Add versioned independent projection contracts

DEVELOPMENT_NOTES.md

@@ -610,3 +610,90 @@ Milestone 2 is complete. Follow-up ideas stay explicitly later-scope: avoid reco
 task-shaped capsule for every continuation page, add authenticated continuation when the threat
 model requires it, verify a native Claude timeout representation, and introduce adapter-owned
 launcher metadata before generating configurations for custom adapters.
+
+## Milestone 3 — active: independent projections
+
+Milestone 3 began only after `main` and `dev` were aligned at the verified Milestone 2 closeout.
+Three read-only audits are running before source changes:
+
+- Manual planning, immutable packages, renderer isolation, receipts, preview/application
+  integration, and full/incremental equivalence.
+- Portable graph planning, static artifacts, the live viewer boundary, worker protocol, and static
+  plus interactive accessibility.
+- Packaging, optional dependencies, public contracts, projection policies, performance,
+  incremental fragments, and maintained gates.
+
+The active design constraints are unchanged: renderers consume one validated immutable generation;
+manual and graph plans remain separate; the live viewer is not retrieval authority; core remains
+usable without rendering; status performs no hidden rendering; full rendering remains the recovery
+and equivalence oracle; no storage rewrite is assumed.
+
+### Milestone 3 architecture decision
+
+The three audits converged on one compatibility-first boundary:
+
+- The existing `docforge.render_contract` names, `GenericHtmlRenderer.prepare()` signature,
+  `generic_html` renderer identity, and byte output remain the version-1 compatibility surface.
+  They become adapters over the new manual-planning path rather than being changed in place.
+- New `ManualRenderPlanV1`, `GraphViewPlanV1`, `ProjectionPackageV1`, and
+  `ProjectionReceiptV1` contracts use strict canonical JSON, deterministic ordering, independent
+  item and byte bounds, exact generation and policy binding, and content-derived identities.
+- Plans and packages contain selected graph facts and bounded content. They never contain a
+  project object, SQLite handle, absolute project or index path, arbitrary query, command, or
+  project-provided executable code.
+- The planner owns graph selection and meaning. A renderer may transform only a validated package
+  into declared artifacts and cannot select nodes, invent relationships, crawl the project, choose
+  publication paths, or mutate canonical sources.
+- Manual and portable graph renderers live behind independent import boundaries. Renderer
+  dependencies load lazily. Default installation behavior remains compatible during the initial
+  migration; optional dependency changes require their own verified packaging decision.
+- Portable graph rendering is additive. It does not replace or silently change
+  `docforge_visualize`, `graph-browser@17`, the viewer-manager protocol, or the query-backed live
+  viewer.
+- Effective policy version 1 remains frozen. Milestone 3 introduces a version-2 projection-policy
+  view for manual `auto|explicit|disabled`, portable graph `explicit|disabled`, and live viewer
+  `on-demand|disabled` enforcement, while retaining the version-1 projection for existing clients.
+- Publication commits content-addressed artifacts first, renderer evidence second, and a bounded
+  generation/view manifest last. Status remains receipt-only. Failures after artifact replacement
+  report committed degraded success rather than an ordinary failed mutation.
+- Full planning and rendering remain the recovery and equivalence oracle. Incremental fragments
+  are disposable, keyed from complete plan semantics, and may be reused only when byte-exact
+  artifact equivalence is proven.
+- The live source endpoint must stop reading mutable canonical files behind a pinned graph
+  snapshot. Portable artifacts never inherit that path-bearing behavior.
+
+The first implementation slice freezes existing golden output, adds the four versioned contracts
+and validators, introduces pure manual and graph planners, and makes the legacy manual renderer a
+compatibility wrapper. Publication hardening, detached rendering, incremental fragments, portable
+graph publication, independent policy enforcement, accessibility, and maintained performance
+gates follow on top of that frozen boundary.
+
+### Milestone 3 contract slice
+
+The first slice now implements:
+
+- Strict Draft 2020-12 schemas and runtime canonical-hash validation for manual plans, graph plans,
+  projection packages, and projection receipts.
+- A deterministic manual planner that owns page selection, navigation, cross-references,
+  backlinks, search documents, component assignments, orphan diagnostics, and cycle diagnostics.
+- A deterministic graph planner with exact-root or metadata-only lexical scope, closed filters,
+  explicit node/edge/work bounds, deterministic omissions, path/source-body exclusion, and
+  no-AST Logic exclusion.
+- A separate `docforge_renderers.manual` package. Its renderer accepts only a validated package and
+  has no project, SQLite, publication-path, or filesystem-write API.
+- The frozen `GenericHtmlRenderer` compatibility shim over the new planner/package/renderer
+  pipeline. The alpha artifact remains exactly 2,043 bytes with output SHA-256
+  `81656bb89debc7ad1fbe8bc290e9a3ba90664442b17a6d57e908d30d20c47f77` and legacy render identity
+  `1c0a49c28ba3b0dabf94be36e75def197dee1be3cb73ac405b09875383c8dc5f`.
+- Rejection of project-template scripts, inline event handlers, `javascript:` URLs, embedded
+  browsing contexts, and refresh redirects.
+- Wheel inclusion for both typed packages and every published JSON schema. Importing `docforge`
+  no longer imports `markdown_it` or the manual renderer package.
+- A live-viewer correction: source evidence now comes from the pinned index generation. The
+  viewer no longer reopens mutable canonical files behind an older graph snapshot.
+
+The new repository-native contract target passes 91 tests and 120 subtests. The combined
+projection, rendering, and live-viewer focus passes with byte-exact compatibility and no hidden
+source/path authority. This is not Milestone 3 closeout: durable multi-artifact publication,
+portable graph rendering, detached workers, fragment reuse/equivalence, policy version 2,
+accessibility, and maintained scale evidence remain active work.