Close Milestone 2 with measured evidence

docs/USER_MANUAL.md

@@ -508,6 +508,67 @@ visualization-status
 visualization-stop
 ```
 
+### Client configuration and doctor
+
+Preview one deterministic standalone client fragment:
+
+```bash
+docforge configure codex --project /absolute/path/MyProject
+docforge configure claude --project /absolute/path/MyProject
+docforge configure openclaw --project /absolute/path/MyProject
+```
+
+Preview is the default. Add `--output /absolute/path/fragment` to create a new private fragment in
+an existing real directory. Publication is create-only. DocForge accepts an identical existing
+private single-link file as unchanged, but it never merges, replaces, broadens permissions, or
+follows a symlink. Descriptor, parent, and target identities are revalidated across the
+publication commit.
+
+The generated command uses the exact current Python interpreter with isolated module startup.
+Generation first proves that this interpreter can import `docforge.mcp_server`. The result binds
+the project root, effective policy, arguments, artifact bytes, and all hashes. It copies no ambient
+environment values.
+
+Select authority explicitly:
+
+```bash
+docforge configure codex \
+  --project /absolute/path/MyProject \
+  --capability-mode proposal \
+  --proposal-writer project-editor
+
+docforge configure codex \
+  --project /absolute/path/MyProject \
+  --capability-mode application \
+  --proposal-writer project-editor \
+  --canonical-applier project-editor
+```
+
+Read mode is the default. Proposal and application modes fail closed unless the descriptor
+declares the named writer, and application requires the same writer/applier identity. Add
+`--no-ast` to preserve the no-AST binding. Generic CLI generation refuses project-owned adapters
+because it cannot safely reconstruct their composition.
+
+Inspect one configured client binding:
+
+```bash
+docforge doctor --client codex --project /absolute/path/MyProject
+docforge doctor --client codex \
+  --project /absolute/path/MyProject \
+  --config /absolute/path/config.toml \
+  --server-name my-project-docforge
+```
+
+Doctor returns `healthy`, `degraded`, or `unhealthy` with exit codes 0, 1, or 2. Its fixed
+version-1 inventory checks project and descriptor binding, the client driver and entry, executable
+and arguments, project root, effective policy, no-AST state, timeouts, environment-key names,
+tool-filter representation, and stat-only index presence.
+
+Doctor is intentionally not a connection test. It never loads canonical sources, opens SQLite,
+starts MCP, executes the configured command, synchronizes, builds, renders, starts a viewer, or
+writes configuration. Claude timeout representation and client filtering that cannot be proved
+locally remain explicit warnings.
+
 ## MCP usage
 
 Run one MCP server per project with absolute paths: