Close Milestone 3 with measured projection evidence

README.md

@@ -26,6 +26,12 @@ declared manuals, visualizes project structure, and manages reviewable documenta
 - Detects project-local adapter implementation and configuration changes and requires a fresh
   project-bound process before any further MCP work.
 - Keeps function-scoped control-flow projections separate from the primary architecture graph.
+- Compiles manuals and portable graph artifacts from separate versioned, generation-pinned plans
+  and immutable packages.
+- Runs built-in manual and graph renderers in fixed detached workers with validated receipts,
+  bounded transfer, and no project-path authority.
+- Enforces independent manual, portable-graph, and live-viewer policy while keeping status
+  receipt-only.
 - Runs a managed loopback graph browser with neighborhood, semantic Flow, convergence Web,
   function-scoped Logic, source inspection, and branch-aware node hiding.
 - Supports generic documentation projects and project-owned source adapters.
@@ -73,6 +79,63 @@ details, and explicit truncation. Paged results use one top-level cursor and a v
 `receipt_header`; `stored_receipt_hash` identifies the complete persisted receipt. The read never
 exposes Logic details, loads canonical source, repairs derived state, or invents history.
 
+## Independent projections
+
+Manual compilation, portable graph rendering, and the live viewer consume the same validated graph
+generation through separate boundaries:
+
+```text
+validated generation
+    ├── ManualRenderPlanV1 → immutable package → detached manual renderer
+    ├── GraphViewPlanV1    → immutable package → detached portable graph renderer
+    └── pinned index       → managed read-only live viewer
+```
+
+Plans, packages, and receipts are canonical, versioned, hash-identified, bounded, and contain no
+project object, SQLite handle, absolute project path, command, or caller-selected renderer module.
+Renderers cannot select graph facts, crawl canonical sources, choose publication paths, or mutate
+project state.
+
+Declare portable graph output separately from manual views:
+
+```toml
+[graph_render]
+output_root = ".docforge/portable-graph"
+
+[[graph_render.views]]
+id = "architecture"
+renderer = "portable_graph_html"
+output = "architecture.html"
+title = "Architecture"
+root = "architecture.overview"
+initial_mode = "web"
+depth = 3
+max_nodes = 250
+max_edges = 1000
+max_work = 100000
+include_logic = false
+```
+
+Plan, publish, and inspect it explicitly:
+
+```bash
+.venv/bin/docforge --project-root "$PROJECT" graph-plan architecture
+.venv/bin/docforge --project-root "$PROJECT" graph-render architecture
+.venv/bin/docforge --project-root "$PROJECT" graph-render-status architecture
+```
+
+The version-2 projection policy independently selects manual
+`auto|explicit|disabled`, portable graph `explicit|disabled`, and live viewer
+`on-demand|disabled`. Use `--manual-render-policy`, `--portable-graph-policy`, and
+`--live-viewer-policy` on CLI/MCP startup or generated client configuration. Status remains
+available when the corresponding active operation is disabled.
+
+Manual fragment reuse is disposable. Cold record publication is guarded by byte-exact comparison
+with a full detached render; warm records are independently recomputed and validated inside the
+worker. Full rendering remains the recovery and equivalence oracle. Portable artifacts commit
+content-addressed output and renderer evidence before one bounded generation/view manifest; status
+does not plan or render.
+
 ## Graph views
 
 The browser presents the primary architecture graph through three complementary views and loads a
@@ -170,10 +233,18 @@ DocForge describes them as a source graph.
   performance, memory, rendering and response sizes, bottlenecks, and missing coverage.
 - [Milestone 0 closeout](docs/MILESTONE_0_CLOSEOUT.md) — lineage, migration, security scan,
   repository state, and fresh-clone proof.
+- [Milestone 1 baseline](docs/MILESTONE_1_BASELINE.md) — warm operation latency, structured work,
+  status, retrieval, and memory measurements.
+- [Milestone 1 closeout](docs/MILESTONE_1_CLOSEOUT.md) — fast-core contracts, adversarial
+  validation, compatibility boundaries, and exact candidate evidence.
 - [Milestone 2 baseline](docs/MILESTONE_2_BASELINE.md) — task context, generation diff, client
   configuration, doctor, response-size, counter, and memory measurements.
 - [Milestone 2 closeout](docs/MILESTONE_2_CLOSEOUT.md) — implemented contracts, adversarial
   validation, exclusions, and exact candidate evidence.
+- [Milestone 3 baseline](docs/MILESTONE_3_BASELINE.md) — manual, fragment, worker, portable graph,
+  status, equivalence, response-size, and memory measurements.
+- [Milestone 3 closeout](docs/MILESTONE_3_CLOSEOUT.md) — independent projection contracts,
+  adversarial validation, compatibility boundaries, and exact candidate evidence.
 - [MCP contract](docs/MCP_CONTRACT.md) — exact tool and process boundary.
 - [Viewer manager](docs/VIEWER_MANAGER.md) — native service setup and lifecycle.
 - [Adapter decision](docs/APPLICATION_DECISION.md) — why custom adapters own canonical
@@ -197,6 +268,8 @@ make gate
 Focused entry points are available as `make contract`, `make test`, `make type`,
 `make benchmark-smoke`, `make benchmark`, `make benchmark-m1-smoke`, and
 `make benchmark-m1`. Milestone 2 adds `make benchmark-m2-smoke` and `make benchmark-m2`.
+Milestone 3 adds `make accessibility`, `make benchmark-m3-smoke`, `make benchmark-m3`, and
+`make benchmark-m3-full`.
 
 The committed 1,000-node baseline and its measurement method are under `benchmarks/`.