Add versioned effective policy

docs/USER_MANUAL.md

@@ -513,6 +513,19 @@ docforge-mcp \
 
 Omit `--proposal-writer` when the MCP client should not create or append proposals.
 
+Select the session's declared surface explicitly when useful:
+
+```bash
+docforge-mcp \
+  --project-root /absolute/path/MyProject \
+  --capability-mode read
+```
+
+Supported modes are `read`, `proposal`, `application`, and `operator`. Existing startup defaults
+remain compatible. Capability mode describes the registered surface; bootstrap separately reports
+whether a configured writer or applier actually grants mutation access. Application mode refuses
+startup without a canonical applier. Operator mode is reserved and currently adds no tools.
+
 Add `--diagnostics` when profiling a development or benchmark session. Each MCP response then
 includes bounded stage timings and compiler-work counters. The same flag is available on
 `docforge`. Diagnostics are disabled by default, record no project content or paths, and never
@@ -530,6 +543,11 @@ docforge-mcp \
 Without `--canonical-applier`, `docforge_apply_changeset` is not registered. The flag is an
 identity, not a command. The changeset creator, configured writer, and canonical applier must agree.
 
+Call `docforge_bootstrap` first. Its version-1 `session_contract` contains the fixed binding,
+current graph generation, effective policy, actual capabilities, render policies, prohibitions,
+and a recommended first operation. Workflow guidance does not recommend registration or
+application when those startup capabilities are unavailable.
+
 Example MCP client configuration:
 
 ```json