feat(consume): the withheld set is counts plus names, not one entry per concept

Measured 2026-09-20 on a 2313-concept bundle of one project's own
documentation: `withheld` held 2 305 entries = 186 440 B of compact JSON =
**65.5 % of the 284 850-byte payload**, and not one of those bytes counted
against the budget the same payload reports (`spent` was 45 192). A reader was
handed 239 658 bytes the budget line did not know about, to learn 2 305 concept
ids with nothing beside them -- the title being exactly what `--withheld-titles`
existed to buy, and which was off because buying it for 2 305 entries cost
another 37.9 %.

`withheld` is now a mapping: `total` (equal to `denominators.withheld`, so
SS 5.2's identity is unmoved and closes on the NUMBERS), `by_rule` (the same
total decomposed over the closed rule set, so "what kind of drop" is answerable
without the list), `nearest` (the best-ranked drops BY NAME, with title and
source document, so a reader who sees a near miss can ask for it) and
`complete`. The near misses are read off the ranking, not off `cut`'s output:
`cut` sorts by id so the partition is comparable, and that order says nothing
about which concept a reader might want next.

Same question, same bundle, after: **52 421 bytes, 18.4 % of the old file**.
The whole list stays reachable behind `--withheld-full`, and the two
instruments that classify EVERY miss by its rule -- the retrieval gate and
`okf_consume_measure` -- now ask for it explicitly and assert `complete`
rather than assuming it. `--withheld-nearest N` sets the cap (default 20,
which is `k` plus the next twelve). `--withheld-titles` is retired: a flag
whose only remaining effect would be to STRIP the title from a list the caller
asked for in full names no decision worth two shapes for one list.

`CONTRACT_REVISION` moves to `okf-consumption/2`, because a consumer indexing
the old key as a list would otherwise break silently. Three checker rules move
with it, and one of them is the interesting case: `parent_unfollowable` used
`excerpts` + `withheld` as the bundle's own denominator, which a truncated
block is not -- so that clause now runs only where the payload SAYS it is
complete, stated in SS 8.6 rather than left as a silence, with the other two
clauses (shape, self-reference) running either way. `Report` carries both
denominators, because a report claiming it examined 2 305 entries it never saw
is the same defect one level up.

The generated skill's "breaking point" section goes with it: it extrapolated a
concept count from the cost of ONE withheld entry, and there is no such slope
any more. It now states what this bundle's bookkeeping cost and that the block
is bounded by the cap rather than by the bundle -- an extrapolation from a
slope the code no longer has would be a measurement of the previous revision.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -86,11 +86,7 @@ here was measured; none of it is a plan.
   (`--accounting PATH`) for that reason. The full list is under
   [Build](#build).
 - **A few rough edges, named rather than fixed.** `okf skill` requires `--out`
-  and exits 2 without it. Over MCP, `okf_describe` requires `bundle_id` where
-  `okf_ask` treats it as optional. One `okf_ask` answer measured over 300 KB on
-  a 2 002-concept bundle, because the payload's `withheld` list carries one
-  entry per concept that was not delivered — the payload itself was well inside
-  its budget.
+  and exits 2 without it.
 - **There is no context graph and no visualisation.** Nothing in this package
   draws a bundle.
 
@@ -965,7 +961,20 @@ taken. 0.8.1's unbounded order is reproducible by no flag;
 It emits the § 8 shape — `contract`, `bundle` (`bundle_id` plus a
 `sha256-tree:` content identity), `budget` (unit, instrument, limit, spent and a
 validated known-positive), `denominators`, `excerpts` and `withheld` — and every
-withheld concept names the rule that dropped it, from a closed set of seven.
+withheld concept is accounted for by the rule that dropped it, from a
+closed set of seven.
+
+**`withheld` is counts plus names, not one entry per concept** (revision
+`okf-consumption/2`). It carries the `total`, the same total decomposed
+`by_rule`, the best-ranked drops by name — with title and source document, so a
+reader who sees a near miss can ask for it — and `complete`, which says whether
+those names ARE the whole set. `--withheld-nearest N` sets how many are named
+(default 20) and `--withheld-full` names every one, which is what an instrument
+classifying every miss should ask for. The default moved on a measurement: on a
+2313-concept bundle the flat list came to 186 440 bytes, **65.5 % of the written
+payload**, none of it counted against the budget the same payload reported, and
+none of it anything a reader could act on. `--withheld-titles` is retired by
+that change — it existed to buy the one field the near misses now carry.
 
 Every excerpt carries the concept's `title`, and — when the producer wrote them
 — `req_number`, the SPEC § 5.1 address `sources`, and **every top-level