feat(consume): the withheld set is counts plus names, not one entry per concept

Measured 2026-09-20 on a 2313-concept bundle of one project's own
documentation: `withheld` held 2 305 entries = 186 440 B of compact JSON =
**65.5 % of the 284 850-byte payload**, and not one of those bytes counted
against the budget the same payload reports (`spent` was 45 192). A reader was
handed 239 658 bytes the budget line did not know about, to learn 2 305 concept
ids with nothing beside them -- the title being exactly what `--withheld-titles`
existed to buy, and which was off because buying it for 2 305 entries cost
another 37.9 %.

`withheld` is now a mapping: `total` (equal to `denominators.withheld`, so
SS 5.2's identity is unmoved and closes on the NUMBERS), `by_rule` (the same
total decomposed over the closed rule set, so "what kind of drop" is answerable
without the list), `nearest` (the best-ranked drops BY NAME, with title and
source document, so a reader who sees a near miss can ask for it) and
`complete`. The near misses are read off the ranking, not off `cut`'s output:
`cut` sorts by id so the partition is comparable, and that order says nothing
about which concept a reader might want next.

Same question, same bundle, after: **52 421 bytes, 18.4 % of the old file**.
The whole list stays reachable behind `--withheld-full`, and the two
instruments that classify EVERY miss by its rule -- the retrieval gate and
`okf_consume_measure` -- now ask for it explicitly and assert `complete`
rather than assuming it. `--withheld-nearest N` sets the cap (default 20,
which is `k` plus the next twelve). `--withheld-titles` is retired: a flag
whose only remaining effect would be to STRIP the title from a list the caller
asked for in full names no decision worth two shapes for one list.

`CONTRACT_REVISION` moves to `okf-consumption/2`, because a consumer indexing
the old key as a list would otherwise break silently. Three checker rules move
with it, and one of them is the interesting case: `parent_unfollowable` used
`excerpts` + `withheld` as the bundle's own denominator, which a truncated
block is not -- so that clause now runs only where the payload SAYS it is
complete, stated in SS 8.6 rather than left as a silence, with the other two
clauses (shape, self-reference) running either way. `Report` carries both
denominators, because a report claiming it examined 2 305 entries it never saw
is the same defect one level up.

The generated skill's "breaking point" section goes with it: it extrapolated a
concept count from the cost of ONE withheld entry, and there is no such slope
any more. It now states what this bundle's bookkeeping cost and that the block
is bounded by the cap rather than by the bundle -- an extrapolation from a
slope the code no longer has would be a measurement of the previous revision.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/consumption-contract.md

@@ -223,9 +223,14 @@ are permitted; the checker reads only the members this section names.
    SPEC § 6.1, "Consumers MUST tolerate broken links". A `parent` names that one concept as reachable
    in § 2.2's sense and names nothing else. The checker refuses
    (`parent_unfollowable`) a `parent` that is not both members, that names its
-   own excerpt, or whose `concept_id` is in neither `excerpts` nor `withheld` —
-   together those name every concept the pre-pass considered (§ 5.2), so a
-   pointer outside them names nothing in the bundle. A pre-pass MAY also carry
+   own excerpt, or — **only where `withheld.complete` is true** — whose
+   `concept_id` is in neither `excerpts` nor `withheld.nearest`. Together those
+   name every concept the pre-pass considered (§ 5.2), so a pointer outside
+   them names nothing in the bundle; over a payload that named a sample of its
+   drops they do not, and a checker applying the clause anyway would refuse
+   correct pointers at the rate the sample is short. That the clause did not
+   run is a fact about the payload's shape, stated here rather than left as a
+   silence. A pre-pass MAY also carry
    the enclosing concept's text inside `parent` — `text`, with that concept's
    own `sha256`, and `truncated` where it was cut to fit — and then only from
    the room its cut left, so that inherited text never displaces an excerpt.