feat(consume): parent reaches the reader -- excerpt field, body link, checker rule

K3-21 A. `okf consume` resolves a concept's `parent:` pointer -- a
`segment_id`, unique only inside one document's plan -- among the concepts
sharing its `source_file` (`consume.link_parents`, one pass, no file opened
again) and an excerpt carries `parent: { concept_id, title }`. Conditional
like `req_number`: a concept with no `parent` key moves no byte. A pointer
that lands nowhere is named `parent_unresolved: true`, never dropped.

The door writes ONE line into a heading-only body whose entry has a parent:
`Enclosing section: [<title>](/<bundle-relative path>)` (SPEC SS 5.1 lineage
through links, SS 6.1 the recommended absolute form and the kind in the
prose). Only such a body, so the segmented goldens' declared parents -- bodies
holding text -- are untouched. Appended AFTER structure derivation and
screened on its own (`_screened`, the `description` rule): read as body text
the link was derived into a second, unresolved `references` edge, measured on
the fixture. `segmentation.heading_only` is the one predicate the proposer and
the door share.

`okf check` gains its seventeenth rule, `parent_unfollowable`: a `parent`
that is not a concept_id and title, names its own excerpt, or names a concept
in neither `excerpts` nor `withheld` (together every considered concept).
Contract SS 8 point 6 added, the figure carries `parent`, and "additional
members are not read by the checker" now says the checker reads only the
members SS 8 names. The template tells the reader what `parent` is and that
SS 2.2 lets it read that one concept; `skill.CONDITIONAL_FIELDS` gains
`parent`. README and CLAUDE.md say what consume now reads.

Moved on purpose, each named: the SS 7.4 known-positive IS the contract
document, so `budget.known_positive` moves in every payload (13 238 / 12 893
/ 345 -> 14 455 / 14 083 / 372); `skills/okf-consume/` regenerated from the
segmented golden, whose plan declares s1 and s2 under s0 -- its example
payload now carries both parents; `test_bundle_identity` 16 -> 17 rules;
`test_shell_parent`'s byte test also accounts for the link line.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -625,8 +625,18 @@ and fixtures, never code.
   The route reads the PLAN, never the row: on R761 it names the ancestor the
   `<sec>` nesting names on **708 of 710** shells (the 2 misses sit at depth 7,
   clipped to 6), where reading section numbers gets 686 (`12` begins with
-  `1`). 35 of 710 have no ancestor holding text and get none. Off because
-  `okf consume` reads no `parent` key. **The index renders every such parent
+  `1`). 35 of 710 have no ancestor holding text and get none. **Since K3-21
+  `okf consume` reads the key** (`consume.link_parents`, resolved among the
+  concepts of the concept's OWN `source_file`, because `p1` exists in every
+  document): an excerpt carries `parent: { concept_id, title }`, conditional
+  like `req_number`, or `parent_unresolved: true` where the pointer lands
+  nowhere, and a heading-only body gains ONE line `Enclosing section:
+  [title](/path)` (SPEC SS 5.1 lineage through links, SS 6.1 the recommended
+  absolute form), appended AFTER structure derivation -- read as body text it
+  became a second, unresolved `references` edge -- and screened on its own.
+  `okf check`'s seventeenth rule, `parent_unfollowable`, holds the form.
+  Whether the build default moves is K3-21 B's measurement, not this line's.
+  **The index renders every such parent
   UNRESOLVED** (`parent: p1?`): `structure` reads `parent` as a document
   NUMBER, and a segment id answers to none -- the one key with two meanings
   `inbox.py` already names for a declared parent. Report:
@@ -745,7 +755,10 @@ and fixtures, never code.
   allowlist, because a list names the producers its author thought of and one
   bundle locates by `source_element_id` on 269 of 274 concepts. A prefix, never
   a substring (`resource_owner` is not a locator). An absent key stays absent
-  and an undecodable address is named (`sources_unreadable`). `sources` is READ
+  and an undecodable address is named (`sources_unreadable`). Since K3-21 an
+  excerpt also carries `parent`, the enclosing concept's `concept_id` and
+  `title` -- never the raw `segment_id` -- or `parent_unresolved`, and the
+  contract's SS 8 point 6 says the checker reads it. `sources` is READ
   in both YAML forms because the two real bundles disagree (flow 629/629 on one,
   block 270/270 on the other) — reading block is not a licence to write it, the
   emission rule is unchanged. Contract § 8 makes `title` a MUST (checker code
@@ -769,7 +782,8 @@ and fixtures, never code.
   numbers a generic skill can only leave as holes or state falsely, and that
   argument NEVER rested on conformance, so closing the measurement leaves it
   standing. **That half is CLOSED 2026-09-10 by `bundle_mismatch`, the checker's
-  SIXTEENTH rule** (`RULES` is a tuple and `Report.rules_evaluated` is
+  SIXTEENTH rule** (seventeen since K3-21 added `parent_unfollowable`;
+  `RULES` is a tuple and `Report.rules_evaluated` is
   `len(RULES)`, so every published «15 rules» line is now «16 rules» — a
   contract change for anyone quoting it). It compares the identity a skill
   DECLARES against the identity its payload declares, **both `bundle_id` AND
@@ -809,7 +823,8 @@ and fixtures, never code.
   veiledningen om krav?"` are both required (the payload test asserts bytes for
   that question), and the checkout prefix is then stripped, because `okf skill`
   writes the bundle root and the skill path ABSOLUTE when `--out` is not under
-  `.claude/skills/`. The pair is rc 0, 16 rules, 0 findings, and a test holds
+  `.claude/skills/`. The pair is rc 0, 17 rules (16 before K3-21), 0 findings,
+  and a test holds
   the shipped bytes to the generator's. Its frontmatter `name` is now
   `b-golden-segmented-okf-v0-2-consume`: Claude Code takes a project skill's
   COMMAND from the directory name and uses `name` only as a display label, and