Close Milestone 3 with measured projection evidence

docs/COMPATIBILITY.md

@@ -71,6 +71,19 @@ Existing hand-written client configurations remain valid and are never rewritten
 Doctor is inspection-only and does not become a hidden bootstrap, synchronization, or migration
 path.
 
+The following Milestone 3 CLI additions are also additive:
+
+- `docforge graph-plan VIEW_ID`
+- `docforge graph-render VIEW_ID`
+- `docforge graph-render-status [VIEW_ID]`
+- `--manual-render-policy auto|explicit|disabled`
+- `--portable-graph-policy explicit|disabled`
+- `--live-viewer-policy on-demand|disabled`
+
+MCP adds the read-only `docforge_graph_plan` and `docforge_graph_render_status` tools. Portable
+graph publication remains an explicit local CLI integration action. Existing manual render,
+preview, visualization, and status names remain supported.
+
 ## Versioned data contracts
 
 Milestone 0 preserves:
@@ -96,6 +109,11 @@ Milestone 0 preserves:
 - Latest-generation-diff page schema version 1. Pages use one top-level pagination object and a
   nested `receipt_header`. `stored_receipt_hash` names the complete stored receipt. Opaque cursors
   may be restarted after a server or receipt change and are not durable public identifiers.
+- Manual render-plan schema version 1.
+- Graph view-plan schema version 1.
+- Projection-package schema version 1.
+- Projection-receipt schema version 1.
+- Independent projection-policy schema version 2. Effective policy version 1 remains frozen.
 
 Indexes, attestations, extraction caches, previews, and rendered artifacts are disposable. A schema
 change may rebuild them. Canonical project content and stored proposals may not be silently
@@ -161,12 +179,24 @@ The following guarantees remain stable:
 
 ## Rendering and visualization
 
-The `generic_html` renderer remains the supported version-1 manual projection. It retains confined
-paths, raw-HTML suppression, fixed template tokens, deterministic identities, atomic replacement,
-and side-effect-free status.
+The `generic_html` renderer remains the supported version-1 manual projection. Its public
+`GenericHtmlRenderer.prepare()` signature, renderer identity, frozen alpha bytes, confined paths,
+raw-HTML suppression, fixed template tokens, deterministic identities, atomic replacement, and
+side-effect-free status remain compatible. It now delegates through a versioned manual plan,
+immutable package, and independent renderer.
+
+The `portable_graph_html` renderer and `graph_render` descriptor table are additive. Manual and
+portable graph declarations, plans, policies, publication receipts, and status remain separate.
+The portable renderer does not replace the existing live viewer or `docforge_visualize`.
+
+Existing project descriptors may retain any positive `max_render_bytes` accepted by schema version
+1. A value above 20,000,000 bytes does not make the descriptor invalid, and a smaller actual
+artifact still renders. Actual detached worker transfer is a separate fixed 20,000,000-byte
+runtime boundary.
 
 The live graph viewer remains a read-only consumer of a generation-pinned validated index. It does
-not become project authority or MCP retrieval authority.
+not become project authority or MCP retrieval authority. Source reads use the pinned index
+generation instead of reopening mutable canonical files behind that generation.
 
 ## Task-context compatibility
 
@@ -199,8 +229,9 @@ The exact version-1 relation aliases are frozen by the MCP contract and reposito
 Changing an alias category requires a new planner version; it is not a silent implementation
 detail.
 
-`ManualRenderPlan`, `GraphViewPlan`, a portable graph renderer, and independently packaged
-renderers are later-milestone direction. Milestone 0 does not claim that those contracts exist.
+Milestone 3 adds `ManualRenderPlanV1`, `GraphViewPlanV1`, projection package and receipt version 1,
+and projection policy version 2. These are additive submodule and schema contracts. They do not
+change the legacy task-context, adapter, changeset, or effective-policy contracts described above.
 
 ## Safety boundary
 
@@ -221,6 +252,8 @@ Milestone 0 records rather than redesigns these areas:
   callers use targeted retrieval for that node.
 - One individually oversized changeset diff is transported as reconstructable canonical-JSON
   chunks. Cursors are corruption-detecting read tokens, not authenticated authorization tokens.
-- Manual planning is not separated from rendering.
-- There is no portable graph-planning or graph-rendering contract.
+- Production fragment validation is currently slower than forced-full rendering at the maintained
+  1,000-page fixture. Full rendering remains the equivalence and recovery oracle.
+- Remote render services, render farms, third-party renderer ecosystems, and a separate render MCP
+  remain deferred.
 - DocForge2 does not self-host its bootstrap documentation.