON-LD @type from the business (ClothingStore/Store for retail, LocalBusiness for services, RealEstateAgent or Residence for property, SoftwareApplication for SaaS) and include ONLY true fields: aggregateRating goes in only with a real rating and review count from a real source, otherwise omit the block, because fabricated structured data is a trust and manual-action risk. Accessibility doubles as an SEO signal (alt text, contrast checked against the brightest frames, focus order, one h1, reduced-motion honored). Before go-live run Lighthouse, a clean-console check, a share-card check and cross-device; if a heavy frame sequence costs Performance, confirm the cost sits in the scrub and state the trade rather than letting a low score pass unexamined."
     },
     {
       "id": "infrastructure-docker-coolify-deploy",
@@ -2531,23 +1623,12 @@
       "stacks": [
         "docker"
       ],
-      "aliases": [
-        "coolify",
-        "docker deploy",
-        "self-hosted",
-        "VPS deployment",
-        "docker compose",
-        "coolify api",
-        "ssh deploy"
-      ],
       "anchors": {
         "setup": "#coolify-service-config",
         "deployment": "#zero-downtime-deploys",
         "ssh": "#triggering-a-deploy-via-ssh--api"
       },
-      "digest": "Coolify is the self-hosted Docker PaaS. We use no Coolify MCP/CLI — all access is via SSH into the VPS, hitting the Coolify API at localhost:8000/api/v1 with a server-side token (never printed, never leaves the SSH session). Configure environment variables in Coolify UI/API — not in Dockerfile. Configure /health endpoint for health checks. HTTPS via Let's Encrypt automatic (Traefik). Redeploys trigger via POST /api/v1/deploy?uuid={uuid} over SSH (Coolify 4.3.23 answers GET with \"This endpoint has changed to a POST request\" and deploys nothing); a queued deploy returns a deployment_uuid, its absence means nothing was deployed.",
-      "verifiedAgainst": ".NET 10 + Next.js 15 + Node 22 (Docker base images) + Coolify 4.x API. The `POST /api/v1/deploy` contract was checked against the Coolify docs/OpenAPI on 2026-10-03, and Coolify 4.3.23 was observed answering `GET /deploy` with \"This endpoint has changed to a POST request\"; Dockerfiles and snippets are documentary.",
-      "provedBy": []
+      "digest": "Coolify is the self-hosted Docker PaaS. We use no Coolify MCP/CLI — all access is via SSH into the VPS, hitting the Coolify API at localhost:8000/api/v1 with a server-side token (never printed, never leaves the SSH session). Configure environment variables in Coolify UI/API — not in Dockerfile. Configure /health endpoint for health checks. HTTPS via Let's Encrypt automatic (Traefik). Redeploys trigger via POST /api/v1/deploy?uuid={uuid} over SSH (Coolify 4.3.23 answers GET with \"This endpoint has changed to a POST request\" and deploys nothing); a queued deploy returns a deployment_uuid, its absence means nothing was deployed."
     },
     {
       "id": "infrastructure-docker-local-compose-isolation",
@@ -2562,17 +1643,6 @@
       "stacks": [
         "docker"
       ],
-      "aliases": [
-        "compose isolation",
-        "worktree ports",
-        "container_name",
-        "POSTGRES_PORT",
-        "COMPOSE_PROJECT_NAME",
-        "port block",
-        "PG_PORT",
-        "portEnvNames",
-        "local docker compose"
-      ],
       "anchors": {
         "layout": "#port-layout-one-contract-everywhere",
         "portNames": "#project-named-port-variables",
@@ -2580,9 +1650,7 @@
         "enforcement": "#what-the-harness-enforces",
         "skeleton": "#minimal-compose-skeleton"
       },
-      "digest": "Every worktree runs its OWN compose stack (project morph-{feature}, own postgres, own volumes). Ports come from the worktree block: PORT +0, API_PORT +1 (ASPNETCORE_URLS on .NET), POSTGRES_PORT +2, REDIS_PORT +3 — publish via ${VAR:-default}:container, never a fixed host port, never container_name (not prefixed by the project → collides). Stable POSTGRES_DB, healthcheck on every service, DATABASE_URL with an in-network default, playwright.config reads PLAYWRIGHT_BASE_URL. A non-isolable compose fails the verify e2e node inside a worktree. finish tears down with volumes (--keep-volumes opts out). Cloud DB credentials go in e2e.auth.envFile, never in .morph/worktree.env. A compose that reads a port by ANOTHER name (PG_PORT) is not fed by the block: declare it in config.json e2e.portEnvNames ({\"postgres\": \"PG_PORT\"}) and the harness exports it with the same value in worktree.env, the compose env and the hook.",
-      "verifiedAgainst": "Docker Compose v2 + morph-spec 8.34 (dedicated stack per worktree).",
-      "provedBy": []
+      "digest": "Every worktree runs its OWN compose stack (project morph-{feature}, own postgres, own volumes). Ports come from the worktree block: PORT +0, API_PORT +1 (ASPNETCORE_URLS on .NET), POSTGRES_PORT +2, REDIS_PORT +3 — publish via ${VAR:-default}:container, never a fixed host port, never container_name (not prefixed by the project → collides). Stable POSTGRES_DB, healthcheck on every service, DATABASE_URL with an in-network default, playwright.config reads PLAYWRIGHT_BASE_URL. A non-isolable compose fails the verify e2e node inside a worktree. finish tears down with volumes (--keep-volumes opts out). Cloud DB credentials go in e2e.auth.envFile, never in .morph/worktree.env. A compose that reads a port by ANOTHER name (PG_PORT) is not fed by the block: declare it in config.json e2e.portEnvNames ({\"postgres\": \"PG_PORT\"}) and the harness exports it with the same value in worktree.env, the compose env and the hook."
     },
     {
       "id": "infrastructure-neon-pgrag",
@@ -2598,20 +1666,11 @@
       "stacks": [
         "neon"
       ],
-      "aliases": [
-        "pgrag",
-        "RAG in SQL",
-        "embedding pipeline",
-        "Neon RAG",
-        "in-database RAG"
-      ],
       "anchors": {
         "setup": "#install-pgrag",
         "pipeline": "#full-rag-pipeline-example"
       },
-      "digest": "pgrag (Neon `rag` extension family) is EXPERIMENTAL: use it for prototyping and simple SQL-only RAG, not production without testing. Run `SET neon.allow_unstable_extensions='true'` before `CREATE EXTENSION rag CASCADE` (also `rag_bge_small_en_v15`, `rag_jina_reranker_v1_tiny_en`). Local bge-small embeddings are 384 dims, OpenAI text-embedding-3-small is 1536: NEVER mix models in one column or use the local one when the app uses another model (dimension mismatch breaks search). Chunk with `rag.chunks_by_character_count` (1000 chars, 200 overlap); `embedding_for_passage` for documents, `embedding_for_query` for queries; create the pgvector HNSW index (m=16, ef_construction=64) after the initial load; rerank with `rerank_distance` (sort ASC). Keep API keys out of SQL scripts. For production .NET needing custom logic, use a typed MAF tool over pgvector (`ai-agents-rag-custom-pgvector`).",
-      "verifiedAgainst": "Neon pgrag (`rag` extension family — experimental, see Core Rules).",
-      "provedBy": []
+      "digest": "pgrag (Neon `rag` extension family) is EXPERIMENTAL: use it for prototyping and simple SQL-only RAG, not production without testing. Run `SET neon.allow_unstable_extensions='true'` before `CREATE EXTENSION rag CASCADE` (also `rag_bge_small_en_v15`, `rag_jina_reranker_v1_tiny_en`). Local bge-small embeddings are 384 dims, OpenAI text-embedding-3-small is 1536: NEVER mix models in one column or use the local one when the app uses another model (dimension mismatch breaks search). Chunk with `rag.chunks_by_character_count` (1000 chars, 200 overlap); `embedding_for_passage` for documents, `embedding_for_query` for queries; create the pgvector HNSW index (m=16, ef_construction=64) after the initial load; rerank with `rerank_distance` (sort ASC). Keep API keys out of SQL scripts. For production .NET needing custom logic, use a typed MAF tool over pgvector (`ai-agents-rag-custom-pgvector`)."
     },
     {
       "id": "infrastructure-neon-pgvector",
@@ -2627,20 +1686,11 @@
       "stacks": [
         "neon"
       ],
-      "aliases": [
-        "pgvector",
-        "vector embeddings",
-        "similarity search",
-        "Neon vectors",
-        "HNSW index"
-      ],
       "anchors": {
         "setup": "#enable-pgvector",
         "queries": "#similarity-search"
       },
-      "digest": "pgvector on Neon with .NET VSA: packages Npgsql.EntityFrameworkCore.PostgreSQL 10.0.3 + Pgvector.EntityFrameworkCore 0.3.0 (snake_case columns mapped with HasColumnName, no naming-convention package); HasPostgresExtension('vector') in OnModelCreating emits CREATE EXTENSION in the migration. Map the column as Pgvector `Vector` (`vector(1536)` for text-embedding-3-small; EF does not map float[] or ReadOnlyMemory<float>) and call `npgsql.UseVector()` inside UseNpgsql (NpgsqlDataSourceBuilder.UseVector only for raw Npgsql). ALWAYS an HNSW index (HasMethod('hnsw'), vector_cosine_ops, m 16, ef_construction 64); the operator class must match the LINQ function (CosineDistance/L2Distance/MaxInnerProduct) or Postgres seq-scans. Query in the slice handler through ApplicationDbContext: `d.Embedding!.CosineDistance(query)`, filter by distance <= 1 - minSimilarity, OrderBy distance ASC (similarity = 1 - distance, never ORDER BY similarity DESC), return Result; no DocumentRepository, no raw SQL from C# (SQL functions such as match_documents/hybrid search only with a decisions.md justification). Ids from Guid.CreateVersion7() in the handler, never gen_random_uuid() defaults. ef_search (default 40) on the pooled endpoint needs SET LOCAL inside the query's transaction.",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview) + Npgsql.EntityFrameworkCore.PostgreSQL 10.0.3 + Pgvector.EntityFrameworkCore 0.3.0 + Microsoft.Extensions.AI 10.9.0 (ai-pin 2026-09-08). The entity, configuration, DbContext, search-handler and raw-Npgsql blocks compile with `TreatWarningsAsErrors` (handler over the `Result`/`IHandler` of `result-pattern.md`/`vertical-slice.md`), and the handler's query shape was translated with `ToQueryString()` to `ORDER BY d.embedding <=> @query`; the SQL (index DDL, `ef_search`, the two SQL functions) is documentary, checked against the pgvector README.",
-      "provedBy": []
+      "digest": "pgvector on Neon with .NET VSA: packages Npgsql.EntityFrameworkCore.PostgreSQL 10.0.3 + Pgvector.EntityFrameworkCore 0.3.0 (snake_case columns mapped with HasColumnName, no naming-convention package); HasPostgresExtension('vector') in OnModelCreating emits CREATE EXTENSION in the migration. Map the column as Pgvector `Vector` (`vector(1536)` for text-embedding-3-small; EF does not map float[] or ReadOnlyMemory<float>) and call `npgsql.UseVector()` inside UseNpgsql (NpgsqlDataSourceBuilder.UseVector only for raw Npgsql). ALWAYS an HNSW index (HasMethod('hnsw'), vector_cosine_ops, m 16, ef_construction 64); the operator class must match the LINQ function (CosineDistance/L2Distance/MaxInnerProduct) or Postgres seq-scans. Query in the slice handler through ApplicationDbContext: `d.Embedding!.CosineDistance(query)`, filter by distance <= 1 - minSimilarity, OrderBy distance ASC (similarity = 1 - distance, never ORDER BY similarity DESC), return Result; no DocumentRepository, no raw SQL from C# (SQL functions such as match_documents/hybrid search only with a plan.md (## Decisões) justification). Ids from Guid.CreateVersion7() in the handler, never gen_random_uuid() defaults. ef_search (default 40) on the pooled endpoint needs SET LOCAL inside the query's transaction."
     },
     {
       "id": "infrastructure-neon-setup",
@@ -2656,20 +1706,11 @@
       "stacks": [
         "neon"
       ],
-      "aliases": [
-        "Neon",
-        "neonctl",
-        "serverless postgres",
-        "Neon CLI",
-        "Neon setup"
-      ],
       "anchors": {
         "setup": "#neon-cli-setup",
         "connection": "#connection-strings"
       },
-      "digest": "Neon serverless Postgres with .NET/EF Core. Two connection strings read through IConfiguration: `ConnectionStrings:DefaultConnection` = pooled `-pooler` endpoint for application traffic (Neon's DATABASE_URL) and `ConnectionStrings:MigrationConnection` = direct endpoint for migrations, `dotnet ef` and advisory locks (Neon's DATABASE_URL_UNPOOLED; PgBouncer does not support advisory locks; the `IDesignTimeDbContextFactory` reads it via appsettings + AddUserSecrets + AddEnvironmentVariables). Never hardcode or commit them: user-secrets in development, Coolify env vars (`ConnectionStrings__DefaultConnection`) in production, appsettings.json keeps empty values. Use the keyword format (`Host=...;SSL Mode=Require`): Npgsql 10 rejects the console's `postgresql://` URI, and `Trust Server Certificate` is obsolete (does nothing). Scale-to-zero suspends compute after 5 minutes idle by default (about 300-500ms cold start), so configure `EnableRetryOnFailure(maxRetryCount: 5, maxRetryDelay: 10s)` and `CommandTimeout(30)`; suspend timeout is set at branch creation (`--suspend-timeout`, `--cu` range) or for an existing compute via Console/API (`suspend_timeout_seconds`, 60-604800), never by recreating main. Branches are copy-on-write: never leave them without expiration (`--expires-at`); `feature/*` 7 days, `ci-*` 1 day, `main` and `dev` never. neonctl: `auth`, `branches create|reset|delete`.",
-      "verifiedAgainst": ".NET 10 (SDK 10.0.400-preview) + Npgsql.EntityFrameworkCore.PostgreSQL 10.0.3 + neonctl. The DbContext registration, design-time factory and cold-start blocks compile with `TreatWarningsAsErrors`; that Npgsql 10 rejects `postgresql://` URIs and marks `Trust Server Certificate` as \"no longer needed and does nothing\" was measured on 10.0.3; the suspend-timeout API and `--cu` ranges were checked against the Neon docs (context7). neonctl commands are documentary.",
-      "provedBy": []
+      "digest": "Neon serverless Postgres with .NET/EF Core. Two connection strings read through IConfiguration: `ConnectionStrings:DefaultConnection` = pooled `-pooler` endpoint for application traffic (Neon's DATABASE_URL) and `ConnectionStrings:MigrationConnection` = direct endpoint for migrations, `dotnet ef` and advisory locks (Neon's DATABASE_URL_UNPOOLED; PgBouncer does not support advisory locks; the `IDesignTimeDbContextFactory` reads it via appsettings + AddUserSecrets + AddEnvironmentVariables). Never hardcode or commit them: user-secrets in development, Coolify env vars (`ConnectionStrings__DefaultConnection`) in production, appsettings.json keeps empty values. Use the keyword format (`Host=...;SSL Mode=Require`): Npgsql 10 rejects the console's `postgresql://` URI, and `Trust Server Certificate` is obsolete (does nothing). Scale-to-zero suspends compute after 5 minutes idle by default (about 300-500ms cold start), so configure `EnableRetryOnFailure(maxRetryCount: 5, maxRetryDelay: 10s)` and `CommandTimeout(30)`; suspend timeout is set at branch creation (`--suspend-timeout`, `--cu` range) or for an existing compute via Console/API (`suspend_timeout_seconds`, 60-604800), never by recreating main. Branches are copy-on-write: never leave them without expiration (`--expires-at`); `feature/*` 7 days, `ci-*` 1 day, `main` and `dev` never. neonctl: `auth`, `branches create|reset|delete`."
     },
     {
       "id": "integration-mcp-mcp-tools",
@@ -2684,20 +1725,11 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "MCP",
-        "Model Context Protocol",
-        "Claude tools",
-        "MCP server",
-        "MCP client"
-      ],
       "anchors": {
         "tools": "#mcp-providers-by-phase",
         "setup": "#mcp-availability-detection"
       },
-      "digest": "MCP tools extend Claude with external data and actions. Tools are synchronous request-response with typed inputSchema. Resources provide read-only data access. Prompts are reusable templates. Register MCP servers in .claude/settings.json. Prefer @context7 for live library docs. Tool names follow where the server is configured: mcp__context7__query-docs from .mcp.json, mcp__plugin_context7_context7__query-docs from the plugin; a deferred tool loads via ToolSearch. Test tools with MCP Inspector before integrating.",
-      "verifiedAgainst": "Claude Code 2.1.282 MCP tooling — context7, Playwright (as plugin and as a project MCP server); GitHub via `gh` CLI; Neon via its MCP or `neonctl`.",
-      "provedBy": []
+      "digest": "MCP tools extend Claude with external data and actions. Tools are synchronous request-response with typed inputSchema. Resources provide read-only data access. Prompts are reusable templates. Register MCP servers in .claude/settings.json. Prefer @context7 for live library docs. Tool names follow where the server is configured: mcp__context7__query-docs from .mcp.json, mcp__plugin_context7_context7__query-docs from the plugin; a deferred tool loads via ToolSearch. Test tools with MCP Inspector before integrating."
     },
     {
       "id": "frontend-admin-app-data-table",
@@ -2712,27 +1744,13 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "data table",
-        "admin list",
-        "server-side pagination",
-        "paginação",
-        "tabela de dados",
-        "ordenação no servidor",
-        "empty state",
-        "row selection",
-        "bulk actions",
-        "manualPagination"
-      ],
       "anchors": {
         "contract": "#the-list-contract-url-and-api",
         "table": "#the-shared-datatable-tier-2",
         "states": "#the-three-states",
         "mobile": "#mobile"
       },
-      "digest": "Every admin list is paged, sorted and filtered on the server, with page/pageSize/sort/dir/filters in the URL (searchParams parsed by a Zod schema with .catch defaults) and the API answering { items, totalCount } over an OrderBy plus a unique id tiebreaker. The Server Component page reads searchParams and wraps the results in a Suspense keyed by the query; one shared components/data-table.tsx on TanStack Table 9 sets manualPagination + rowCount, manualSorting and selection by a stable getRowId, and only writes the URL (router.replace with scroll:false, page reset on any filter/sort change). Three non-happy states always: loading skeleton, empty (no records vs no match for the filters), error as a value with retry via router.refresh(). Compact density, right-aligned tabular numbers, one inline row action plus a menu, a bulk bar over the selected page, a card list below md. Never 'first N + see all' instead of paging.",
-      "verifiedAgainst": "Next.js 16 App Router + @tanstack/react-table 9 + Zod 4 + shadcn 4 (the code blocks typecheck under `tsc --strict`).",
-      "provedBy": []
+      "digest": "Every admin list is paged, sorted and filtered on the server, with page/pageSize/sort/dir/filters in the URL (searchParams parsed by a Zod schema with .catch defaults) and the API answering { items, totalCount } over an OrderBy plus a unique id tiebreaker. The Server Component page reads searchParams and wraps the results in a Suspense keyed by the query; one shared components/data-table.tsx on TanStack Table 9 sets manualPagination + rowCount, manualSorting and selection by a stable getRowId, and only writes the URL (router.replace with scroll:false, page reset on any filter/sort change). Three non-happy states always: loading skeleton, empty (no records vs no match for the filters), error as a value with retry via router.refresh(). Compact density, right-aligned tabular numbers, one inline row action plus a menu, a bulk bar over the selected page, a card list below md. Never 'first N + see all' instead of paging."
     },
     {
       "id": "frontend-admin-app-feedback",
@@ -2747,24 +1765,12 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "confirmation dialog",
-        "confirm dialog",
-        "delete confirmation",
-        "toast",
-        "sonner",
-        "toast messages",
-        "undo toast",
-        "diálogo de confirmação"
-      ],
       "anchors": {
         "when": "#when-to-confirm",
         "dialog": "#the-confirmation-dialog-tier-2",
         "catalog": "#the-toast-catalog"
       },
-      "digest": "One ConfirmDialog (controlled shadcn AlertDialog, a plain Button that awaits the action, stays open showing the error on failure, optional type-to-confirm) used only for destructive-irreversible, bulk or discard-changes actions; a reversible action gets a 'Desfazer' toast instead. The title names the object and the confirm label repeats the verb. Every toast string comes from a catalog (lib/toast-messages.ts for generic outcomes + per-entity EntityMessages, because Portuguese agrees in gender and number); sonner toast.success/toast.error with an id per action, a longer duration for errors, errors mapped by status (403, 409, network), never the server's raw text, and field validation never in a toast.",
-      "verifiedAgainst": "shadcn 4 `AlertDialog` (Radix) + sonner 2 + TanStack Query 5 (the code blocks typecheck under `tsc --strict`).",
-      "provedBy": []
+      "digest": "One ConfirmDialog (controlled shadcn AlertDialog, a plain Button that awaits the action, stays open showing the error on failure, optional type-to-confirm) used only for destructive-irreversible, bulk or discard-changes actions; a reversible action gets a 'Desfazer' toast instead. The title names the object and the confirm label repeats the verb. Every toast string comes from a catalog (lib/toast-messages.ts for generic outcomes + per-entity EntityMessages, because Portuguese agrees in gender and number); sonner toast.success/toast.error with an id per action, a longer duration for errors, errors mapped by status (403, 409, network), never the server's raw text, and field validation never in a toast."
     },
     {
       "id": "frontend-admin-app-forms",
@@ -2779,22 +1785,12 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "admin form",
-        "crud form",
-        "server validation errors",
-        "ValidationProblemDetails",
-        "unsaved changes",
-        "formulário"
-      ],
       "anchors": {
         "server-errors": "#server-errors-on-the-field",
         "placement": "#where-the-form-lives",
         "dirty": "#unsaved-changes"
       },
-      "digest": "Admin forms use the one pattern of nextjs/forms.md (Zod schema, zodResolver, react-hook-form Controller + shadcn Field/FieldError, useMutation) plus the CRUD deltas: map .NET ValidationProblemDetails errors onto their fields with setError (unmatched ones go to root.serverError), mode 'onTouched', submit disabled only while saving, form.reset(values) after a successful save, a guard for unsaved changes, the three useForm generics (z.input / unknown / z.output) when the schema coerces, and placement by size: dialog up to 4 fields, sheet or page up to 12, its own page beyond that, a wizard when steps depend on each other.",
-      "verifiedAgainst": "react-hook-form 7 + @hookform/resolvers 5 + Zod 4 + TanStack Query 5 + shadcn 4 `Field` (the code blocks typecheck under `tsc --strict`).",
-      "provedBy": []
+      "digest": "Admin forms use the one pattern of nextjs/forms.md (Zod schema, zodResolver, react-hook-form Controller + shadcn Field/FieldError, useMutation) plus the CRUD deltas: map .NET ValidationProblemDetails errors onto their fields with setError (unmatched ones go to root.serverError), mode 'onTouched', submit disabled only while saving, form.reset(values) after a successful save, a guard for unsaved changes, the three useForm generics (z.input / unknown / z.output) when the schema coerces, and placement by size: dialog up to 4 fields, sheet or page up to 12, its own page beyond that, a wizard when steps depend on each other."
     },
     {
       "id": "frontend-admin-app-page-structure",
@@ -2809,24 +1805,12 @@
       "stacks": [
         "nextjs"
       ],
-      "aliases": [
-        "tabs",
-        "abas",
-        "long page",
-        "página longa",
-        "wizard",
-        "multi-step form",
-        "stepper",
-        "detail page"
-      ],
       "anchors": {
         "decision": "#tabs-long-page-or-wizard",
         "tabs": "#tabs-in-the-url",
         "wizard": "#wizard-for-long-flows"
       },
-      "digest": "Decide per screen and write it in the mockup checklist: tabs for 3+ independent sections, a long page with sticky section nav when sections are read together or share one save, a plain page for 2 short blocks, a wizard when later fields depend on earlier answers. The active tab lives in ?tab= and only its content is rendered and fetched on the server; switching tab drops the list params of the tab being left. Unbounded related lists get their own paged tab, never a capped preview. A wizard keeps one react-hook-form across steps, validates each step with trigger(stepFields), never loses data going back, and commits on a final review step.",
-      "verifiedAgainst": "Next.js 16 App Router + shadcn 4 `Tabs` (Radix) + react-hook-form 7 + Zod 4 (the code blocks typecheck under `tsc --strict`).",
-      "provedBy": []
+      "digest": "Decide per screen and write it in the mockup checklist: tabs for 3+ independent sections, a long page with sticky section nav when sections are read together or share one save, a plain page for 2 short blocks, a wizard when later fields depend on earlier answers. The active tab lives in ?tab= and only its content is rendered and fetched on the server; switching tab drops the list params of the tab being left. Unbounded related lists get their own paged tab, never a capped preview. A wizard keeps one react-hook-form across steps, validates each step with trigger(stepFields), never loses data going back, and commits on a final review step."
     },
     {
       "id": "architecture-code-comments",
@@ -2841,22 +1825,12 @@
       "stacks": [
         "*"
       ],
-      "aliases": [
-        "code comments",
-        "comentário de código",
-        "comment policy",
-        "política de comentário",
-        "comentário de processo",
-        "self-documenting code"
-      ],
       "anchors": {
         "comment-policy": "#o-que-merece-comentário",
         "not-worth": "#o-que-não-merece",
         "size": "#tamanho"
       },
-      "digest": "Default is NO comment: code explains itself through names, types and tests. Before commenting, rename, extract a function or named constant, encode the state in the type, or write a test; comment only what none of these can express: an invariant the type does not express, an order that matters, an external quirk (third-party API, library bug with its link), or the contract of a package published for consumers outside the repo. Never process history (task, UC, ADR, FR, Gate, evaluator, spec.md, mockup: commit message and decisions.md; in a test the link to the postcondition goes in the test NAME), never restate the code, no XML doc/JSDoc on application members that repeats the signature, no file headers, section banners, #region, commented-out code or loose TODOs, no claims about behavior (make them test assertions). One line is normal, ~3 is the ceiling; more than one comment line per ten code lines means the names are not doing the work. A heavily commented neighbour file is not a model. The comment-guard hook blocks an edit that ADDS process history, a banner/#region, a block over 3 lines or a doc-comment outside a published package; the verify validators node (code-budget) warns on added comments that cite process and on added comment density.",
-      "verifiedAgainst": "C#, TypeScript e JavaScript (convenção de linguagem, sem pacote externo).",
-      "provedBy": []
+      "digest": "Default is NO comment: code explains itself through names, types and tests. Before commenting, rename, extract a function or named constant, encode the state in the type, or write a test; comment only what none of these can express: an invariant the type does not express, an order that matters, an external quirk (third-party API, library bug with its link), or the contract of a package published for consumers outside the repo. Never process history (task, UC, ADR, FR, Gate, evaluator, spec.md, mockup: commit message and plan.md (## Decisões); in a test the link to the postcondition goes in the test NAME), never restate the code, no XML doc/JSDoc on application members that repeats the signature, no file headers, section banners, #region, commented-out code or loose TODOs, no claims about behavior (make them test assertions). One line is normal, ~3 is the ceiling; more than one comment line per ten code lines means the names are not doing the work. A heavily commented neighbour file is not a model. The comment-guard hook blocks an edit that ADDS process history, a banner/#region, a block over 3 lines or a doc-comment outside a published package; the verify validators node (code-budget) warns on added comments that cite process and on added comment density."
     },
     {
       "id": "ai-agents-tool-adapters",
@@ -2873,18 +1847,6 @@
       "stacks": [
         "dotnet"
       ],
-      "aliases": [
-        "tool fina",
-        "adaptador de tool",
-        "Ops",
-        "Desfecho",
-        "Render",
-        "regra de negocio em tool",
-        "descricao da tool",
-        "golden de tool",
-        "refactor neutro",
-        "migracao de teste"
-      ],
       "anchors": {
         "fronteira": "#fronteira-com-os-outros-standards",
         "problema": "#o-problema",
@@ -2895,100 +1857,28 @@
         "reais": "#exemplos-reais",
         "regras": "#regras"
       },
-      "digest": "A tool that carries business rule keeps apart three things that change for different reasons: the RULE (sealed class XOps(...), primary constructor, explicit AddScoped; never *Service, which MORPH.md bans as a layer between handler and data), the sentence the MODEL reads, and the EFFECT a human sees. Each Ops method returns a typed outcome (abstract record XDesfecho, one sealed record per case); the model-facing text (description, refusal, self-correction, success, the ToolUnavailable decision) lives in the adapter, in public static object Render(XDesfecho), while human text delivered by code (task body, note, ack) stays in Ops because it is an effect. Checkable by grep: Ops names no tool and instructs no model. The adapter (AIFunctionFactory.Create) only builds the typed request, calls Ops and returns Render: zero rule, not a line count, and a long dynamic description stays byte for byte. Two test layers: Ops tests assert outcome, calls and order on the fake, never text; contract tests assert Render's exact literal and .Description, with a golden of name, description and schema per real tenant. A neutral refactor is proven before any test moves: a proof commit with the old suite untouched and green (offline evals included), then the migration, with mutation run only against the new tests. \"Already covered\" needs proof assertion by assertion (11 of 22 such claims had lost one); the tests left at the origin must be identical to the base; mutation on the new tests found rules the old suite never protected. The C# blocks were compiled against the pin and the three xunit tests run.",
-      "verifiedAgainst": "Microsoft.Extensions.AI 10.9.0 + Microsoft.Agents.AI 1.20.0 (ai-pin 2026-09-08); os dois blocos C# abaixo foram extraídos com `scripts/extract-doc-csharp.mjs` e compilados contra o pin com `TreatWarningsAsErrors`, e os três testes do segundo bloco foram executados e passam. **A separação em si e a migração de teste são verificação documental:** vêm da feature `tools-finas` do MORPH_GHLBrain e o ai-kit não as traz.",
-      "provedBy": []
+      "digest": "A tool that carries business rule keeps apart three things that change for different reasons: the RULE (sealed class XOps(...), primary constructor, explicit AddScoped; never *Service, which MORPH.md bans as a layer between handler and data), the sentence the MODEL reads, and the EFFECT a human sees. Each Ops method returns a typed outcome (abstract record XDesfecho, one sealed record per case); the model-facing text (description, refusal, self-correction, success, the ToolUnavailable decision) lives in the adapter, in public static object Render(XDesfecho), while human text delivered by code (task body, note, ack) stays in Ops because it is an effect. Checkable by grep: Ops names no tool and instructs no model. The adapter (AIFunctionFactory.Create) only builds the typed request, calls Ops and returns Render: zero rule, not a line count, and a long dynamic description stays byte for byte. Two test layers: Ops tests assert outcome, calls and order on the fake, never text; contract tests assert Render's exact literal and .Description, with a golden of name, description and schema per real tenant. A neutral refactor is proven before any test moves: a proof commit with the old suite untouched and green (offline evals included), then the migration, with mutation run only against the new tests. \"Already covered\" needs proof assertion by assertion (11 of 22 such claims had lost one); the tests left at the origin must be identical to the base; mutation on the new tests found rules the old suite never protected. The C# blocks were compiled against the pin and the three xunit tests run."
+    },
+    {
+      "id": "frontend-design-system-art-direction",
+      "name": "art direction",
+      "path": "frontend/design-system/art-direction.md",
+      "category": "frontend",
+      "subcategory": "design-system",
+      "tags": [
+        "frontend",
+        "design-system"
+      ],
+      "anchors": {
+        "direction": "#section-1-write-the-direction-first",
+        "explore": "#section-2-explore-two-or-three-directions",
+        "examples": "#section-3-good-and-bad-directions",
+        "tells": "#section-4-template-tells-to-avoid",
+        "mobile": "#section-5-mobile-is-designed-not-derived",
+        "motion": "#section-6-motion-with-intent",
+        "prototype": "#section-7-prototype-and-self-review"
+      },
+      "digest": "Order beats talent: before any component of a new or changed screen, write 1-design/direcao.md with the concept in one sentence, the visual metaphor, what makes it memorable, and what it must NOT look like. New screens and brand moments (login, onboarding, first screen, empty state, success) explore 2-3 DISTINCT directions and recommend one with a product reason. Avoid template tells (raw shadcn look, white card centered on gray, generic icon list, default fonts, flat backgrounds, mobile as stacked desktop, decorative fade-ins, made-up numbers); three or more means raise it. Mobile is composed at 390px on its own (bottom sheet, thumb zone, 44px targets). Motion tells something with the lightest tool (CSS keyframes > scroll-driven CSS > Framer Motion > GSAP), transform/opacity only, and a composed reduced-motion version. Prove it in 1-design/prototipos/{screen}.html with the project REAL tokens, screenshotted at 1280 and 390 and revised until it passes."
     }
-  ],
-  "sharedAliases": {
-    "agent middleware": [
-      "ai-agents-production",
-      "ai-agents-middleware-patterns"
-    ],
-    "anti-hallucination": [
-      "ai-agents-production",
-      "ai-agents-middleware-patterns"
-    ],
-    "agent observability": [
-      "ai-agents-production",
-      "ai-agents-observability-patterns"
-    ],
-    "agent telemetry": [
-      "ai-agents-production",
-      "ai-agents-observability-patterns"
-    ],
-    "when not to use workflow": [
-      "ai-agents-workflows",
-      "ai-agents-sweet-spot"
-    ],
-    "rag": [
-      "ai-agents-rag-custom-pgvector",
-      "backend-database-vector-search-rag"
-    ],
-    "vector search": [
-      "ai-agents-rag-custom-pgvector",
-      "backend-database-vector-search-rag"
-    ],
-    "pgvector": [
-      "ai-agents-rag-custom-pgvector",
-      "backend-database-vector-search-rag",
-      "infrastructure-neon-pgvector"
-    ],
-    "embeddings": [
-      "ai-agents-rag-custom-pgvector",
-      "backend-database-vector-search-rag"
-    ],
-    "semantic search": [
-      "ai-agents-rag-custom-pgvector",
-      "backend-database-vector-search-rag"
-    ],
-    "middleware": [
-      "ai-agents-middleware-patterns",
-      "frontend-nextjs-nextjs-patterns"
-    ],
-    "image generation": [
-      "ai-agents-modalities-image-gen",
-      "frontend-design-system-ai-image-generation"
-    ],
-    "mcp": [
-      "ai-agents-mcp-tools",
-      "integration-mcp-mcp-tools"
-    ],
-    "model context protocol": [
-      "ai-agents-mcp-tools",
-      "integration-mcp-mcp-tools"
-    ],
-    "mcp client": [
-      "ai-agents-mcp-tools",
-      "integration-mcp-mcp-tools"
-    ],
-    "mcp server": [
-      "ai-agents-mcp-server",
-      "integration-mcp-mcp-tools"
-    ],
-    "feature slice": [
-      "architecture-vertical-slice-vertical-slice",
-      "backend-dotnet-vsa-handler-patterns"
-    ],
-    "component naming": [
-      "frontend-design-system-naming",
-      "frontend-nextjs-naming-conventions"
-    ],
-    "video generation": [
-      "ai-agents-media-video",
-      "frontend-design-system-ai-video-generation"
-    ],
-    "seedance": [
-      "ai-agents-media-video",
-      "frontend-design-system-ai-video-generation"
-    ],
-    "test budget": [
-      "backend-dotnet-testing",
-      "frontend-nextjs-testing"
-    ],
-    "orçamento de teste": [
-      "backend-dotnet-testing",
-      "frontend-nextjs-testing"
-    ]
-  }
+  ]
 }