any-doctor 0.2.0 → 0.2.1

package/CONTEXT.md

@@ -5,11 +5,10 @@ When a term here conflicts with language elsewhere, this file wins.
 
 Current product intent lives in [docs/vision.md](docs/vision.md). For work on
 persistent decisions, history, identity, or team convergence, read the
-[lifecycle design](docs/plans/finding-lifecycle/design.md); the first identity
-delivery (lifecycle M1, slices A1+A2) is planned in
-[analysis improvements](docs/plans/analysis-improvements.md). Their proposed records
-are not implemented interfaces; the glossary below describes current behavior
-unless a term is explicitly marked planned.
+[lifecycle design](docs/plans/finding-lifecycle/design.md). Identity (M1) and
+remembered local decisions (M2) have landed; Git-shared decisions (M3) and
+bounded history (M4) remain planned. The glossary below describes current
+behavior unless a term is explicitly marked planned.
 
 ## Doctor program
 
@@ -88,8 +87,8 @@ tree without rebuilding it. A SiteFinding's readKey
 Text the dashboard copies to the clipboard as one unit of agent work: one
 finding (fixPrompt), every finding of one check (checkFixPrompt), or a
 doctor's whole batch (doctorFixPrompt) — pure functions of Doctor-tree
-types plus the verify command, no terminal required. The lifecycle plan
-(M2) reworks this family toward investigation-first framing and
+types plus the verify command, no terminal required. The local-decision
+delivery (M2) reworked this family toward investigation-first framing and
 authorized decision paths.
 
 ## Gate
@@ -384,9 +383,10 @@ Where a doctor program lives: repo-local (`./doctors/`, committed with
 the consuming repo), user-global (`~/.any-doctor/doctors/`, available
 in every repo), or bundled (the first-party pack inside the package,
 read-only — a starting point, not a dependency). Repo-local wins slug
-collisions, then user-global, then bundled. Scanning a target repo
-currently does not persist state in any scope. Planned CLI-owned state is
-separate from doctor discovery and does not grant doctors write capabilities.
+collisions, then user-global, then bundled. Scanning itself remains read-only.
+Recording a review decision creates CLI-owned local state under the target's
+`.any-doctor/` directory; that state is separate from doctor discovery and does
+not grant doctors write capabilities.
 
 ## Skill
 
@@ -406,18 +406,19 @@ positive witness. Unspecified legacy units and unavailable analysis are
 reported as not exercised, not counted as passing. Fixture expectations
 establish tested coverage, not general correctness or independence of labels.
 
-## Lifecycle vocabulary (planned, except where marked landed)
+## Lifecycle vocabulary
 
-These terms describe the accepted direction, not current fields on Finding or
-DoctorCtx. The [design](docs/plans/finding-lifecycle/design.md) owns their data
-and applicability rules.
+These terms describe shipped and planned lifecycle behavior. They are CLI-owned,
+not DoctorCtx capabilities. The [design](docs/plans/finding-lifecycle/design.md)
+owns their data and applicability rules.
 
-- **Finding identity** *(landed in the diff path, D30)*: continuity of one
+- **Finding identity** *(landed in diff and local decisions, D30/D31)*: continuity of one
   occurrence across comparable scans, distinct from its current source
-  coordinates. Host-derived today — check key, file, normalized flagged-line
-  digest, indentation-relative column, and innermost enclosing function span —
-  computed per comparison from one post-scan read, never persisted.
-- **Observation:** evidence that a finding was detected in a particular scan.
+  coordinates. Host-derived today — check key, file, normalized evidence digest,
+  indentation-relative column, and innermost enclosing function span. The CLI
+  computes it from source-bound capture; local decisions persist the resulting key.
+- **Observation** *(planned, M4)*: evidence that a finding was detected in a
+  particular retained scan.
 - **Decision** *(landed locally, D31)*: a reasoned accepted/not-applicable
   disposition with a required reason, stored in the local decisions file,
   reversible, attached to a Finding identity — it changes review state
@@ -429,7 +430,8 @@ and applicability rules.
   matched by cardinality are flagged ambiguous.
 - **No longer detected** *(landed in the diff path)*: absence established by
   compatible, completed coverage.
-- **Claimed fix:** a recorded explanation of remediation, separate from rescan evidence.
+- **Claimed fix** *(planned, M4)*: a recorded explanation of remediation,
+  separate from rescan evidence.
 - **Reassessment** *(landed locally)*: a decision requires review because
   its evidence changed — the finding resurfaces with a warning; the
   decision is never silently carried.

package/README.md

@@ -13,8 +13,9 @@ rescan after changes. Saved doctors run without model inference.
 
 Analysis runs locally without an account, API key, or telemetry. Package/tool
 installation can require downloads; the doctor runtime has no network access.
-Remembered decisions and finding history are [planned](docs/plans/finding-lifecycle/proposal.md),
-not available yet.
+Remembered local decisions persist between runs and resurface when their source
+evidence or doctor meaning changes. Shared project decisions and finding history
+remain [planned](docs/plans/finding-lifecycle/proposal.md).
 
 [![npm version](https://img.shields.io/npm/v/any-doctor.svg)](https://www.npmjs.com/package/any-doctor)
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](#)
@@ -38,6 +39,13 @@ npx any-doctor@latest run slop   # one doctor, straight to the report
 Non-terminals and CI never see a prompt — output is stable and pipeable
 (`--format json`, or `ANY_DOCTOR_HEADLESS=1`).
 
+During review, press `a` to accept an applicable concern or `x` to mark it not
+applicable; both require a reason. The decision is stored locally under
+`.any-doctor/`, hides the matching occurrence from later active lists, and can
+be inspected or reversed with `any-doctor decisions`. Changed evidence resurfaces
+the finding for reassessment. Local decisions never suppress raw JSON findings or
+change CI gates; keep `.any-doctor/decisions.local.json` untracked.
+
 ## The bundled pack
 
 | Doctor | Discipline | Checks |
@@ -51,8 +59,8 @@ Non-terminals and CI never see a prompt — output is stable and pipeable
 
 Checks ship positive and innocent-lookalike fixtures. `verify` compares an
 exact multiset of rule/file/line and optional column, then runs shared innocent
-and sensitivity corpora. Convex checks also declare per-check location coverage;
-legacy undeclared coverage is reported as not exercised. Passing fixtures show
+and sensitivity corpora. Every bundled check declares its reporting unit, and
+occurrence checks carry per-check location coverage. Passing fixtures show
 agreement on those cases, not a general accuracy guarantee. See
 [the reliability protocol](docs/doctor-reliability.md).
 
@@ -133,9 +141,9 @@ npx any-doctor@latest run --all --fail-on warning --base origin/main
 | [CONTEXT.md](CONTEXT.md) | Domain glossary — canonical terms |
 | [docs/vision.md](docs/vision.md) | Current goals and product direction |
 | [docs/features.md](docs/features.md) | Available features versus planned work |
-| [docs/plans/analysis-improvements.md](docs/plans/analysis-improvements.md) | Next slice: source evidence, identity, and reliable Git-base comparisons |
-| [docs/plans/finding-lifecycle/proposal.md](docs/plans/finding-lifecycle/proposal.md) | Planned decisions, history, and team workflows |
-| [docs/plans/finding-lifecycle/design.md](docs/plans/finding-lifecycle/design.md) | State ownership, SQLite, Git convergence, and open choices |
+| [docs/plans/analysis-improvements.md](docs/plans/analysis-improvements.md) | Delivered identity work and later analysis opportunities |
+| [docs/plans/finding-lifecycle/proposal.md](docs/plans/finding-lifecycle/proposal.md) | Current local decisions plus planned history and team workflows |
+| [docs/plans/finding-lifecycle/design.md](docs/plans/finding-lifecycle/design.md) | State ownership, Git convergence, future history storage, and open choices |
 | [docs/plans/finding-lifecycle/milestones.md](docs/plans/finding-lifecycle/milestones.md) | Implementation slices and acceptance evidence |
 | [docs/HANDOFF.md](docs/HANDOFF.md) | Current handoff and next bounded task |
 | [docs/decisions.md](docs/decisions.md) | Historical choices and explicit supersessions |
@@ -145,7 +153,9 @@ npx any-doctor@latest run --all --fail-on warning --base origin/main
 
 ## Status
 
-Pre-1.0. The next direction is reliable finding identity, remembered decisions,
-team sharing, and bounded local history. Scanning stays available through npx
-without mandatory initialization. See the [feature map](docs/features.md) for
-current availability. MIT.
+Pre-1.0. Finding identity and remembered local decisions are available. The next
+product phase is real-world adoption and reliability feedback; the next planned
+lifecycle feature is Git-shared project decisions, followed separately by bounded
+local history. Scanning stays available through npx without mandatory
+initialization. See the [feature map](docs/features.md) for current availability.
+MIT.

package/docs/HANDOFF.md

@@ -1,117 +1,94 @@
-# Handoff — finding lifecycle planning
+# Handoff — post-0.2.0 adoption and finding lifecycle
 
-Updated September 10, 2026. Start here when continuing Any Doctor's product direction
-or implementing decisions, history, identity, or team sharing.
+Updated September 22, 2026. Start here when continuing Any Doctor's product
+direction, adoption work, decisions, history, identity, or team sharing.
+
+## Current release state
+
+- npm package: `any-doctor@0.2.0`.
+- Source release tag: `v0.2.0` at `3f98de0`.
+- `main` additionally contains `5b91bf8`, a test-only PTY release-gate
+  stabilization; the packed artifact was byte-identical after that change.
+- Release verification completed with 1,091 tests, all bundled doctors verified,
+  capability-gap certification, packed-consumer checks and a clean diff check.
+
+Recheck npm, HEAD and the working tree before making a new release claim. Evidence
+records describe their named candidates; they are not automatically current.
 
 ## Read in order
 
-1. [Vision](vision.md): the maintainer's three priorities and the trust model.
-2. [Feature map](features.md): available behavior versus planned work.
-3. [Lifecycle proposal](plans/finding-lifecycle/proposal.md): user and agent workflows.
-4. [Lifecycle design](plans/finding-lifecycle/design.md): ownership, storage,
-   identity, Git reconciliation, scale, and unresolved choices.
-5. [Milestones](plans/finding-lifecycle/milestones.md): bounded delivery and evidence.
-6. [Analysis improvements](plans/analysis-improvements.md): the concrete M1
-   implementation scope, anchor/contract choices, and strict acceptance matrix.
-
-D29 in [decisions.md](decisions.md) records this direction. Current terms remain in
-[CONTEXT.md](../CONTEXT.md); planned lifecycle terms are explicitly marked there.
-
-## Current state
-
-This documentation pass began on a clean checkout at source HEAD 4adf69c. The
-package declared version 0.0.7. Recheck branch, HEAD, dirty state, runtime, and
-publication status before implementation; these are inspection facts, not a
-permanent baseline or proof of what npm currently serves.
-
-The prior Convex/certification repair is now part of the inspected source, followed
-by additional review commits. Its [audit](repair-audit-007.md) records the exact
-older candidate tested, including 286 tests and 100 Convex verification rows.
-Those results must not be presented as a fresh test of later source or this plan.
-
-**Delivered on `implement/analysis-a1-a2` (A1+A2, D30 + identity-repair
-amendment):** the `--base` diff compares through the host-derived identity
-layer — added / continuing / no-longer-detected with contextFallback,
-ambiguous, stale, lineScoped, unreadable, and contextUnavailable surfaced in
-report, JSON, and gate paths. `compareFindings` stays the strict fixture gate.
-An adversarial review's four findings are repaired with its probes as
-regression tests: literal-preserving normalization (quote-state scanner;
-string/template/regex interiors byte-exact), execution-bound provenance and
-evidence (pre-scan doctor digests, scan-adjacent immutable source capture,
-post-capture consistency recheck), optional host-validated Finding evidence
-ranges (multiline continuation edits break identity; scope surfaced as
-lineScoped), and linear duplicate matching (per-bucket cursors; 100k
-identical pairs ~58ms — dev/identity-bench.mjs is the benchmark of record).
-Evidence: 332 tests green plus a packed-artifact smoke on sift-skills (Apple
-M1 Pro, 16 GB, Node 26.5.0; full-pack `--base HEAD~5`: 402 continuing / 1
-added — the added finding cross-checked against git as a gitignored
-working-tree artifact — 402 lineScoped honestly reported because no bundled
-doctor emits ranges yet). Remaining limitations (D30 amendment, explicitly
-not guarantees): edits during a scan itself remain undetectable;
-receiver/declaration linkage unused; same-line occurrences need columns;
-bundled doctors emit no evidence ranges yet. The CLI still has no persistent
-decision store, SQLite layer, or finding history.
-
-**Architecture pass (same branch):** the dashboard split into its three
-concerns — src/doctor-tree.ts (the view-model: SiteFinding, buildTree,
-summaries, expansion defaults), src/prompts.ts (the Task prompt family),
-and a slimmer src/dashboard.ts (layout, frame, loop, read state);
-RunOutcome/CrashedDoctor/cohortFileCount/DEFAULT_EXTS moved to
-contract.ts. Strictly behavior-preserving (test bodies unchanged, import
-sources updated); glossary entries added (Dashboard, Doctor tree, Task
-prompt). M2's decision workflow now lands in the loop's state and the
-prompt family without piercing the tree.
-
-**Delivered on `implement/m2-decisions` (M2, D31):** local remembered
-decisions end to end — flat atomic state (no SQLite; the coupling rule
-is auto-history ⇒ database, reconsidered at M4), decide/decisions
-commands, dashboard a/x/v/u with a reason prompt, exact-identity
-application with visible reassessment, gates on raw findings, packed-
-install acceptance on sift-skills (decide → fresh-process rescan hides
-and annotates → inspect → reverse), 370 tests. Five review loops plus two adversarial repair rounds closed
-the findings: the loops caught and fixed a duplicate-suppression
-defect (identical occurrences now hold decisions back as ambiguous), an
-unreachable reason pane, a falsely-claimed flag refusal, NUL-bearing
-keys that could not cross argv (now base64url everywhere a shell can
-see them), and an encoded-key recording regression — all pinned by
-tests, with D31 recording the overclaims honestly.
-
-## Next bounded scope
-
-M2 — remember one decision end to end — is next, per the
-[milestones](plans/finding-lifecycle/milestones.md). The identity layer's v1
-choices are recorded in D30 and the [design](plans/finding-lifecycle/design.md)
-open-choice table; per-check compatibility revisions and doctor-supplied
-evidence are still open there because nothing persists yet.
-
-Broader module resolution, value flow, control flow, and optional types are later
-independently scoped capabilities. They do not all block M2/M3. Measure the real
-scanner separately from synthetic identity records; report current limits and
-assign scanner-scale work explicitly before claiming massive-codebase capacity.
-
-M3 (share decisions through Git, CI application) is next; M4 adds bounded
-history. These are planning increments, not authorization to run all four
-or publish a version.
-Resolve open choices in their milestone and write accepted decisions back to the
-design and decision log. Maintain one-off read-only scans and doctor confinement.
-
-## Product constraints to preserve
-
-Useful contextual findings and user-defined conventions remain in scope. The goal
-is better review with the user's own agent, not forcing every report to zero.
-Accepted concerns, not-applicable findings, observed disappearance, and claimed
-fixes must remain distinct. A dismissal does not authorize broad detector changes.
-
-SQLite is local state; committed project files are authoritative for team decisions.
-Private decisions cannot silently change CI. Git branch changes and semantic merge
-conflicts must be tested, including cache rebuild from shared records. No mandatory
-hosted service, account, init, or built-in model provider is required.
-
-## Validation for the next agent
-
-Use the milestone's acceptance cases and independent counterexamples. Review the
-actual candidate, pack/install it, and exercise a real target such as Sift without
-changing unrelated product code. Sift alone does not validate massive-codebase
-performance; retain the scale harness results and limits too. Update this handoff
-with the delivered slice, exact evidence, and remaining open choices. The maintainer
-owns versioning and publication unless a later instruction explicitly changes that.
+1. [Vision](vision.md): purpose and trust model.
+2. [Feature map](features.md): shipped behavior versus planned work.
+3. [Lifecycle proposal](plans/finding-lifecycle/proposal.md): user and agent
+   workflows.
+4. [Lifecycle design](plans/finding-lifecycle/design.md): state ownership,
+   identity, Git reconciliation and remaining choices.
+5. [Lifecycle milestones](plans/finding-lifecycle/milestones.md): completed M1/M2
+   and planned M3/M4 boundaries.
+6. [Doctor SDK](doctor-sdk.md) and [Value Path](plans/value-path/design.md): the
+   shipped semantic authoring surface.
+7. [Bundled doctor modernization](doctor-modernization.md): current shared seams,
+   retained domain policy and verification expectations for every doctor.
+
+## What shipped before and in 0.2.0
+
+- M1 identity-aware Git-base comparison with source-bound evidence, conservative
+  ambiguity and stale-source handling.
+- M2 remembered local accepted/not-applicable decisions, required reasons,
+  reversal, reassessment, dashboard and agent/JSON workflows. State is atomic
+  JSON, not SQLite; gates remain based on raw findings.
+- The Doctor SDK semantic result contract, shared recipes and maintained challenge
+  profiles.
+- Value Path as a bounded shared property-path query, adopted by Deepgram and
+  OpenRouter. A later fidelity audit removed Deepgram's private fallback and
+  intentionally narrowed one nested opaque-transfer credential case.
+- Locally complete recipe modules behind one registry.
+- The bundled doctors use the shared provider consistently: Async is recipe-native;
+  Deepgram and OpenRouter use Value Path; Convex retains domain-specific graph
+  policy over shared facts; Effect and Slop no longer carry line/brace parsers.
+
+Authoritative architectural decisions are D30–D33 in
+[decisions.md](decisions.md). Preserved implementation plans and evidence may
+contain older branch names, package versions and baseline counts.
+
+## Immediate phase: adoption
+
+Use real repositories to measure:
+
+- time to the first useful finding;
+- false positives and missed findings, classified per check;
+- narrowed/unknown cases users expected the tool to answer;
+- first-attempt `generate` → `verify` → `run` success for a custom doctor;
+- whether users understand and use remembered decisions;
+- installation, performance, terminal and JSON friction.
+
+Prefer small `0.2.x` documentation, correctness and usability repairs backed by
+reproductions. A new semantic capability starts from a concrete false positive or
+miss plus valid lookalikes; Value Path remains bounded rather than growing into a
+general JavaScript interpreter.
+
+## Next planned feature: M3 shared project decisions
+
+M3 makes selected decisions reviewable Git-tracked project state and applies them
+consistently in fresh checkouts and CI. It must preserve private local decisions,
+raw findings, doctor confinement and one-off read-only scans.
+
+Before implementation, resolve and record:
+
+- shared record layout and deterministic serialization;
+- doctor namespace/rename identity;
+- semantic conflict behavior after textual Git merges;
+- branch/worktree reconciliation and deletion;
+- read-only CI application and whether shared decisions affect gates;
+- raw, active and reviewed score presentation.
+
+M4 bounded history is separate. It is the point to reconsider SQLite or another
+indexed local store; M3 does not require a database merely to share decisions.
+
+## Completion evidence for future slices
+
+Bind the exact candidate and target, reproduce the motivating case, run focused
+and full tests, verify all doctors, build and pack, exercise a clean consumer and a
+representative real repository, review the actual diff, and record limitations.
+Publication and version changes remain separate maintainer actions unless a task
+explicitly authorizes them.

package/docs/decisions.md

@@ -1313,6 +1313,13 @@ specialized identity and control-flow policy remains local. Later Doctors
 migrate when that same deletion test demonstrates leverage. Accuracy changes
 are reviewed separately from the architecture migration.
 
+**Later audit note (2026-09-22):** The bundled-doctor modernization audit made
+one separately reviewed accuracy change: Deepgram now trusts Value Path's unknown
+result after a configuration is nested inside an object passed to an opaque call,
+rather than reviving the old resolver's definite credential finding. The case
+narrows because the opaque call may mutate the nested configuration. D32's
+architecture and proof boundary are unchanged.
+
 **Consequences:** Doctor programs become smaller policy modules over shared
 semantic proof, while the host owns source integrity, caching, evaluation and
 uncertainty. Certification gains one cross-language-ready conformance contract.

package/docs/doctor-modernization.md

@@ -0,0 +1,44 @@
+# Bundled doctor modernization
+
+Updated September 22, 2026. This is the current architecture map for bundled
+doctors. “Modernized” means a doctor uses host-owned facts for language mechanics,
+declares every required capability and unknown policy, and keeps only technology
+meaning behind its own interface. It does not mean every doctor is expressed as
+a recipe or that passing fixtures proves accuracy on arbitrary repositories.
+
+| Doctor | Shared mechanics | Deliberately local policy |
+| --- | --- | --- |
+| Async | Identity, option presence, value disposition and resource lifetime through three certified recipes | Which native request, promise-array and React timer observations merit review |
+| Convex | Calls, bindings, types, function ownership, branches, directives and value flow | Convex registration/context/query-chain semantics; generic recipes do not express correlated query paths or context capabilities |
+| Deepgram | Calls, identity and Value Path for property proof | Endpoint/model matrices, transport support, Read validation, hosts and browser credential policy |
+| OpenRouter | Calls, identity, option presence, the required-option recipe and Value Path | Stream provenance, same-chunk guards, response-dependent retry loops and model-pin policy |
+| Effect | Structural search plus shared calls, identity, bindings and exact spans | The Effect v4 skill's policy choices and test-file convention |
+| Slop | Exact spans, calls/value flow, lexical bindings, project consumers and structural fingerprints | Corpus-derived thresholds and the interpretation of maintenance review candidates |
+
+## Audit outcomes
+
+- Effect no longer counts braces, scans raw lines for API calls, or parses zod
+  argument lists. It resolves imports and aliases, honors shadowing, accepts
+  multiline names, uses exact class/function ranges, and reports full evidence.
+- Slop's hostname, overlapping-substring, tri-state and abbreviation checks no
+  longer depend on same-line formatting. Receiver identity and actual call
+  argument roles remove nearby-lookalike false positives.
+- Deepgram no longer revives a private property-walker answer after Value Path
+  returns unknown. A nested configuration passed through an opaque object now
+  narrows because mutation cannot be excluded.
+- Async, OpenRouter and Convex already used the accepted shared seams. Their
+  specialized policy remains local because moving it into a generic recipe would
+  enlarge the interface without a second equivalent consumer.
+
+## Maintainer rule
+
+Do not judge modernization by file size or recipe count. Apply the deletion test:
+move a mechanic into the host when deleting the shared module would force the same
+language reasoning back into multiple doctors. Keep technology-specific meaning
+local. Add a Doctor SDK or Value Path capability only from a reproduced miss or
+false positive with definite-positive, negative, uncertain and mixed-neighbor
+evidence. Unsupported flow narrows; it never becomes confident absence.
+
+For a release, run the complete suite, `verify --all`, capability-gap certification,
+package dry-run and packed-consumer checks. Compare any changed findings against
+fixed source, not just counts.

package/docs/doctor-reliability.md

@@ -4,10 +4,10 @@ A passing fixture suite establishes agreement on its cases. It does not establis
 precision on arbitrary repositories. Treat every check as a bounded claim.
 
 The [Doctor SDK foundations](doctor-sdk.md) move recurring identity, value-flow,
-resource and option mechanics into host-owned semantic queries and certify three
-reusable recipes with metadata-selected challenge profiles. The implementation
-on its feature branch is a review candidate, not a published compatibility
-promise; the [design](plans/doctor-sdk/design.md) remains the governing boundary.
+resource and option mechanics into host-owned semantic queries and certify four
+reusable recipes with metadata-selected challenge profiles. The SDK and Value
+Path are published in `0.2.0`; the [design](plans/doctor-sdk/design.md) records
+their governing boundary.
 
 The [vision](vision.md) includes project-specific policies and contextual review
 candidates alongside defects. Reliability means the evidence supports the stated
@@ -51,14 +51,16 @@ corrected false positive, preserved positive, intentional narrowing, new candida
 or regression. Counts alone cannot establish improvement. Record versions, target
 commit and dirty state, analysis availability, crashes, and unsupported cases.
 
-## Review decisions and reliability (planned)
+## Review decisions and reliability
 
-The [lifecycle proposal](plans/finding-lifecycle/proposal.md) adds accepted and
-not-applicable decisions. Preserve their reasons and distinguish the two: an
+The [lifecycle proposal](plans/finding-lifecycle/proposal.md) defines accepted and
+not-applicable decisions. Local decisions are implemented; project sharing and
+history remain planned. Preserve their reasons and distinguish the two: an
 accepted concern is not evidence that the detector is wrong. A confirmed
 not-applicable case should become a counterexample for its rule when appropriate.
-Shared decisions change the review view, not raw observations or analysis coverage.
-They must not silently teach a doctor to ignore unrelated similar code.
+Decisions change the active review view, not raw observations or analysis coverage.
+Local decisions do not change gates. No decision may silently teach a doctor to
+ignore unrelated similar code.
 
 Revalidate decision applicability after relevant source or rule changes. A claimed
 fix, a disappearance under comparable coverage, and an accepted finding are
@@ -71,7 +73,7 @@ authorize telemetry, uploading source, or automatic global rule changes.
 
 ## Current Convex boundaries
 
-Convex revision-2 checks use shared call structure and lexical identity. Supported
+Convex revision-2/3 checks use shared call structure and lexical identity. Supported
 registration imports, immutable aliases, local handler/config variables and direct
 handlers establish contexts. Database aliases, destructuring, imported context
 types (including local aliases and `Pick`), and consistent observed local helper