docs: U4-kallstedene som invariant + --explore paa den publiserte flaten (ORDRE 20260823T204216Z)

CLAUDE.md: ny invariant «Utforskningens KALLSTEDER» - det kaller-eide sporet og
hvorfor formen er tvunget av en maaling og ikke valgt, tredelingen av hostings
whitelist og den NEGATIVE halvdelen Fase 4e-beviset trengte, de to nektene som baerer
en beslutning (to kilder til ett mandat; enable_plan_review nektet FOER explore()
fordi ExplorationError er en RuntimeError), demo-scenarioets vakuitets-vakt, seksten
maalte mutasjoner, og den ene som falsifiserte testen foerst. Linja «--explore i
run.py ... er IKKE bygget (oekt 57)» er fjernet - den er ikke sann lenger.

README: --explore/--explore-config i single-project-partisjonen, med bundene som maa
oppgis og hvorfor ingen av dem har en default, nekten mot --mandate og doera som
faktisk betjener fagpersonens egne hypoteser, samt {run_id}-exploration.json og det
hostede explore_prompt.

998 passed / 5 skipped. Golden-transkriptet byte-uendret.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YRZhBJcxqTcqWyMW6hBttx

README.md

@@ -394,7 +394,9 @@ when the seam is detached, so the loop cannot silently degrade into theater.
     `--semantic-retrieval`, `--decision`/`--rationale`, `--live-dry-run`, and
     `--scripted-replies <file>` (the offline whole-loop door — see
     [Walk the whole chain offline](#walk-the-whole-chain-offline); mutually exclusive with
-    `--live-dry-run`, which stops before the first model call rather than answering it).
+    `--live-dry-run`, which stops before the first model call rather than answering it), and
+    `--explore "<prompt>" --explore-config <file>` (opt-in: run an exploration first and let it
+    shape the mandate this run evaluates — see below).
   - **Portfolio** — `--portfolio`, plus optional `--goals`, `--ledger`, `--dimension-config`,
     `--semantic-retrieval`; it stops early and prints a `goal reached: …` line when the
     accumulated ledger meets a goal.
@@ -414,6 +416,33 @@ when the seam is detached, so the loop cannot silently degrade into theater.
   uv run python -m portfolio_optimiser.run --report --ledger ledger.json
   ```
 
+  `--explore` (U4) is **opt-in** and sits *over* the eight-step loop, never inside it. Given a
+  prompt and a knowledge base, a Magentic manager decides what to read and which cost-saving
+  directions are worth testing; what leaves that freedom is a **mandate**, and every number in it
+  is still gated by the same blocking deterministic validator. The exploration writes nothing —
+  no outbox artefact, no wiki entry, no verdict.
+
+  ```bash
+  uv run python -m portfolio_optimiser.run FV42-GSV-E1 --docs-dir <docs> --bundle-dir <bundle> \
+    --explore "Find the cheapest saving worth testing here" --explore-config exploration.json
+  ```
+
+  `--explore-config` states the bounds, and **every field is required** — `max_rounds`,
+  `max_tokens`, `max_stall_count`, `max_reset_count`, `max_plan_revisions`, `enable_plan_review`.
+  None of them has a default, because an omitted cap falls back to an *unbounded* loop rather than
+  a conservative one. `enable_plan_review` must be `false` on this surface: the plan review is
+  synchronous and there is no reviewer at a CLI to answer it (the library API takes one).
+
+  `--explore` is refused together with `--mandate` — they are two sources of one mandate, and
+  merging would silently overwrite what you wrote. To seed an exploration with a domain expert's
+  own hypotheses, use `explore(..., seed_approaches=[Approach(...)])`; seeds are always preserved
+  and always come first, including when the loop stops early. With `--outbox-dir`/`--run-id` the
+  run also writes `{run_id}-exploration.json`: the per-round ledger, the plan reviews and the
+  in-loop advisory verdicts, written even when a cap cut the exploration short.
+
+  The hosted surface takes the same door as `explore_prompt` + `explore_contract` on
+  `POST /invocations`.
+
   `--semantic-retrieval` (S3.1) is an **opt-in** ranking change, **off by default**. Off, prior
   verdicts are ranked exactly as before: a structural score over the affected cost-code set,
   measure type and magnitude bucket, with surface text deliberately excluded. On, that score is