diff --git a/CHANGELOG.md b/CHANGELOG.md
index e7e01d68..6aa5cda2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,44 @@ and this project adheres to
 
 ### Added
 
+- **`okfgen generate --roslyn-timeout <seconds>`** — a wall-clock budget for the
+  whole Roslyn stage, the `dotnet msbuild` queries and the compilations after
+  them. Absent by default, and absent means unbounded: each query is capped at
+  two minutes on its own, but nothing caps their sum, so a large repository runs
+  for as long as it runs. It is not a default because a budget makes the emitted
+  bundle a function of how fast the machine is, and determinism is pinned at a
+  fixed extractor version, not a fixed CPU. If the budget runs out the stage is
+  abandoned **whole**, never truncated: the run lands in exactly the
+  `--no-msbuild` state, with a note naming the same two losses, rather than
+  emitting a bundle whose exact and name-matched links are divided by machine
+  speed with nothing recording where the line fell.
+- **`okfgen` gains a C# code-graph stage** (`producers/OkfProducer`, outside
+  `OKF4net.sln` and outside CI by decision). `generate` now emits one `code/`
+  concept per namespace, type and member, with resolved `## Calls` links. Two
+  engines behind one contract: tree-sitter extracts symbols and call sites
+  language-agnostically, and Roslyn resolves C# call sites exactly — without
+  `MSBuildWorkspace`, querying project inputs through a bounded `msbuild -getItem`
+  subprocess — with a name-match resolver covering what Roslyn cannot reach. Call
+  sites are identified by UTF-8 byte offset, since the two engines natively speak
+  UTF-16.
+- **`okfgen generate` prints a completeness report** to stderr, prefixed `run: `,
+  on every run that reaches the generation stage: files visited and how many fell
+  to each cause, whether the traversal was complete, projects detected and how
+  many of the closure compiled, exact-resolver coverage, and how many `code`
+  concepts are reachable from `overview`. It exists because every other account a
+  run gives of itself is a note gated on its own trigger, so a run printing
+  nothing was indistinguishable from a mechanism that did not fire. On stderr, so
+  no CI gate reading stdout changes and nothing lands in the bundle.
+- **`okfgen generate --check`** compares a regenerated bundle against the one on
+  disk, over a copy, and reports drift without writing. Backed by a golden
+  fixture.
+- **Project detection follows every `*.sln` in the tree**, not only one at the
+  repository root. A root-only lookup let the first root solution decide the whole
+  answer: measured on this repository, 9 of 17 `.csproj` were detected, and the
+  194 `code` concepts of the undetected projects belonged to no package concept
+  and were unreachable from `overview` — which `okf validate` does not report,
+  because an orphan dangles nothing. A `.csproj` that no solution references is
+  still not a package.
 - **`ConceptSearch.TopDiversified`** — picks the top N of a scored result set
   while rotating across top-level id families, so one family cannot take every
   slot in a truncated window. `ConceptSearch.Search` is unchanged; this is an
@@ -263,6 +301,40 @@ and this project adheres to
 
 ### Fixed
 
+- **`generated.by` is an actor again, and the engine versions moved to
+  `generated.engines`.** §5.2 makes that field an actor and §7 defines an actor as
+  exactly one of `<producer>/<version>`, `human:<id>`, `process:<id>`. It was written
+  as `okfgen/0.1.0 tree-sitter/1.3.0 roslyn/5.3.0`, which is none of them — and the
+  failure was silent, because `Actor.Parse` splits on the first `/` and reported it
+  well-formed with a version of `0.1.0 tree-sitter/1.3.0 roslyn/5.3.0`. `okf validate`
+  called such a bundle clean while every consumer reading the version got a string
+  naming no release. The provenance is preserved in a sibling key, which OKF keeps
+  across a round-trip. **Regenerate to update an existing bundle's `overview`.**
+- **Scope filters on effective visibility.** A `public` member of an `internal` type is
+  capped at internal by C#, so it is now out of scope by default. It used to be emitted
+  with `--include-internal` off *and* tagged `public` — a visibility the language does
+  not give it — so a bundle generated to exclude internal API published it anyway.
+  **This removes concepts from regenerated bundles**, which is the point.
+- **Generic types are disambiguated with a backtick, not `_`.** `Holder<T>` was spelled
+  `Holder_1`, drawn from the C# identifier alphabet, so a type genuinely named
+  `Holder_1` collapsed into the same concept — both signatures under one description.
+  The ids move from `holder_1` to `holder-1`.
+- **`okfgen` no longer names Roslyn in `generated.engines` on a run where Roslyn never
+  ran** — including the common one, where every project failed to query or compile
+  (an unrestored checkout, no `dotnet` on `PATH`). That field is a determinism claim
+  — *these engine versions produced these bytes* — so naming an engine the run never
+  invoked makes it false in the direction that matters, by promising reproducibility
+  against a tool that was not there. It was written unconditionally on every run that
+  was not `--no-code`, which also covers `--no-msbuild`, a repository with no project
+  file, and an exhausted `--roslyn-timeout`. The golden fixture could not catch this:
+  the fixture harness had the rule right while the shipped CLI did not, so the two
+  disagreed about the same repository.
+- **`--roslyn-timeout` is read invariantly, and its whole range is validated.** Without
+  a custom parser the value was converted with the machine's culture and
+  `AllowThousands`: `1.5` meant 15 on a comma-decimal locale, silently, and was refused
+  outright on another. Values above `TimeSpan`'s range and below one tick escaped the
+  range guard as unhandled exceptions. `--roslyn-timeout 0` was accepted and meant
+  *unbounded*, the opposite of the smallest bound; it is refused now.
 - **Cancelling an attested computation now stops it, whatever the host stage
   does.** The orchestrator handed its token to each stage and trusted them to
   observe it; a stage that ignores its token — any client predating cancellation
diff --git a/ROADMAP.md b/ROADMAP.md
index 35c15a18..1233a49f 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -163,6 +163,16 @@ are the concrete entry points.
     verification command, the packaging step and the project layout.
 
   Open follow-ups, still open:
+  - **The pruning guard compares scope FLAGS, not the scope RULE.** `BundleWriter` refuses to prune
+    when the previous run covered a wider scope, and it decides that by comparing the flags recorded
+    in the manifest — so it is blind to a run whose flags are identical but whose *rule* narrowed.
+    Measured on exactly that: a bundle generated before scope moved to effective visibility, then
+    regenerated with the same flags, lost five concepts and the guard stayed silent, because nothing
+    in the manifest said the rule had changed. The producer now prints a note when it caps a public
+    member at an internal container, which covers the one case that exists today; the general fix is
+    to record a scope-rule identifier beside `scope` in the manifest so the existing guard fires on a
+    rule change as it does on a flag change. Deliberately not done in the fix round that found it:
+    it changes the manifest format, which is a compatibility decision of its own.
   - **More ecosystems.** Package detection is npm and NuGet only, and the code stage is C# only.
     The architecture is multi-language by construction (one `LanguageProfile` per language, one
     `ISymbolResolver` per precision level); a second profile would test the generality of that
diff --git a/docs/superpowers/specs/2026-08-31-okf-producer-code-graph-design.md b/docs/superpowers/specs/2026-08-31-okf-producer-code-graph-design.md
index 09fe47e8..00e7d157 100644
--- a/docs/superpowers/specs/2026-08-31-okf-producer-code-graph-design.md
+++ b/docs/superpowers/specs/2026-08-31-okf-producer-code-graph-design.md
@@ -145,6 +145,21 @@ Effet de bord bienvenu : les `partial class` réparties sur plusieurs fichiers f
 
 - **Segments réservés.** `BundleConceptWriter` rejette les concepts nommés `index` ou `log` (ils écraseraient les fichiers propres du bundle) — vérifié dans `src/OKF4net/BundleConceptWriter.cs`. Une propriété nommée `Index` est parfaitement plausible ; on **réutilise** `IsReservedSegment` de `ConceptGenerator.cs` au lieu d'en écrire un second.
 - **Collision résiduelle** (casse seule — `Parse` vs `parse` — ou type imbriqué homonyme d'un membre) : départage déterministe par **ordre Ordinal du nom d'origine**, le premier garde le slug nu, les suivants prennent `-2`, `-3`. Ordinal **sur le nom** et non sur (fichier, ligne), pour que le départage survive à un déplacement de fichier ou à un décalage de lignes. Mesuré à **0 occurrence** sur ce repo ; la règle existe pour Go et JS, où c'est courant.
+
+> **Correction apportée à l'implémentation (dépilage des findings Important, 2026-09-04) : une TROISIÈME collision résiduelle existait, non listée ici.** Une classe `Bar` dans le namespace `Foo` et une classe `Baz` dans le namespace `Foo.Bar` se réduisent au même chemin brut `[code, csharp, Foo, Bar]` pour leur parent. Le conteneur n'était donc jamais synthétisé — un groupe réclamait déjà le chemin — et `Baz` s'enregistrait sous l'identifiant du **type**. Mesuré sur cette fixture exacte avant correctif : `code/csharp/foo/bar/baz`, c'est-à-dire un type de premier niveau rendu comme un type imbriqué, le namespace n'ayant aucun concept.
+>
+> `SymbolFact.Container` ne peut pas trancher : c'est une chaîne pointée aplatie, et une classe imbriquée dans `Bar` comme une classe de premier niveau dans `Foo.Bar` y rapportent toutes deux `"Foo.Bar"`. L'extracteur, lui, connaît la différence — il descend les ancêtres et voit un nœud namespace dans un cas, un nœud type dans l'autre — et l'aplatissement la jetait.
+>
+> `SymbolFact.ContainerNamespace` (propriété `init`, défaut `null`, même forme que `HeaderEndLine`) porte désormais la partie namespace du conteneur. La règle : **le parent d'un groupe est un namespace exactement quand sa profondeur égale celle du namespace.** Deux lignes du tableau ci-dessous ont des segments identiques et des parents différents, ce qui est précisément ce qu'aucune règle sur la chaîne ne peut exprimer.
+>
+> | déclaration | segments | profondeur ns | parent |
+> |---|---|---|---|
+> | `Bar`, type dans ns `Foo` | `[code,csharp,Foo,Bar]` | 3 | namespace `Foo` |
+> | `M`, membre de `Bar` | `[code,csharp,Foo,Bar,M]` | 3 | type `Bar` |
+> | `Baz`, type dans ns `Foo.Bar` | `[code,csharp,Foo,Bar,Baz]` | 4 | namespace `Foo.Bar` |
+> | `Baz`, imbriquée dans `Bar` | `[code,csharp,Foo,Bar,Baz]` | 3 | type `Bar` |
+>
+> Le namespace reçoit un chemin brut marqué et donc son propre identifiant (`code/csharp/foo/bar-2`) ; **le type garde le chemin qu'il avait**, donc aucun identifiant de type existant ne bouge. Un groupe dont `ContainerNamespace` est `null` — toute fixture de test, tout futur extracteur qui ne l'enregistre pas — est laissé exactement tel quel : la passe est inerte plutôt que devinatrice.
 - **Profondeur.** Un type devient à la fois le fichier `link-scanner.md` et le dossier `link-scanner/`. C'est légal, et `IndexGenerator` les liste dans deux rubriques distinctes du parent (document / `Subdirectories`). Conséquence assumée : **un `index.md` par dossier de type** (~170 sur ce repo). Sur un projet Java profond (`com/example/…`), les chemins s'allongent — **à surveiller vis-à-vis de `MAX_PATH` sous Windows**.
 
 ### 3.4 Un registre d'ids unique
@@ -190,6 +205,16 @@ Scans a concept body for §6 markdown links, returning them in source order.
 - `Enumerable.Where`
 ```
 
+> **Correction apportée à l'implémentation (dépilage des findings Minor, 2026-09-06) : deux comportements livrés n'apparaissaient dans aucune section de cette spec.**
+>
+> **1. Le plafond d'en-tête sur un `resource` de TYPE (R48).** L'exemple ci-dessus est un *membre*, et un membre garde son span complet `StartLine..EndLine` — c'est utile, un permalien vers son corps entier. Un **type**, lui, voit son span coupé à la fin de son en-tête. La raison est la promesse de rayon d'impact de §8.3 : le span d'une déclaration de type court jusqu'à son accolade fermante, donc *toute* édition dans le corps — ajouter un membre privé, ajouter une surcharge, supprimer une méthode — déplacerait `EndLine` et réécrirait le concept du type. Ce serait du churn causé par la position de l'édition et non par ce que le type déclare, ce qui falsifie « ajouter un membre privé ne change aucun concept ».
+>
+> Une édition *au-dessus* du type le déplace encore, et c'est correct : la déclaration a réellement bougé. `SymbolFact.HeaderEndLine` porte la ligne, et `producers/tests/.../fixtures/golden` contient depuis 2026-09-04 un type dont l'en-tête tient sur trois lignes — sans lui, le plafond aurait produit un golden identique s'il retournait `StartLine + 1`.
+>
+> Le finding qui a relevé cette omission ajoutait que le plafond « contredit l'exemple de §4.1 ». Vérifié : il ne le contredit pas, l'exemple étant un membre.
+>
+> **2. La neutralisation du texte repris.** Une `description` dérivée d'un commentaire de documentation est du texte écrit par autrui qui atterrit dans un document markdown, et rien ici ne le disait. Ce qui est appliqué : les liens markdown sont neutralisés, un marqueur de bloc en début de ligne est échappé, une fence **non fermée** est défusée (une fence équilibrée est laissée telle quelle), le contenu d'un bloc `<code>` est **jeté** — c'est de la source, pas de la prose, le même argument que le sanitizer du viewer fait pour `<script>`/`<style>` — tandis que `<c>` inline est conservé parce qu'il fait partie de la phrase. Un run non fermé qui *ressemble* à une balise est laissé verbatim, par la règle qui garde `List<T> of results` intact.
+
 ### 4.2 `description` : une chaîne de sources, pas un LLM
 
 tree-sitter capture le nœud de commentaire précédant la déclaration ; on en extrait le `<summary>` en C#, le JSDoc en TS, la docstring en Python, le doc comment en Go. **C'est l'avantage net sur okf-rs**, qui a besoin de `generate --enrich` et d'un endpoint OpenAI pour remplir ce champ.
@@ -489,7 +514,9 @@ La correction 1 récupère bien les fichiers générés **par le SDK** (`*.Globa
 >
 > Vérifié par `grep` sur tout `producers/src` : aucun lecteur de production pour l'une ou l'autre propriété ; les seuls lecteurs sont les tests. Ce que l'opérateur voit vient de `GenerateRun.ReportProjects`, qui itère `RoslynResolver.Projects` et émet **une note par projet non compilé**, en nommant le projet, sa `RoslynProjectAvailability` et le détail. C'est strictement plus d'information qu'un booléen.
 >
-> Arbitrage retenu : **corriger le document et les commentaires plutôt que câbler une seconde voie**. Câbler `IsComplete` dans le rapport ajouterait une ligne agrégée à côté d'une voie par projet qui fonctionne déjà et qui dit davantage. Les deux propriétés restent : c'est la question qu'un hôte intégrant le resolver pose, et le fixture de `RoslynResolverTests` s'appuie sur `IsComplete` pour prouver que son dépôt scratch a réellement compilé.
+> Arbitrage retenu : **corriger le document et les commentaires plutôt que câbler une seconde voie**. Câbler `IsComplete` dans le rapport ajouterait une ligne agrégée à côté d'une voie par projet qui fonctionne déjà et qui dit davantage.
+>
+> **Suite (dépilage des findings Important, 2026-09-04) : les deux propriétés ont été SUPPRIMÉES.** La vague 2b les avait gardées en écrivant ici qu'« un hôte intégrant le resolver pose cette question » et que le fixture de `RoslynResolverTests` s'appuyait sur `IsComplete`. Arbitrage de l'utilisateur : aucun hôte ne les lit, `producers/` n'est pas une bibliothèque publiée, et une propriété dont les seuls lecteurs sont les tests qui l'assertent est exactement la forme que cette branche a payée treize fois (« assertion incapable d'échouer »). `AnyCompiled` et `AllCompiled` vivent désormais dans `RoslynResolverTests`, dérivées de `RoslynResolver.Projects` en une ligne — ce qu'écrirait tout appelant voulant le résumé. La clause `Count > 0` reste documentée là-bas : `All` sur une liste vide est vrai par vacuité, et une liste vide est précisément l'état où *tous* les appels sont retombés sur le name matching.
 
 **Rayon d'impact — il déborde du projet en échec.** C'est le point le moins intuitif et il doit être écrit noir sur blanc. Un projet qui ne compile pas ne coûte pas seulement la précision *sur ses propres fichiers* :
 
@@ -649,6 +676,14 @@ Drapeaux ajoutés à `okfgen generate` par ce lot :
 | `--include-internal` | off | descend sous la visibilité publique | 5.4 |
 | `--no-code` | off | désactive l'étage graphe de code (comportement actuel) | 5.4 |
 | `--max-file-size <n>` | 2 Mo | plafond par fichier source, appliqué par les deux moteurs ; au-delà, l'extracteur ignore **et compte** (run partiel), la porte Roslyn laisse tomber l'item `Compile` **silencieusement** | 2.3 |
+| `--no-msbuild` | off | saute tout l'étage Roslyn, et avec lui l'évaluation MSBuild qu'il exige. Coûte **deux** choses, pas une : les liens d'appel viennent de la seule baseline par correspondance de noms, et il n'y a **aucune** carte de propriété des sources, donc aucun lien `packages` → namespace n'est émis (sous `--update`, cela écrase ceux d'un run précédent) | 2.1, 5.1 |
+| `--roslyn-timeout <s>` | *absent* | budget horloge pour tout l'étage Roslyn — les requêtes `dotnet msbuild` et les compilations qui suivent. **Absent veut dire non borné** : chaque requête est plafonnée à deux minutes isolément, rien ne plafonne leur somme. Opt-in parce qu'un budget fait dépendre le bundle émis de la vitesse de la machine, alors que §6.2 fixe le déterminisme à une version d'extracteur, pas à un CPU. Épuisé, l'étage est abandonné **en entier** : le run atterrit exactement dans l'état `--no-msbuild`, avec la même note, plutôt que d'émettre un bundle dont les liens exacts et par nom sont séparés par la vitesse de la machine sans rien pour dire où passe la ligne | 2.3, 6.2 |
+
+> **Les deux dernières lignes ont été ajoutées après coup, et l'omission mérite d'être nommée.**
+> `--no-msbuild` est décrit longuement en §7.2 (« Levier ajouté ») mais n'avait jamais rejoint ce
+> tableau, qui se présente pourtant comme la surface CLI du lot. Un tableau récapitulatif incomplet est
+> pire qu'absent : il se lit comme exhaustif. Vérifié cette fois contre `OkfgenCli.Run` plutôt que
+> contre le souvenir de ce qui a été ajouté.
 
 `--update` conserve son nom mais change de sémantique sur `code/` (élagage, §6.3).
 
diff --git a/producers/README.md b/producers/README.md
index ec6494ca..d54577dd 100644
--- a/producers/README.md
+++ b/producers/README.md
@@ -53,9 +53,10 @@ dotnet run --project producers/src/OkfProducer.Cli -- validate --okf ./bundle
 | `--rev <ref>` | current branch | The ref permalinks point at. Never a commit sha by default: a sha would rewrite every code concept's `resource` on the next commit. On a detached HEAD there is no branch name, so this becomes required for permalinks. |
 | `--check` | off | Regenerate over a copy of the bundle and exit non-zero if anything differs. Never writes to `--out`. Refused with `--reset`/`--force` (it would delete nothing while the operator believed a reset happened) and with `--no-code` (see below). |
 | `--include-tests` | off | Walk test projects and `test`/`tests`/`spec` directories too. |
-| `--include-internal` | off | Emit `internal` declarations, not only public ones. |
+| `--include-internal` | off | Emit `internal` declarations, not only public ones. The filter is on **effective** visibility, so a `public` member of an `internal` type is capped at internal and stays out by default — it used to be emitted, and tagged `public`, a visibility C# does not give it. |
 | `--no-code` | off | Skip the code-graph stage entirely: `overview`, `packages/` and `docs/` only. |
 | `--no-msbuild` | off | Do not run `dotnet msbuild` on the scanned repository, and skip the Roslyn resolver built on it. Costs **two** things: call links then come from name matching alone, so an ambiguous name is left unlinked instead of resolved exactly; and the run has no source-ownership map, so **no `packages` → namespace containment link is emitted at all** — under `--update` that overwrites the ones a previous run wrote. **Read the section below before deciding you do not need this.** |
+| `--roslyn-timeout <seconds>` | *none* | Wall-clock budget for the whole Roslyn stage — the `dotnet msbuild` queries and the compilations after them. **Absent means unbounded**, which is the default and is deliberate: each query is capped at two minutes on its own, but nothing caps their sum, so a large repository runs for as long as it runs, and a budget would make the emitted bundle a function of how fast this machine is (§6.2 pins determinism at a fixed extractor version, not a fixed CPU). If the budget runs out the stage is abandoned **whole**, never truncated — you get the same uniformly name-matched bundle `--no-msbuild` produces, with a note naming the same two losses, rather than one whose exact and name-matched links are divided by machine speed with nothing recording where the line fell. |
 | `--max-file-size <bytes>` | 2 MiB | Largest source file the code stage will read — by **both** engines. The tree-sitter engine skips a larger one *and counts it*, which makes the run partial: the concepts it owned are then not pruned. The Roslyn engine applies the same cap to the `Compile` items MSBuild reports, but drops an over-cap item **silently** — for a file the scan also walked the counted skip covers it, and for one it did not (a linked out-of-repository source, a generated file under `obj/`) nothing reports it: the project simply fails to compile and is named as such. |
 
 ### Generating from a repository runs that repository's build logic
@@ -91,9 +92,11 @@ scanned tree, with the repository as the working directory, reading its `.git/co
 many times depends on the flags, so here is the whole of it rather than a number. `git show
 -s` and `git rev-parse` run on *every* generate — they stamp `overview`'s `generated.at`
 and `revision`. `git symbolic-ref` runs as well, **unless `--rev` already named the ref**, in
-which case the branch is never read. And `--check` runs one further `git rev-parse` in the
-scanned tree before the regeneration it compares against, on top of that regeneration's own.
-Two to four invocations, then. Far less exposure than MSBuild — none of them triggers a hook,
+which case the branch is never read — and where it succeeds it is followed by a second
+`git rev-parse --verify HEAD`, because an *unborn* branch (`git init` with no commit yet) is a
+branch name that names no commit, and permalinks built against it point at nothing. And
+`--check` runs one further `git rev-parse` in the scanned tree before the regeneration it
+compares against, on top of that regeneration's own. Two to five invocations, then. Far less exposure than MSBuild — none of them triggers a hook,
 an fsmonitor, or a pager with stdout redirected — but it is not nothing, and this section
 used to say "no process is spawned". And it is not free of structural cost: the source-ownership
 map comes out of the same MSBuild query, so with the flag on there is **no `packages` →
@@ -103,6 +106,23 @@ It is **off by default on purpose**. Turning it on by default would silently deg
 resolution quality of every run that exists today, which is a worse trade than a documented
 hazard with a lever next to it.
 
+### What `revision` on `overview` does and does not say
+
+`overview` carries a `revision` field holding the exact HEAD sha, and it names the
+**committed HEAD — never the working tree**. Both `git show -s` and `git rev-parse` report
+the commit currently checked out regardless of any uncommitted change to the source the run
+actually scanned, so on a dirty tree `revision` names a commit this bundle was **not**, byte
+for byte, generated from. There is no attempt to detect that and no fabricated value in its
+place: a sha is either the checked-out one or absent.
+
+Two consequences worth stating rather than discovering. A reader treating `revision` as
+"check out this commit and you get this bundle" is right only when the tree was clean at
+generation time. And `--check` cannot see the difference either: both sides carry the same
+revision, so a bundle generated from uncommitted edits can be reported as having no drift.
+
+Generating from a clean tree is what makes the field mean what it appears to mean.
+
+
 ### What a run says about itself
 
 Every `generate` that reaches the generation stage prints one **completeness report** to
@@ -479,10 +499,45 @@ None of this is applied to `src/OKF4net.Mcp`, which has real users and declares
 
 | Project | Depends on | Holds |
 |---|---|---|
-| `src/OkfProducer.Core` | `OKF4net` only | Scanning, the language-agnostic code-graph contracts, concept generation, the bundle writer, `--check`, the generation manifest. |
+| `src/OkfProducer.Core` | `OKF4net` only | Scanning, the code-graph contracts, concept generation, the bundle writer, `--check`, the generation manifest. |
 | `src/OkfProducer.CodeGraph.TreeSitter` | Core + `TreeSitter.DotNet` | The `ILanguageExtractor` and the C# profile. |
 | `src/OkfProducer.CodeGraph.Roslyn` | Core + `Microsoft.CodeAnalysis.CSharp` | The exact `ISymbolResolver`, and the `dotnet msbuild` query behind it. |
 | `src/OkfProducer.Cli` | all of the above | The composition root — the only project that can assemble the pipeline — and the `okfgen` command surface. |
 | `tests/OkfProducer.Tests` | all of the above | xunit, the fixture repository and the golden bundle. |
 
+### Adding a second language means editing Core, not only adding a profile
+
+That row used to say Core holds the **language-agnostic** code-graph contracts, and
+that word was doing work the code does not do. Three pieces of C#/MSBuild knowledge
+live in Core today, and each of them is a place a second language has to touch:
+
+- `LanguageProfile.SplitContainer` picks its separator from the language name —
+  `.` for `csharp` and `java`, `/` for everything else. It is not a profile field
+  on purpose: `ConceptGenerator.ProfileFor` synthesizes a throwaway profile from a
+  bare language name when a symbol's language matches none the caller supplied, and
+  that fallback produces the right concept ids only while this method is a pure
+  function of `Language`. Making the separator a field would silently mis-slug
+  every affected id (§3.1 treats id churn as unrecoverable), so the fallback would
+  have to become a hard requirement in the same change. Both ends say so.
+- `LanguageProfile.VisibilityOf` collapses modifier text using C#'s real access
+  rules, including its default-visibility rules per declaration kind.
+- `FileEligibility` reads `.csproj` XML to decide what a project owns and what is a
+  test project.
+
+And one that is not code organization but correctness, so it is the first thing to
+budget for: **`CallSite` carries no language field at all.** A call names its caller
+and its target as `(container, name)`, so both joins in `ConceptGenerator` are
+language-blind — unambiguous today only because v1 ships exactly one profile. With
+two, the same `(container, name)` declared in each attributes one call to *both*
+concepts, and a wrong edge in a knowledge bundle is worse than a missing one: an
+agent reading it gets a confidently false answer. That assumption does not sit in a
+comment waiting to be missed — `ConceptGenerator` **throws** on a graph carrying more
+than one language, and the throw is the specification of the fix: give both joins a
+language component, which means `CallSite` gaining a `Language` the resolvers supply.
+
+None of this is a defect to fix now — a second language is not on the roadmap, and
+inventing a general abstraction for one hypothetical consumer would be the worse
+trade. It is written down because the alternative is discovering it halfway through
+adding that language, having budgeted for "just add a profile".
+
 Design: [`docs/superpowers/specs/2026-08-31-okf-producer-code-graph-design.md`](../docs/superpowers/specs/2026-08-31-okf-producer-code-graph-design.md).
diff --git a/producers/src/OkfProducer.Cli/GenerateRun.cs b/producers/src/OkfProducer.Cli/GenerateRun.cs
index 084c48ff..6f7762e6 100644
--- a/producers/src/OkfProducer.Cli/GenerateRun.cs
+++ b/producers/src/OkfProducer.Cli/GenerateRun.cs
@@ -34,6 +34,16 @@ namespace OkfProducer.Cli;
 /// only lever over the fact that evaluating a repository's MSBuild logic <i>executes</i> that logic;
 /// see <see cref="GenerateRun"/>'s own remarks for what it does and does not buy.
 /// </param>
+/// <param name="RoslynTimeout">
+/// A wall-clock budget for the whole Roslyn stage, or <see langword="null"/> for none -- which is the
+/// default, because a budget makes the emitted bundle a function of how fast the machine is and §6.2
+/// pins determinism at a fixed extractor version, not a fixed CPU. The extraction stage has always
+/// honoured <c>ExtractionLimits.Timeout</c>; this stage never had a bound of its own, since MSBuild's
+/// two-minute per-query cap bounds one subprocess and nothing bounds their sum. When the budget runs
+/// out the stage is abandoned WHOLE, so the run degrades to exactly the <see cref="NoMsBuild"/> state
+/// and says so, rather than emitting a bundle whose exact and name-matched links are divided by
+/// machine speed with nothing recording where the line fell.
+/// </param>
 internal sealed record GenerateRequest(
     string RepoPath,
     string OutPath,
@@ -45,7 +55,8 @@ internal sealed record GenerateRequest(
     bool IncludeInternal,
     bool NoCode,
     long MaxFileBytes,
-    bool NoMsBuild);
+    bool NoMsBuild,
+    TimeSpan? RoslynTimeout = null);
 
 /// <summary>
 /// The producer's composition root: the one place scan, extract, resolve, attribute, generate and
@@ -91,8 +102,12 @@ internal sealed record GenerateRequest(
 /// below <i>unless</i> <c>--rev</c> already named the ref, in which case the <c>??</c> never
 /// evaluates it; and <c>--check</c> spawns one further <c>git rev-parse</c>
 /// (<c>BundleDrift.Check</c>) before the regeneration it compares against. All of them go through
-/// <c>GitRevision.RunGit</c> with the scanned repository as their working directory. Two to four
-/// invocations, then, not a fixed three -- <c>producers/README.md</c> states the same breakdown.
+/// <c>GitRevision.RunGit</c> with the scanned repository as their working directory. Two to FIVE
+/// invocations, then, not a fixed three: the unborn-branch fix added a second
+/// <c>git rev-parse --verify HEAD</c> inside <c>GitRevision.CurrentBranch</c>, and this sentence was
+/// left at "two to four" while <c>producers/README.md</c> was corrected -- so it also stopped being
+/// true that the README "states the same breakdown". Both halves are fixed here; the README is the
+/// one to keep in step, since it is what an operator reads.
 /// The flag is off by default deliberately -- making it opt-in would silently
 /// degrade the resolution quality of every run that exists today -- which is why it is stated here and
 /// in <c>producers/README.md</c> rather than left to be discovered.</para>
@@ -210,17 +225,68 @@ public static WriteResult Execute(GenerateRequest request, ProducerServices serv
             {
                 // Later resolvers override earlier ones for the files they own (§2.1), so the exact
                 // resolver goes after the name-matching baseline, never before it.
-                roslyn = RoslynResolver.Create(request.RepoPath, projectPaths, limits);
-                resolvers.Add(roslyn);
+                //
+                // The two branches are not two policies. Without a budget this is the call it always
+                // was, on the overload that cannot return null, so nothing about an unbudgeted run
+                // changed when the budget arrived. With one, an exhausted budget lands the run in
+                // exactly the --no-msbuild state -- resolver absent, ownership map absent -- which is
+                // why the note below names the same two losses in the same order rather than
+                // inventing a third vocabulary for a state the operator already has a name for.
+                if (request.RoslynTimeout is { } budget)
+                {
+                    if (RoslynResolver.TryCreateWithin(request.RepoPath, projectPaths, limits, budget, out var bounded))
+                    {
+                        roslyn = bounded;
+                    }
+                    else
+                    {
+                        note($"--roslyn-timeout of {budget.TotalSeconds:0.###}s ran out before the Roslyn stage"
+                            + " finished, so the stage was abandoned whole and this run resolved calls with the"
+                            + " name-matching baseline alone. The two losses are the same ones --no-msbuild"
+                            + " carries. (1) Every `## Calls` link here is a name match, and an inter-type"
+                            + " ambiguity it cannot settle is left unlinked. (2) There is no source-ownership map,"
+                            + " so NO `packages` -> namespace containment link is emitted, and under --update that"
+                            + " overwrites the ones a previous run had. Raise the budget, or drop --roslyn-timeout"
+                            + " to let the stage take as long as it takes.");
+                    }
+                }
+                else
+                {
+                    roslyn = RoslynResolver.Create(request.RepoPath, projectPaths, limits);
+                }
 
-                ReportProjects(roslyn, request.RepoPath, note);
-                ownership = Attribution(request.RepoPath, roslyn.QueriedProjects, note);
+                if (roslyn is not null)
+                {
+                    resolvers.Add(roslyn);
+                    ReportProjects(roslyn, request.RepoPath, note);
+                    ownership = Attribution(request.RepoPath, roslyn.QueriedProjects, note);
+                }
             }
 
             // Disposed as soon as the graph exists: CodeGraph holds symbols and edges, never a handle
             // into the parser.
             using var extractor = new TreeSitterExtractor();
             graph = new CodeGraphBuilder(extractor, profiles, resolvers).Build(snapshot, limits, scope);
+
+            // Said out loud because the alternative is a SILENT deletion. Scope filters on effective
+            // visibility -- a member is capped by every type enclosing it -- and that is correct, but
+            // an earlier version of this producer filtered on the declared modifier alone and emitted
+            // these. Regenerating over such a bundle prunes them, and `BundleWriter`'s scope-narrowing
+            // guard cannot say so: it compares the recorded scope FLAGS, which are identical on both
+            // sides here. It is the rule that narrowed, not the run, and nothing else in the pipeline
+            // is in a position to notice.
+            //
+            // A note rather than a refusal to prune: the concepts really are out of scope now, and
+            // keeping them would republish exactly the internal API the flag was left off to exclude.
+            // What the operator needs is to know it happened and how to get them back.
+            if (graph.CappedByContainer > 0 && !request.IncludeInternal)
+            {
+                note($"{graph.CappedByContainer} declaration(s) are public in their own right but enclosed by an"
+                    + " internal type, so C# caps them at internal and this run left them out. An earlier version of"
+                    + " this producer emitted them anyway, tagged `public` -- so regenerating over a bundle that has"
+                    + " them will delete them, and that deletion is this change rather than anything removed from the"
+                    + " repository. Pass --include-internal to keep them.");
+            }
         }
 
         var options = new GenerateOptions
@@ -238,6 +304,31 @@ public static WriteResult Execute(GenerateRequest request, ProducerServices serv
                 : null,
             SourceOwnership = ownership,
             Note = note,
+
+            // §6.2: each engine is named only when it actually ran. Under --no-code no engine touched
+            // the repository, so claiming a tree-sitter and a Roslyn version would attach a determinism
+            // guarantee to an artefact none of them produced -- the same reason that path passes a null
+            // manifest rather than an empty one.
+            //
+            // PER ENGINE, and it used to be all-or-nothing. Roslyn was named on every run that was not
+            // --no-code, including the runs where it demonstrably never ran: --no-msbuild, a repository
+            // with no project file, an exhausted --roslyn-timeout, and -- the case a non-null check
+            // still got wrong -- a repository whose projects all FAILED to query or compile. That is
+            // the exact claim this block exists to refuse, one engine over, and `ProducerFixture` had
+            // the rule right ("tree-sitter alone, because tree-sitter alone ran") while the shipped CLI
+            // did not.
+            //
+            // The condition is "at least one project compiled", not "a resolver exists".
+            // `RoslynResolver.Create` returns a resolver whatever happened: every project can be
+            // recorded MsBuildQueryFailed and it still constructs one. That is the COMMON degradation
+            // -- an unrestored checkout, no `dotnet` on PATH -- and it named `roslyn/5.3.0` in a bundle
+            // Roslyn contributed no byte to. This producer's own fixture repository is in exactly that
+            // state, which is how the golden and the shipped CLI came to disagree about one repository.
+            EngineVersions = request.NoCode
+                ? []
+                : roslyn is null || !roslyn.Projects.Any(p => p.Availability == RoslynProjectAvailability.Compiled)
+                    ? [TreeSitterExtractor.EngineVersion]
+                    : [TreeSitterExtractor.EngineVersion, RoslynResolver.EngineVersion],
         };
 
         var concepts = services.Generator.Generate(snapshot, graph, options);
@@ -600,6 +691,25 @@ private static bool IsOwned(string id) =>
     /// The <c>.csproj</c> files the scan detected, absolute -- the same set the <c>packages/</c>
     /// family is generated from, so the ownership map's join key is by construction the one
     /// <c>ConceptGenerator</c> looks a package up by.
+    ///
+    /// <para>Every nuget project MSBuild will be asked about -- <b>including test projects, and
+    /// including them when <c>--include-tests</c> is off</b>.</para>
+    ///
+    /// <para>That reads as an inconsistency and is not one, because the flag and this list govern
+    /// different things. <c>--include-tests</c> decides which FILES are extracted
+    /// (<c>FileEligibility.IsEligible</c>); this decides which projects are asked for their
+    /// <c>Compile</c> item sets, and §5.1's ownership map is built from those. A test project can
+    /// legitimately claim a PRODUCTION file -- a linked <c>&lt;Compile Include="..\..\src\Shared.cs"/&gt;</c>
+    /// is ordinary -- and dropping it here would silently remove that file's
+    /// <c>## Also compiled by</c> entry, which is a fact about the production file rather than about
+    /// the test project. Narrowing the query would make the map answer a different question from the
+    /// one it is documented to answer.</para>
+    ///
+    /// <para><b>The cost, stated because it is real:</b> one <c>dotnet msbuild</c> subprocess per test
+    /// project on every run, roughly a second each here, for item sets whose own files this run will
+    /// not extract. Measured on this repository, no test project claims a production file, so nothing
+    /// in the emitted bundle would change if they were skipped -- the price buys correctness in the
+    /// general case, not in this one.</para>
     /// </summary>
     private static IReadOnlyList<string> CSharpProjectPaths(RepositorySnapshot snapshot) =>
     [
diff --git a/producers/src/OkfProducer.Cli/OkfgenCli.cs b/producers/src/OkfProducer.Cli/OkfgenCli.cs
index 3bc182c7..3fed2cb7 100644
--- a/producers/src/OkfProducer.Cli/OkfgenCli.cs
+++ b/producers/src/OkfProducer.Cli/OkfgenCli.cs
@@ -101,7 +101,9 @@ private static RootCommand BuildRootCommand(ProducerServices services, TextWrite
             Description =
                 "The git ref --repo-url permalinks are built against. Defaults to the current branch name, never "
                 + "a commit sha -- a sha would rewrite every code concept's `resource` on the next commit. On a "
-                + "detached HEAD there is no branch name to read, so this becomes required for permalinks.",
+                + "detached HEAD there is no branch name to read, so this becomes required for permalinks. "
+                + "The recorded revision names the COMMITTED HEAD, not the working tree: with uncommitted local "
+                + "edits it names a commit this bundle was not generated from.",
         };
 
         var checkOption = new Option<bool>("--check") { Description = BundleDrift.CheckDescription };
@@ -154,6 +156,53 @@ private static RootCommand BuildRootCommand(ProducerServices services, TextWrite
             DefaultValueFactory = _ => ExtractionLimits.Default.MaxFileBytes,
         };
 
+        // Option<double?> rather than Option<double>, so "absent" and "0" are distinguishable. With a
+        // 0 default they were not: `--roslyn-timeout 0` reached the same value as not passing the
+        // option, so it silently meant UNBOUNDED -- the opposite of the smallest bound an operator (or
+        // a wrapper computing a remaining budget down to zero) was asking for -- while
+        // `--roslyn-timeout -1` was refused with a message saying the value must be positive. The
+        // accepted domain and the stated domain disagreed on exactly the value most likely to arrive
+        // programmatically. Zero is now refused like any other non-positive budget.
+        var roslynTimeoutOption = new Option<double?>("--roslyn-timeout")
+        {
+            Description =
+                "Wall-clock budget, in seconds, for the whole Roslyn stage -- the `dotnet msbuild` queries and the "
+                + "compilations after them. Absent by default, and absent means unbounded: each query is capped at "
+                + "two minutes on its own, but nothing caps their sum, so a large repository runs for as long as it "
+                + "runs. Supplying a budget changes what the bundle contains as a function of how fast this machine "
+                + "is, which is why it is not a default. If the budget runs out the stage is abandoned WHOLE, not "
+                + "truncated: you get the same uniformly name-matched bundle --no-msbuild produces, with the same "
+                + "note saying what was lost, rather than one where some links are exact and some are not with "
+                + "nothing recording which.",
+            DefaultValueFactory = _ => null,
+
+            // PARSED INVARIANTLY, and this is a correctness fix rather than tidiness. Without a custom
+            // parser System.CommandLine converts a double with the CURRENT culture and
+            // NumberStyles.AllowThousands, so this option meant different things on different machines:
+            // measured under de-DE, `--roslyn-timeout 1.5` parsed as 15 and `0.001` as 1 -- exit 0, no
+            // diagnostic, a budget 10^n too large from the exact form README.md documents -- while
+            // under fr-FR the same `1.5` was refused outright. A budget silently multiplied changes
+            // which projects finish, so it changes the `## Calls` links, the containment links and
+            // `generated.engines` in the emitted bundle: the locale of the machine would have decided bundle
+            // content, which is precisely what §6.2 pins determinism against.
+            //
+            // NumberStyles.Float and no AllowThousands: a separator here is a typo, not a grouping, and
+            // reading `1,5` as 15 is the failure this exists to stop rather than a convenience.
+            CustomParser = result =>
+            {
+                var token = result.Tokens.Count > 0 ? result.Tokens[0].Value : string.Empty;
+                if (double.TryParse(token, NumberStyles.Float, CultureInfo.InvariantCulture, out var seconds))
+                {
+                    return seconds;
+                }
+
+                result.AddError(
+                    $"--roslyn-timeout: '{token}' is not a number of seconds. Write it with a '.' decimal point"
+                    + " and no thousands separator (for example 90 or 1.5), whatever this machine's locale is.");
+                return 0;
+            },
+        };
+
         var generateCommand = new Command("generate", "Generate an OKF bundle from a repository")
         {
             Options =
@@ -161,6 +210,7 @@ private static RootCommand BuildRootCommand(ProducerServices services, TextWrite
                 repoOption, outOption, updateOption, resetOption, forceOption,
                 repoUrlOption, revOption, checkOption,
                 includeTestsOption, includeInternalOption, noCodeOption, noMsBuildOption, maxFileSizeOption,
+                roslynTimeoutOption,
             },
         };
 
@@ -177,6 +227,45 @@ private static RootCommand BuildRootCommand(ProducerServices services, TextWrite
                 return 1;
             }
 
+            // 0 is this option's "absent", not a zero-second budget: a budget of zero would abandon the
+            // stage before it started, which is what --no-msbuild already says more clearly. Negative
+            // is a typo either way.
+            //
+            // THE RANGE IS CHECKED ON THE TimeSpan, NOT ON THE DOUBLE, because those are two different
+            // ranges and the guard used to test the wrong one. Two bands of values passed `>= 0` here
+            // and then threw out of the run with a stack trace instead of this message: anything above
+            // TimeSpan.MaxValue.TotalSeconds (~9.22e11) made TimeSpan.FromSeconds throw
+            // OverflowException, and anything under one tick (1e-7 s) truncated to TimeSpan.Zero, which
+            // TryCreateWithin refuses by contract. A CLI that answers a bad argument with an unhandled
+            // exception has no argument validation on that path, whatever the line above looks like.
+            TimeSpan? roslynTimeout = null;
+            if (parseResult.GetValue(roslynTimeoutOption) is { } roslynTimeoutSeconds)
+            {
+                if (double.IsNaN(roslynTimeoutSeconds)
+                    || roslynTimeoutSeconds <= 0
+                    || roslynTimeoutSeconds > TimeSpan.MaxValue.TotalSeconds)
+                {
+                    error.WriteLine(
+                        "error: --roslyn-timeout must be a positive number of seconds, and no larger than "
+                        + TimeSpan.MaxValue.TotalSeconds.ToString("F0", CultureInfo.InvariantCulture) + ".");
+                    return 1;
+                }
+
+                var budget = TimeSpan.FromSeconds(roslynTimeoutSeconds);
+                if (budget <= TimeSpan.Zero)
+                {
+                    // Positive as a double, zero as a TimeSpan: below one tick there is no budget left
+                    // to express, and rounding it up to a tick would be inventing a value the operator
+                    // did not ask for.
+                    error.WriteLine(
+                        "error: --roslyn-timeout is smaller than the smallest budget that can be expressed"
+                        + " (100 nanoseconds). Use a larger value, or drop the option to leave the stage unbounded.");
+                    return 1;
+                }
+
+                roslynTimeout = budget;
+            }
+
             if (check && reset)
             {
                 // Rejected rather than ignored: --check never writes to --out, so honouring --reset
@@ -250,7 +339,8 @@ private static RootCommand BuildRootCommand(ProducerServices services, TextWrite
                 IncludeInternal: parseResult.GetValue(includeInternalOption),
                 NoCode: parseResult.GetValue(noCodeOption),
                 MaxFileBytes: maxFileBytes,
-                NoMsBuild: parseResult.GetValue(noMsBuildOption));
+                NoMsBuild: parseResult.GetValue(noMsBuildOption),
+                RoslynTimeout: roslynTimeout);
 
             return Generate(request, services, output, error);
         });
diff --git a/producers/src/OkfProducer.CodeGraph.Roslyn/CompilationFactory.cs b/producers/src/OkfProducer.CodeGraph.Roslyn/CompilationFactory.cs
index 3cf36aa1..76a9bc6e 100644
--- a/producers/src/OkfProducer.CodeGraph.Roslyn/CompilationFactory.cs
+++ b/producers/src/OkfProducer.CodeGraph.Roslyn/CompilationFactory.cs
@@ -346,6 +346,30 @@ private static string[] PreprocessorSymbols(ProjectInputs inputs) =>
     /// it produces no <see cref="CallSite"/> for anything in it and there is nothing for a shifted
     /// offset to mis-attach to.
     /// </para>
+    ///
+    /// <para>
+    /// <b>The one condition identical decoding does not buy, said here because everything else on this
+    /// page argues that offsets are comparable.</b> This is the SECOND read of the file. The extractor
+    /// read it earlier, in its own pass, and recorded its offsets against the bytes it saw then; this
+    /// reads the bytes again, now. Spec §2.3 calls for "lecture unique en snapshot", and this pipeline
+    /// does not have one -- it has two independent reads at two different times, with the whole
+    /// tree-sitter pass between them. A file edited inside that window is decoded identically by both
+    /// engines and still yields offsets that do not line up, which is the failure this type exists to
+    /// prevent: not a lost call, a call credited to whatever now sits at that offset.
+    /// </para>
+    ///
+    /// <para>
+    /// It is a KNOWN, ACCEPTED window rather than an oversight, and the accounting is worth being
+    /// plain about. Nothing detects it: §2.3 also asks for the hash of each file's read content in the
+    /// manifest, and <c>GenerationManifest</c> records at its own summary that no hash is computed
+    /// anywhere in this pipeline, so there is no artefact a later run could compare. Closing it is not
+    /// a local fix -- the extractor decodes the text and drops it (<c>ExtractionResult</c> carries
+    /// symbols, sites and a status, never bytes), so a real snapshot means carrying the decoded text
+    /// from the first read through to here and parsing THAT, which is a change to the contract between
+    /// the two engines rather than to this method. Until then the exposure is bounded by what actually
+    /// runs the producer: a one-shot CLI over a checkout, where the window is one repository scan long
+    /// and an edit inside it is a developer saving a file mid-run.
+    /// </para>
     /// </summary>
     private static SyntaxTree? TryParse(string path, CSharpParseOptions parseOptions, SourceFileGate gate)
     {
diff --git a/producers/src/OkfProducer.CodeGraph.Roslyn/MsBuildProjectQuery.cs b/producers/src/OkfProducer.CodeGraph.Roslyn/MsBuildProjectQuery.cs
index f5e46212..a3be3d5b 100644
--- a/producers/src/OkfProducer.CodeGraph.Roslyn/MsBuildProjectQuery.cs
+++ b/producers/src/OkfProducer.CodeGraph.Roslyn/MsBuildProjectQuery.cs
@@ -144,7 +144,25 @@ public static class MsBuildProjectQuery
     /// JSON. Every one of these means "this project's inputs are unknown", never "this project has no
     /// references" -- the caller must degrade, not compile from a half-answer.
     /// </exception>
-    public static ProjectInputs Query(string projectPath)
+    public static ProjectInputs Query(string projectPath) => Query(projectPath, "dotnet", QueryTimeout);
+
+    /// <summary>
+    /// <see cref="Query(string)"/> against a named <paramref name="executable"/> and a caller-chosen
+    /// <paramref name="timeout"/>, so the two degradation paths that spawning hides can be executed.
+    ///
+    /// <para><b>Why this exists.</b> Two branches here -- the dotnet CLI being absent
+    /// (<see cref="Win32Exception"/> out of <see cref="Process.Start(ProcessStartInfo)"/>) and the
+    /// query outrunning its deadline -- were reachable only by uninstalling the SDK or waiting two
+    /// minutes, so neither was ever executed by a test. That is not a cosmetic gap: this class's
+    /// wrapping is what keeps ONE project's failure from ending the whole repository's run, and the
+    /// review that found C2-1 (an unwrapped exception doing exactly that) named this absence as the
+    /// reason it had gone unnoticed.</para>
+    ///
+    /// <para><c>internal</c>, and the public overload is the only production caller: the executable
+    /// and the deadline are not knobs an operator gets, they are what a test needs to make a real
+    /// failure happen instead of describing one.</para>
+    /// </summary>
+    internal static ProjectInputs Query(string projectPath, string executable, TimeSpan timeout)
     {
         ArgumentException.ThrowIfNullOrEmpty(projectPath);
 
@@ -153,7 +171,7 @@ public static ProjectInputs Query(string projectPath)
         string json;
         try
         {
-            json = RunQuery(fullPath, targetFramework: null);
+            json = RunQuery(fullPath, targetFramework: null, executable, timeout);
         }
         catch (MsBuildQueryException)
         {
@@ -161,13 +179,13 @@ public static ProjectInputs Query(string projectPath)
             // front would add an MSBuild round trip per project to spare the rare multi-targeting one.
             // An unrestored project fails here too and its probe comes back null, so the original --
             // and far more useful -- failure is what propagates.
-            var framework = FirstTargetFramework(fullPath);
+            var framework = FirstTargetFramework(fullPath, executable, timeout);
             if (framework is null)
             {
                 throw;
             }
 
-            json = RunQuery(fullPath, framework);
+            json = RunQuery(fullPath, framework, executable, timeout);
         }
 
         return ReadInputs(fullPath, json);
@@ -215,12 +233,12 @@ internal static ProjectInputs ReadInputs(string projectPath, string json)
     /// failure is the one worth reporting). Evaluation only -- no targets run -- so this is the cheap
     /// probe, taken only after the full query has already failed.
     /// </summary>
-    private static string? FirstTargetFramework(string projectPath)
+    private static string? FirstTargetFramework(string projectPath, string executable, TimeSpan timeout)
     {
         string json;
         try
         {
-            json = Run(projectPath, ["-getProperty:TargetFrameworks", "-getProperty:TargetFramework"]);
+            json = Run(projectPath, ["-getProperty:TargetFrameworks", "-getProperty:TargetFramework"], executable, timeout);
         }
         catch (MsBuildQueryException)
         {
@@ -255,7 +273,7 @@ internal static ProjectInputs ReadInputs(string projectPath, string json)
         }
     }
 
-    private static string RunQuery(string projectPath, string? targetFramework)
+    private static string RunQuery(string projectPath, string? targetFramework, string executable, TimeSpan timeout)
     {
         var arguments = new List<string>();
         if (targetFramework is not null)
@@ -267,10 +285,10 @@ private static string RunQuery(string projectPath, string? targetFramework)
         arguments.AddRange(Items);
         arguments.AddRange(Properties);
 
-        return Run(projectPath, arguments);
+        return Run(projectPath, arguments, executable, timeout);
     }
 
-    private static string Run(string projectPath, IReadOnlyList<string> arguments)
+    private static string Run(string projectPath, IReadOnlyList<string> arguments, string executable, TimeSpan timeout)
     {
         // Guards Process.Start against a working directory that is not there -- a project directory
         // that vanished between the scan and this query, or a caller naming a project that never
@@ -286,7 +304,7 @@ private static string Run(string projectPath, IReadOnlyList<string> arguments)
                 $"could not start `dotnet msbuild` for {projectPath}: its directory does not exist.");
         }
 
-        var startInfo = new ProcessStartInfo("dotnet")
+        var startInfo = new ProcessStartInfo(executable)
         {
             RedirectStandardOutput = true,
             RedirectStandardError = true,
@@ -335,7 +353,7 @@ private static string Run(string projectPath, IReadOnlyList<string> arguments)
             // honoured -- and anything else holding the write end of those pipes (an inherited MSBuild
             // worker; see -nodeReuse:false above) keeps them open with no escape. Cancelling the reads
             // as well as the wait closes that gap.
-            using var timeout = new CancellationTokenSource(QueryTimeout);
+            using var deadline = new CancellationTokenSource(timeout);
 
             // Both streams are drained concurrently, never one ReadToEnd() after the other: MSBuild
             // writes enough to fill a pipe buffer, and a sequential read deadlocks the moment the
@@ -345,15 +363,15 @@ private static string Run(string projectPath, IReadOnlyList<string> arguments)
             // an unbounded read of it is an OutOfMemoryException a scanned repository can ask for. See
             // ReadCappedAsync for the measurement that sets the caps -- and for the mechanism that does
             // NOT do it, since the obvious guess is wrong.
-            var stdoutTask = ReadCappedAsync(process.StandardOutput, MaxStdoutChars, timeout.Token);
-            var stderrTask = ReadCappedAsync(process.StandardError, MaxStderrChars, timeout.Token);
+            var stdoutTask = ReadCappedAsync(process.StandardOutput, MaxStdoutChars, deadline.Token);
+            var stderrTask = ReadCappedAsync(process.StandardError, MaxStderrChars, deadline.Token);
 
             CappedRead stdoutRead;
             CappedRead stderrRead;
             int exitCode;
             try
             {
-                process.WaitForExitAsync(timeout.Token).GetAwaiter().GetResult();
+                process.WaitForExitAsync(deadline.Token).GetAwaiter().GetResult();
                 stdoutRead = stdoutTask.GetAwaiter().GetResult();
                 stderrRead = stderrTask.GetAwaiter().GetResult();
                 exitCode = process.ExitCode;
@@ -362,7 +380,7 @@ private static string Run(string projectPath, IReadOnlyList<string> arguments)
             {
                 TryKill(process);
                 throw new MsBuildQueryException(
-                    $"`dotnet msbuild` for {projectPath} did not finish within {QueryTimeout.TotalSeconds:0} s.");
+                    $"`dotnet msbuild` for {projectPath} did not finish within {timeout.TotalSeconds:0} s.");
             }
             catch (Exception e) when (e is IOException or ObjectDisposedException or InvalidOperationException)
             {
diff --git a/producers/src/OkfProducer.CodeGraph.Roslyn/OkfProducer.CodeGraph.Roslyn.csproj b/producers/src/OkfProducer.CodeGraph.Roslyn/OkfProducer.CodeGraph.Roslyn.csproj
index 221b8b75..d6affa28 100644
--- a/producers/src/OkfProducer.CodeGraph.Roslyn/OkfProducer.CodeGraph.Roslyn.csproj
+++ b/producers/src/OkfProducer.CodeGraph.Roslyn/OkfProducer.CodeGraph.Roslyn.csproj
@@ -4,6 +4,10 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+
+    <!-- Spec section 6.2: the engine versions are locked rather than floated. See the same
+         property and the full reasoning in OkfProducer.CodeGraph.TreeSitter.csproj. -->
+    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
   </PropertyGroup>
 
   <ItemGroup>
@@ -20,8 +24,11 @@
 
       Deliberately absent: Microsoft.CodeAnalysis.Workspaces.MSBuild. Avoiding it, and driving the
       compilation from `dotnet msbuild`'s own item/property query output instead, is the point of
-      this project (design 7.2, proven by producers/spikes/RoslynCompilationSpike at 0 errors on three
-      real projects). Also deliberately absent: any reference to OkfProducer.CodeGraph.TreeSitter,
+      this project (design 7.2, proven by a spike at 0 errors on three real projects). That spike is
+      NOT in the working tree: it was deleted after answering, the way a spike should be, and it is
+      recoverable at `git checkout 0db6e9a  producers/spikes` (with the usual path separator). This comment cited the path as
+      if it were still there, which is a pointer to nothing for anyone trying to check the claim.
+      Also deliberately absent: any reference to OkfProducer.CodeGraph.TreeSitter,
       whose native grammars weigh ~590 MB; the offset conversion both extractors share lives in
       OkfProducer.Core instead.
     -->
diff --git a/producers/src/OkfProducer.CodeGraph.Roslyn/RoslynResolver.cs b/producers/src/OkfProducer.CodeGraph.Roslyn/RoslynResolver.cs
index cddf3a34..8e549b66 100644
--- a/producers/src/OkfProducer.CodeGraph.Roslyn/RoslynResolver.cs
+++ b/producers/src/OkfProducer.CodeGraph.Roslyn/RoslynResolver.cs
@@ -1,4 +1,7 @@
 // SPDX-License-Identifier: LGPL-3.0-or-later
+using System.Diagnostics;
+using System.Globalization;
+using System.Text;
 using Microsoft.CodeAnalysis;
 using Microsoft.CodeAnalysis.CSharp;
 using Microsoft.CodeAnalysis.CSharp.Syntax;
@@ -26,12 +29,21 @@ namespace OkfProducer.CodeGraph.Roslyn;
 ///
 /// <para><b>Degradation.</b> A project that cannot be compiled cleanly is reported unavailable and its
 /// files are not <see cref="Owns"/>ed, so <see cref="NameMatchResolver"/>'s baseline stands for them
-/// untouched. This resolver never resolves from a compilation that has errors. <see cref="Projects"/>,
-/// <see cref="IsAvailable"/> and <see cref="IsComplete"/> are what let a caller distinguish "ran, and
-/// resolved nothing" from "could not run" -- the difference between a repository with no internal
-/// calls and one whose call graph is only approximate. That distinction is a question a caller can
-/// ask, not a pruning gate: see <see cref="IsComplete"/>'s own doc comment for why it cannot be one,
-/// and for the fact that only <see cref="Projects"/> reaches the run's report today.</para>
+/// untouched. This resolver never resolves from a compilation that has errors. <see cref="Projects"/>
+/// is what lets a caller distinguish "ran, and resolved nothing" from "could not run" -- the
+/// difference between a repository with no internal calls and one whose call graph is only
+/// approximate -- and it reports that per project, naming each one and why, rather than as a
+/// boolean.
+///
+/// <para>Two summary properties, <c>IsAvailable</c> and <c>IsComplete</c>, used to sit here.
+/// Remediation wave 2b established that nothing in <c>producers/src</c> read either one: the run's
+/// report comes from <c>GenerateRun.ReportProjects</c> iterating <see cref="Projects"/>, and §7.2 had
+/// claimed otherwise. That wave chose to correct the claims and keep the properties; this one removed
+/// them instead. The reasoning for keeping them was that a host embedding the resolver would ask
+/// exactly that question -- but no host does, this is not a published library, and a property whose
+/// only readers are the tests asserting on it is a shape this branch has already been burned by. A
+/// caller wanting the summary derives it from <see cref="Projects"/> in one line, which is what the
+/// tests now do.</para>
 ///
 /// <para><b>Loud, but never fatal to the run.</b> An unknown <c>LangVersion</c> is refused rather
 /// than degraded to a preview language version (correction 3) -- but the refusal is scoped to the one
@@ -139,62 +151,11 @@ private RoslynResolver(
     public IReadOnlyList<RoslynProjectReport> Projects { get; }
 
     /// <summary>
-    /// Whether at least one project compiled, i.e. whether this resolver can settle anything at all.
-    ///
-    /// <para><b>Nothing in <c>producers/src</c> reads this, or <see cref="IsComplete"/>.</b> Grepped,
-    /// not assumed: the only readers are this project's tests. See <see cref="IsComplete"/> for what
-    /// the run's report actually feeds from and why that was left as it is.</para>
-    /// </summary>
-    public bool IsAvailable => Projects.Any(p => p.Availability == RoslynProjectAvailability.Compiled);
-
-    /// <summary>
-    /// Whether this resolver covered the repository completely: at least one project, and every one of
-    /// them compiled. <see langword="false"/> means some C# was resolved by name alone, so this run's
-    /// call graph is approximate and an operator should be told.
-    ///
-    /// <para><b>It is not the pruning gate, and an earlier version of this comment said it was.</b>
-    /// Task 11 settled it against the code: which concepts exist is decided entirely by extraction --
-    /// <c>CodeGraphBuilder</c> builds <c>CodeGraph.Symbols</c> from <see cref="ILanguageExtractor"/>
-    /// output filtered by <see cref="FileEligibility.IsInScope"/>, and no resolver contributes a symbol
-    /// to it. A resolver decides only whether a call site renders as a link or as a code span. So a
-    /// degraded resolver cannot make a symbol <i>absent</i>, which is the only way an incomplete
-    /// picture could turn into a wrong deletion. Gating on it would also make pruning dead code on this
-    /// very repository -- <c>src/OKF4net.Cli</c> uses a source generator and does not compile here, so
-    /// this property is <see langword="false"/> on an ordinary checkout -- which is the same trap
-    /// <see cref="RunStatus.IsComplete"/> sets, for the same shape of reason. What DOES gate pruning is
-    /// <see cref="RunStatus.TraversalComplete"/> plus the per-file <see cref="FileStatus"/>; see
-    /// <c>BundleWriter</c>.</para>
-    ///
-    /// <para>
-    /// The <c>Count &gt; 0</c> clause is the whole point of this property, not a formality.
-    /// <c>Projects.All(...)</c> over an empty list is vacuously <see langword="true"/>, so a resolver
-    /// constructed with no projects at all -- which is precisely the state in which EVERY call in the
-    /// repository fell back to name matching -- would otherwise report itself complete. That state is
-    /// reachable rather than theoretical: finding no <c>.csproj</c> in a C# repository is a known gap
-    /// in this producer, and it yields an empty project list, not an error.
-    /// </para>
-    ///
-    /// <para>
-    /// What that clause protects is a caller who asks this question. Claiming completeness would tell
-    /// one the call graph is exact when every edge in it was in fact guessed from a name -- and a wrong
-    /// <c>## Calls</c> link reads as confidently as a right one. It forbids nothing, gates nothing, and
-    /// blocks no deletion; see the paragraph above for why it cannot.
-    /// </para>
-    ///
-    /// <para><b>It does not feed the run's report, and this comment used to say it did -- as did
-    /// 7.2.</b> Grepped across <c>producers/src</c>: nothing reads this property or
-    /// <see cref="IsAvailable"/>; the only readers are this project's tests. What the operator
-    /// actually sees is <c>GenerateRun.ReportProjects</c> iterating <see cref="Projects"/> and
-    /// emitting one note per project that did not compile, naming the project, the
-    /// <see cref="RoslynProjectAvailability"/> and the detail. That is strictly more than a single
-    /// boolean says, which is why the fix was to correct this claim and 7.2's rather than to wire a
-    /// second, coarser channel alongside a working one. Both properties stay: they are the question a
-    /// host embedding this resolver would ask, and the fixture in <c>RoslynResolverTests</c> asserts
-    /// on <see cref="IsComplete"/> to prove its own scratch repository really compiled -- a test that
-    /// would otherwise measure nothing.</para>
+    /// This engine's §6.2 token for <c>overview</c>'s <c>generated.engines</c>, read from the compiler
+    /// assembly this resolver actually loads rather than from a version string written by hand.
     /// </summary>
-    public bool IsComplete =>
-        Projects.Count > 0 && Projects.All(p => p.Availability == RoslynProjectAvailability.Compiled);
+    public static string EngineVersion { get; } =
+        EngineVersions.Token("roslyn", typeof(CSharpCompilation).Assembly);
 
     /// <summary>
     /// Compiles <paramref name="projectPaths"/>, plus every project they reference that lives under
@@ -226,14 +187,75 @@ private RoslynResolver(
     /// </remarks>
     public static RoslynResolver Create(
         string repositoryPath, IReadOnlyList<string> projectPaths, ExtractionLimits? limits = null)
+        // No budget, so no loop below can abandon and the null return is unreachable from here. The
+        // nullable result exists for TryCreateWithin alone, and this overload's behaviour is
+        // unchanged by its arrival -- which is the point of keeping the two separate rather than
+        // making every caller handle a null it can never receive.
+        => CreateWithin(repositoryPath, projectPaths, limits, new StageDeadline(null))!;
+
+    /// <summary>
+    /// <see cref="Create"/> under a wall-clock budget: builds the resolver if the whole stage fits in
+    /// <paramref name="timeout"/>, and otherwise abandons it and returns <see langword="false"/>.
+    ///
+    /// <para><b>Why this is opt-in, and why the caller gets nothing rather than something.</b> The
+    /// extraction stage has always honoured <see cref="ExtractionLimits.Timeout"/>; this one never
+    /// had a bound of its own. Each <c>dotnet msbuild</c> subprocess is capped at two minutes, but
+    /// nothing caps their sum, and nothing caps the compilations after them -- so a large enough
+    /// repository runs for as long as it runs. A default budget would fix that by making the output
+    /// depend on how fast the machine is, and §6.2 pins determinism at a fixed extractor version,
+    /// not at a fixed CPU. So the budget arrives only when an operator asks for one.</para>
+    ///
+    /// <para>And when it trips, the stage is abandoned <b>whole</b>. Returning the projects that
+    /// happened to finish first would emit a bundle where some <c>## Calls</c> links are exact and
+    /// some are name matches, with the line between them drawn by machine speed and recorded
+    /// nowhere -- an artefact its reader cannot interpret, which §2.1 rates below having no exact
+    /// resolver at all. Abandoning whole leaves a uniformly name-matched bundle, which is a state the
+    /// producer already has a name and a note for.</para>
+    /// </summary>
+    /// <param name="repositoryPath">As <see cref="Create"/>.</param>
+    /// <param name="projectPaths">As <see cref="Create"/>.</param>
+    /// <param name="limits">As <see cref="Create"/>.</param>
+    /// <param name="timeout">The budget for the whole stage. Must be positive.</param>
+    /// <param name="resolver">The resolver, or <see langword="null"/> if the budget was exhausted.</param>
+    /// <returns><see langword="true"/> if the stage completed inside the budget.</returns>
+    public static bool TryCreateWithin(
+        string repositoryPath,
+        IReadOnlyList<string> projectPaths,
+        ExtractionLimits? limits,
+        TimeSpan timeout,
+        [System.Diagnostics.CodeAnalysis.NotNullWhen(true)] out RoslynResolver? resolver)
+    {
+        ArgumentOutOfRangeException.ThrowIfLessThanOrEqual(timeout, TimeSpan.Zero);
+
+        resolver = CreateWithin(repositoryPath, projectPaths, limits, new StageDeadline(timeout));
+        return resolver is not null;
+    }
+
+    private static RoslynResolver? CreateWithin(
+        string repositoryPath, IReadOnlyList<string> projectPaths, ExtractionLimits? limits, StageDeadline deadline)
     {
         ArgumentException.ThrowIfNullOrEmpty(repositoryPath);
         ArgumentNullException.ThrowIfNull(projectPaths);
 
         var repositoryRoot = Path.GetFullPath(repositoryPath);
         var gate = new SourceFileGate((limits ?? ExtractionLimits.Default).MaxFileBytes, repositoryRoot);
-        var queried = QueryProjectClosure(repositoryRoot, projectPaths, out var reports);
-        var compiled = CompileInDependencyOrder(queried, reports, gate);
+        var queried = QueryProjectClosure(repositoryRoot, projectPaths, out var reports, deadline);
+        var compiled = CompileInDependencyOrder(queried, reports, gate, deadline);
+
+        // Asked once, after both loops, because both stop at the same flag: whichever of them tripped
+        // it, everything computed so far is discarded rather than published half-done.
+        //
+        // ShouldAbandon() rather than the latched Tripped, and the difference is the whole overrun that
+        // happens during the LAST unit of work -- or the only one, on a single-project repository.
+        // Both loops consult the clock at the top of an iteration, so an overrun after the final check
+        // was never noticed: this returned a resolver for a stage that took longer than the budget,
+        // which contradicts both this method's own doc ("builds the resolver if the whole stage fits in
+        // timeout") and the help text's "the stage is abandoned WHOLE". Asking here reads the clock one
+        // last time, after all the work, which is the only place the total elapsed time is known.
+        if (deadline.ShouldAbandon())
+        {
+            return null;
+        }
 
         var ownedFiles = new Dictionary<string, OwnedFile>(PathComparer);
         // Ordinal by project path so that, when two projects both compile the same file (a linked
@@ -374,6 +396,35 @@ public IReadOnlyList<ResolvedEdge> Resolve(IReadOnlyList<CallSite> sites, IReadO
         return edges;
     }
 
+    /// <summary>
+    /// The stage's wall-clock budget, or an unbounded one when <paramref name="budget"/> is
+    /// <see langword="null"/> -- which is what <see cref="Create"/> passes, so that overload runs
+    /// exactly the code it always ran and never consults a clock at all.
+    ///
+    /// <para><see cref="ShouldAbandon"/> is asked at the top of each per-project iteration, and that
+    /// granularity is the honest one: a single <c>dotnet msbuild</c> query is already capped at two
+    /// minutes by <c>MsBuildProjectQuery</c>, so the finest thing this can interrupt is the gap
+    /// between projects. It latches rather than recomputing, so a loop cannot resume after another
+    /// one gave up, and <see cref="Tripped"/> stays false when both loops merely finished.</para>
+    /// </summary>
+    private sealed class StageDeadline(TimeSpan? budget)
+    {
+        private readonly long _start = Stopwatch.GetTimestamp();
+
+        /// <summary>True once a loop has actually abandoned -- never merely because time has passed.</summary>
+        public bool Tripped { get; private set; }
+
+        public bool ShouldAbandon()
+        {
+            if (!Tripped && budget is { } b && Stopwatch.GetElapsedTime(_start) > b)
+            {
+                Tripped = true;
+            }
+
+            return Tripped;
+        }
+    }
+
     /// <summary>
     /// Runs <see cref="MsBuildProjectQuery.Query"/> over the requested projects and, transitively,
     /// over every project reference that resolves to a <c>.csproj</c> under the repository root.
@@ -383,7 +434,8 @@ public IReadOnlyList<ResolvedEdge> Resolve(IReadOnlyList<CallSite> sites, IReadO
     private static Dictionary<string, ProjectInputs> QueryProjectClosure(
         string repositoryRoot,
         IReadOnlyList<string> projectPaths,
-        out Dictionary<string, RoslynProjectReport> reports)
+        out Dictionary<string, RoslynProjectReport> reports,
+        StageDeadline deadline)
     {
         var queried = new Dictionary<string, ProjectInputs>(PathComparer);
         reports = new Dictionary<string, RoslynProjectReport>(PathComparer);
@@ -393,6 +445,11 @@ private static Dictionary<string, ProjectInputs> QueryProjectClosure(
 
         for (var i = 0; i < pending.Count; i++)
         {
+            if (deadline.ShouldAbandon())
+            {
+                break;
+            }
+
             var projectPath = pending[i];
 
             ProjectInputs inputs;
@@ -431,13 +488,23 @@ private static Dictionary<string, ProjectInputs> QueryProjectClosure(
     private static Dictionary<string, CSharpCompilation> CompileInDependencyOrder(
         Dictionary<string, ProjectInputs> queried,
         Dictionary<string, RoslynProjectReport> reports,
-        SourceFileGate gate)
+        SourceFileGate gate,
+        StageDeadline deadline)
     {
         var compiled = new Dictionary<string, CSharpCompilation>(PathComparer);
         var inProgress = new HashSet<string>(PathComparer);
 
         foreach (var projectPath in queried.Keys.OrderBy(p => p, StringComparer.Ordinal))
         {
+            // Only at the top level, deliberately, and not inside Compile's recursion into
+            // dependencies: abandoning halfway down a dependency chain would leave a project compiled
+            // against a reference that was itself abandoned, which is a worse compilation than not
+            // attempting it. A dependency chain is one unit of work here.
+            if (deadline.ShouldAbandon())
+            {
+                break;
+            }
+
             Compile(projectPath, queried, reports, compiled, inProgress, gate);
         }
 
@@ -570,7 +637,7 @@ private Dictionary<int, CalleeMatch> BuildIndex(OwnedFile owned)
         var text = owned.Tree.GetText().ToString();
         var model = owned.Compilation.GetSemanticModel(owned.Tree);
 
-        var index = new Dictionary<int, CalleeMatch>();
+        var pending = new List<(int Utf16Offset, CalleeMatch Match)>();
         foreach (var invocation in owned.Tree.GetRoot().DescendantNodes().OfType<InvocationExpressionSyntax>())
         {
             var callee = CalleeName(invocation.Expression);
@@ -582,16 +649,42 @@ private Dictionary<int, CalleeMatch> BuildIndex(OwnedFile owned)
             var symbol = TargetSymbol(model, invocation, callee);
             var (kind, container, name) = DescribeTarget(owned.Compilation, _repositoryProjectAssemblies, symbol);
 
-            // Roslyn counts UTF-16 code units; a CallSite's identity is a UTF-8 byte offset. Do not
-            // delete this conversion on the grounds that the tree-sitter side "already gives UTF-16
-            // too" -- see Utf8Offsets' summary; that is an artefact of the binding, and the failure
-            // mode when it stops holding is a call credited to the wrong symbol, silently.
-            var offset = Utf8Offsets.ToUtf8(text, callee.Identifier.SpanStart);
-
             // Identifier.Text, not ValueText: ValueText strips the @ from a verbatim identifier, while
             // CallSite.CalledName is the grammar's raw token and keeps it, so @class() would fail the
             // name guard in Resolve on a difference that is purely about how the name was spelled.
-            index[offset] = new CalleeMatch(callee.Identifier.Text, kind, container, name);
+            pending.Add((callee.Identifier.SpanStart, new CalleeMatch(callee.Identifier.Text, kind, container, name)));
+        }
+
+        // Roslyn counts UTF-16 code units; a CallSite's identity is a UTF-8 byte offset. Do not delete
+        // this conversion on the grounds that the tree-sitter side "already gives UTF-16 too" -- see
+        // Utf8Offsets' summary; that is an artefact of the binding, and the failure mode when it stops
+        // holding is a call credited to the WRONG symbol, silently.
+        //
+        // ONE pass over the file for all of its call sites, rather than one pass per site.
+        // `Utf8Offsets.ToUtf8` counts from the start of the text every time, so calling it per callee
+        // made this O(file size x call sites): a large file with many calls paid for its own length
+        // once for each of them. Sorted first so the walk only ever moves forward.
+        var index = new Dictionary<int, CalleeMatch>();
+        var utf8 = 0;
+        var utf16 = 0;
+
+        foreach (var (utf16Offset, match) in pending.OrderBy(entry => entry.Utf16Offset))
+        {
+            // The boundary guard `Utf8Offsets.ToUtf8` applies, kept rather than lost to the
+            // optimisation: an offset splitting a surrogate pair would make the segment below start on
+            // a lone low surrogate and count 3 bytes for it through the replacement fallback -- a
+            // plausible wrong number out of the join key, which is the failure this whole discipline
+            // exists to prevent. O(1) here, where the method's own check is O(1) too.
+            if (utf16Offset > 0 && utf16Offset < text.Length
+                && char.IsHighSurrogate(text[utf16Offset - 1]) && char.IsLowSurrogate(text[utf16Offset]))
+            {
+                throw new ArgumentOutOfRangeException(
+                    nameof(owned), utf16Offset, "a callee identifier begins inside a surrogate pair.");
+            }
+
+            utf8 += Encoding.UTF8.GetByteCount(text.AsSpan(utf16, utf16Offset - utf16));
+            utf16 = utf16Offset;
+            index[utf8] = match;
         }
 
         return index;
@@ -796,20 +889,12 @@ private static string ContainerPathFromSyntax(SyntaxNode declaration)
 
         for (var current = declaration.Parent; current is not null; current = current.Parent)
         {
-            var segment = current switch
-            {
-                BaseNamespaceDeclarationSyntax ns => ns.Name.ToString(),
-                BaseTypeDeclarationSyntax type => type.Identifier.Text,
-                DelegateDeclarationSyntax dele => dele.Identifier.Text,
-                MethodDeclarationSyntax method => method.Identifier.Text,
-                ConstructorDeclarationSyntax constructor => constructor.Identifier.Text,
-                DestructorDeclarationSyntax destructor => destructor.Identifier.Text,
-                PropertyDeclarationSyntax property => property.Identifier.Text,
-                EventDeclarationSyntax @event => @event.Identifier.Text,
-                LocalFunctionStatementSyntax local => local.Identifier.Text,
-                VariableDeclaratorSyntax declarator => declarator.Identifier.Text,
-                _ => string.Empty,
-            };
+            // Through DeclaredName for everything but a namespace, so an ancestor is spelled here
+            // exactly as that ancestor's own concept is. Spelling it with the bare identifier token
+            // instead was measured to put every member of `Holder<T>` under `Holder`'s container.
+            var segment = current is BaseNamespaceDeclarationSyntax ns
+                ? ns.Name.ToString()
+                : DeclaredName(current);
 
             if (segment.Length > 0)
             {
@@ -857,6 +942,69 @@ private static string ContainerPathFromSymbols(ISymbol symbol)
         return string.Join(".", segments);
     }
 
+    /// <summary>
+    /// The name <c>TreeSitterExtractor</c> gives this declaration -- the ONE place the two engines'
+    /// spelling rule lives on this side, used both for a leaf name and for every ancestor segment of a
+    /// container path.
+    ///
+    /// <para><b>Why it is not just the identifier token.</b> Two shapes need more than the token, and
+    /// both were measured to drift when only one side knew: a generic TYPE carries its arity
+    /// (<c>Holder</c>, <c>Holder_1</c>, <c>Holder_2</c>, since the grammar's <c>name</c> field is
+    /// <c>Holder</c> for all three), and a member implementing an interface explicitly carries the
+    /// interface as a dotted prefix (<c>IShape.Draw</c>), because it is a different member from a
+    /// public <c>Draw</c> and not callable as one.</para>
+    ///
+    /// <para>Arity is a TYPE rule only: a call site captures its callee as the bare identifier, so
+    /// qualifying a generic METHOD would stop every call to it from joining. Delegates take no arity
+    /// either, because the extractor classes them as members.</para>
+    ///
+    /// <para>Getting this wrong is not a missed link but a WRONG one, which is the outcome §2.1's
+    /// chaining exists to make impossible: <c>CodeGraphBuilder</c> overwrites the baseline's verdict
+    /// with the exact one and only then degrades a non-joining <c>Exact</c>, so a spelling only this
+    /// side knows leaves the graph strictly worse than not running the resolver at all.</para>
+    /// </summary>
+    private static string DeclaredName(SyntaxNode declaration)
+    {
+        var identifier = declaration switch
+        {
+            BaseTypeDeclarationSyntax type => type.Identifier,
+            DelegateDeclarationSyntax dele => dele.Identifier,
+            MethodDeclarationSyntax method => method.Identifier,
+            ConstructorDeclarationSyntax constructor => constructor.Identifier,
+            DestructorDeclarationSyntax destructor => destructor.Identifier,
+            PropertyDeclarationSyntax property => property.Identifier,
+            EventDeclarationSyntax @event => @event.Identifier,
+            LocalFunctionStatementSyntax local => local.Identifier,
+            VariableDeclaratorSyntax declarator => declarator.Identifier,
+            _ => default,
+        };
+
+        if (identifier.Text.Length == 0)
+        {
+            return string.Empty;
+        }
+
+        if (declaration is TypeDeclarationSyntax { TypeParameterList.Parameters.Count: > 0 } generic)
+        {
+            // The separator is TreeSitterExtractor.ArityMarker, read from there rather than repeated as
+            // a literal: this spelling is what the two engines join on, so a copy here could drift and
+            // the symptom would not be a lost call but a call credited to another symbol.
+            return $"{identifier.Text}{SymbolFact.ArityMarker}{generic.TypeParameterList!.Parameters.Count.ToString(CultureInfo.InvariantCulture)}";
+        }
+
+        var explicitInterface = declaration switch
+        {
+            MethodDeclarationSyntax method => method.ExplicitInterfaceSpecifier,
+            PropertyDeclarationSyntax property => property.ExplicitInterfaceSpecifier,
+            EventDeclarationSyntax @event => @event.ExplicitInterfaceSpecifier,
+            _ => null,
+        };
+
+        return explicitInterface is null
+            ? identifier.Text
+            : $"{explicitInterface.Name}.{identifier.Text}";
+    }
+
     /// <summary>
     /// The declaration's name <b>exactly as it is written in source</b>, because that -- not Roslyn's
     /// idea of the name -- is what <see cref="SymbolFact.Name"/> holds, and the two have to be the
@@ -879,23 +1027,9 @@ private static string SimpleNameOf(ISymbol symbol)
             // The node kinds here mirror CSharpProfile.DeclarationQuery's, deliberately: a declaration
             // this producer does not extract has no SymbolFact to join anyway, so there is nothing to
             // match its spelling against.
-            var identifier = reference.GetSyntax() switch
-            {
-                BaseTypeDeclarationSyntax type => type.Identifier,
-                DelegateDeclarationSyntax dele => dele.Identifier,
-                MethodDeclarationSyntax method => method.Identifier,
-                ConstructorDeclarationSyntax constructor => constructor.Identifier,
-                DestructorDeclarationSyntax destructor => destructor.Identifier,
-                PropertyDeclarationSyntax property => property.Identifier,
-                EventDeclarationSyntax @event => @event.Identifier,
-                LocalFunctionStatementSyntax local => local.Identifier,
-                VariableDeclaratorSyntax declarator => declarator.Identifier,
-                _ => default,
-            };
-
-            if (identifier.Text.Length > 0)
+            if (DeclaredName(reference.GetSyntax()) is { Length: > 0 } declared)
             {
-                return identifier.Text;
+                return declared;
             }
         }
 
diff --git a/producers/src/OkfProducer.CodeGraph.Roslyn/packages.lock.json b/producers/src/OkfProducer.CodeGraph.Roslyn/packages.lock.json
new file mode 100644
index 00000000..f0e69f22
--- /dev/null
+++ b/producers/src/OkfProducer.CodeGraph.Roslyn/packages.lock.json
@@ -0,0 +1,39 @@
+{
+  "version": 1,
+  "dependencies": {
+    "net10.0": {
+      "Microsoft.CodeAnalysis.CSharp": {
+        "type": "Direct",
+        "requested": "[5.3.0, )",
+        "resolved": "5.3.0",
+        "contentHash": "SQFNGQF4f7UfDXKxMzzGNMr3fjrPDIjLfmRvvVgDCw+dyvEHDaRfHuKA5q0Pr0/JW0Gcw89TxrxrS/MjwBvluQ==",
+        "dependencies": {
+          "Microsoft.CodeAnalysis.Analyzers": "5.3.0-2.25625.1",
+          "Microsoft.CodeAnalysis.Common": "[5.3.0]"
+        }
+      },
+      "Microsoft.CodeAnalysis.Analyzers": {
+        "type": "Transitive",
+        "resolved": "5.3.0-2.25625.1",
+        "contentHash": "4Yhh2fnu3G+J0J1lDc8WZVgMjgbynSeTfkl5IFJMFrmiIO0sc7Tjx+f3sFVV8Sd35PrIUWfof0RWc3lAMl7Azg=="
+      },
+      "Microsoft.CodeAnalysis.Common": {
+        "type": "Transitive",
+        "resolved": "5.3.0",
+        "contentHash": "uC0qk3jzTQY7i90ehfnCqaOZpBUGJyPMiHJ3c0jOb8yaPBjWzIhVdNxPbeVzI74DB0C+YgBKPLqUkgFZzua5Mg==",
+        "dependencies": {
+          "Microsoft.CodeAnalysis.Analyzers": "5.3.0-2.25625.1"
+        }
+      },
+      "okf4net": {
+        "type": "Project"
+      },
+      "okfproducer.core": {
+        "type": "Project",
+        "dependencies": {
+          "OKF4net": "[0.5.0, )"
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/producers/src/OkfProducer.CodeGraph.TreeSitter/OkfProducer.CodeGraph.TreeSitter.csproj b/producers/src/OkfProducer.CodeGraph.TreeSitter/OkfProducer.CodeGraph.TreeSitter.csproj
index d8fba79d..4bc73d05 100644
--- a/producers/src/OkfProducer.CodeGraph.TreeSitter/OkfProducer.CodeGraph.TreeSitter.csproj
+++ b/producers/src/OkfProducer.CodeGraph.TreeSitter/OkfProducer.CodeGraph.TreeSitter.csproj
@@ -4,6 +4,22 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+
+    <!-- Spec section 6.2: determinism holds at a FIXED extractor version, so the engine versions are locked
+         rather than floated. A grammar or Roslyn bump can move symbols, spans and descriptions
+         over unchanged source; locking makes that bump a deliberate migration instead of a drift
+         a rebuild suffers. The versions are ALSO recorded in overview's generated.engines, which is
+         what makes a golden diff interpretable, and which a lock file alone cannot say.
+
+         The committed lock file covers the plain `net10.0` restore, the one `dotnet build` and
+         `dotnet test producers/OkfProducer.sln` perform, which is this project's whole guarantee since
+         producers/ is outside CI. A RID-TARGETED restore rewrites it: `dotnet publish -r win-x64` on
+         OkfProducer.Cli (which declares three RuntimeIdentifiers) adds a `net10.0/win-x64` section
+         here, leaving a dirty working tree. Committing all three is not available: successive RID
+         restores REPLACE each other's section rather than accumulating, measured, so the plain
+         restore is what is committed, and a `-r` build is expected to modify this file. Do not commit
+         that modification; it is an artefact of the target, not a dependency change. -->
+    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
   </PropertyGroup>
 
   <ItemGroup>
diff --git a/producers/src/OkfProducer.CodeGraph.TreeSitter/Profiles/CSharpProfile.cs b/producers/src/OkfProducer.CodeGraph.TreeSitter/Profiles/CSharpProfile.cs
index 1da4f10e..b68c1d7c 100644
--- a/producers/src/OkfProducer.CodeGraph.TreeSitter/Profiles/CSharpProfile.cs
+++ b/producers/src/OkfProducer.CodeGraph.TreeSitter/Profiles/CSharpProfile.cs
@@ -35,7 +35,18 @@ public static class CSharpProfile
     /// immediately after the anonymous <c>operator</c> keyword node, not a field. Naming either
     /// requires bespoke, untested-by-any-brief-requirement logic (walk to the child after the
     /// keyword; synthesize something like <c>this[]</c>), so this profile accepts the coverage gap
-    /// rather than add unverified naming rules.</item>
+    /// rather than add unverified naming rules.
+    ///
+    /// <para><b>What that gap ripples into, which this list used not to say.</b> A CALL inside one of
+    /// them finds no ancestor in <c>TreeSitterExtractor.CallerMemberAncestorNodeTypes</c> either, so
+    /// the site is emitted with an empty caller. Nothing downstream can hang a <c>## Calls</c> entry
+    /// on a caller that has no concept, and an edge naming one is exactly what §2.1 calls worse than
+    /// no edge -- so <c>CodeGraphBuilder</c>'s invariant, that no edge may name a caller absent from
+    /// <c>Symbols</c>, is what removes it. The outcome is right; it was reached by two mechanisms
+    /// neither of which mentioned the other.
+    /// <c>TreeSitterExtractorTests.A_call_inside_an_indexer_or_an_operator_yields_no_edge_at_all</c>
+    /// pins both halves, and asserts the gap itself, so it fails loudly rather than vacuously if this
+    /// profile ever starts extracting them.</para></item>
     /// </list>
     /// </summary>
     public const string DeclarationQuery = """
diff --git a/producers/src/OkfProducer.CodeGraph.TreeSitter/TreeSitterExtractor.cs b/producers/src/OkfProducer.CodeGraph.TreeSitter/TreeSitterExtractor.cs
index 38f1ed0d..70485e11 100644
--- a/producers/src/OkfProducer.CodeGraph.TreeSitter/TreeSitterExtractor.cs
+++ b/producers/src/OkfProducer.CodeGraph.TreeSitter/TreeSitterExtractor.cs
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: LGPL-3.0-or-later
+using System.Globalization;
 using System.Text;
 using OkfProducer.Core.CodeGraph;
 using TreeSitter;
@@ -24,6 +25,59 @@ namespace OkfProducer.CodeGraph.TreeSitter;
 /// </remarks>
 public sealed class TreeSitterExtractor : ILanguageExtractor, IDisposable
 {
+    private readonly IFileSystemReader _reader;
+
+    /// <summary>
+    /// Reads <paramref name="stream"/> to its end into a single array.
+    /// <paramref name="expectedLength"/> is a hint and never a bound: the bound is
+    /// <see cref="ExtractionLimits.MaxFileBytes"/>, checked before this is reached.
+    ///
+    /// <para><b>One buffer, because two would halve the cap's meaning.</b> This read into a
+    /// <see cref="MemoryStream"/> and returned <c>ToArray()</c>, under a comment claiming it "allocates
+    /// once" -- it always allocated twice, the stream's buffer and then the array copied out of it, so
+    /// peak was 2x the file where <c>File.ReadAllBytes</c> peaked at 1x. <c>--max-file-size</c> is
+    /// §2.3's bound on what one hostile file can make this process allocate, and it was bounding half
+    /// of what was allocated. The growth path was worse than the doubling: a stream given no usable
+    /// hint grows by repeated reallocation and copies the whole file before it can fail, where
+    /// <c>ReadAllBytes</c> refused on the declared length up front.</para>
+    ///
+    /// <para>Filled with <see cref="Stream.ReadExactly(byte[], int, int)"/> when the length is known,
+    /// so a short read is an error rather than a silently truncated file -- truncation would yield
+    /// spans pointing at the wrong code, which §2.3 rates below not extracting the file at all. The
+    /// unknown-length fallback keeps the old behaviour, since there is nothing better to do.</para>
+    /// </summary>
+    private static byte[] ReadFully(Stream stream, long expectedLength)
+    {
+        if (expectedLength is > 0 and <= int.MaxValue)
+        {
+            var buffer = new byte[(int)expectedLength];
+            stream.ReadExactly(buffer, 0, buffer.Length);
+            return buffer;
+        }
+
+        using var growing = new MemoryStream();
+        stream.CopyTo(growing);
+        return growing.ToArray();
+    }
+
+    /// <summary>
+    /// Creates an extractor reading through <paramref name="reader"/>, or the real filesystem when it
+    /// is <see langword="null"/>.
+    ///
+    /// <para>The seam exists so a test can observe WHETHER a file was read, which no
+    /// <see cref="FileStatus"/> can report: the guarantee that a file's declared length alone decides
+    /// <see cref="FileStatus.SkippedTooLarge"/> is about an operation that did not happen, and only a
+    /// collaborator can witness that. Reparse-point detection is NOT routed through it -- see
+    /// <c>TryReadSource</c>.</para>
+    /// </summary>
+    public TreeSitterExtractor(IFileSystemReader? reader = null) => _reader = reader ?? SystemFileReader.Instance;
+
+    /// <summary>
+    /// This engine's §6.2 token for <c>overview</c>'s <c>generated.engines</c>, read from the binding
+    /// assembly this extractor actually loads rather than from a version string written by hand.
+    /// </summary>
+    public static string EngineVersion { get; } = Core.CodeGraph.EngineVersions.Token("tree-sitter", typeof(Parser).Assembly);
+
     private const string CommentNodeType = "comment";
     private const string FileScopedNamespaceNodeType = "file_scoped_namespace_declaration";
     private const string NamespaceDeclarationNodeType = "namespace_declaration";
@@ -590,30 +644,38 @@ private static IEnumerable<Node> Descendants(Node root)
     /// <paramref name="source"/> to the decoded text when every guard passes; otherwise returns the
     /// <see cref="FileStatus"/> to report and sets <paramref name="source"/> to <see cref="string.Empty"/>.
     /// </summary>
-    private static FileStatus? TryReadSource(string relativePath, string absolutePath, ExtractionLimits limits, out string source)
+    private FileStatus? TryReadSource(string relativePath, string absolutePath, ExtractionLimits limits, out string source)
     {
         source = string.Empty;
 
         byte[] bytes;
         try
         {
+            // The link check stays on the real FileInfo and is deliberately NOT behind the reader
+            // seam. It is a containment decision, and a seam able to answer it is a seam able to
+            // waive it -- a test double could then let a symlink through a check whose whole purpose
+            // is that nothing does.
             var fileInfo = new FileInfo(absolutePath);
             if (fileInfo.LinkTarget is not null || IsUnderReparsePoint(absolutePath, relativePath))
             {
                 return FileStatus.SkippedSymlink;
             }
 
-            if (!fileInfo.Exists)
+            // Length BEFORE any read, and the seam is what lets a test say so: a status cannot
+            // distinguish "rejected on its declared length" from "read, then rejected", and those are
+            // the same outcome for a caller and a very different one for memory.
+            if (_reader.TryGetLength(absolutePath) is not { } length)
             {
                 return FileStatus.SkippedUnreadable;
             }
 
-            if (fileInfo.Length > limits.MaxFileBytes)
+            if (length > limits.MaxFileBytes)
             {
                 return FileStatus.SkippedTooLarge;
             }
 
-            bytes = File.ReadAllBytes(absolutePath);
+            using var stream = _reader.OpenRead(absolutePath);
+            bytes = ReadFully(stream, length);
         }
         catch (IOException)
         {
@@ -708,9 +770,9 @@ private static List<SymbolFact> ExtractSymbols(
                 continue;
             }
 
-            var name = match.Captures.First(c => c.Name == "name").Node.Text;
-
             var kind = IsTypeDeclaration(decl.Type) ? SymbolKind.Type : SymbolKind.Member;
+            var name = QualifyName(match.Captures.First(c => c.Name == "name").Node.Text, decl, kind);
+
             var container = ComputeContainerPath(decl, namespaceContext.NameCovering(decl.StartIndex));
             var modifiersText = ComputeModifiersText(decl, kind);
             var visibility = profile.VisibilityOf(modifiersText, kind);
@@ -742,6 +804,7 @@ private static List<SymbolFact> ExtractSymbols(
                 // stops short of the declaration it names. Where there is no body at all
                 // (`public record Foo(int X);`), the declaration's own last line is its header's.
                 HeaderEndLine = (bodyStart?.StartPosition.Row ?? decl.EndPosition.Row) + 1,
+                ContainerNamespace = ComputeContainerNamespace(decl, namespaceContext.NameCovering(decl.StartIndex)),
             });
         }
 
@@ -803,6 +866,98 @@ private static List<CallSite> ExtractCallSites(string source, Tree tree, Query c
     private static bool IsTypeDeclaration(string nodeType) =>
         Array.IndexOf(TypeDeclarationNodeTypes, nodeType) >= 0;
 
+    /// <summary>The node holding a generic declaration's type parameters, when it has any.</summary>
+    private const string TypeParameterListNodeType = "type_parameter_list";
+
+    /// <summary>One type parameter inside a <see cref="TypeParameterListNodeType"/>.</summary>
+    private const string TypeParameterNodeType = "type_parameter";
+
+    /// <summary>
+    /// The node naming the interface an explicitly-implemented member belongs to
+    /// (<c>void IFoo.Bar()</c>), when there is one.
+    /// </summary>
+    private const string ExplicitInterfaceSpecifierNodeType = "explicit_interface_specifier";
+
+    /// <summary>
+    /// The name a declaration is known by once two shapes the grammar's <c>name</c> field cannot tell
+    /// apart are separated.
+    ///
+    /// <para><b>Generic arity, on TYPES only.</b> <c>Foo</c>, <c>Foo&lt;T&gt;</c> and
+    /// <c>Foo&lt;T, U&gt;</c> in one namespace all report <c>name</c> as <c>Foo</c>, so they collapsed
+    /// into one symbol group and were rendered as overloads of a single member. §3.2's merge rule was
+    /// written for method overloads, where merging is the point; extending it to unrelated types was
+    /// never intended by the spec.
+    ///
+    /// <b>The separator is a BACKTICK, and the reason is injectivity rather than taste.</b> This first
+    /// shipped as <c>_N</c>, chosen so a reader could tell "arity 1" from the registry's "second thing
+    /// called Foo" (<c>-2</c>) at a glance. But <c>_</c> and a digit are both drawn from the C#
+    /// identifier alphabet, so the mapping was not injective: a type genuinely named <c>Holder_1</c>
+    /// and <c>Holder&lt;T&gt;</c> produced the SAME <see cref="SymbolFact.Name"/>, landed in one
+    /// <c>SymbolKey</c> group, and were emitted as a single concept listing both signatures with one
+    /// description -- reinstating, for a perfectly legal input, the exact merge this rule exists to
+    /// remove. A backtick cannot occur in a C# identifier under any spelling (not via <c>@</c>, not via
+    /// a Unicode escape), so <c>Holder`1</c> can only have been produced here, and it is the CLR's own
+    /// arity convention besides. <see cref="ConceptId.Slugify"/> maps it to <c>-</c>, so the id reads
+    /// <c>holder-1</c> while a real <c>Holder_1</c> stays <c>holder_1</c> -- distinct at both levels.
+    ///
+    /// <b>Members are deliberately left alone</b>, generic ones included. A call site captures its
+    /// callee as the bare identifier (<c>Bar&lt;T&gt;()</c> yields <c>Bar</c>), so qualifying a generic
+    /// METHOD would stop every call to it from matching by name -- trading a merged concept for a lost
+    /// edge, which is the worse of the two.</para>
+    ///
+    /// <para><b>Explicit interface implementations.</b> <c>public void Bar()</c> and
+    /// <c>void IFoo.Bar()</c> on one type also both report <c>Bar</c>, and collapsed into one concept
+    /// carrying one description -- the first declaration's -- and both signatures. The qualified form
+    /// takes the interface as a dotted prefix, which is how C# writes it. Name matching no longer
+    /// reaches the explicit member, and that is correct rather than a cost: it is not callable as
+    /// <c>Bar()</c> on the type, so a call that used to bind to it was binding to the wrong member.</para>
+    /// </summary>
+    private static string QualifyName(string name, Node decl, SymbolKind kind)
+    {
+        if (kind == SymbolKind.Type)
+        {
+            var arity = decl.Children
+                .FirstOrDefault(c => c.Type == TypeParameterListNodeType)
+                ?.Children.Count(c => c.Type == TypeParameterNodeType) ?? 0;
+
+            return arity == 0 ? name : $"{name}{SymbolFact.ArityMarker}{arity.ToString(CultureInfo.InvariantCulture)}";
+        }
+
+        var explicitInterface = decl.Children
+            .FirstOrDefault(c => c.Type == ExplicitInterfaceSpecifierNodeType)
+            ?.Text.TrimEnd('.');
+
+        return string.IsNullOrEmpty(explicitInterface) ? name : $"{explicitInterface}.{name}";
+    }
+
+    /// <summary>
+    /// The namespace part of the path <see cref="ComputeContainerPath"/> builds -- the same walk,
+    /// keeping only the <c>namespace</c> ancestors -- or <see langword="null"/> when there are none.
+    ///
+    /// <para>Always a dotted PREFIX of the container path, because a namespace can only enclose a type
+    /// and never the reverse, so the generator can compare depths rather than re-parse either string.
+    /// A block-scoped <c>namespace Foo.Bar { }</c> contributes its whole dotted name as one ancestor,
+    /// exactly as it does over there, so the two stay in step.</para>
+    /// </summary>
+    private static string? ComputeContainerNamespace(Node decl, string? fileScopedNamespaceName)
+    {
+        var segments = new List<string>();
+        for (var current = decl.Parent; current is not null; current = current.Parent)
+        {
+            if (current.Type == NamespaceDeclarationNodeType && current.GetChildForField(NameFieldName) is { } nameField)
+            {
+                segments.Insert(0, nameField.Text);
+            }
+        }
+
+        if (fileScopedNamespaceName is not null)
+        {
+            segments.Insert(0, fileScopedNamespaceName);
+        }
+
+        return segments.Count == 0 ? null : string.Join(".", segments);
+    }
+
     /// <summary>
     /// Builds the dotted <c>N.Outer.Inner</c> path above <paramref name="decl"/>: every ancestor
     /// that exposes a <c>name</c> field (a namespace, a type, or -- for a local function -- the
@@ -828,7 +983,15 @@ private static string ComputeContainerPath(Node decl, string? fileScopedNamespac
             var nameField = current.Type == FileScopedNamespaceNodeType ? null : current.GetChildForField(NameFieldName);
             if (nameField is not null)
             {
-                segments.Insert(0, nameField.Text);
+                // Through the SAME qualification the declaration itself gets, or the container path
+                // would spell an ancestor differently from that ancestor's own concept. Measured on
+                // the enriched golden fixture before this line existed: `Holder`, `Holder<T>` and
+                // `Holder<T, U>` became three type concepts, and all of their members landed under the
+                // first one, because a member's container read the ancestor's bare `name` field.
+                segments.Insert(0, QualifyName(
+                    nameField.Text,
+                    current,
+                    IsTypeDeclaration(current.Type) ? SymbolKind.Type : SymbolKind.Member));
             }
 
             current = current.Parent;
@@ -895,6 +1058,16 @@ private static string ComputeSignature(Node decl, Node? end)
     /// <see cref="ComputeSignature"/> so the signature text and
     /// <see cref="SymbolFact.HeaderEndLine"/> are cut at the same node by construction; see that
     /// property for why the line matters.
+    ///
+    /// <para><b>These three strings are a contract with the vendored grammar, and the concern was that
+    /// nothing would notice it breaking.</b> A grammar bump renaming any of the fields makes the
+    /// lookup return <see langword="null"/> silently, and the header then falls back to the
+    /// declaration's own last line -- which is the pre-R48 churn defect, where every edit inside a
+    /// type's body rewrote the type's own concept. MEASURED, one rename at a time, against the whole
+    /// suite: <c>body</c> turns 12 tests red (the golden included, through <c>CheckTests</c>, plus two
+    /// <c>BlastRadiusTests</c> rows), <c>accessors</c> turns 8 red, <c>value</c> turns 1 red. Covered
+    /// by execution rather than by name, and the golden's enrichment -- one occurrence of each
+    /// declaration shape -- is what carries most of it.</para>
     /// </summary>
     private static Node? HeaderEndNode(Node decl) =>
         decl.GetChildForField(BodyFieldName)
diff --git a/producers/src/OkfProducer.CodeGraph.TreeSitter/packages.lock.json b/producers/src/OkfProducer.CodeGraph.TreeSitter/packages.lock.json
new file mode 100644
index 00000000..665578da
--- /dev/null
+++ b/producers/src/OkfProducer.CodeGraph.TreeSitter/packages.lock.json
@@ -0,0 +1,22 @@
+{
+  "version": 1,
+  "dependencies": {
+    "net10.0": {
+      "TreeSitter.DotNet": {
+        "type": "Direct",
+        "requested": "[1.3.0, )",
+        "resolved": "1.3.0",
+        "contentHash": "VFl5j5UguKI3BvdQ/bbHDrDP1FG7lkEjv9LZCQ01bPe4NuAiXQVnEfuFRWdJ8TA9NmY/D7qqGkj8CuD3ptiDDw=="
+      },
+      "okf4net": {
+        "type": "Project"
+      },
+      "okfproducer.core": {
+        "type": "Project",
+        "dependencies": {
+          "OKF4net": "[0.5.0, )"
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/producers/src/OkfProducer.Core/CodeGraph/CodeGraph.cs b/producers/src/OkfProducer.Core/CodeGraph/CodeGraph.cs
index b54ba002..887a6c08 100644
--- a/producers/src/OkfProducer.Core/CodeGraph/CodeGraph.cs
+++ b/producers/src/OkfProducer.Core/CodeGraph/CodeGraph.cs
@@ -10,4 +10,26 @@ namespace OkfProducer.Core.CodeGraph;
 /// <see cref="EdgeConfidence.Unresolved"/> rather than pointing at a concept that will not exist,
 /// which then renders as plain text per §4.5's fallback for an unresolved call.
 /// </summary>
-public sealed record CodeGraph(IReadOnlyList<SymbolFact> Symbols, IReadOnlyList<ResolvedEdge> Edges, RunStatus Status);
+public sealed record CodeGraph(IReadOnlyList<SymbolFact> Symbols, IReadOnlyList<ResolvedEdge> Edges, RunStatus Status)
+{
+    /// <summary>
+    /// How many declarations this run dropped because an enclosing TYPE capped them, though their own
+    /// modifier was in scope -- a <c>public</c> member of an <c>internal</c> class, and everything
+    /// nested below one.
+    ///
+    /// <para><b>It exists so the drop is not silent.</b> Scope filtering on effective visibility is
+    /// correct -- C# caps a member at its container, so such a member is not reachable outside the
+    /// assembly whatever its keyword says -- but it removes concepts an earlier version of this
+    /// producer emitted, and a regeneration over an existing bundle PRUNES them. The writer's
+    /// scope-narrowing guard cannot catch that: it compares the recorded scope FLAGS, and here the
+    /// flags are identical on both sides. It is the rule that narrowed, not the run. Measured on a
+    /// two-level fixture: five concepts deleted, nothing printed.</para>
+    ///
+    /// <para>Not on <see cref="RunStatus"/>, which is about FILES -- was each one visited, did it parse
+    /// -- while this is about declarations inside files that were read perfectly well. An <c>init</c>
+    /// property defaulting to zero for the same reason <see cref="SymbolFact.HeaderEndLine"/> is one:
+    /// every fixture in this solution constructs a graph positionally, and zero means "nothing was
+    /// capped", which is what those fixtures mean.</para>
+    /// </summary>
+    public int CappedByContainer { get; init; }
+}
diff --git a/producers/src/OkfProducer.Core/CodeGraph/CodeGraphBuilder.cs b/producers/src/OkfProducer.Core/CodeGraph/CodeGraphBuilder.cs
index c4fbca02..54c632a3 100644
--- a/producers/src/OkfProducer.Core/CodeGraph/CodeGraphBuilder.cs
+++ b/producers/src/OkfProducer.Core/CodeGraph/CodeGraphBuilder.cs
@@ -11,7 +11,7 @@ namespace OkfProducer.Core.CodeGraph;
 /// site's relative path and offset), so a missing or non-owning resolver degrades precision, never
 /// the shape of the output (§2.1).
 /// </summary>
-public sealed class CodeGraphBuilder(ILanguageExtractor extractor, IReadOnlyList<LanguageProfile> profiles, IReadOnlyList<ISymbolResolver> resolvers)
+public sealed class CodeGraphBuilder(ILanguageExtractor extractor, IReadOnlyList<LanguageProfile> profiles, IReadOnlyList<ISymbolResolver> resolvers, IFileSystemReader? reader = null)
 {
     /// <summary>
     /// Extracts every eligible file in <paramref name="snapshot"/>'s repository, concatenates and
@@ -126,7 +126,7 @@ public CodeGraph Build(RepositorySnapshot snapshot, ExtractionLimits limits, Sco
                 continue;
             }
 
-            if (!FileEligibility.IsEligible(relativePath, snapshot, scope))
+            if (!FileEligibility.IsEligible(relativePath, snapshot, scope, reader))
             {
                 continue;
             }
@@ -160,14 +160,46 @@ public CodeGraph Build(RepositorySnapshot snapshot, ExtractionLimits limits, Sco
         // that is load-bearing rather than incidental. Filtering `declared` (already sorted) rather
         // than sorting a separately-filtered list keeps the two in the same order by construction.
         var declared = SortSymbols(results.SelectMany(r => r.Result.Symbols));
-        var symbols = declared.Where(s => FileEligibility.IsInScope(s, scope)).ToList();
+        // Filtered on EFFECTIVE visibility, which needs the whole declared set: a member is capped by
+        // every type enclosing it, and a SymbolFact names its container as a dotted path without the
+        // container's own visibility. `declared` is the unfiltered set on purpose -- filtering first
+        // would remove the containers that do the capping.
+        //
+        // Keyed by (Container, Name), the same join every other consumer uses. A duplicate key is
+        // possible in principle (two declarations reduced to one identity) and is resolved by keeping
+        // the FIRST, which `declared` has already sorted deterministically; the alternative, throwing,
+        // would fail a run over a shape §3.2 exists to merge rather than reject.
+        var declaredByKey = new Dictionary<(string Container, string Name), SymbolFact>();
+        foreach (var symbol in declared)
+        {
+            declaredByKey.TryAdd((symbol.Container, symbol.Name), symbol);
+        }
+
+        var symbols = declared.Where(s => FileEligibility.IsInScope(s, declaredByKey, scope)).ToList();
+
+        // Counted rather than merely applied, because this filter REMOVES concepts an earlier version
+        // of this producer emitted, and a regeneration prunes them from a bundle that already has them.
+        // The writer's scope-narrowing guard cannot see it -- it compares the recorded scope FLAGS, and
+        // this run's flags match the previous run's exactly; it is the rule that narrowed. So the count
+        // is what lets the run say so out loud. Exactly the difference between the two filters: a
+        // declaration whose own modifier is in scope and whose enclosing type is not.
+        var cappedByContainer = declared.Count(s =>
+            FileEligibility.IsInScope(s, scope) && !FileEligibility.IsInScope(s, declaredByKey, scope));
 
         var sites = results.SelectMany(r => r.Result.Sites).ToList();
 
+        // (path, offset) is a call site's identity -- the same key both engines match on -- so two
+        // sites sharing one would be two calls at the same byte, which the grammar cannot produce:
+        // an `invocation_expression`'s callee node starts where no other callee node starts. Seeded
+        // with `Add` rather than the indexer so that stops being an assumption: if a future grammar or
+        // profile ever emits two, this throws here instead of silently keeping whichever came last and
+        // dropping a call from the graph with nothing to show for it.
         var verdicts = new Dictionary<(string RelativePath, int Offset), ResolvedEdge>();
         foreach (var site in sites)
         {
-            verdicts[(site.RelativePath, site.Offset)] = new ResolvedEdge(site, TargetContainer: null, TargetName: null, EdgeConfidence.Unresolved);
+            verdicts.Add(
+                (site.RelativePath, site.Offset),
+                new ResolvedEdge(site, TargetContainer: null, TargetName: null, EdgeConfidence.Unresolved));
         }
 
         foreach (var resolver in resolvers)
@@ -191,7 +223,17 @@ public CodeGraph Build(RepositorySnapshot snapshot, ExtractionLimits limits, Sco
             // are handled after the fact, by the degrade-to-Unresolved pass below.
             foreach (var edge in resolver.Resolve(ownedSites, declared))
             {
-                verdicts[(edge.Site.RelativePath, edge.Site.Offset)] = edge;
+                // Only over a site the EXTRACTOR emitted. `verdicts[key] = edge` accepted anything a
+                // resolver handed back, so a resolver returning an edge for a site nobody extracted --
+                // a stale offset, a file it read itself, an off-by-one -- added a phantom call to the
+                // graph, and a phantom edge is a `## Calls` link to a caller that does not exist. The
+                // dictionary is seeded from `sites` above, so membership IS the contract
+                // `ISymbolResolver.Resolve` states and never enforced: an edge answers a site it was
+                // given, or it is not an answer.
+                if (verdicts.ContainsKey((edge.Site.RelativePath, edge.Site.Offset)))
+                {
+                    verdicts[(edge.Site.RelativePath, edge.Site.Offset)] = edge;
+                }
             }
         }
 
@@ -245,7 +287,7 @@ public CodeGraph Build(RepositorySnapshot snapshot, ExtractionLimits limits, Sco
         // own doc comments for the full reasoning §6.3 and this task's own measurement forced).
         var status = new RunStatus(!incomplete, skipped);
 
-        return new CodeGraph(symbols, edges, status);
+        return new CodeGraph(symbols, edges, status) { CappedByContainer = cappedByContainer };
     }
 
     /// <summary>
diff --git a/producers/src/OkfProducer.Core/CodeGraph/EngineVersions.cs b/producers/src/OkfProducer.Core/CodeGraph/EngineVersions.cs
new file mode 100644
index 00000000..1681aab1
--- /dev/null
+++ b/producers/src/OkfProducer.Core/CodeGraph/EngineVersions.cs
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+using System.Reflection;
+
+namespace OkfProducer.Core.CodeGraph;
+
+/// <summary>
+/// Builds the <c>name/version</c> tokens §6.2 puts in <c>overview</c>'s <c>generated.engines</c>.
+///
+/// <para>Here rather than in either engine project so the two cannot come to spell a version
+/// differently, and so <c>OkfProducer.Core</c> -- which references neither engine -- can define the
+/// shape without knowing who fills it. Each engine names ITSELF by handing over its own assembly;
+/// the composition root collects the tokens and passes them to <c>GenerateOptions</c>.</para>
+/// </summary>
+public static class EngineVersions
+{
+    /// <summary>
+    /// <paramref name="name"/> joined to <paramref name="assembly"/>'s version by <c>/</c>.
+    ///
+    /// <para>The informational version is preferred because it identifies the exact BUILD, where the
+    /// assembly version is often frozen across a package's whole major line -- and identifying the
+    /// build is what §6.2 needs, since determinism holds at a fixed extractor and two builds of one
+    /// major line can move symbols. Anything after a <c>+</c> is dropped: SourceLink appends the commit
+    /// sha there, which would put a 40-character hash into every regenerated bundle and make the field
+    /// churn on rebuilds that changed no dependency.</para>
+    ///
+    /// <para><b>It is NOT always the NuGet package version, and this comment used to say it was.</b>
+    /// Measured on the pinned <c>Microsoft.CodeAnalysis.CSharp</c>: the package is <c>5.3.0</c> in both
+    /// the <c>.csproj</c> and <c>packages.lock.json</c>, while the informational version is
+    /// <c>5.3.0-2.26078.5+16f9bd2</c>, so the recorded token is <c>roslyn/5.3.0-2.26078.5</c> -- a
+    /// Roslyn build id that matches no package a reader can look up. That is the right value to record
+    /// anyway, for the reason above; what was wrong was the promise that a reader could resolve it to a
+    /// package. For tree-sitter the two coincide (<c>tree-sitter/1.3.0</c>), which is how the claim
+    /// went unchallenged.</para>
+    ///
+    /// <para>An assembly that declares neither falls back to <c>unknown</c> rather than being omitted:
+    /// a run whose engine version could not be read is a run whose determinism claim is weaker, and
+    /// saying so is the point of the field.</para>
+    /// </summary>
+    public static string Token(string name, Assembly assembly)
+    {
+        var informational = assembly.GetCustomAttribute<AssemblyInformationalVersionAttribute>()?.InformationalVersion;
+        if (!string.IsNullOrWhiteSpace(informational))
+        {
+            var plus = informational.IndexOf('+', StringComparison.Ordinal);
+            return $"{name}/{(plus < 0 ? informational : informational[..plus])}";
+        }
+
+        return $"{name}/{assembly.GetName().Version?.ToString(3) ?? "unknown"}";
+    }
+}
diff --git a/producers/src/OkfProducer.Core/CodeGraph/ExtractionLimits.cs b/producers/src/OkfProducer.Core/CodeGraph/ExtractionLimits.cs
index 8883148a..fa6220b2 100644
--- a/producers/src/OkfProducer.Core/CodeGraph/ExtractionLimits.cs
+++ b/producers/src/OkfProducer.Core/CodeGraph/ExtractionLimits.cs
@@ -54,6 +54,61 @@ namespace OkfProducer.Core.CodeGraph;
 /// </param>
 public sealed record ExtractionLimits(long MaxFileBytes, int MaxDepth, TimeSpan Timeout)
 {
+    /// <summary>
+    /// Refuses a value that cannot mean what a limit means, at construction rather than mid-run.
+    ///
+    /// <para>A non-positive <see cref="Timeout"/> is the one that mattered: it cancels the linked
+    /// source immediately, so <c>CodeGraphBuilder.Build</c> raised out of the walk instead of coming
+    /// back with an incomplete <see cref="RunStatus"/> -- the honest reporting path this type exists
+    /// to feed. An operator who typed a bad number got a stack trace where the design promises a run
+    /// that says what it could not do. A non-positive <see cref="MaxFileBytes"/> or
+    /// <see cref="MaxDepth"/> is refused for the same reason: it does not bound a run, it empties one,
+    /// and doing so silently is worse than saying no.</para>
+    /// </summary>
+    private readonly long _maxFileBytes = Positive(MaxFileBytes, nameof(MaxFileBytes));
+    private readonly int _maxDepth = (int)Positive(MaxDepth, nameof(MaxDepth));
+    private readonly TimeSpan _timeout = PositiveDuration(Timeout);
+
+    /// <inheritdoc cref="MaxFileBytes"/>
+    public long MaxFileBytes
+    {
+        get => _maxFileBytes;
+        init => _maxFileBytes = Positive(value, nameof(MaxFileBytes));
+    }
+
+    /// <inheritdoc cref="MaxDepth"/>
+    public int MaxDepth
+    {
+        get => _maxDepth;
+        init => _maxDepth = (int)Positive(value, nameof(MaxDepth));
+    }
+
+    /// <inheritdoc cref="Timeout"/>
+    public TimeSpan Timeout
+    {
+        get => _timeout;
+        init => _timeout = PositiveDuration(value);
+    }
+
+    /// <summary>
+    /// Refuses a bound that does not bound.
+    ///
+    /// <para>Written as explicit <c>init</c> accessors over backing fields, not as property
+    /// initialisers, and the difference is not stylistic: a record's <c>with</c> expression copies
+    /// backing fields through the compiler-generated copy constructor and <b>does not re-run property
+    /// initialisers</b>. The initialiser form validated the primary constructor only, and
+    /// <c>ExtractionLimits.Default with { Timeout = ... }</c> -- which is how every caller in this
+    /// solution builds one -- sailed straight past it. Measured, by a test that failed.</para>
+    /// </summary>
+    private static long Positive(long value, string name) =>
+        value > 0 ? value : throw new ArgumentOutOfRangeException(name, value, "must be positive.");
+
+    /// <inheritdoc cref="Positive"/>
+    private static TimeSpan PositiveDuration(TimeSpan value) =>
+        value > TimeSpan.Zero
+            ? value
+            : throw new ArgumentOutOfRangeException(nameof(Timeout), value, "must be a positive duration.");
+
     /// <summary>
     /// 2 MB per file, a directory depth of 512, and a 10-minute between-files deadline -- see
     /// <see cref="Timeout"/> for exactly what that last one does and does not bound.
diff --git a/producers/src/OkfProducer.Core/CodeGraph/FileEligibility.cs b/producers/src/OkfProducer.Core/CodeGraph/FileEligibility.cs
index 3d95f3f5..290baa13 100644
--- a/producers/src/OkfProducer.Core/CodeGraph/FileEligibility.cs
+++ b/producers/src/OkfProducer.Core/CodeGraph/FileEligibility.cs
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: LGPL-3.0-or-later
 using System.Xml.Linq;
+using OkfProducer.Core.Generation;
 using OkfProducer.Core.Scanning;
 
 namespace OkfProducer.Core.CodeGraph;
@@ -33,7 +34,7 @@ public static class FileEligibility
     /// -- the same treatment <see cref="CodeGraphBuilder.Build"/> already gives a file matching no
     /// <see cref="LanguageProfile"/>.
     /// </summary>
-    public static bool IsEligible(string relativePath, RepositorySnapshot snapshot, ScopeOptions scope)
+    public static bool IsEligible(string relativePath, RepositorySnapshot snapshot, ScopeOptions scope, IFileSystemReader? reader = null)
     {
         var directorySegments = DirectorySegments(relativePath);
 
@@ -58,7 +59,7 @@ public static bool IsEligible(string relativePath, RepositorySnapshot snapshot,
             }
         }
 
-        return !IsOwnedByTestProject(relativePath, snapshot);
+        return !IsOwnedByTestProject(relativePath, snapshot, reader ?? SystemFileReader.Instance);
     }
 
     /// <summary>
@@ -77,6 +78,76 @@ public static bool IsInScope(SymbolFact fact, ScopeOptions scope) =>
             _ => false,
         };
 
+    /// <summary>
+    /// <see cref="IsInScope(SymbolFact, ScopeOptions)"/> against a symbol's EFFECTIVE visibility: the
+    /// least visible of its own modifier and every type that encloses it.
+    ///
+    /// <para><b>Why the declared modifier alone was the wrong filter.</b> C# caps a member at its
+    /// container: <c>public void Never()</c> inside <c>internal class Hidden</c> is not reachable from
+    /// outside the assembly, whatever the keyword says. Filtering on the modifier alone put that member
+    /// in a default-scope bundle -- tagged <c>public</c>, a visibility the language does not give it --
+    /// so an operator who left <c>--include-internal</c> off precisely to keep internal API out of a
+    /// shipped knowledge bundle got it published anyway, and mislabelled. The producer's own fixture
+    /// carries that shape, so the golden blessed it.
+    /// </para>
+    ///
+    /// <para><b>Why it takes the whole declared set.</b> A <see cref="SymbolFact"/> names its container
+    /// as a dotted path and nothing more, so the container's own visibility is not on it; the cap can
+    /// only be computed where every declared symbol is in hand. <paramref name="declared"/> must be the
+    /// UNFILTERED set -- filtering first would drop the very containers that do the capping, and a
+    /// member whose container is missing would then look top-level and slip through.</para>
+    ///
+    /// <para>A container that is not among <paramref name="declared"/> caps nothing: it is a namespace,
+    /// or a type in a file this run did not read. Treating an unknown container as private would delete
+    /// concepts over a file the run merely failed to open, which §2.3 rates well below keeping them.</para>
+    /// </summary>
+    /// <param name="fact">The symbol to test.</param>
+    /// <param name="declared">Every symbol this run extracted, before any scope filtering.</param>
+    /// <param name="scope">The run's scope options.</param>
+    public static bool IsInScope(SymbolFact fact, IReadOnlyDictionary<(string Container, string Name), SymbolFact> declared, ScopeOptions scope)
+    {
+        ArgumentNullException.ThrowIfNull(fact);
+        ArgumentNullException.ThrowIfNull(declared);
+
+        var effective = fact.Visibility;
+        var container = fact.Container;
+
+        // Upward one type at a time, taking the least visible seen. Bounded by the container's segment
+        // count, so a cycle is not expressible: each step strictly shortens the path.
+        while (container.Length > 0 && effective != SymbolVisibility.Private)
+        {
+            var lastDot = container.LastIndexOf('.');
+            var parentContainer = lastDot < 0 ? string.Empty : container[..lastDot];
+            var name = lastDot < 0 ? container : container[(lastDot + 1)..];
+
+            if (declared.TryGetValue((parentContainer, name), out var enclosing) && enclosing.Kind == SymbolKind.Type)
+            {
+                effective = Least(effective, enclosing.Visibility);
+            }
+
+            container = parentContainer;
+        }
+
+        return IsInScope(fact with { Visibility = effective }, scope);
+    }
+
+    /// <summary>
+    /// The less visible of two tiers. Written as an explicit ladder rather than as a comparison on the
+    /// enum's numeric order: the members happen to be declared most-visible-first today, so
+    /// <c>left > right</c> would work and would silently invert if anyone reordered them.
+    /// </summary>
+    private static SymbolVisibility Least(SymbolVisibility left, SymbolVisibility right)
+    {
+        if (left == SymbolVisibility.Private || right == SymbolVisibility.Private)
+        {
+            return SymbolVisibility.Private;
+        }
+
+        return left == SymbolVisibility.Internal || right == SymbolVisibility.Internal
+            ? SymbolVisibility.Internal
+            : SymbolVisibility.Public;
+    }
+
     private static string[] DirectorySegments(string relativePath)
     {
         var segments = relativePath.Split('/', StringSplitOptions.RemoveEmptyEntries);
@@ -104,7 +175,7 @@ private static bool ContainsIgnoreCase(string[] names, string segment)
     /// resolved path back off disk, rather than adding raw project data to
     /// <see cref="RepositorySnapshot"/>, keeps that record's shape unchanged for every other consumer.
     /// </summary>
-    private static bool IsOwnedByTestProject(string relativePath, RepositorySnapshot snapshot)
+    private static bool IsOwnedByTestProject(string relativePath, RepositorySnapshot snapshot, IFileSystemReader reader)
     {
         var fileDirectory = DirectorySegments(relativePath);
 
@@ -134,13 +205,24 @@ private static bool IsOwnedByTestProject(string relativePath, RepositorySnapshot
         }
 
         var absoluteCsprojPath = Path.Combine(snapshot.RepoPath, bestProjectPath.Replace('/', Path.DirectorySeparatorChar));
-        return ReferencesTestSdk(absoluteCsprojPath);
+        return ReferencesTestSdk(absoluteCsprojPath, reader);
     }
 
-    // Ordinal, not OrdinalIgnoreCase: every other path comparison in this codebase (§6.2's "never a
-    // culture-dependent comparison" rule) is Ordinal, and a case-sensitive filesystem can genuinely
-    // hold both src/Foo and src/foo as distinct directories -- OrdinalIgnoreCase here could pick the
-    // wrong one as a file's owning project.
+    // Case-insensitively on Windows and ordinally elsewhere -- BundlePaths.PathComparison, the
+    // codebase's one answer to "are these the same path", rather than a second rule written here.
+    //
+    // This was a flat Ordinal, argued for on the grounds that a case-sensitive filesystem can hold
+    // both src/Foo and src/foo as distinct directories, which is true and is exactly what
+    // PathComparison already encodes. What the argument missed is where the two sides come from. A
+    // file's path is walked off disk; the project's comes from `PackageManifest.RelativePath`, which
+    // RepositoryScanner may have read out of a `.sln`'s TEXT and never normalised against disk. On
+    // Windows a differently-cased entry there still passes `File.Exists`, so the project was found,
+    // its `.csproj` was read, and then this comparison rejected it -- and a test project in a
+    // non-conventionally-named directory was silently INCLUDED with `--include-tests` off, which is
+    // the one direction §5.4 cannot afford to get wrong.
+    //
+    // Still never culture-dependent, which is what §6.2 forbids: OrdinalIgnoreCase is not a
+    // linguistic comparison.
     private static bool IsAncestorOrSame(string[] directory, string[] descendant)
     {
         if (directory.Length > descendant.Length)
@@ -150,7 +232,7 @@ private static bool IsAncestorOrSame(string[] directory, string[] descendant)
 
         for (var i = 0; i < directory.Length; i++)
         {
-            if (!string.Equals(directory[i], descendant[i], StringComparison.Ordinal))
+            if (!string.Equals(directory[i], descendant[i], BundlePaths.PathComparison))
             {
                 return false;
             }
@@ -159,24 +241,38 @@ private static bool IsAncestorOrSame(string[] directory, string[] descendant)
         return true;
     }
 
-    private static bool ReferencesTestSdk(string absoluteCsprojPath)
+    private static bool ReferencesTestSdk(string absoluteCsprojPath, IFileSystemReader reader)
     {
-        if (!File.Exists(absoluteCsprojPath))
+        if (reader.TryGetLength(absoluteCsprojPath) is null)
         {
             return false;
         }
 
         try
         {
-            var xml = XDocument.Load(absoluteCsprojPath);
+            using var stream = reader.OpenRead(absoluteCsprojPath);
+            var xml = XDocument.Load(stream);
             return (xml.Root?.Descendants().Where(e => e.Name.LocalName == "PackageReference") ?? [])
                 .Any(e => string.Equals((string?)e.Attribute("Include"), TestSdkPackageId, StringComparison.OrdinalIgnoreCase));
         }
-        catch (System.Xml.XmlException)
-        {
-            return false;
-        }
-        catch (IOException)
+        // Every way XDocument.Load can fail on a path that existed a moment ago, not just the two
+        // that were listed here. This method is called from CodeGraphBuilder.Build's per-file loop,
+        // which deliberately does NOT wrap its body -- so an exception escaping here does not degrade
+        // one file, it aborts the whole repository's run. `File.Exists` above narrows nothing: it
+        // answers for the instant it was asked, and it returns false for a directory, so the
+        // interesting failures are the ones it cannot see -- an ACL that denies read, a path the
+        // platform rejects, a file deleted between the two calls.
+        //
+        // NOT covered by an executable test, and that is a real gap rather than an oversight:
+        // UnauthorizedAccessException and SecurityException cannot be provoked here portably (a
+        // read-denying ACL is Windows-specific and needs elevation the suite does not have), and the
+        // two that CAN be provoked -- XmlException, IOException -- were already caught before this
+        // change. Covering the rest needs a loader seam on this type; see the register entry.
+        catch (Exception e) when (e is System.Xml.XmlException
+            or IOException
+            or UnauthorizedAccessException
+            or System.Security.SecurityException
+            or NotSupportedException)
         {
             return false;
         }
diff --git a/producers/src/OkfProducer.Core/CodeGraph/IFileSystemReader.cs b/producers/src/OkfProducer.Core/CodeGraph/IFileSystemReader.cs
new file mode 100644
index 00000000..a4d2eacf
--- /dev/null
+++ b/producers/src/OkfProducer.Core/CodeGraph/IFileSystemReader.cs
@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+namespace OkfProducer.Core.CodeGraph;
+
+/// <summary>
+/// The two filesystem reads the extraction stage performs, behind a seam so a test can observe them
+/// and provoke them.
+///
+/// <para><b>Why this exists rather than direct <c>File.*</c> calls.</b> Two guarantees on this path
+/// were stated and could not be executed. That a file's declared length alone decides
+/// <see cref="FileStatus.SkippedTooLarge"/> -- proving it needs to observe whether the bytes were
+/// read at all, and a status cannot say. And that an unreadable <c>.csproj</c> degrades one file
+/// instead of ending the repository's run -- provoking it needs an <see cref="System.UnauthorizedAccessException"/>
+/// from a read, which on this platform needs an ACL and an elevation a test suite does not have.
+/// Both are answerable once the read is a collaborator.</para>
+///
+/// <para>Deliberately two members and no more. This is not a filesystem abstraction: writes,
+/// enumeration and metadata stay on <see cref="System.IO.File"/> and <see cref="System.IO.Directory"/>
+/// where their callers already are. It covers exactly the reads whose ORDER or FAILURE a test needs
+/// to pin.</para>
+/// </summary>
+public interface IFileSystemReader
+{
+    /// <summary>
+    /// The file's length in bytes, or <see langword="null"/> when it does not exist or is not a file.
+    /// Answers for the instant it is asked and nothing later -- a caller that then opens the file
+    /// still handles failure.
+    /// </summary>
+    long? TryGetLength(string absolutePath);
+
+    /// <summary>
+    /// Opens the file for reading. Throws exactly what <see cref="System.IO.File.OpenRead"/> throws;
+    /// callers on this path treat a failure as a skipped file, never as a failed run.
+    /// </summary>
+    Stream OpenRead(string absolutePath);
+}
+
+/// <summary>
+/// <see cref="IFileSystemReader"/> over the real filesystem -- the default everywhere in production,
+/// and the reason every seam parameter can carry a default rather than ripple through call sites.
+/// </summary>
+public sealed class SystemFileReader : IFileSystemReader
+{
+    /// <summary>The single shared instance; the type is stateless.</summary>
+    public static SystemFileReader Instance { get; } = new();
+
+    /// <inheritdoc/>
+    public long? TryGetLength(string absolutePath)
+    {
+        var info = new FileInfo(absolutePath);
+        return info.Exists ? info.Length : null;
+    }
+
+    /// <inheritdoc/>
+    public Stream OpenRead(string absolutePath) => File.OpenRead(absolutePath);
+}
diff --git a/producers/src/OkfProducer.Core/CodeGraph/ResolvedEdge.cs b/producers/src/OkfProducer.Core/CodeGraph/ResolvedEdge.cs
index c2db3f60..c5816c7e 100644
--- a/producers/src/OkfProducer.Core/CodeGraph/ResolvedEdge.cs
+++ b/producers/src/OkfProducer.Core/CodeGraph/ResolvedEdge.cs
@@ -10,7 +10,21 @@ public enum EdgeConfidence
     /// <summary>Matched a target by name alone, with no type/overload information.</summary>
     ByName,
 
-    /// <summary>Matched a target with full symbol/type information (e.g. a Roslyn binding).</summary>
+    /// <summary>
+    /// Matched a target with full symbol/type information (e.g. a Roslyn binding).
+    ///
+    /// <para><b>What the BINDING settled and what this edge can carry are not the same thing.</b>
+    /// <see cref="ResolvedEdge"/> names its target by <c>(TargetContainer, TargetName)</c>, and §3.2
+    /// deliberately merges a method's overloads into ONE concept -- so an exact binding to
+    /// <c>Register(Scanner)</c> and one to <c>Register(Scanner, string)</c> arrive at the same key and
+    /// point at the same concept. That is correct given the merge, and it is also the honest limit of
+    /// this value: <c>Exact</c> says the resolver knew which declaration it meant, not that the bundle
+    /// can express which one.</para>
+    ///
+    /// <para>An explicitly implemented interface member no longer collapses this way -- the extractor
+    /// names it apart from a public member of the same name -- so overload sets are the residual case,
+    /// and the only one.</para>
+    /// </summary>
     Exact,
 }
 
diff --git a/producers/src/OkfProducer.Core/CodeGraph/RunStatus.cs b/producers/src/OkfProducer.Core/CodeGraph/RunStatus.cs
index c3f67391..1f628d25 100644
--- a/producers/src/OkfProducer.Core/CodeGraph/RunStatus.cs
+++ b/producers/src/OkfProducer.Core/CodeGraph/RunStatus.cs
@@ -35,6 +35,20 @@ public sealed record RunStatus(bool TraversalComplete, IReadOnlyList<(string Pat
     /// </summary>
     public bool IsComplete => TraversalComplete && Skipped.All(s => s.Status == FileStatus.Extracted);
 
-    /// <summary>A run in which the traversal completed and every eligible file extracted cleanly.</summary>
+    /// <summary>
+    /// A run in which the traversal completed and every eligible file extracted cleanly.
+    ///
+    /// <para><b>Nothing in <c>producers/src</c> constructs one through this.</b> Grepped, not assumed:
+    /// every production <see cref="RunStatus"/> comes out of <c>CodeGraphBuilder.Build</c> with the
+    /// statuses it actually observed, and the only readers here are this solution's test fixtures,
+    /// which want "a clean run" in one token. Recorded so the next reader does not take it for a
+    /// production path and reason about a code path that has no callers -- the shape this branch has
+    /// been caught by more than once.</para>
+    ///
+    /// <para>Kept rather than moved to the test project, unlike <c>RoslynResolver</c>'s two removed
+    /// summary properties: those made a claim the spec repeated and the code did not honour, while this
+    /// is a factory for the type's own least surprising value, and the fourteen call sites it would
+    /// churn buy nothing.</para>
+    /// </summary>
     public static RunStatus Complete { get; } = new(true, []);
 }
diff --git a/producers/src/OkfProducer.Core/CodeGraph/SymbolFact.cs b/producers/src/OkfProducer.Core/CodeGraph/SymbolFact.cs
index d20655fa..5c554091 100644
--- a/producers/src/OkfProducer.Core/CodeGraph/SymbolFact.cs
+++ b/producers/src/OkfProducer.Core/CodeGraph/SymbolFact.cs
@@ -50,6 +50,26 @@ public sealed record SymbolFact(
     int EndLine,
     string? DocComment)
 {
+    /// <summary>
+    /// Separates a generic type's name from its arity in <see cref="Name"/> (<c>Holder`1</c>).
+    ///
+    /// <para><b>It lives here, in Core, because it is a contract BETWEEN the two engines</b> -- the
+    /// same reason <c>Utf8Offsets</c> does. Both the tree-sitter extractor and the Roslyn resolver
+    /// spell a generic type's name this way, and they join on that spelling; a copy in each that drifts
+    /// does not lose a call, it credits it to another symbol.</para>
+    ///
+    /// <para><b>A backtick because it cannot occur in a C# identifier</b> -- not through <c>@</c>, not
+    /// through a Unicode escape -- which is what makes the qualification injective. The first version
+    /// used <c>_N</c>, chosen so a reader could tell "arity 1" from the registry's "second thing called
+    /// Foo" (<c>-2</c>). Both characters are in the identifier alphabet, so a type genuinely named
+    /// <c>Holder_1</c> and one named <c>Holder&lt;T&gt;</c> produced the same <see cref="Name"/>,
+    /// grouped as one concept, and were emitted with both signatures under one description -- exactly
+    /// the merge this qualification exists to prevent, reachable from legal C#. The backtick is also
+    /// the CLR's own arity convention, and <c>ConceptId.Slugify</c> maps it to <c>-</c>, so the emitted
+    /// id is <c>holder-1</c> while a real <c>Holder_1</c> stays <c>holder_1</c>.</para>
+    /// </summary>
+    public const char ArityMarker = '`';
+
     /// <summary>
     /// The line carrying the end of this declaration's <b>header</b> -- the opening brace of its body
     /// where it has one, the declaration's own last line where it does not -- or <see langword="null"/>
@@ -74,4 +94,28 @@ public sealed record SymbolFact(
     /// header line recorded, so use the full span".</para>
     /// </summary>
     public int? HeaderEndLine { get; init; }
+
+    /// <summary>
+    /// The namespace part of <see cref="Container"/> -- a dotted prefix of it -- or
+    /// <see langword="null"/> when the extractor did not record one.
+    ///
+    /// <para><b>What it separates, and why <see cref="Container"/> alone cannot.</b>
+    /// <c>Container</c> is a flat dotted string, so a type nested inside <c>Bar</c> and a top-level
+    /// type in the namespace <c>Foo.Bar</c> both report <c>"Foo.Bar"</c> -- two structurally different
+    /// parents spelled identically. The consequence was measured: with a class <c>Bar</c> in namespace
+    /// <c>Foo</c> and a class <c>Baz</c> in namespace <c>Foo.Bar</c>, <c>Baz</c> was emitted at
+    /// <c>code/csharp/foo/bar/baz</c>, as though it were nested inside the type. §3.3 enumerated two
+    /// residual collisions; this was a third.
+    ///
+    /// The extractor knows the difference -- it walks ancestors and sees a namespace node in one case
+    /// and a type node in the other -- and the flattening threw it away. Recording where the namespace
+    /// STOPS is enough to recover it: a group's parent is a namespace exactly when the parent's depth
+    /// equals the namespace's.</para>
+    ///
+    /// <para>An <c>init</c> property defaulting to <see langword="null"/> for the same reason as
+    /// <see cref="HeaderEndLine"/>: every fixture in this solution constructs a <see cref="SymbolFact"/>
+    /// positionally with no syntax tree to read this from, and <see langword="null"/> means "not
+    /// recorded", which the generator treats exactly as it behaved before this existed.</para>
+    /// </summary>
+    public string? ContainerNamespace { get; init; }
 }
diff --git a/producers/src/OkfProducer.Core/CodeGraph/Utf8Offsets.cs b/producers/src/OkfProducer.Core/CodeGraph/Utf8Offsets.cs
index 398ed2d4..f362fc95 100644
--- a/producers/src/OkfProducer.Core/CodeGraph/Utf8Offsets.cs
+++ b/producers/src/OkfProducer.Core/CodeGraph/Utf8Offsets.cs
@@ -57,6 +57,20 @@ public static int ToUtf8(string text, int utf16Offset)
             throw new ArgumentOutOfRangeException(nameof(utf16Offset), utf16Offset, "must be within the text.");
         }
 
+        // An offset splitting a surrogate pair is REFUSED rather than converted, because converting it
+        // silently returns a plausible wrong number: the span then ends on a lone high surrogate,
+        // which `GetByteCount` runs through the replacement fallback and scores as 3 bytes -- neither
+        // the 0 of the codepoint's start nor the 4 of its end. This type is a JOIN KEY between two
+        // engines, so a wrong number here does not lose a call site, it credits the call to whatever
+        // sits a few bytes away (§2.1). The class summary says both engines only ever produce
+        // boundary offsets; this is that assumption made checkable instead of merely stated.
+        if (utf16Offset > 0 && utf16Offset < text.Length
+            && char.IsHighSurrogate(text[utf16Offset - 1]) && char.IsLowSurrogate(text[utf16Offset]))
+        {
+            throw new ArgumentOutOfRangeException(
+                nameof(utf16Offset), utf16Offset, "splits a surrogate pair, so it names no codepoint boundary.");
+        }
+
         return Encoding.UTF8.GetByteCount(text.AsSpan(0, utf16Offset));
     }
 
@@ -77,9 +91,22 @@ public static int ToUtf16(string text, int utf8Offset)
         var utf16Index = 0;
         var utf8Count = 0;
 
+        // `==`, not `>=`, and that one character is the whole fix. With `>=`, an offset landing INSIDE
+        // a multi-byte sequence silently rounded UP to the next boundary and returned it: on
+        // `"A\U0001D11EB"` an offset of 2 -- one byte into the four-byte codepoint -- came back as 3,
+        // the index of the `B` after it.
+        //
+        // The example carried a trailing `B` for a reason this comment first got wrong, citing the
+        // two-rune `"A\U0001D11E"` instead. Rounding up needs a rune AFTER the multi-byte sequence to
+        // round up TO: without one the loop runs out and the old code threw rather than answering, so
+        // the shorter string demonstrates the opposite of the failure being described. Measured both
+        // ways before rewriting this.
+        //
+        // A plausible wrong number out of a join key credits a call to a neighbouring symbol rather
+        // than losing it, which §2.1 calls the worse of the two.
         foreach (var rune in text.EnumerateRunes())
         {
-            if (utf8Count >= utf8Offset)
+            if (utf8Count == utf8Offset)
             {
                 return utf16Index;
             }
@@ -88,11 +115,18 @@ public static int ToUtf16(string text, int utf8Offset)
             utf16Index += rune.Utf16SequenceLength;
         }
 
-        if (utf8Count != utf8Offset)
+        if (utf8Count == utf8Offset)
         {
-            throw new ArgumentOutOfRangeException(nameof(utf8Offset), utf8Offset, "beyond the end of the text.");
+            return utf16Index;
         }
 
-        return utf16Index;
+        // Overshooting means the offset fell inside a sequence; falling short means it is past the end.
+        // Two different mistakes on the caller's side, told apart so the message names the real one.
+        throw new ArgumentOutOfRangeException(
+            nameof(utf8Offset),
+            utf8Offset,
+            utf8Count < utf8Offset
+                ? "beyond the end of the text."
+                : "does not land on a codepoint boundary.");
     }
 }
diff --git a/producers/src/OkfProducer.Core/Generation/BundleDrift.cs b/producers/src/OkfProducer.Core/Generation/BundleDrift.cs
index 3ce6e4b0..9e6c9e89 100644
--- a/producers/src/OkfProducer.Core/Generation/BundleDrift.cs
+++ b/producers/src/OkfProducer.Core/Generation/BundleDrift.cs
@@ -237,7 +237,10 @@ public static class BundleDrift
         + "does not make a link invisible. Where regenerating writes a concept at the link's own path, "
         + "that path is reported as drift, in a sentence saying a link is what the bundle holds there; "
         + "where it writes concepts UNDER a linked directory, each of them is reported. Every skipped "
-        + "link the differences do not already name is reported as a note.";
+        + "link the differences do not already name is reported as a note. One case a clean result "
+        + "does NOT cover: `revision` names the committed HEAD, never the working tree, so with "
+        + "uncommitted local edits both sides carry the same revision and the check can report no "
+        + "drift for a bundle neither side was generated from.";
 
     /// <summary>
     /// Copies the bundle at <paramref name="bundlePath"/> into a temporary directory, hands that copy
diff --git a/producers/src/OkfProducer.Core/Generation/BundleWriter.cs b/producers/src/OkfProducer.Core/Generation/BundleWriter.cs
index 9cddf0e5..1ac182ff 100644
--- a/producers/src/OkfProducer.Core/Generation/BundleWriter.cs
+++ b/producers/src/OkfProducer.Core/Generation/BundleWriter.cs
@@ -262,7 +262,15 @@ public WriteResult Write(
                     + " Remove the link, or generate into a bundle that does not contain one.");
             }
 
-            ReportUnownedFiles(outPath, manifest.OwnedPrefix, manifest, previous, notes);
+            // `merged`, not `manifest`: the difference is exactly the ids that FAILED to write, and
+            // handing over the pre-merge set made this method treat each of them as owned. A file
+            // sitting at a failed id's path -- which is where a hand-written concept is most likely to
+            // be, since the failure is often the filesystem refusing to overwrite it -- was therefore
+            // the one file §6.3 rule 2 exists to report and the one this report stayed silent about.
+            //
+            // Same set the manifest records, for the same reason it records it: ownership is what
+            // authorizes deletion, so anything not owned is what an operator needs named.
+            ReportUnownedFiles(outPath, merged.OwnedPrefix, merged, previous, notes);
         }
 
         // Not gated HERE, and it does not need to be: IndexGenerator gates itself. A previous round of
@@ -380,7 +388,13 @@ private static ReconcileOutcome Reconcile(
 
         if (RefusalToPrune(manifest, status, previous, repoPath, failureCount) is { } refusal)
         {
-            notes.Add($"{candidates.Count} concept(s) this run did not generate were kept: {refusal}");
+            // Named by their prefix rather than counted bare. The count is correct -- a review filed it
+            // as a miscount and it is not -- but on `--update --no-code` it is EVERY code concept the
+            // previous run claimed, so a bare "678 concept(s) this run did not generate" reads as a
+            // loss report on a run that wrote thirty concepts perfectly well. Saying which family they
+            // are is what turns an alarming true number into a useful one.
+            notes.Add(
+                $"{candidates.Count} concept(s) under '{previous.OwnedPrefix}' that this run did not generate were kept: {refusal}");
             return new ReconcileOutcome([], candidates);
         }
 
@@ -418,7 +432,18 @@ private static ReconcileOutcome Reconcile(
             {
                 // No owner means no way to tell a deleted symbol from an unread file, and the safe
                 // reading of "I cannot tell" is always "keep".
+                //
+                // SAID, where it used to be done silently. The sibling branch immediately above notes
+                // its carry and this one did not, so the two identical outcomes were distinguishable
+                // only by which of them the operator heard about. And this is not a shape only a
+                // hand-edited manifest can reach: `ReadStrings` answers `[]` for a truncated or
+                // malformed sources list rather than rejecting the manifest, so a run interrupted while
+                // writing one leaves every candidate looking source-less on the next run -- a bundle
+                // that quietly stops pruning, with nothing said.
                 carried.Add(candidate);
+                notes.Add(
+                    $"'{candidate.Id}' records no source file in the previous manifest, so this run cannot"
+                    + " tell a deleted symbol from an unread file; it was kept.");
                 continue;
             }
 
@@ -870,9 +895,21 @@ private static void RemoveEmptyDirectories(string outPath, string ownedPrefix, I
 
     /// <summary>
     /// Whether <paramref name="directory"/> is the owned prefix's own directory or one nested inside
-    /// it. Compares path components rather than raw string prefixes, so a sibling directory whose name
-    /// merely starts with the prefix (<c>code2/</c> beside <c>code/</c>) is not walked into and
-    /// deleted.
+    /// it. Compares path components rather than raw string prefixes.
+    ///
+    /// <para><b>What it actually stops: the walk climbing ABOVE the owned prefix.</b>
+    /// <see cref="RemoveEmptyDirectories"/> starts at a pruned concept's directory and moves upward one
+    /// parent at a time, so this is the sole condition standing between a
+    /// <c>Directory.Delete(recursive: true)</c> and the bundle root. It is the most destructive
+    /// statement on this branch, and until
+    /// <c>PruningTests.The_directory_ladder_stops_at_the_owned_prefix_root_and_not_above_it</c> it was
+    /// on no test's critical path -- every other fixture left a sibling that broke the loop one rung in.
+    ///
+    /// <para>This comment used to describe a different scenario: a sibling directory whose name merely
+    /// starts with the prefix (<c>code2/</c> beside <c>code/</c>) being walked into and deleted. That
+    /// cannot happen and never could -- the walk only ever goes upward, so it never reaches a sibling
+    /// at all. The component comparison is still the right implementation; it just was not defending
+    /// against the thing the comment named.</para></para>
     /// </summary>
     private static bool IsWithinPrefixRoot(string directory, string prefixRoot) =>
         string.Equals(directory, prefixRoot, PathComparison)
diff --git a/producers/src/OkfProducer.Core/Generation/CodeConceptIds.cs b/producers/src/OkfProducer.Core/Generation/CodeConceptIds.cs
index b09be906..1cbd8baf 100644
--- a/producers/src/OkfProducer.Core/Generation/CodeConceptIds.cs
+++ b/producers/src/OkfProducer.Core/Generation/CodeConceptIds.cs
@@ -192,6 +192,13 @@ private static string SplitWordBoundaries(string input)
 
             // Rule 3: digit -> upper marks the start of the next word (Utf8Offsets -> Utf8-Offsets).
             // upper -> digit and lower -> digit are deliberately NOT boundaries (OKF4net stays whole).
+            //
+            // `_` is NOT a boundary either, and that is a decision rather than an omission a review
+            // should keep re-finding. `MAX_VALUE` slugifies to `max_value`, not `max-value`, because
+            // `_` is a valid concept-id character (ConceptId.ValidateSegment admits it) and the
+            // underscore the author wrote is information about the name rather than punctuation this
+            // producer invented. Splitting on it would also make `_field` and `Field` collide, which
+            // the three rules above exist to avoid rather than create.
             var digitToUpper = char.IsUpper(c) && char.IsDigit(prev);
 
             if (lowerToUpper || acronymBoundary || digitToUpper)
@@ -214,6 +221,23 @@ private static string SplitWordBoundaries(string input)
 /// register them in <see cref="StringComparer.Ordinal"/> order of their original (pre-slugify) name
 /// so the numeric tie-break (§3.3) is stable across a file move or a line shift, not dependent on
 /// scan order.
+///
+/// <para><b>What that stability does NOT cover, stated because the sentence above reads wider than it
+/// is.</b> The suffix is positional: among colliding candidates the Ordinal-first keeps the bare slug
+/// and the rest take <c>-2</c>, <c>-3</c>. So adding a candidate that sorts BEFORE an existing one
+/// renumbers the existing one -- <c>parse</c> becomes <c>parse-2</c> without its own declaration
+/// having changed -- which is the id churn §3.1 treats as unrecoverable, one level up from the
+/// overload merge that exists to prevent exactly this. A file move does not do it; a new sibling
+/// does.</para>
+///
+/// <para>Left as it stands rather than fixed, and the accounting is why. Closing it means suffixing by
+/// something intrinsic to the symbol instead of by position, which moves every already-suffixed id
+/// once -- churn now, to prevent churn later. Measured at ZERO occurrences on this repository and on
+/// the fixture: C#'s residual collisions are case-only pairs and a nested type sharing a member's
+/// name, and neither occurs here. §3.3 says the rule exists for Go and JS, where it is common -- and
+/// no profile for either exists yet, nor can one land without the wider work
+/// <c>producers/README.md</c> prices under "Adding a second language". That is when to pay for this,
+/// with a real corpus to measure the trade against.</para>
 /// </summary>
 public sealed class ConceptIdRegistry
 {
diff --git a/producers/src/OkfProducer.Core/Generation/ConceptGenerator.cs b/producers/src/OkfProducer.Core/Generation/ConceptGenerator.cs
index 3e7ee7dc..b18c7317 100644
--- a/producers/src/OkfProducer.Core/Generation/ConceptGenerator.cs
+++ b/producers/src/OkfProducer.Core/Generation/ConceptGenerator.cs
@@ -6,6 +6,13 @@
 using OkfProducer.Core.CodeGraph;
 using OkfProducer.Core.Scanning;
 
+// The text layer lives in LiftedMarkdown.cs. Every transform applied to text this producer did not
+// author is a pure string function whose correctness is argued against `LinkScanner`, not against
+// anything in this file, and reading the two rule sets side by side is the whole point of the split.
+// Imported statically so the call sites below read exactly as they did before the move: the seam is
+// for whoever has to compare those rules, not a new spelling to learn here.
+using static OkfProducer.Core.Generation.LiftedMarkdown;
+
 // In any namespace with a sibling `CodeGraph` NAMESPACE in scope -- OkfProducer.Core.Generation has
 // OkfProducer.Core.CodeGraph, and OkfProducer.Tests.Generation has OkfProducer.Tests.CodeGraph -- the
 // bare name binds to that namespace before it can bind to the type of the same name a `using` brought
@@ -151,7 +158,7 @@ public IReadOnlyList<GeneratedConcept> Generate(RepositorySnapshot snapshot, Cod
         var revision = GitRevision.HeadSha(snapshot.RepoPath);
         results.Add(new GeneratedConcept(
             overviewId,
-            BuildOverview(snapshot, overviewChildren, generatedAt, revision, options.ExistingFrontmatter?.Invoke(overviewId))));
+            BuildOverview(snapshot, overviewChildren, generatedAt, revision, options.ExistingFrontmatter?.Invoke(overviewId), options.EngineVersions)));
 
         foreach (var (id, manifest) in packages)
         {
@@ -249,7 +256,8 @@ private static OkfDocument BuildOverview(
         IReadOnlyList<Child> children,
         string generatedAt,
         string? revision,
-        Frontmatter? existing)
+        Frontmatter? existing,
+        IReadOnlyList<string> engineVersions)
     {
         var derived = snapshot.Packages.Count switch
         {
@@ -263,6 +271,19 @@ private static OkfDocument BuildOverview(
         var body = new StringBuilder();
         body.Append("# ").Append(LiftedBodyText(snapshot.RepoName)).Append("\n\n")
             .Append(LiftedBodyParagraph(description, preserved)).Append('\n');
+
+        // The dirty-tree caveat, where a READER of the bundle is rather than only in a code comment.
+        // `revision` names the committed HEAD and never the working tree, so with uncommitted edits at
+        // generation time it names a commit this bundle was not built from -- and `--check` cannot see
+        // the difference either, since both sides carry the same revision. Emitted only when there is a
+        // revision to qualify: outside a git repository the field is absent and there is nothing to
+        // warn about.
+        if (revision is { Length: > 0 })
+        {
+            body.Append("\nThe `revision` above names the committed HEAD, not the working tree: if the repository had "
+                + "uncommitted changes when this bundle was generated, that commit is not what it was generated from.\n");
+        }
+
         AppendContains(body, children);
 
         var builder = OkfDocumentBuilder
@@ -279,9 +300,33 @@ private static OkfDocument BuildOverview(
         // generated in one pass, and a per-concept timestamp would store the same fact hundreds of
         // times over, rewriting every file's `generated.at` on every regeneration regardless of what in
         // the code actually changed.
+        // §6.2: the extraction engines are named here and nowhere else in the bundle. Determinism holds
+        // at a FIXED extractor version, not absolutely -- a grammar or Roslyn bump can move symbols,
+        // spans and descriptions over unchanged source -- so a golden that moved is uninterpretable
+        // unless the artefact says which engines produced it. A run given none (every fixture, and
+        // --no-code) emits the producer key alone.
+        //
+        // THE ENGINES ARE A SIBLING KEY, NOT PART OF `by`, and the difference is conformance rather
+        // than taste. §5.2 makes `generated.by` an actor, and §7 defines an actor as ONE of exactly
+        // three forms -- `<producer>/<version>`, `human:<id>`, `process:<id>`. This used to write
+        // `okfgen/0.1.0 tree-sitter/1.3.0 roslyn/5.3.0`, which is none of them, and the failure was
+        // silent in the worst way: `OKF4net.Actor.Parse` splits on the FIRST `/`, so it returned
+        // `IsWellFormed: true` with `Version` = "0.1.0 tree-sitter/1.3.0 roslyn/5.3.0". The validator
+        // warns only on a malformed actor (`Validate.cs`), so `okf validate` called the bundle clean
+        // while every consumer reading the version off this producer's own artefact got a three-token
+        // string naming no release of anything.
+        //
+        // `engines` keeps §6.2's property without touching the actor: OKF frontmatter preserves
+        // producer keys it does not know across a round-trip (`Frontmatter` wraps an order-preserving
+        // `YamlMapping` rather than a fixed DTO), so the provenance survives and `by` stays an actor.
         var generated = new YamlMapping();
         generated.Insert("by", new YamlString(ProducerActor));
         generated.Insert("at", new YamlString(generatedAt));
+        if (engineVersions.Count > 0)
+        {
+            generated.Insert("engines", new YamlSequence([.. engineVersions.Select(v => new YamlString(v))]));
+        }
+
         builder = builder.Extension("generated", generated);
 
         // `revision` is the exact sha, a sibling of `generated` rather than nested inside it -- distinct
@@ -396,15 +441,6 @@ preservedSource is null
             ? builder
             : builder.Extension(DescriptionResolver.DescriptionSourceKey, new YamlString(preservedSource));
 
-    /// <summary>
-    /// A <see cref="LiftedBodyParagraph"/> that respects <paramref name="preservedSource"/>: text this
-    /// producer derived is neutralized, text the author wrote in the bundle is left as written apart from
-    /// an unclosed fence. The same rule <see cref="BodyDescription"/> applies to the <c>code/</c> family,
-    /// keyed the same way, so two concepts with identical text cannot behave differently.
-    /// </summary>
-    private static string LiftedBodyParagraph(string text, string? preservedSource) =>
-        preservedSource is null ? LiftedBodyParagraph(text) : DefuseLeadingFenceOnly(text);
-
     /// <summary>
     /// The description source for a family whose text is a projection of repository metadata: it always
     /// produces, and the label it produces is dropped rather than written (see
@@ -537,6 +573,7 @@ private static CodeFamily BuildCodeConcepts(
             .ToList();
 
         DisambiguateSharedRawPaths(groups);
+        DisambiguateNamespacesAgainstTypes(groups, language => ProfileFor(language, options, profiles));
 
         // A call site names its caller as (container, name) and its target as (container, name) -- and
         // CallSite carries no language at all. Both joins below are therefore language-agnostic, which is
@@ -1215,7 +1252,19 @@ private static string BuildCodeBody(
                 // Defensive: CodeGraph guarantees a resolved target exists in Symbols, so the lookup
                 // above cannot miss. If it ever did, rendering text is the safe direction -- a link to
                 // a concept that was never generated is a broken link in the user's bundle.
-                unresolved.Add($"- {CodeSpan(edge.Site.CalledName)}");
+                //
+                // The RESOLVED name where there is one, not the call site's. Both are available here,
+                // and they are not equally useful: `CalledName` is the bare identifier as written at
+                // the call (`Get`), while a resolver that got far enough to name a target knows which
+                // `Get` it meant. Falling back to the less informative of the two, in the branch that
+                // only runs when something has already gone wrong, throws away the diagnosis exactly
+                // where a reader needs it most.
+                unresolved.Add($"- {CodeSpan(
+                    edge.Confidence != EdgeConfidence.Unresolved && edge.TargetName is { } resolvedName
+                        ? edge.TargetContainer is { Length: > 0 } resolvedContainer
+                            ? $"{resolvedContainer}.{resolvedName}"
+                            : resolvedName
+                        : edge.Site.CalledName)}");
             }
         }
 
@@ -1275,7 +1324,7 @@ private static OkfDocument BuildContainerConcept(
     /// the split direction only and a title is prose, not an id.
     /// </summary>
     private static string ContainerTitle(string[] segments) =>
-        segments.Length <= MinimumContainerDepth ? segments[^1] : $"{segments[^2]}.{segments[^1]}";
+        segments.Length <= MinimumContainerDepth ? SegmentName(segments[^1]) : $"{SegmentName(segments[^2])}.{SegmentName(segments[^1])}";
 
     /// <summary>
     /// A container rendered as a <see cref="SymbolFact"/> <b>for the description chain only</b>, so a
@@ -1297,8 +1346,8 @@ private static string ContainerTitle(string[] segments) =>
     private static SymbolFact ContainerFact(string[] segments) => new(
         SymbolKind.Namespace,
         Language: segments[1],
-        Container: string.Join('.', segments[2..^1]),
-        Name: segments[^1],
+        Container: string.Join('.', segments[2..^1].Select(SegmentName)),
+        Name: SegmentName(segments[^1]),
         Signature: string.Empty,
         SymbolVisibility.Public,
         RelativePath: string.Empty,
@@ -1308,484 +1357,6 @@ private static string ContainerTitle(string[] segments) =>
         EndLine: 0,
         DocComment: null);
 
-    /// <summary>
-    /// Any text this producer <b>lifted from outside the bundle</b> and renders into a body -- a
-    /// repository or package name, a README's own <c>#</c> heading, a <c>.csproj</c>
-    /// <c>&lt;Description&gt;</c>, a doc comment -- with its markdown link syntax neutralized.
-    ///
-    /// <para><b>The test is where the text was authored FOR, not who typed it.</b> A NuGet
-    /// <c>&lt;Description&gt;</c> and a README heading are written by humans, but for NuGet and for
-    /// GitHub; nobody writing either means a link relative to a bundle that did not exist yet. So from
-    /// the bundle's point of view they are derived, exactly as a doc comment is, and rendering
-    /// <c>[docs](guide)</c> or <c>[Guide](docs/guide.md)</c> from one of them verbatim manufactures a
-    /// link the author never wrote. Only text authored <i>in</i> the bundle is exempt, and
-    /// <c>description_source</c> is what says so -- see <see cref="BodyDescription"/>.</para>
-    ///
-    /// <para>A no-op for text that cannot contain the syntax, which is most of it: a C# identifier, a
-    /// dotted type name. Applied uniformly all the same, because a per-family exception is exactly how
-    /// two concepts with identical text end up behaving differently.</para>
-    /// </summary>
-    private static string LiftedBodyText(string text) => NeutralizeMarkdownLinks(text);
-
-    /// <summary>
-    /// <see cref="LiftedBodyText"/> for lifted text that <b>begins a paragraph</b> in the body: it
-    /// additionally escapes a leading block-construct marker, so a description cannot silently stop
-    /// being a paragraph and start being a heading, a list item or a block quote.
-    ///
-    /// <para><b>Bounded on purpose: one character, at the start of a line.</b> The only thing that can
-    /// change a line's block type is its first non-space character -- <c>#</c>, <c>-</c>, <c>*</c>,
-    /// <c>+</c>, <c>&gt;</c>, a run of 3+ backticks or tildes (a fenced code block), or a run of digits
-    /// followed by <c>.</c> or <c>)</c>. This is deliberately not a general markdown escaper: everything
-    /// further into the line is inline markup, which renders as the author's own emphasis and is none of
-    /// this producer's business. CommonMark renders <c>\#</c> as <c>#</c>, so the reader sees exactly
-    /// what was written.</para>
-    ///
-    /// <para><b>A marker only counts when a space, a tab or the line's end follows it</b> -- which is
-    /// CommonMark's own rule and not a refinement of it. Escaping unconditionally would rewrite ordinary
-    /// emphasis: <c>*fast* and small.</c> would become <c>\*fast* and small.</c> and render its asterisks
-    /// literally, this guard corrupting the prose it exists to protect. <c>&gt;</c> and a fence are the
-    /// exceptions the spec itself makes: <c>&gt;text</c> is a block quote with no space at all, and an
-    /// info string may sit right against a fence (<c>```csharp</c>).</para>
-    ///
-    /// <para><b>An unbalanced fence has a consumer, not just a renderer, to answer to.</b> A leading
-    /// ``` or <c>~~~</c> left undefused makes <see cref="OKF4net.LinkScanner"/>.<c>ExtractLinks</c> skip
-    /// every line after it as code -- so a description whose fence is never closed (ordinary: it is only
-    /// a description, not a whole document) silently hides the rest of this concept's own body, links
-    /// included, from the very scanner that resolves them.</para>
-    ///
-    /// <para><b>Every line, not only the first.</b> A <c>.csproj</c> <c>&lt;Description&gt;</c> reaches
-    /// a body with its newlines intact, so a <c>- </c> opening line 2 starts a list exactly as it would
-    /// opening line 1 -- a guarantee stated for "the description" has to hold for all of it, or the
-    /// documentation and the code disagree about which half is covered.</para>
-    ///
-    /// <para><b>For an ordered-list marker the delimiter is escaped, not the digit</b>, and the two are
-    /// not interchangeable: <c>\1.</c> renders a literal backslash, because a backslash escape is only
-    /// defined for ASCII punctuation, while <c>1\.</c> renders <c>1.</c> and forms no list.</para>
-    ///
-    /// <para>The sharpest case is <c>#</c>. A description that opens a heading is a rendering fault on
-    /// its own, and <c>LinkScanner.ExtractCitations</c> reads a heading whose title is exactly
-    /// <c>Citations</c> as §13.1's legacy citations marker -- a structural claim about the concept,
-    /// made by text its author wrote for a compiler.</para>
-    /// </summary>
-    private static string LiftedBodyParagraph(string text) => EscapeLeadingBlockMarker(LiftedBodyText(text));
-
-    /// <summary>
-    /// Escapes the one character that would make <paramref name="text"/> open a markdown block, or
-    /// returns it unchanged when it opens none. See <see cref="LiftedBodyParagraph"/> for the bound.
-    /// </summary>
-    private static string EscapeLeadingBlockMarker(string text)
-    {
-        // Every line, not only the first: a `.csproj` <Description> reaches a body with its newlines
-        // intact, and a `- ` opening line 2 starts a list exactly as it would opening line 1. Splitting
-        // on `\n` and keeping any `\r` with the line leaves the text byte-identical apart from the
-        // escapes themselves.
-        var lines = text.Split('\n');
-        for (var i = 0; i < lines.Length; i++)
-        {
-            lines[i] = EscapeLineBlockMarker(lines[i]);
-        }
-
-        return string.Join('\n', lines);
-    }
-
-    private static string EscapeLineBlockMarker(string line)
-    {
-        var start = LeadingWhitespaceEnd(line);
-        if (start >= line.Length)
-        {
-            return line;
-        }
-
-        // A block quote is the one marker CommonMark does not require a space after: `>text` quotes.
-        if (line[start] == '>')
-        {
-            return line.Insert(start, "\\");
-        }
-
-        if (TryEscapeLeadingFence(line, start, out var fenced))
-        {
-            return fenced;
-        }
-
-        // A line that is nothing but one repeated marker is a thematic break (`---`, `***`, `___`) or a
-        // setext underline (`---`, `===`), and a setext underline retitles the paragraph ABOVE it -- a
-        // block-type change made to a line the guard already passed. It is checked before the bullet
-        // rule because the space requirement below, correct for `- item`, is exactly what lets these
-        // through.
-        if (IsMarkerOnlyLine(line, start))
-        {
-            return line.Insert(start, "\\");
-        }
-
-        // A bullet or an ATX heading marker only opens a block when a space (or the line's end) follows
-        // it. Without that check this escapes ordinary emphasis: `*fast* and small.` would become
-        // `\*fast* and small.`, which renders the asterisks literally -- the method damaging the prose
-        // it is here to protect.
-        if (line[start] is '-' or '*' or '+')
-        {
-            return IsBlockMarkerBoundary(line, start + 1) ? line.Insert(start, "\\") : line;
-        }
-
-        if (line[start] == '#')
-        {
-            var hashes = start;
-            while (hashes < line.Length && line[hashes] == '#')
-            {
-                hashes++;
-            }
-
-            // Seven or more `#` is not a heading at all, so there is nothing to defuse.
-            return hashes - start <= 6 && IsBlockMarkerBoundary(line, hashes)
-                ? line.Insert(start, "\\")
-                : line;
-        }
-
-        if (!char.IsAsciiDigit(line[start]))
-        {
-            return line;
-        }
-
-        // An ordered-list marker: digits, then `.` or `)`, then the same boundary. The DELIMITER is
-        // escaped, never the digit -- see this method's caller.
-        var delimiter = start;
-        while (delimiter < line.Length && char.IsAsciiDigit(line[delimiter]))
-        {
-            delimiter++;
-        }
-
-        return delimiter < line.Length
-            && line[delimiter] is '.' or ')'
-            && IsBlockMarkerBoundary(line, delimiter + 1)
-                ? line.Insert(delimiter, "\\")
-                : line;
-    }
-
-    /// <summary>
-    /// The index of the first non-whitespace character in <paramref name="line"/> (or its length, if
-    /// there is none), where <b>whitespace means <see cref="char.IsWhiteSpace(char)"/></b> -- NBSP, form
-    /// feed, vertical tab and U+2028 included, not the <c>' '</c>/<c>'\t'</c> pair CommonMark allows
-    /// before a block marker.
-    ///
-    /// <para><b>The consumer's definition is the authoritative one, and the consumer is
-    /// <see cref="OKF4net.LinkScanner"/>.</b> Its <c>CodeFreeLines</c> decides a line opens a fenced code
-    /// block by <c>TrimStart()</c>, which trims every <c>char.IsWhiteSpace</c>. So a description line
-    /// beginning with an NBSP and then ``` was not defused here while it did open a fence there -- after
-    /// which the scanner skipped every following line, this concept's own <c>## Contains</c> and
-    /// <c>## Calls</c> included. Two definitions of "leading whitespace" is precisely how a branch gets
-    /// severed with nothing dangling for <c>okf validate</c> to see, and the same reasoning that makes
-    /// <see cref="NeutralizeMarkdownLinks"/> mirror <c>BlankInlineCode</c> rather than CommonMark applies
-    /// here: this has to agree with the consumer, not with a spec.</para>
-    ///
-    /// <para>The wider class is safe for the markers that only affect <i>rendering</i>
-    /// (<see cref="EscapeLineBlockMarker"/>'s others), because CommonMark does not admit them behind an
-    /// NBSP either: the line was already a paragraph, and the escape it now gets renders identically to
-    /// the character it protects (<c>\-</c> is <c>-</c>). It can add a redundant escape; it cannot
-    /// change what a reader sees.</para>
-    /// </summary>
-    private static int LeadingWhitespaceEnd(string line)
-    {
-        var start = 0;
-        while (start < line.Length && char.IsWhiteSpace(line[start]))
-        {
-            start++;
-        }
-
-        return start;
-    }
-
-    /// <summary>
-    /// Escapes a leading run of 3+ backticks or tildes at <paramref name="start"/> -- a fenced code
-    /// block opener -- and reports whether it did. CommonMark requires no following space (an info
-    /// string may sit right against it, `` ```csharp ``), so this is unconditional, like a block quote.
-    ///
-    /// <para><b>Why an unbalanced fence is dangerous, not just ugly.</b> Left undefused, a fence with no
-    /// matching close anywhere later in the same body -- ordinary when the text is only a description,
-    /// not a whole document -- makes <see cref="OKF4net.LinkScanner"/>.<c>ExtractLinks</c> skip every
-    /// line after it as code, silently hiding this concept's own outgoing links (<c>## Contains</c>,
-    /// <c>## Calls</c>) from the very scanner that resolves them. Nothing dangles, so <c>okf validate</c>
-    /// stays silent while the branch is simply severed -- which is why <see cref="BodyDescription"/>
-    /// defuses this one marker even on text it otherwise leaves untouched (see its own remarks).</para>
-    /// </summary>
-    private static bool TryEscapeLeadingFence(string line, int start, out string escaped)
-    {
-        if (line[start] is '`' or '~')
-        {
-            var fenceMarker = line[start];
-            var run = start;
-            while (run < line.Length && line[run] == fenceMarker)
-            {
-                run++;
-            }
-
-            if (run - start >= 3)
-            {
-                escaped = line.Insert(start, "\\");
-                return true;
-            }
-        }
-
-        escaped = line;
-        return false;
-    }
-
-    /// <summary>
-    /// Whether position <paramref name="index"/> ends a block marker: a space, a tab, or the end of the
-    /// line (a bare <c>-</c> on its own line is an empty list item). A <c>\r</c> counts as the end, so a
-    /// CRLF-separated line behaves like an LF-separated one.
-    /// </summary>
-    private static bool IsBlockMarkerBoundary(string line, int index) =>
-        index >= line.Length || line[index] is ' ' or '\t' or '\r';
-
-    /// <summary>
-    /// Whether every non-blank character from <paramref name="start"/> is the same one of
-    /// <c>-</c>, <c>*</c>, <c>_</c>, <c>=</c> -- the shape of a thematic break or a setext underline.
-    /// Requiring one repeated character is CommonMark's own rule and is what keeps this from firing on
-    /// ordinary prose: <c>-*-</c> is neither construct and is left alone.
-    /// </summary>
-    private static bool IsMarkerOnlyLine(string line, int start)
-    {
-        var marker = line[start];
-        if (marker is not ('-' or '*' or '_' or '='))
-        {
-            return false;
-        }
-
-        for (var i = start; i < line.Length; i++)
-        {
-            var c = line[i];
-            if (c is ' ' or '\t' or '\r')
-            {
-                continue;
-            }
-
-            if (c != marker)
-            {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
-    /// <summary>
-    /// A <c>description</c> as it is rendered <b>into a body</b>: neutralized as
-    /// <see cref="LiftedBodyText"/> when this producer derived it, and left exactly as the author wrote
-    /// it when the author wrote it in the bundle.
-    ///
-    /// <para><b>The asymmetry is the whole rule.</b> A <c>[text](dest)</c> inside a C# doc comment is
-    /// doc syntax that merely looks like markdown -- <c>LinkScanner</c>'s own summary in this repository
-    /// contains the literal <c>&lt;c&gt;[text](dest)&lt;/c&gt;</c> -- and the author never meant a
-    /// bundle link. Rendered verbatim it becomes one: measured, that single doc comment was the only
-    /// broken link in a 649-concept bundle generated from this repository. The same syntax in a
-    /// <c>manual</c> or <c>llm</c> description is a link the author meant <i>for this bundle</i>, and
-    /// rewriting it would be editing a human's text.</para>
-    ///
-    /// <para><b>Keyed on <c>description_source</c>, which makes it consistent with §4.2's preservation
-    /// table by construction rather than by coincidence:</b> the set neutralized here --
-    /// <see cref="DocCommentSource.SourceLabel"/> and <see cref="SignatureSource.SourceLabel"/> -- is
-    /// exactly the set <see cref="DescriptionResolver"/> re-derives, and everything it protects is
-    /// left alone. The comparison is <see cref="StringComparison.Ordinal"/> against the two literals,
-    /// where the resolver's own comparison is case-insensitive, and that is correct rather than a
-    /// mismatch: this value is not read off disk, it is whatever <see cref="DescriptionResolver.Resolve"/>
-    /// just returned, and a spelling variant of a derived label can only reach that return as a
-    /// <i>preserved</i> value -- which must not be touched, and is not.</para>
-    ///
-    /// <para>The families with no <c>description_source</c> at all -- <c>packages/*</c>, <c>docs/*</c>,
-    /// <c>overview</c> -- never reach this method: nothing in them is bundle-authored, so they go
-    /// straight through <see cref="LiftedBodyText"/>.</para>
-    ///
-    /// <para><b>One exception to "left exactly as the author wrote it": a leading fence is defused
-    /// regardless of provenance.</b> Every other marker only changes rendering, which is the author's
-    /// choice to make. A fence is different in kind -- <see cref="TryEscapeLeadingFence"/>'s own remarks
-    /// explain why -- and the danger it poses to <c>## Contains</c>/<c>## Calls</c> is the same whether
-    /// the text came from a doc comment or was hand-typed straight into the bundle's frontmatter on a
-    /// prior <c>--update</c>. So a bundle-authored description is defused for a fence and left untouched
-    /// for everything else, rather than skipping <see cref="BodyDescription"/> entirely.</para>
-    /// </summary>
-    private static string BodyDescription(string description, string descriptionSource) =>
-        descriptionSource is DocCommentSource.SourceLabel or SignatureSource.SourceLabel
-            ? LiftedBodyParagraph(description)
-            : DefuseLeadingFenceOnly(description);
-
-    /// <summary>
-    /// Escapes the leading fenced-code-block marker that <b>never closes</b> -- nothing else, including
-    /// every other block marker <see cref="EscapeLeadingBlockMarker"/> also handles, and including a
-    /// fence that is part of a balanced pair. See <see cref="BodyDescription"/> for why a fence alone is
-    /// defused on text this producer otherwise never touches.
-    ///
-    /// <para><b>Balanced pairs are left alone, and that is a correction rather than a relaxation.</b> The
-    /// danger is not a fence, it is a fence <see cref="OKF4net.LinkScanner"/> never closes: on a balanced
-    /// pair the scanner opens the block and closes it again, so every line after the close -- this
-    /// concept's own <c>## Contains</c> and <c>## Calls</c> -- is scanned exactly as it would be with no
-    /// fence at all. Escaping such a pair bought no structural property whatsoever, and it was not free:
-    /// <c>\</c> before ``` renders as a literal backtick followed by a stray two-backtick span opener, so
-    /// the escape destroyed the author's code block rather than blemishing it -- damage done to text this
-    /// method's whole premise is that it must not edit.</para>
-    ///
-    /// <para><b>Which fence is the unclosed one is decided by replaying the scanner's own state machine,
-    /// not by counting.</b> A <c>~~~</c> does not close a ``` block, so parity over all fence-shaped
-    /// lines is the wrong question; and the replay has to be repeated until it settles, because escaping
-    /// the unclosed opener puts the lines it was hiding back in front of the scanner and one of THEM can
-    /// open a fence of its own (``` then <c>~~~</c> is the two-line case). Each pass escapes exactly one
-    /// line and strictly reduces the number of fence-shaped lines, so it terminates.</para>
-    /// </summary>
-    private static string DefuseLeadingFenceOnly(string text)
-    {
-        var lines = text.Split('\n');
-
-        while (UnclosedFenceLine(lines) is { } index)
-        {
-            // The escape always lands: UnclosedFenceLine nominates a line only on the same 3+ run of the
-            // same marker that TryEscapeLeadingFence tests for. Guarded all the same, because the loop's
-            // termination rests on that agreement and a future edit to either could break it silently --
-            // an unescaped fence is the bug this method already has; an infinite loop would be a new one.
-            var start = LeadingWhitespaceEnd(lines[index]);
-            if (!TryEscapeLeadingFence(lines[index], start, out var fenced))
-            {
-                break;
-            }
-
-            lines[index] = fenced;
-        }
-
-        return string.Join('\n', lines);
-    }
-
-    /// <summary>
-    /// The index of the line that opens a fenced code block <see cref="OKF4net.LinkScanner"/> never
-    /// closes, or <see langword="null"/> when every fence in <paramref name="lines"/> is balanced.
-    ///
-    /// <para>A transcription of <c>LinkScanner.CodeFreeLines</c>'s own loop, and deliberately so: the
-    /// question is not what CommonMark makes of these lines, it is what the scanner that resolves this
-    /// bundle's links does with them. Both marker characters are tracked separately, and a closer must
-    /// repeat the marker its opener used.</para>
-    /// </summary>
-    private static int? UnclosedFenceLine(IReadOnlyList<string> lines)
-    {
-        char? fence = null;
-        var opener = 0;
-
-        for (var i = 0; i < lines.Count; i++)
-        {
-            var line = lines[i];
-            var start = LeadingWhitespaceEnd(line);
-            var marker = start < line.Length ? line[start] : '\0';
-            var run = 0;
-            while (start + run < line.Length && line[start + run] == marker)
-            {
-                run++;
-            }
-
-            var isFence = marker is '`' or '~' && run >= 3;
-
-            if (fence is { } open)
-            {
-                if (isFence && marker == open)
-                {
-                    fence = null;
-                }
-
-                continue;
-            }
-
-            if (isFence)
-            {
-                fence = marker;
-                opener = i;
-            }
-        }
-
-        return fence is null ? null : opener;
-    }
-
-    /// <summary>
-    /// Escapes every unescaped <c>]</c>, which neutralizes markdown link <i>syntax</i> while leaving
-    /// every character the reader sees exactly where it was: CommonMark renders <c>\]</c> as <c>]</c>,
-    /// so <c>[text](dest)</c> still reads as <c>[text](dest)</c>.
-    ///
-    /// <para><b>The closing bracket, and not the opening one</b>, because the opening one does not
-    /// work: <c>LinkScanner.ScanLineLinks</c> dispatches on <c>[</c> with no look-back at all, so a
-    /// preceding backslash does not stop it and <c>\[text](dest)</c> would render correctly while still
-    /// being extracted as a link. Its <c>ParseInlineLink</c> does honour a backslash inside the link
-    /// text, where it skips the next character -- so an escaped <c>]</c> never closes the text, the
-    /// bracket depth never returns to zero, and the parse fails. Verified against the scanner itself in
-    /// <c>CodeConceptGeneratorTests</c> rather than reasoned about here alone.</para>
-    ///
-    /// <para>An already-escaped character is copied through untouched rather than escaped twice, which
-    /// would turn an invisible escape into a visible backslash.</para>
-    ///
-    /// <para><b>Inside an inline code span nothing is escaped at all</b>, and that is a correctness
-    /// requirement rather than a nicety: CommonMark does not process backslash escapes inside a code
-    /// span, so the backslash would simply be VISIBLE -- <c>YamlValue.cs</c>'s summary shipped as
-    /// <c>A sequence (`[...\]` or block `- ...`)</c>, this method corrupting the very prose it exists to
-    /// preserve. It is also provably unnecessary there: <c>LinkScanner.BlankInlineCode</c> blanks code
-    /// spans before scanning, so a <c>]</c> inside one could never have produced a link. The backtick
-    /// rule here therefore mirrors that method's exactly -- toggle on every backtick, not on runs --
-    /// because the two must agree with each other, not with a spec.</para>
-    /// </summary>
-    private static string NeutralizeMarkdownLinks(string text)
-    {
-        if (!text.Contains(']', StringComparison.Ordinal))
-        {
-            return text;
-        }
-
-        var builder = new StringBuilder(text.Length + 8);
-        var inCodeSpan = false;
-
-        for (var i = 0; i < text.Length; i++)
-        {
-            var c = text[i];
-
-            // A backtick toggles a code span, exactly as LinkScanner.BlankInlineCode does -- one
-            // backtick, not a run, and with NO backslash awareness, because that is the rule the
-            // consumer applies and this has to agree with the consumer, not with CommonMark. Honouring
-            // `\` before a backtick desynchronises the two: on ``A \` b ` [text](dest).`` the scanner
-            // closes its span at the second backtick and reads the rest as prose, while a producer that
-            // skipped the first would still believe it was inside a span and ship a live link.
-            if (c == '`')
-            {
-                inCodeSpan = !inCodeSpan;
-                builder.Append(c);
-                continue;
-            }
-
-            // And the flag resets at every newline, because BlankInlineCode is applied per line: an
-            // unclosed backtick cannot make the NEXT line code. Carrying it across `\n` would leave a
-            // multi-line description -- a `.csproj` <Description> reaches a body with its newlines
-            // intact -- "inside a code span" for the whole rest of the text.
-            if (c == '\n')
-            {
-                inCodeSpan = false;
-                builder.Append(c);
-                continue;
-            }
-
-            if (inCodeSpan)
-            {
-                builder.Append(c);
-                continue;
-            }
-
-            // The double-escape guard, but never over a backtick: that character is the consumer's
-            // state machine, and consuming it here is what caused the divergence described above.
-            if (c == '\\' && i + 1 < text.Length && text[i + 1] != '`')
-            {
-                builder.Append(c).Append(text[i + 1]);
-                i++;
-                continue;
-            }
-
-            if (c == ']')
-            {
-                builder.Append('\\');
-            }
-
-            builder.Append(c);
-        }
-
-        return builder.ToString();
-    }
 
     /// <summary>The one level of containment below this concept (§5.2), as absolute links (§6.1).</summary>
     private static void AppendContains(StringBuilder body, IReadOnlyList<Child> children) =>
@@ -1927,7 +1498,7 @@ private static ConceptId RegisterContainerId(
 
         if (registeredByRawPath.TryGetValue(RawKey(segments[..^1]), out var parentId))
         {
-            foreach (var candidate in new[] { segments[^1], ContainerToken })
+            foreach (var candidate in new[] { SegmentName(segments[^1]), ContainerToken })
             {
                 try
                 {
@@ -1939,7 +1510,21 @@ private static ConceptId RegisterContainerId(
             }
         }
 
-        string[][] candidates = [segments[2..], [ContainerToken]];
+        // SegmentName on EVERY segment, not just the leaf, and this is the whole defect the fallback
+        // used to have. The branch above cleans its leaf; this one passed the raw segments straight to
+        // CodeConceptIds, so a namespace that DisambiguateNamespacesAgainstTypes had marked was
+        // slugified WITH its marker and shipped as `code/csharp/foo-ns` -- id and title disagreeing
+        // (`title: Foo`), the marker recorded in the manifest, and every id in that subtree carrying it
+        // permanently, which §3.1 treats as unrecoverable.
+        //
+        // It was not a corner: for a TOP-LEVEL namespace this fallback is always the path taken, since
+        // the parent key `[code, <language>]` is never in registeredByRawPath. Reproduced on two files
+        // -- a global-namespace `class Foo` beside a `namespace Foo` -- and pinned by
+        // `ConceptGeneratorTests.A_marked_namespace_container_is_registered_under_its_real_name`.
+        //
+        // SegmentName's own summary already claimed that every path back to something a reader sees
+        // goes through it. That claim is now true.
+        string[][] candidates = [[.. segments[2..].Select(SegmentName)], [ContainerToken]];
         foreach (var candidateSegments in candidates)
         {
             try
@@ -2001,6 +1586,23 @@ private static string[] RawSegments(SymbolFact fact, LanguageProfile profile)
     /// </summary>
     private static string RawKey(IEnumerable<string> segments) => string.Join(char.MinValue, segments);
 
+    /// <summary>
+    /// A raw segment with any <see cref="RawPathDiscriminator"/> suffix cut off -- the name it denotes,
+    /// as against the key it is.
+    ///
+    /// <para>Every place that turns a raw segment back into something a reader sees goes through this,
+    /// which is what makes the discriminator a pure keying device. That was already true of a GROUP's
+    /// segments by accident rather than by design: a group's id and title come from its
+    /// <see cref="SymbolFact"/>, so nothing read its leaf segment as a name. It is not true of a
+    /// synthesized container, whose id, title and description-chain fact are all derived from the
+    /// segments themselves -- so a discriminator on a container segment would have reached output.</para>
+    /// </summary>
+    private static string SegmentName(string segment)
+    {
+        var cut = segment.IndexOf(RawPathDiscriminator, StringComparison.Ordinal);
+        return cut < 0 ? segment : segment[..cut];
+    }
+
     /// <summary>
     /// The character appended to a leaf raw segment to tell two groups apart that
     /// <see cref="RawSegments"/> would otherwise give the same path. Never NUL, which
@@ -2010,6 +1612,88 @@ private static string[] RawSegments(SymbolFact fact, LanguageProfile profile)
     /// </summary>
     private const char RawPathDiscriminator = '\u0001';
 
+    /// <summary>The marker a namespace segment carries when a type of the same name occupies its path.</summary>
+    private const string NamespaceMarker = "ns";
+
+    /// <summary>
+    /// Separates a namespace from a type that occupies the same raw path, so the namespace's contents
+    /// stop being emitted as though they were nested inside the type.
+    ///
+    /// <para><b>The shape.</b> A class <c>Bar</c> in namespace <c>Foo</c>, and a class <c>Baz</c> in
+    /// namespace <c>Foo.Bar</c>. Both reduce to the raw path <c>[code, csharp, Foo, Bar]</c> for their
+    /// parent, so the container was never synthesized (a group already claimed the path) and
+    /// <c>Baz</c> registered under the TYPE's id: measured as <c>code/csharp/foo/bar/baz</c>, a
+    /// top-level type rendered as a nested one, with the namespace having no concept at all. §3.3
+    /// enumerated two residual collisions; this was a third, and it had no test.</para>
+    ///
+    /// <para><b>Why a flat container string cannot decide it, and what can.</b>
+    /// <see cref="SymbolFact.Container"/> is dotted and flat, so a type nested in <c>Bar</c> and a
+    /// top-level type in <c>Foo.Bar</c> both report <c>"Foo.Bar"</c>. What separates them is
+    /// <see cref="SymbolFact.ContainerNamespace"/>: a group's parent is a namespace exactly when the
+    /// parent's depth equals the namespace's. The four cases, on the fixture above --
+    /// <c>Bar</c> (parent depth 3, namespace depth 3, so a namespace), its member <c>M</c> (4 against
+    /// 3, so a type), <c>Baz</c> in <c>Foo.Bar</c> (4 against 4, a namespace) and a <c>Baz</c> nested
+    /// inside <c>Bar</c> (4 against 3, a type) -- have two rows whose segments are IDENTICAL and whose
+    /// parents differ. That is precisely what the depth decides and the string cannot.</para>
+    ///
+    /// <para><b>What it does not do.</b> A group whose <see cref="SymbolFact.ContainerNamespace"/> is
+    /// <see langword="null"/> -- every fixture in this solution, and any future extractor that does not
+    /// record one -- is left exactly as it was, so this pass is inert rather than guessing. And a
+    /// group never discriminates its own full path, only the namespace prefixes ABOVE it: the type
+    /// keeps the undecorated path it already had, so no existing type's id moves.</para>
+    /// </summary>
+    private static void DisambiguateNamespacesAgainstTypes(
+        List<(SymbolKey Key, IReadOnlyList<SymbolFact> Declarations, string[] RawSegments)> groups,
+        Func<string, LanguageProfile> profileFor)
+    {
+        var typePaths = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var group in groups)
+        {
+            if (group.Declarations[0].Kind == SymbolKind.Type)
+            {
+                typePaths.Add(RawKey(group.RawSegments));
+            }
+        }
+
+        if (typePaths.Count == 0)
+        {
+            return;
+        }
+
+        for (var i = 0; i < groups.Count; i++)
+        {
+            var (key, declarations, segments) = groups[i];
+            if (declarations[0].ContainerNamespace is not { } containerNamespace)
+            {
+                continue;
+            }
+
+            // Two for `code` and the language tag, which every raw path starts with.
+            var namespaceDepth = 2 + profileFor(key.Language).SplitContainer(containerNamespace).Count;
+            var deepest = Math.Min(namespaceDepth, segments.Length - 1);
+
+            string[]? rewritten = null;
+            for (var depth = MinimumContainerDepth; depth <= deepest; depth++)
+            {
+                // Against the REWRITTEN prefix once a shallower level has been marked: a marked prefix
+                // no longer matches any type path, which is the point -- one mark separates the whole
+                // branch below it rather than every level repeating the same separation.
+                if (!typePaths.Contains(RawKey((rewritten ?? segments)[..depth])))
+                {
+                    continue;
+                }
+
+                rewritten ??= (string[])segments.Clone();
+                rewritten[depth - 1] = SegmentName(rewritten[depth - 1]) + RawPathDiscriminator + NamespaceMarker;
+            }
+
+            if (rewritten is not null)
+            {
+                groups[i] = (key, declarations, rewritten);
+            }
+        }
+    }
+
     /// <summary>
     /// Gives every symbol group a raw path of its own, which <see cref="RawSegments"/> alone does not
     /// guarantee.
@@ -2284,77 +1968,4 @@ private static int RenderedEndLine(SymbolFact declaration) =>
     private static string SpanLabel(SymbolFact declaration) =>
         NormalizeSeparators(declaration.RelativePath) + LineSpan(declaration);
 
-    /// <summary>
-    /// Wraps <paramref name="text"/> in a markdown code span that survives the text itself: the fence
-    /// is one backtick longer than the longest backtick run inside, padded with spaces when the content
-    /// starts or ends with a backtick, and control characters (a code span cannot contain a newline)
-    /// are flattened to spaces. Signatures and called names come out of source files, which §2.3 treats
-    /// as untrusted input -- a naive <c>$"`{text}`"</c> would let one of them close the span early and
-    /// corrupt the rest of the document.
-    /// </summary>
-    private static string CodeSpan(string text)
-    {
-        var flat = Flatten(text);
-        var fence = new string('`', LongestBacktickRun(flat) + 1);
-        var pad = flat.Length == 0 || flat[0] == '`' || flat[^1] == '`' ? " " : string.Empty;
-
-        return fence + pad + flat + pad + fence;
-    }
-
-    private static string Flatten(string text)
-    {
-        var chars = text.ToCharArray();
-        for (var i = 0; i < chars.Length; i++)
-        {
-            if (char.IsControl(chars[i]))
-            {
-                chars[i] = ' ';
-            }
-        }
-
-        return new string(chars).Trim();
-    }
-
-    private static int LongestBacktickRun(string text)
-    {
-        var longest = 0;
-        var current = 0;
-        foreach (var c in text)
-        {
-            current = c == '`' ? current + 1 : 0;
-            longest = Math.Max(longest, current);
-        }
-
-        return longest;
-    }
-
-    /// <summary>
-    /// Escapes the display half of a markdown link. Symbol names are identifiers in practice, but they
-    /// reach here from untrusted source text (§2.3), and a stray <c>]</c> would end the link text early
-    /// and turn the rest of the line into prose.
-    ///
-    /// <para><b>A backtick is replaced rather than escaped, and it is the link's survival that is at
-    /// stake, not its rendering.</b> <see cref="OKF4net.LinkScanner"/>'s <c>BlankInlineCode</c> toggles a
-    /// code span on <i>every</i> backtick and blanks to the end of the line, so a bullet whose label
-    /// carries an ODD number of them has its own <c>](/id)</c> blanked before <c>ScanLineLinks</c> ever
-    /// sees it: the link vanishes, the target file still exists, and nothing dangles, so
-    /// <c>okf validate</c> stays silent while the branch is severed -- the same failure shape as an
-    /// unbalanced fence, one character wide. Reachable through <c>overview</c>'s own children, since a
-    /// doc concept's title is lifted verbatim from the README's <c>#</c> heading and an unbalanced
-    /// backtick in one (<c>Migrating to `v2</c>) is an ordinary typo.</para>
-    ///
-    /// <para><b>Why <c>&amp;#96;</c> and not <c>\`</c>.</b> A backslash would be correct for a renderer --
-    /// CommonMark escapes a backtick like any ASCII punctuation -- and useless here, because
-    /// <c>BlankInlineCode</c> has no backslash awareness at all, deliberately (see
-    /// <see cref="NeutralizeMarkdownLinks"/>, which mirrors that rule rather than CommonMark's for
-    /// exactly this reason). Only a form carrying no backtick CHARACTER leaves the consumer's state
-    /// machine alone, and a numeric character reference renders as the character the author wrote. The
-    /// substitution is not applied to <see cref="CodeSpan"/>, where a backtick is content and the fence
-    /// is widened around it instead.</para>
-    /// </summary>
-    private static string LinkText(string text) =>
-        Flatten(text).Replace("\\", "\\\\", StringComparison.Ordinal)
-            .Replace("`", "&#96;", StringComparison.Ordinal)
-            .Replace("[", "\\[", StringComparison.Ordinal)
-            .Replace("]", "\\]", StringComparison.Ordinal);
 }
diff --git a/producers/src/OkfProducer.Core/Generation/DocCommentSource.cs b/producers/src/OkfProducer.Core/Generation/DocCommentSource.cs
index 339123be..89e0a1c6 100644
--- a/producers/src/OkfProducer.Core/Generation/DocCommentSource.cs
+++ b/producers/src/OkfProducer.Core/Generation/DocCommentSource.cs
@@ -135,6 +135,22 @@ internal static string UnwrapXmlDocTags(string comment, out long scanCost)
 
                 if (token.IsTag)
                 {
+                    // A `<code>` BLOCK's content is source, not prose, and this field is documented to
+                    // hold "a complete sentence, not a fragment". Flowing it through left a multi-line
+                    // example collapsed onto one line by CollapseWhitespaceRuns below -- `var a = 1;
+                    // var b = 2;` reading as if it were a sentence -- which is neither the code nor a
+                    // description. The same argument the viewer's sanitizer makes for `<script>` and
+                    // `<style>`: an opaque tag's content is dropped rather than kept as text.
+                    //
+                    // `<c>` is deliberately NOT in this set. Inline code is part of the sentence
+                    // (`returns <c>null</c> when...`), and dropping it would delete the words the
+                    // sentence is about.
+                    if (IsOpaqueTagOpener(token.Markup))
+                    {
+                        i = SkipToCloser(comment, tokens, ref next, token, "code");
+                        continue;
+                    }
+
                     result.Append(Substitution(token.Markup));
                 }
                 else
@@ -700,6 +716,58 @@ private static bool StartsTag(string comment, int index)
         return next == '/' || char.IsAsciiLetter(next);
     }
 
+    /// <summary>
+    /// Whether <paramref name="markup"/> opens a <c>&lt;code&gt;</c> block -- the one tag whose CONTENT
+    /// this producer drops rather than keeps as text. Not <c>&lt;c&gt;</c>: an inline code span is part
+    /// of the sentence, and a self-closing <c>&lt;code/&gt;</c> encloses nothing to drop.
+    /// </summary>
+    private static bool IsOpaqueTagOpener(string markup)
+    {
+        if (markup.StartsWith('/') || markup.EndsWith('/'))
+        {
+            return false;
+        }
+
+        var end = 0;
+        while (end < markup.Length && !char.IsWhiteSpace(markup[end]))
+        {
+            end++;
+        }
+
+        return markup.AsSpan(0, end).Equals("code", StringComparison.OrdinalIgnoreCase);
+    }
+
+    /// <summary>
+    /// Advances <paramref name="next"/> past every token up to and including the closer matching
+    /// <paramref name="opener"/>, and returns the comment index rendering should resume at.
+    ///
+    /// <para><b>The end-of-comment return is a backstop, not the unclosed-opener policy</b>, and this
+    /// paragraph said otherwise until it was measured. An opener nothing closed is never marked as a
+    /// tag in the first place, so it does not reach this method at all: it falls through to the
+    /// tag-shaped-but-unpaired branch and is emitted verbatim, by the same rule that keeps
+    /// <c>List&lt;T&gt; of results</c> intact. That is the right answer on arbitrary repositories,
+    /// where a lone <c>&lt;code&gt;</c> is likelier to be prose than a block whose content should
+    /// vanish, and <c>DescriptionTests.An_unclosed_code_opener_is_prose_by_the_same_rule_that_protects_a_generic</c>
+    /// pins it.</para>
+    /// </summary>
+    private static int SkipToCloser(string comment, List<Token> tokens, ref int next, Token opener, string name)
+    {
+        while (next < tokens.Count)
+        {
+            var candidate = tokens[next];
+            next++;
+
+            if (candidate.IsTag
+                && candidate.Markup.StartsWith('/')
+                && candidate.Markup.AsSpan(1).Trim().Equals(name, StringComparison.OrdinalIgnoreCase))
+            {
+                return candidate.End + 1;
+            }
+        }
+
+        return comment.Length;
+    }
+
     /// <summary>
     /// What one tag's inner markup (everything between <c>&lt;</c> and <c>&gt;</c>) contributes to the
     /// text. Empty for every tag that carries no name of its own; the tag's <i>content</i> is not read
diff --git a/producers/src/OkfProducer.Core/Generation/GenerateOptions.cs b/producers/src/OkfProducer.Core/Generation/GenerateOptions.cs
index de3ba56f..bcbb61c2 100644
--- a/producers/src/OkfProducer.Core/Generation/GenerateOptions.cs
+++ b/producers/src/OkfProducer.Core/Generation/GenerateOptions.cs
@@ -103,6 +103,30 @@ public sealed record GenerateOptions
     /// </summary>
     public Action<string>? Note { get; init; }
 
+    /// <summary>
+    /// The extraction engines this run used, each already spelled <c>name/version</c>, written as
+    /// <c>overview</c>'s <c>generated.engines</c> -- a sibling of <c>generated.by</c>, never appended
+    /// to it. They were appended once, which made <c>by</c> a space-separated list where §5.2 and §7
+    /// require a single actor; <c>Actor.Parse</c> accepted it as well formed and read the version
+    /// wrong, so nothing warned.
+    ///
+    /// <para><b>Why the artefact carries them.</b> §6.2's determinism holds <i>at a fixed extractor
+    /// version</i>, not absolutely: a tree-sitter grammar or Roslyn bump can change symbols, spans or
+    /// descriptions over unchanged source. Locking the versions (<c>packages.lock.json</c>) makes the
+    /// bump deliberate; recording them makes a diff INTERPRETABLE, which is the half a lock file
+    /// cannot supply. Without them, a golden that moved says only that something changed.</para>
+    ///
+    /// <para><b>Supplied by the composition root, not read here.</b> <c>OkfProducer.Core</c> references
+    /// neither engine, and should not: each engine names its own version, and the CLI -- the one
+    /// project that references everything -- passes them through. A run with none (every test fixture,
+    /// and <c>--no-code</c>) emits the producer token alone, exactly as before this existed.</para>
+    ///
+    /// <para><b>On <c>overview</c> alone</b>, like <c>at</c> and for the same reason (§6.1): the
+    /// engines are a fact about the run, and repeating them on every one of hundreds of <c>code/</c>
+    /// concepts would rewrite every file on a version bump that changed nothing else.</para>
+    /// </summary>
+    public IReadOnlyList<string> EngineVersions { get; init; } = [];
+
     /// <summary>
     /// Whether <paramref name="repoUrl"/> is something §4.3's <c>resource</c> permalink can actually
     /// be built from -- present, absolute, and <c>http</c> or <c>https</c> -- handing back the parsed
diff --git a/producers/src/OkfProducer.Core/Generation/GenerationManifest.cs b/producers/src/OkfProducer.Core/Generation/GenerationManifest.cs
index 80b3731e..6ce54a37 100644
--- a/producers/src/OkfProducer.Core/Generation/GenerationManifest.cs
+++ b/producers/src/OkfProducer.Core/Generation/GenerationManifest.cs
@@ -328,10 +328,50 @@ public bool WriteTo(string bundleRoot)
             return false;
         }
 
-        File.WriteAllBytes(path, Serialize(Normalized()));
+        // Staged and moved, like every other write this producer makes. `File.WriteAllBytes` truncates
+        // first and fills after, so a process that dies between the two leaves a manifest that is
+        // present, shorter than it should be, and not JSON -- the one truncate-then-write left in a
+        // design whose whole point is that a bundle is never observed half-written.
+        //
+        // The damage was bounded rather than absent: `TryRead` answers null for anything it cannot
+        // parse, and null downstream means "this run owns nothing, delete nothing", so the next run
+        // prunes nothing instead of pruning wrongly. That is the safe direction, and it is still a
+        // silent pruning-free run caused by a crash that need not have cost one.
+        //
+        // The temp name carries a GUID rather than a fixed `.tmp` suffix: `.okfgen-manifest.json` is a
+        // fixed name at a known root, and the gate above exists because something can be planted at a
+        // predictable path there. A name chosen at write time cannot be waited for.
+        var staged = path + "." + Guid.NewGuid().ToString("N") + ".tmp";
+        File.WriteAllBytes(staged, Serialize(Normalized()));
+
+        try
+        {
+            File.Move(staged, path, overwrite: true);
+        }
+        catch
+        {
+            TryDelete(staged);
+            throw;
+        }
+
         return true;
     }
 
+    /// <summary>Removes a staged manifest that never became one, without turning cleanup into the failure a caller sees.</summary>
+    private static void TryDelete(string path)
+    {
+        try
+        {
+            File.Delete(path);
+        }
+        catch (IOException)
+        {
+        }
+        catch (UnauthorizedAccessException)
+        {
+        }
+    }
+
     /// <summary>
     /// Reads the manifest in <paramref name="bundleRoot"/>, or <see langword="null"/> when there is
     /// none, it cannot be read, it is not valid JSON, or it carries a
diff --git a/producers/src/OkfProducer.Core/Generation/GitRevision.cs b/producers/src/OkfProducer.Core/Generation/GitRevision.cs
index 6e53d85f..7a308348 100644
--- a/producers/src/OkfProducer.Core/Generation/GitRevision.cs
+++ b/producers/src/OkfProducer.Core/Generation/GitRevision.cs
@@ -72,8 +72,9 @@ public static string HeadCommitInstant(string repoRoot)
 
     /// <summary>
     /// The name of the branch currently checked out in <paramref name="repoRoot"/> (e.g. <c>main</c>,
-    /// <c>feature/x</c>), or <see langword="null"/> when there is none to read: a <b>detached
-    /// HEAD</b>, a path outside any git repository, or <c>git</c> itself not runnable.
+    /// <c>feature/x</c>), or <see langword="null"/> when there is none a permalink could be built
+    /// against: a <b>detached HEAD</b>, an <b>unborn branch</b> (initialised, no commit yet), a path
+    /// outside any git repository, or <c>git</c> itself not runnable.
     ///
     /// <para><b>What the null is for.</b> This is the default the CLI's <c>--rev</c> falls back to
     /// when building §4.3's <c>resource</c> permalinks, and a branch name is deliberately the only
@@ -90,8 +91,27 @@ public static string HeadCommitInstant(string repoRoot)
     /// the caller as a null.</para>
     /// </summary>
     /// <param name="repoRoot">The repository root to run <c>git</c> in.</param>
-    public static string? CurrentBranch(string repoRoot) =>
-        RunGit(repoRoot, "symbolic-ref", "--quiet", "--short", "HEAD") is { Length: > 0 } branch ? branch : null;
+    public static string? CurrentBranch(string repoRoot)
+    {
+        if (RunGit(repoRoot, "symbolic-ref", "--quiet", "--short", "HEAD") is not { Length: > 0 } branch)
+        {
+            return null;
+        }
+
+        // An UNBORN branch is a branch name that names no commit, and a permalink built against it
+        // resolves to nothing. `git init` followed by no commit is exactly that state, and it is not
+        // exotic -- it is every repository on its first run of this producer.
+        //
+        // Measured: on a zero-commit repository `symbolic-ref` SUCCEEDS and returns the branch while
+        // `rev-parse HEAD` fails. So checking only the first left `--repo-url` without `--rev` emitting
+        // a `resource` on every code concept, all pointing into a branch containing none of the files,
+        // and the caller's "no branch name could be read" note never fired to say otherwise. A wrong
+        // link reads exactly as confidently as a right one, which §2.3 calls the worse outcome.
+        //
+        // The second invocation is the cost, and it is only paid where the first succeeded: a caller
+        // that passed --rev never reaches this method at all. producers/README.md counts it.
+        return RunGit(repoRoot, "rev-parse", "--verify", "--quiet", "HEAD") is { Length: > 0 } ? branch : null;
+    }
 
     /// <summary>Formats <paramref name="instant"/>, taken as UTC, as <c>yyyy-MM-ddTHH:mm:ssZ</c> -- invariant, second precision, a literal <c>Z</c>.</summary>
     private static string FormatUtc(DateTimeOffset instant) =>
diff --git a/producers/src/OkfProducer.Core/Generation/LiftedMarkdown.cs b/producers/src/OkfProducer.Core/Generation/LiftedMarkdown.cs
new file mode 100644
index 00000000..6b4f0c59
--- /dev/null
+++ b/producers/src/OkfProducer.Core/Generation/LiftedMarkdown.cs
@@ -0,0 +1,594 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+using System.Text;
+using OKF4net;
+
+namespace OkfProducer.Core.Generation;
+
+/// <summary>
+/// Every markdown-text transform this producer applies to text it did not author: neutralizing link
+/// syntax, escaping a leading block marker, defusing an unclosed fence, and building a code span or a
+/// link label that the text inside cannot break out of.
+///
+/// <para><b>Lifted out of <see cref="ConceptGenerator"/> because its correctness argument is a
+/// different argument.</b> Everything here is a pure function from string to string. Nothing in it
+/// knows about a <c>CodeGraph</c>, a <c>Bundle</c>, or a <c>GenerateOptions</c>, and nothing needs to:
+/// these transforms are decided entirely against ONE external contract -- <c>LinkScanner</c>'s
+/// <c>CodeFreeLines</c>, <c>BlankInlineCode</c> and <c>ParseInlineLink</c> in <c>OKF4net</c>, which is
+/// what will read the markdown this producer emits. That is why the escaping here deliberately mirrors
+/// the consumer's rules rather than CommonMark's wherever the two differ, and each place it does says
+/// so at the site.</para>
+///
+/// <para>The seam is worth having because of what kept going wrong on the other side of it. The
+/// defects recorded in this neighbourhood are, repeatedly, one shape: <i>this code and
+/// <c>Links.cs</c> disagree about one character class</i> -- a backslash before a backtick, a bracket
+/// inside a code span, whitespace before a fence. Buried among two thousand lines of concept
+/// assembly, the two rules could not be read side by side; in a file of their own, against a named
+/// contract, they can. No behaviour changed in the move: the golden bundle is byte-identical across
+/// it, which is the evidence that claim rests on.</para>
+///
+/// <para><c>internal</c> rather than public: this is <c>ConceptGenerator</c>'s text layer, not an API
+/// this producer offers anyone. It is a seam for reading and for testing, not a published surface.</para>
+/// </summary>
+internal static class LiftedMarkdown
+{
+    /// <summary>
+    /// Any text this producer <b>lifted from outside the bundle</b> and renders into a body -- a
+    /// repository or package name, a README's own <c>#</c> heading, a <c>.csproj</c>
+    /// <c>&lt;Description&gt;</c>, a doc comment -- with its markdown link syntax neutralized.
+    ///
+    /// <para><b>The test is where the text was authored FOR, not who typed it.</b> A NuGet
+    /// <c>&lt;Description&gt;</c> and a README heading are written by humans, but for NuGet and for
+    /// GitHub; nobody writing either means a link relative to a bundle that did not exist yet. So from
+    /// the bundle's point of view they are derived, exactly as a doc comment is, and rendering
+    /// <c>[docs](guide)</c> or <c>[Guide](docs/guide.md)</c> from one of them verbatim manufactures a
+    /// link the author never wrote. Only text authored <i>in</i> the bundle is exempt, and
+    /// <c>description_source</c> is what says so -- see <see cref="BodyDescription"/>.</para>
+    ///
+    /// <para>A no-op for text that cannot contain the syntax, which is most of it: a C# identifier, a
+    /// dotted type name. Applied uniformly all the same, because a per-family exception is exactly how
+    /// two concepts with identical text end up behaving differently.</para>
+    /// </summary>
+    internal static string LiftedBodyText(string text) => NeutralizeMarkdownLinks(text);
+
+    /// <summary>
+    /// <see cref="LiftedBodyText"/> for lifted text that <b>begins a paragraph</b> in the body: it
+    /// additionally escapes a leading block-construct marker, so a description cannot silently stop
+    /// being a paragraph and start being a heading, a list item or a block quote.
+    ///
+    /// <para><b>Bounded on purpose: one character, at the start of a line.</b> The only thing that can
+    /// change a line's block type is its first non-space character -- <c>#</c>, <c>-</c>, <c>*</c>,
+    /// <c>+</c>, <c>&gt;</c>, a run of 3+ backticks or tildes (a fenced code block), or a run of digits
+    /// followed by <c>.</c> or <c>)</c>. This is deliberately not a general markdown escaper: everything
+    /// further into the line is inline markup, which renders as the author's own emphasis and is none of
+    /// this producer's business. CommonMark renders <c>\#</c> as <c>#</c>, so the reader sees exactly
+    /// what was written.</para>
+    ///
+    /// <para><b>A marker only counts when a space, a tab or the line's end follows it</b> -- which is
+    /// CommonMark's own rule and not a refinement of it. Escaping unconditionally would rewrite ordinary
+    /// emphasis: <c>*fast* and small.</c> would become <c>\*fast* and small.</c> and render its asterisks
+    /// literally, this guard corrupting the prose it exists to protect. <c>&gt;</c> and a fence are the
+    /// exceptions the spec itself makes: <c>&gt;text</c> is a block quote with no space at all, and an
+    /// info string may sit right against a fence (<c>```csharp</c>).</para>
+    ///
+    /// <para><b>An unbalanced fence has a consumer, not just a renderer, to answer to.</b> A leading
+    /// ``` or <c>~~~</c> left undefused makes <see cref="OKF4net.LinkScanner"/>.<c>ExtractLinks</c> skip
+    /// every line after it as code -- so a description whose fence is never closed (ordinary: it is only
+    /// a description, not a whole document) silently hides the rest of this concept's own body, links
+    /// included, from the very scanner that resolves them.</para>
+    ///
+    /// <para><b>Every line, not only the first.</b> A <c>.csproj</c> <c>&lt;Description&gt;</c> reaches
+    /// a body with its newlines intact, so a <c>- </c> opening line 2 starts a list exactly as it would
+    /// opening line 1 -- a guarantee stated for "the description" has to hold for all of it, or the
+    /// documentation and the code disagree about which half is covered.</para>
+    ///
+    /// <para><b>For an ordered-list marker the delimiter is escaped, not the digit</b>, and the two are
+    /// not interchangeable: <c>\1.</c> renders a literal backslash, because a backslash escape is only
+    /// defined for ASCII punctuation, while <c>1\.</c> renders <c>1.</c> and forms no list.</para>
+    ///
+    /// <para>The sharpest case is <c>#</c>. A description that opens a heading is a rendering fault on
+    /// its own, and <c>LinkScanner.ExtractCitations</c> reads a heading whose title is exactly
+    /// <c>Citations</c> as §13.1's legacy citations marker -- a structural claim about the concept,
+    /// made by text its author wrote for a compiler.</para>
+    /// </summary>
+    internal static string LiftedBodyParagraph(string text) => EscapeLeadingBlockMarker(LiftedBodyText(text));
+
+    /// <summary>
+    /// A <see cref="LiftedBodyParagraph(string)"/> that respects <paramref name="preservedSource"/>: text this
+    /// producer derived is neutralized, text the author wrote in the bundle is left as written apart from
+    /// an unclosed fence. The same rule <see cref="BodyDescription"/> applies to the <c>code/</c> family,
+    /// keyed the same way, so two concepts with identical text cannot behave differently.
+    /// </summary>
+    internal static string LiftedBodyParagraph(string text, string? preservedSource) =>
+        preservedSource is null ? LiftedBodyParagraph(text) : DefuseLeadingFenceOnly(text);
+
+    /// <summary>
+    /// Escapes the one character that would make <paramref name="text"/> open a markdown block, or
+    /// returns it unchanged when it opens none. See <see cref="LiftedBodyParagraph"/> for the bound.
+    /// </summary>
+    private static string EscapeLeadingBlockMarker(string text)
+    {
+        // Every line, not only the first: a `.csproj` <Description> reaches a body with its newlines
+        // intact, and a `- ` opening line 2 starts a list exactly as it would opening line 1. Splitting
+        // on `\n` and keeping any `\r` with the line leaves the text byte-identical apart from the
+        // escapes themselves.
+        var lines = text.Split('\n');
+        for (var i = 0; i < lines.Length; i++)
+        {
+            lines[i] = EscapeLineBlockMarker(lines[i]);
+        }
+
+        return string.Join('\n', lines);
+    }
+
+    private static string EscapeLineBlockMarker(string line)
+    {
+        var start = LeadingWhitespaceEnd(line);
+        if (start >= line.Length)
+        {
+            return line;
+        }
+
+        // A block quote is the one marker CommonMark does not require a space after: `>text` quotes.
+        if (line[start] == '>')
+        {
+            return line.Insert(start, "\\");
+        }
+
+        if (TryEscapeLeadingFence(line, start, out var fenced))
+        {
+            return fenced;
+        }
+
+        // A line that is nothing but one repeated marker is a thematic break (`---`, `***`, `___`) or a
+        // setext underline (`---`, `===`), and a setext underline retitles the paragraph ABOVE it -- a
+        // block-type change made to a line the guard already passed. It is checked before the bullet
+        // rule because the space requirement below, correct for `- item`, is exactly what lets these
+        // through.
+        if (IsMarkerOnlyLine(line, start))
+        {
+            return line.Insert(start, "\\");
+        }
+
+        // A bullet or an ATX heading marker only opens a block when a space (or the line's end) follows
+        // it. Without that check this escapes ordinary emphasis: `*fast* and small.` would become
+        // `\*fast* and small.`, which renders the asterisks literally -- the method damaging the prose
+        // it is here to protect.
+        if (line[start] is '-' or '*' or '+')
+        {
+            return IsBlockMarkerBoundary(line, start + 1) ? line.Insert(start, "\\") : line;
+        }
+
+        if (line[start] == '#')
+        {
+            var hashes = start;
+            while (hashes < line.Length && line[hashes] == '#')
+            {
+                hashes++;
+            }
+
+            // Seven or more `#` is not a heading at all, so there is nothing to defuse.
+            return hashes - start <= 6 && IsBlockMarkerBoundary(line, hashes)
+                ? line.Insert(start, "\\")
+                : line;
+        }
+
+        if (!char.IsAsciiDigit(line[start]))
+        {
+            return line;
+        }
+
+        // An ordered-list marker: digits, then `.` or `)`, then the same boundary. The DELIMITER is
+        // escaped, never the digit -- see this method's caller.
+        var delimiter = start;
+        while (delimiter < line.Length && char.IsAsciiDigit(line[delimiter]))
+        {
+            delimiter++;
+        }
+
+        return delimiter < line.Length
+            && line[delimiter] is '.' or ')'
+            && IsBlockMarkerBoundary(line, delimiter + 1)
+                ? line.Insert(delimiter, "\\")
+                : line;
+    }
+
+    /// <summary>
+    /// The index of the first non-whitespace character in <paramref name="line"/> (or its length, if
+    /// there is none), where <b>whitespace means <see cref="char.IsWhiteSpace(char)"/></b> -- NBSP, form
+    /// feed, vertical tab and U+2028 included, not the <c>' '</c>/<c>'\t'</c> pair CommonMark allows
+    /// before a block marker.
+    ///
+    /// <para><b>The consumer's definition is the authoritative one, and the consumer is
+    /// <see cref="OKF4net.LinkScanner"/>.</b> Its <c>CodeFreeLines</c> decides a line opens a fenced code
+    /// block by <c>TrimStart()</c>, which trims every <c>char.IsWhiteSpace</c>. So a description line
+    /// beginning with an NBSP and then ``` was not defused here while it did open a fence there -- after
+    /// which the scanner skipped every following line, this concept's own <c>## Contains</c> and
+    /// <c>## Calls</c> included. Two definitions of "leading whitespace" is precisely how a branch gets
+    /// severed with nothing dangling for <c>okf validate</c> to see, and the same reasoning that makes
+    /// <see cref="NeutralizeMarkdownLinks"/> mirror <c>BlankInlineCode</c> rather than CommonMark applies
+    /// here: this has to agree with the consumer, not with a spec.</para>
+    ///
+    /// <para>The wider class is safe for the markers that only affect <i>rendering</i>
+    /// (<see cref="EscapeLineBlockMarker"/>'s others), because CommonMark does not admit them behind an
+    /// NBSP either: the line was already a paragraph, and the escape it now gets renders identically to
+    /// the character it protects (<c>\-</c> is <c>-</c>). It can add a redundant escape; it cannot
+    /// change what a reader sees.</para>
+    /// </summary>
+    private static int LeadingWhitespaceEnd(string line)
+    {
+        var start = 0;
+        while (start < line.Length && char.IsWhiteSpace(line[start]))
+        {
+            start++;
+        }
+
+        return start;
+    }
+
+    /// <summary>
+    /// Escapes a leading run of 3+ backticks or tildes at <paramref name="start"/> -- a fenced code
+    /// block opener -- and reports whether it did. CommonMark requires no following space (an info
+    /// string may sit right against it, `` ```csharp ``), so this is unconditional, like a block quote.
+    ///
+    /// <para><b>Why an unbalanced fence is dangerous, not just ugly.</b> Left undefused, a fence with no
+    /// matching close anywhere later in the same body -- ordinary when the text is only a description,
+    /// not a whole document -- makes <see cref="OKF4net.LinkScanner"/>.<c>ExtractLinks</c> skip every
+    /// line after it as code, silently hiding this concept's own outgoing links (<c>## Contains</c>,
+    /// <c>## Calls</c>) from the very scanner that resolves them. Nothing dangles, so <c>okf validate</c>
+    /// stays silent while the branch is simply severed -- which is why <see cref="BodyDescription"/>
+    /// defuses this one marker even on text it otherwise leaves untouched (see its own remarks).</para>
+    /// </summary>
+    private static bool TryEscapeLeadingFence(string line, int start, out string escaped)
+    {
+        if (line[start] is '`' or '~')
+        {
+            var fenceMarker = line[start];
+            var run = start;
+            while (run < line.Length && line[run] == fenceMarker)
+            {
+                run++;
+            }
+
+            if (run - start >= 3)
+            {
+                escaped = line.Insert(start, "\\");
+                return true;
+            }
+        }
+
+        escaped = line;
+        return false;
+    }
+
+    /// <summary>
+    /// Whether position <paramref name="index"/> ends a block marker: a space, a tab, or the end of the
+    /// line (a bare <c>-</c> on its own line is an empty list item). A <c>\r</c> counts as the end, so a
+    /// CRLF-separated line behaves like an LF-separated one.
+    /// </summary>
+    private static bool IsBlockMarkerBoundary(string line, int index) =>
+        index >= line.Length || line[index] is ' ' or '\t' or '\r';
+
+    /// <summary>
+    /// Whether every non-blank character from <paramref name="start"/> is the same one of
+    /// <c>-</c>, <c>*</c>, <c>_</c>, <c>=</c> -- the shape of a thematic break or a setext underline.
+    /// Requiring one repeated character is CommonMark's own rule and is what keeps this from firing on
+    /// ordinary prose: <c>-*-</c> is neither construct and is left alone.
+    /// </summary>
+    private static bool IsMarkerOnlyLine(string line, int start)
+    {
+        var marker = line[start];
+        if (marker is not ('-' or '*' or '_' or '='))
+        {
+            return false;
+        }
+
+        for (var i = start; i < line.Length; i++)
+        {
+            var c = line[i];
+            if (c is ' ' or '\t' or '\r')
+            {
+                continue;
+            }
+
+            if (c != marker)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// A <c>description</c> as it is rendered <b>into a body</b>: neutralized as
+    /// <see cref="LiftedBodyText"/> when this producer derived it, and left exactly as the author wrote
+    /// it when the author wrote it in the bundle.
+    ///
+    /// <para><b>The asymmetry is the whole rule.</b> A <c>[text](dest)</c> inside a C# doc comment is
+    /// doc syntax that merely looks like markdown -- <c>LinkScanner</c>'s own summary in this repository
+    /// contains the literal <c>&lt;c&gt;[text](dest)&lt;/c&gt;</c> -- and the author never meant a
+    /// bundle link. Rendered verbatim it becomes one: measured, that single doc comment was the only
+    /// broken link in a 649-concept bundle generated from this repository. The same syntax in a
+    /// <c>manual</c> or <c>llm</c> description is a link the author meant <i>for this bundle</i>, and
+    /// rewriting it would be editing a human's text.</para>
+    ///
+    /// <para><b>Keyed on <c>description_source</c>, which makes it consistent with §4.2's preservation
+    /// table by construction rather than by coincidence:</b> the set neutralized here --
+    /// <see cref="DocCommentSource.SourceLabel"/> and <see cref="SignatureSource.SourceLabel"/> -- is
+    /// exactly the set <see cref="DescriptionResolver"/> re-derives, and everything it protects is
+    /// left alone. The comparison is <see cref="StringComparison.Ordinal"/> against the two literals,
+    /// where the resolver's own comparison is case-insensitive, and that is correct rather than a
+    /// mismatch: this value is not read off disk, it is whatever <see cref="DescriptionResolver.Resolve"/>
+    /// just returned, and a spelling variant of a derived label can only reach that return as a
+    /// <i>preserved</i> value -- which must not be touched, and is not.</para>
+    ///
+    /// <para>The families with no <c>description_source</c> at all -- <c>packages/*</c>, <c>docs/*</c>,
+    /// <c>overview</c> -- never reach this method: nothing in them is bundle-authored, so they go
+    /// straight through <see cref="LiftedBodyText"/>.</para>
+    ///
+    /// <para><b>One exception to "left exactly as the author wrote it": a leading fence is defused
+    /// regardless of provenance.</b> Every other marker only changes rendering, which is the author's
+    /// choice to make. A fence is different in kind -- <see cref="TryEscapeLeadingFence"/>'s own remarks
+    /// explain why -- and the danger it poses to <c>## Contains</c>/<c>## Calls</c> is the same whether
+    /// the text came from a doc comment or was hand-typed straight into the bundle's frontmatter on a
+    /// prior <c>--update</c>. So a bundle-authored description is defused for a fence and left untouched
+    /// for everything else, rather than skipping <see cref="BodyDescription"/> entirely.</para>
+    /// </summary>
+    internal static string BodyDescription(string description, string descriptionSource) =>
+        descriptionSource is DocCommentSource.SourceLabel or SignatureSource.SourceLabel
+            ? LiftedBodyParagraph(description)
+            : DefuseLeadingFenceOnly(description);
+
+    /// <summary>
+    /// Escapes the leading fenced-code-block marker that <b>never closes</b> -- nothing else, including
+    /// every other block marker <see cref="EscapeLeadingBlockMarker"/> also handles, and including a
+    /// fence that is part of a balanced pair. See <see cref="BodyDescription"/> for why a fence alone is
+    /// defused on text this producer otherwise never touches.
+    ///
+    /// <para><b>Balanced pairs are left alone, and that is a correction rather than a relaxation.</b> The
+    /// danger is not a fence, it is a fence <see cref="OKF4net.LinkScanner"/> never closes: on a balanced
+    /// pair the scanner opens the block and closes it again, so every line after the close -- this
+    /// concept's own <c>## Contains</c> and <c>## Calls</c> -- is scanned exactly as it would be with no
+    /// fence at all. Escaping such a pair bought no structural property whatsoever, and it was not free:
+    /// <c>\</c> before ``` renders as a literal backtick followed by a stray two-backtick span opener, so
+    /// the escape destroyed the author's code block rather than blemishing it -- damage done to text this
+    /// method's whole premise is that it must not edit.</para>
+    ///
+    /// <para><b>Which fence is the unclosed one is decided by replaying the scanner's own state machine,
+    /// not by counting.</b> A <c>~~~</c> does not close a ``` block, so parity over all fence-shaped
+    /// lines is the wrong question; and the replay has to be repeated until it settles, because escaping
+    /// the unclosed opener puts the lines it was hiding back in front of the scanner and one of THEM can
+    /// open a fence of its own (``` then <c>~~~</c> is the two-line case). Each pass escapes exactly one
+    /// line and strictly reduces the number of fence-shaped lines, so it terminates.</para>
+    /// </summary>
+    internal static string DefuseLeadingFenceOnly(string text)
+    {
+        var lines = text.Split('\n');
+
+        while (UnclosedFenceLine(lines) is { } index)
+        {
+            // The escape always lands: UnclosedFenceLine nominates a line only on the same 3+ run of the
+            // same marker that TryEscapeLeadingFence tests for. Guarded all the same, because the loop's
+            // termination rests on that agreement and a future edit to either could break it silently --
+            // an unescaped fence is the bug this method already has; an infinite loop would be a new one.
+            var start = LeadingWhitespaceEnd(lines[index]);
+            if (!TryEscapeLeadingFence(lines[index], start, out var fenced))
+            {
+                break;
+            }
+
+            lines[index] = fenced;
+        }
+
+        return string.Join('\n', lines);
+    }
+
+    /// <summary>
+    /// The index of the line that opens a fenced code block <see cref="OKF4net.LinkScanner"/> never
+    /// closes, or <see langword="null"/> when every fence in <paramref name="lines"/> is balanced.
+    ///
+    /// <para>A transcription of <c>LinkScanner.CodeFreeLines</c>'s own loop, and deliberately so: the
+    /// question is not what CommonMark makes of these lines, it is what the scanner that resolves this
+    /// bundle's links does with them. Both marker characters are tracked separately, and a closer must
+    /// repeat the marker its opener used.</para>
+    /// </summary>
+    private static int? UnclosedFenceLine(IReadOnlyList<string> lines)
+    {
+        char? fence = null;
+        var opener = 0;
+
+        for (var i = 0; i < lines.Count; i++)
+        {
+            var line = lines[i];
+            var start = LeadingWhitespaceEnd(line);
+            var marker = start < line.Length ? line[start] : '\0';
+            var run = 0;
+            while (start + run < line.Length && line[start + run] == marker)
+            {
+                run++;
+            }
+
+            var isFence = marker is '`' or '~' && run >= 3;
+
+            if (fence is { } open)
+            {
+                if (isFence && marker == open)
+                {
+                    fence = null;
+                }
+
+                continue;
+            }
+
+            if (isFence)
+            {
+                fence = marker;
+                opener = i;
+            }
+        }
+
+        return fence is null ? null : opener;
+    }
+
+    /// <summary>
+    /// Escapes every unescaped <c>]</c>, which neutralizes markdown link <i>syntax</i> while leaving
+    /// every character the reader sees exactly where it was: CommonMark renders <c>\]</c> as <c>]</c>,
+    /// so <c>[text](dest)</c> still reads as <c>[text](dest)</c>.
+    ///
+    /// <para><b>The closing bracket, and not the opening one</b>, because the opening one does not
+    /// work: <c>LinkScanner.ScanLineLinks</c> dispatches on <c>[</c> with no look-back at all, so a
+    /// preceding backslash does not stop it and <c>\[text](dest)</c> would render correctly while still
+    /// being extracted as a link. Its <c>ParseInlineLink</c> does honour a backslash inside the link
+    /// text, where it skips the next character -- so an escaped <c>]</c> never closes the text, the
+    /// bracket depth never returns to zero, and the parse fails. Verified against the scanner itself in
+    /// <c>CodeConceptGeneratorTests</c> rather than reasoned about here alone.</para>
+    ///
+    /// <para>An already-escaped character is copied through untouched rather than escaped twice, which
+    /// would turn an invisible escape into a visible backslash.</para>
+    ///
+    /// <para><b>Inside an inline code span nothing is escaped at all</b>, and that is a correctness
+    /// requirement rather than a nicety: CommonMark does not process backslash escapes inside a code
+    /// span, so the backslash would simply be VISIBLE -- <c>YamlValue.cs</c>'s summary shipped as
+    /// <c>A sequence (`[...\]` or block `- ...`)</c>, this method corrupting the very prose it exists to
+    /// preserve. It is also provably unnecessary there: <c>LinkScanner.BlankInlineCode</c> blanks code
+    /// spans before scanning, so a <c>]</c> inside one could never have produced a link. The backtick
+    /// rule here therefore mirrors that method's exactly -- toggle on every backtick, not on runs --
+    /// because the two must agree with each other, not with a spec.</para>
+    /// </summary>
+    private static string NeutralizeMarkdownLinks(string text)
+    {
+        if (!text.Contains(']', StringComparison.Ordinal))
+        {
+            return text;
+        }
+
+        var builder = new StringBuilder(text.Length + 8);
+        var inCodeSpan = false;
+
+        for (var i = 0; i < text.Length; i++)
+        {
+            var c = text[i];
+
+            // A backtick toggles a code span, exactly as LinkScanner.BlankInlineCode does -- one
+            // backtick, not a run, and with NO backslash awareness, because that is the rule the
+            // consumer applies and this has to agree with the consumer, not with CommonMark. Honouring
+            // `\` before a backtick desynchronises the two: on ``A \` b ` [text](dest).`` the scanner
+            // closes its span at the second backtick and reads the rest as prose, while a producer that
+            // skipped the first would still believe it was inside a span and ship a live link.
+            if (c == '`')
+            {
+                inCodeSpan = !inCodeSpan;
+                builder.Append(c);
+                continue;
+            }
+
+            // And the flag resets at every newline, because BlankInlineCode is applied per line: an
+            // unclosed backtick cannot make the NEXT line code. Carrying it across `\n` would leave a
+            // multi-line description -- a `.csproj` <Description> reaches a body with its newlines
+            // intact -- "inside a code span" for the whole rest of the text.
+            if (c == '\n')
+            {
+                inCodeSpan = false;
+                builder.Append(c);
+                continue;
+            }
+
+            if (inCodeSpan)
+            {
+                builder.Append(c);
+                continue;
+            }
+
+            // The double-escape guard, but never over a backtick: that character is the consumer's
+            // state machine, and consuming it here is what caused the divergence described above.
+            if (c == '\\' && i + 1 < text.Length && text[i + 1] != '`')
+            {
+                builder.Append(c).Append(text[i + 1]);
+                i++;
+                continue;
+            }
+
+            if (c == ']')
+            {
+                builder.Append('\\');
+            }
+
+            builder.Append(c);
+        }
+
+        return builder.ToString();
+    }
+    /// <summary>
+    /// Wraps <paramref name="text"/> in a markdown code span that survives the text itself: the fence
+    /// is one backtick longer than the longest backtick run inside, padded with spaces when the content
+    /// starts or ends with a backtick, and control characters (a code span cannot contain a newline)
+    /// are flattened to spaces. Signatures and called names come out of source files, which §2.3 treats
+    /// as untrusted input -- a naive <c>$"`{text}`"</c> would let one of them close the span early and
+    /// corrupt the rest of the document.
+    /// </summary>
+    internal static string CodeSpan(string text)
+    {
+        var flat = Flatten(text);
+        var fence = new string('`', LongestBacktickRun(flat) + 1);
+        var pad = flat.Length == 0 || flat[0] == '`' || flat[^1] == '`' ? " " : string.Empty;
+
+        return fence + pad + flat + pad + fence;
+    }
+
+    private static string Flatten(string text)
+    {
+        var chars = text.ToCharArray();
+        for (var i = 0; i < chars.Length; i++)
+        {
+            if (char.IsControl(chars[i]))
+            {
+                chars[i] = ' ';
+            }
+        }
+
+        return new string(chars).Trim();
+    }
+
+    private static int LongestBacktickRun(string text)
+    {
+        var longest = 0;
+        var current = 0;
+        foreach (var c in text)
+        {
+            current = c == '`' ? current + 1 : 0;
+            longest = Math.Max(longest, current);
+        }
+
+        return longest;
+    }
+
+    /// <summary>
+    /// Escapes the display half of a markdown link. Symbol names are identifiers in practice, but they
+    /// reach here from untrusted source text (§2.3), and a stray <c>]</c> would end the link text early
+    /// and turn the rest of the line into prose.
+    ///
+    /// <para><b>A backtick is replaced rather than escaped, and it is the link's survival that is at
+    /// stake, not its rendering.</b> <see cref="OKF4net.LinkScanner"/>'s <c>BlankInlineCode</c> toggles a
+    /// code span on <i>every</i> backtick and blanks to the end of the line, so a bullet whose label
+    /// carries an ODD number of them has its own <c>](/id)</c> blanked before <c>ScanLineLinks</c> ever
+    /// sees it: the link vanishes, the target file still exists, and nothing dangles, so
+    /// <c>okf validate</c> stays silent while the branch is severed -- the same failure shape as an
+    /// unbalanced fence, one character wide. Reachable through <c>overview</c>'s own children, since a
+    /// doc concept's title is lifted verbatim from the README's <c>#</c> heading and an unbalanced
+    /// backtick in one (<c>Migrating to `v2</c>) is an ordinary typo.</para>
+    ///
+    /// <para><b>Why <c>&amp;#96;</c> and not <c>\`</c>.</b> A backslash would be correct for a renderer --
+    /// CommonMark escapes a backtick like any ASCII punctuation -- and useless here, because
+    /// <c>BlankInlineCode</c> has no backslash awareness at all, deliberately (see
+    /// <see cref="NeutralizeMarkdownLinks"/>, which mirrors that rule rather than CommonMark's for
+    /// exactly this reason). Only a form carrying no backtick CHARACTER leaves the consumer's state
+    /// machine alone, and a numeric character reference renders as the character the author wrote. The
+    /// substitution is not applied to <see cref="CodeSpan"/>, where a backtick is content and the fence
+    /// is widened around it instead.</para>
+    /// </summary>
+    internal static string LinkText(string text) =>
+        Flatten(text).Replace("\\", "\\\\", StringComparison.Ordinal)
+            .Replace("`", "&#96;", StringComparison.Ordinal)
+            .Replace("[", "\\[", StringComparison.Ordinal)
+            .Replace("]", "\\]", StringComparison.Ordinal);
+}
diff --git a/producers/tests/OkfProducer.Tests/CliTests.cs b/producers/tests/OkfProducer.Tests/CliTests.cs
index 5fe11b42..f1e7984e 100644
--- a/producers/tests/OkfProducer.Tests/CliTests.cs
+++ b/producers/tests/OkfProducer.Tests/CliTests.cs
@@ -254,6 +254,174 @@ public void A_run_that_could_not_attribute_its_namespaces_says_so_on_stderr()
         Assert.DoesNotContain("no source-ownership map was supplied", result.Output, StringComparison.Ordinal);
     }
 
+    [Fact]
+    public void A_run_that_capped_a_public_member_at_its_internal_container_says_so()
+    {
+        // The one deletion in this producer that nothing else can report. Scope filters on EFFECTIVE
+        // visibility, so a `public` member of an `internal` type is out -- correct, since C# caps it
+        // there -- but an earlier version emitted it, tagged `public`, and regenerating over such a
+        // bundle PRUNES it. `BundleWriter`'s scope-narrowing guard cannot say so: it compares the
+        // recorded scope FLAGS, and those are identical on both sides. It is the rule that narrowed.
+        //
+        // Measured before the note existed, on this exact shape: five concepts deleted, nothing
+        // printed. A note rather than a refusal to prune, because the concepts really are out of scope
+        // and keeping them would republish the internal API the flag was left off to exclude.
+        using var workspace = NewWorkspace(out var repo, out var bundle);
+        WriteSource(repo, "src/Capped.cs", """
+            namespace Demo;
+
+            internal class Outer
+            {
+                /// <summary>Public, but nothing outside the assembly can reach it.</summary>
+                public void Reachable() { }
+            }
+            """);
+
+        var result = Run("generate", "--repo", repo, "--out", bundle);
+
+        Assert.Equal(0, result.ExitCode);
+        Assert.Contains("1 declaration(s) are public in their own right but enclosed by an internal type", result.Error, StringComparison.Ordinal);
+        Assert.Contains("Pass --include-internal to keep them", result.Error, StringComparison.Ordinal);
+
+        // Counted once, and only for what the CAP removed: `Outer` is out by its own modifier, so it
+        // must not be in the count -- an inflated number would send an operator looking for a
+        // declaration the flag would not bring back.
+        AssertAbsent(bundle, "code/csharp/demo/outer/reachable");
+    }
+
+    [Fact]
+    public void A_run_that_capped_nothing_stays_silent_about_it()
+    {
+        // The other half, so the note cannot become one every run prints and nobody reads. The default
+        // fixture has no internal container, so there is nothing to cap.
+        using var workspace = NewWorkspace(out var repo, out var bundle);
+
+        var result = Run("generate", "--repo", repo, "--out", bundle);
+
+        Assert.Equal(0, result.ExitCode);
+        Assert.DoesNotContain("enclosed by an internal type", result.Error, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void A_run_that_never_reached_roslyn_does_not_name_roslyn_as_having_produced_it()
+    {
+        // §6.2: `generated.by` is a determinism claim -- "these engine versions produced these bytes"
+        // -- so naming an engine that did not run makes the claim false in the direction that matters,
+        // by promising reproducibility against a tool the run never invoked.
+        //
+        // It was named unconditionally on every run that was not --no-code, which covers three cases
+        // where Roslyn demonstrably never ran: --no-msbuild, a repository with no project file (this
+        // fixture: a package.json and C# sources, no .csproj), and an exhausted --roslyn-timeout.
+        // `ProducerFixture` had the rule right for its own capture -- "tree-sitter alone, because
+        // tree-sitter alone ran" -- and the shipped CLI did not, which is why the golden could not
+        // catch it.
+        using var workspace = NewWorkspace(out var repo, out var bundle);
+
+        var result = Run("generate", "--repo", repo, "--out", bundle);
+
+        Assert.Equal(0, result.ExitCode);
+
+        // Read off `generated.engines`, not `generated.by`: the engines used to be appended to the
+        // actor, which §7 does not allow, so the list moved to a sibling key. `by` is now an actor and
+        // says nothing about engines at all -- which is why this assertion had to move with it rather
+        // than merely be adjusted.
+        var generated = Frontmatter(bundle, "overview").Get("generated")?.AsMapping();
+        var engines = generated?.Get("engines")?.AsSequence()?.Select(i => i.AsDisplayString()).ToList();
+
+        Assert.Equal(ConceptGenerator.ProducerActor, generated?.Get("by")?.AsDisplayString());
+        Assert.NotNull(engines);
+        Assert.Contains(engines, e => e!.StartsWith("tree-sitter/", StringComparison.Ordinal));
+        Assert.DoesNotContain(engines, e => e!.StartsWith("roslyn/", StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData("-1", "must be a positive number of seconds")]
+    // Zero is refused, and it used to be the one value where the accepted domain and the stated domain
+    // disagreed: the guard rejected only `< 0` with a message saying the value must be POSITIVE, then
+    // mapped 0 to "no budget" -- so an operator, or a wrapper script whose remaining budget had counted
+    // down to zero, asked for the smallest possible bound and silently got the largest one. It reads as
+    // absent only because the option's default was also 0; the option is nullable now, so the two are
+    // distinguishable and zero is refused like any other non-positive budget.
+    [InlineData("0", "must be a positive number of seconds")]
+    // Above TimeSpan.MaxValue.TotalSeconds (~9.22e11). Accepted by the `>= 0` guard this used to have,
+    // then thrown out of TimeSpan.FromSeconds as an unhandled OverflowException with a stack trace.
+    [InlineData("1000000000000", "no larger than")]
+    // Positive as a double, zero as a TimeSpan: under one tick (1e-7 s) it truncated to TimeSpan.Zero,
+    // which TryCreateWithin refuses by contract -- an unhandled ArgumentOutOfRangeException from inside
+    // the run. The guard tested the double's range; the value that reaches the API is a TimeSpan, and
+    // those are two different ranges.
+    [InlineData("0.00000001", "smaller than the smallest budget")]
+    public void A_roslyn_budget_outside_the_expressible_range_is_refused_with_an_error_not_a_stack_trace(
+        string value, string because)
+    {
+        using var workspace = NewWorkspace(out var repo, out var bundle);
+
+        var result = Run("generate", "--repo", repo, "--out", bundle, "--roslyn-timeout", value);
+
+        Assert.Equal(1, result.ExitCode);
+        Assert.Contains(because, result.Error, StringComparison.Ordinal);
+        Assert.DoesNotContain("Unhandled exception", result.Error, StringComparison.Ordinal);
+        Assert.False(Directory.Exists(bundle), $"'{value}' was refused but the run still created the bundle.");
+    }
+
+    [Theory]
+    // The decimal point is '.', on every machine. Without a custom parser System.CommandLine converts a
+    // double with the CURRENT culture and NumberStyles.AllowThousands, so this option meant different
+    // things in different places: measured under de-DE, `1.5` parsed as 15 and `0.001` as 1 -- exit 0,
+    // no diagnostic, a budget 10^n too large from the exact form the README documents -- while fr-FR
+    // refused the same `1.5` outright. A multiplied budget changes which projects finish, so it changes
+    // the emitted `## Calls` links, the containment links and `generated.engines`: the machine's locale
+    // would have decided bundle content, which is what §6.2 pins determinism against.
+    [InlineData("1,5")]
+    [InlineData("1 000")]
+    [InlineData("90s")]
+    public void A_roslyn_budget_is_read_invariantly_so_a_separator_is_a_typo_and_not_a_grouping(string value)
+    {
+        using var workspace = NewWorkspace(out var repo, out var bundle);
+
+        var result = Run("generate", "--repo", repo, "--out", bundle, "--roslyn-timeout", value);
+
+        Assert.NotEqual(0, result.ExitCode);
+        Assert.Contains("is not a number of seconds", result.Error, StringComparison.Ordinal);
+        Assert.False(Directory.Exists(bundle), $"'{value}' was refused but the run still created the bundle.");
+    }
+
+    [Fact]
+    public void The_help_says_what_supplying_a_roslyn_budget_costs()
+    {
+        // The option is opt-in because it makes the emitted bundle a function of machine speed, and an
+        // operator has to be able to read that BEFORE reaching for it -- so both halves of the warning
+        // are pinned: that unbounded is the default, and that the abandonment is whole, not partial.
+        //
+        // This was called `No_roslyn_budget_is_the_default_and_...`, and the first half of that name
+        // was a claim about BEHAVIOUR made entirely out of help text. Reading a sentence that says
+        // "absent means unbounded" cannot show that absent means unbounded; the test below is what
+        // does, by observing that a default run has no budget to run out of.
+        var result = Run("generate", "--help");
+        var help = Collapse(result.Output);
+
+        Assert.Equal(0, result.ExitCode);
+        Assert.Contains("--roslyn-timeout", help, StringComparison.Ordinal);
+        Assert.Contains("absent means unbounded", help, StringComparison.Ordinal);
+        Assert.Contains("the stage is abandoned WHOLE, not truncated", help, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void A_run_with_no_roslyn_budget_never_abandons_the_stage_for_running_out_of_one()
+    {
+        // The behavioural half. "Absent means unbounded" is observable in one place -- the note the
+        // abandonment prints -- so a default run must never carry it, however long the stage takes.
+        // Asserted against the note's own text rather than a timing measurement, which would make the
+        // test a function of the machine exactly as the option makes the bundle one.
+        using var workspace = NewWorkspace(out var repo, out var bundle);
+
+        var result = Run("generate", "--repo", repo, "--out", bundle);
+
+        Assert.Equal(0, result.ExitCode);
+        Assert.DoesNotContain("--roslyn-timeout of", result.Error, StringComparison.Ordinal);
+        Assert.DoesNotContain("ran out before the Roslyn stage finished", result.Error, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void Check_passes_on_a_bundle_that_matches_its_repository()
     {
@@ -477,6 +645,14 @@ public void A_repo_url_that_is_not_an_absolute_http_url_is_rejected_before_anyth
     [InlineData("/srv/demo", false)]
     [InlineData("", false)]
     [InlineData(null, false)]
+
+    // Two shapes the table omitted, both verified correct and neither proved by it. `javascript:` is
+    // the scheme a permalink must never carry into a bundle a viewer will render. And a
+    // scheme-relative `//host/path` is rejected for a reason worth having a row for rather than
+    // relying on: .NET parses it as `Scheme="file"`, so it fails the http/https check as a quirk of
+    // the parser rather than by an explicit rule, and a future parser change would flip it silently.
+    [InlineData("javascript:alert(1)", false)]
+    [InlineData("//github.com/acme/demo", false)]
     public void The_permalink_base_rule_is_one_definition_shared_by_the_generator_and_the_cli(string? repoUrl, bool expected)
     {
         // Pinned as a table because this rule now has two consumers who must not diverge: the
@@ -1025,6 +1201,11 @@ public void Check_help_carries_the_whole_exclusion_list()
         // Compared with whitespace collapsed, since the help renderer wraps to the console width.
         var result = Run("generate", "--help");
 
+        // `--help` is a successful invocation, not a refused one, and this file's every other test
+        // says so about its own run. Both `--help` tests here asserted only the text, so a regression
+        // that printed the whole help and then exited non-zero -- a shell script's `okfgen --help ||
+        // exit 1` breaking for nobody's benefit -- had nothing to fail.
+        Assert.Equal(0, result.ExitCode);
         Assert.Contains(Collapse(BundleDrift.CheckDescription), Collapse(result.Output), StringComparison.Ordinal);
     }
 
@@ -1043,8 +1224,10 @@ public void The_help_keeps_the_clauses_that_make_its_two_hazard_sentences_true()
         // counted, which makes the run partial", or back to "no process is spawned" -- turns this
         // red. README prose is deliberately NOT pinned here: it changes for good reasons, and a
         // substring test over it would be noise.
-        var help = Collapse(Run("generate", "--help").Output);
+        var result = Run("generate", "--help");
+        var help = Collapse(result.Output);
 
+        Assert.Equal(0, result.ExitCode);
         Assert.Contains("but drops an over-cap item silently", help, StringComparison.Ordinal);
         Assert.Contains(
             "It does not make the run process-free: `git` still runs in the scanned tree",
@@ -1158,6 +1341,115 @@ private static void CommitAndDetach(string repoPath)
         Assert.Null(GitRevision.CurrentBranch(repoPath));
     }
 
+
+    [Fact]
+    public void The_validate_verb_reports_a_conformant_bundle_and_exits_zero()
+    {
+        // Nothing in the solution called Run("validate", ...) at all, so everything the composition
+        // root wires for this verb -- the option name, the diagnostic lines, the count line, the
+        // IsConformant ternary and the BundleLoadException branch -- was held by no test, while this
+        // class's own doc claimed it exercises "the shipped composition, in process".
+        // BundleValidationRunnerTests covers the runner; these four cover the CLI around it.
+        using var workspace = NewWorkspace(out var repo, out var bundle);
+        Assert.Equal(0, Run("generate", "--repo", repo, "--out", bundle).ExitCode);
+
+        var result = Run("validate", "--okf", bundle);
+
+        Assert.Equal(0, result.ExitCode);
+        Assert.Contains("0 error(s)", result.Output, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void The_validate_verb_exits_one_on_a_bundle_that_is_not_conformant()
+    {
+        // The other side of the ternary, so inverting it fails one of the two rather than neither.
+        // A concept with no `type` is the one thing §11 hard-requires, so this is an error and not a
+        // warning -- warnings leave the bundle conformant and would not separate the branches.
+        using var workspace = NewWorkspace(out var repo, out var bundle);
+        Assert.Equal(0, Run("generate", "--repo", repo, "--out", bundle).ExitCode);
+        File.WriteAllText(Path.Combine(bundle, "broken.md"), "---\ntitle: t\n---\n\nbody\n");
+
+        var result = Run("validate", "--okf", bundle);
+
+        Assert.Equal(1, result.ExitCode);
+    }
+
+    [Fact]
+    public void The_validate_verb_reports_an_unloadable_bundle_on_stderr_and_exits_one()
+    {
+        // The catch (BundleLoadException) branch. Dropping it turns a missing bundle from a reported
+        // error into an unhandled exception, and no test noticed.
+        using var workspace = NewWorkspace(out _, out var bundle);
+
+        var result = Run("validate", "--okf", Path.Combine(bundle, "does-not-exist"));
+
+        Assert.Equal(1, result.ExitCode);
+        Assert.StartsWith("error: ", result.Error, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void The_validate_verb_names_its_bundle_option_okf()
+    {
+        // Pins the option NAME. The bundle is generated first, and that is the whole fixture: without
+        // it, `--bundle` on a path that does not exist exits non-zero whether the option is recognised
+        // or not, so the assertion holds under the rename it claims to catch -- measured, after the
+        // first version of this test did exactly that.
+        using var workspace = NewWorkspace(out var repo, out var bundle);
+        Assert.Equal(0, Run("generate", "--repo", repo, "--out", bundle).ExitCode);
+
+        Assert.NotEqual(0, Run("validate").ExitCode);
+        Assert.NotEqual(0, Run("validate", "--bundle", bundle).ExitCode);
+    }
+
+    [Fact]
+    public void A_repository_with_no_commit_yet_reports_no_branch_name()
+    {
+        // MEASURED, and the reason this is not the detached-HEAD case one property over: on a
+        // zero-commit repository `git symbolic-ref` SUCCEEDS and returns the unborn branch, while
+        // `git rev-parse HEAD` fails. Reading only the first left `--repo-url` without `--rev` emitting
+        // a `resource` permalink on every code concept, each pointing into a branch that contains none
+        // of the files -- and the CLI's "no branch name could be read" note never fired to say so. A
+        // wrong link reads exactly as confidently as a right one, which §2.3 calls the worse outcome.
+        ProducerFixture.RequireGit();
+        using var workspace = NewWorkspace(out var repo, out _);
+
+        ProducerFixture.Git(repo, "init", "-q");
+
+        Assert.Null(GitRevision.CurrentBranch(repo));
+
+        // The other direction, so the assertion above cannot pass because the fixture simply has no
+        // working git: the SAME repository, one commit later, does report a branch.
+        ProducerFixture.Git(repo, "config", "user.email", "cli-tests@example.invalid");
+        ProducerFixture.Git(repo, "config", "user.name", "CLI Tests");
+        ProducerFixture.Git(repo, "config", "commit.gpgsign", "false");
+        ProducerFixture.Git(repo, "add", "-A");
+        ProducerFixture.Git(repo, "commit", "-q", "-m", "fixture");
+
+        Assert.NotNull(GitRevision.CurrentBranch(repo));
+    }
+
+    [Fact]
+    public void Force_is_an_alias_for_reset_and_not_a_flag_that_does_nothing()
+    {
+        // `--force` is documented as an alias for `--reset` and was exercised by no test at all:
+        // dropping the `|| forceOption` clause at the composition root broke the alias silently, and
+        // an operator using it would have got a run that refused a non-empty --out instead of
+        // recreating it.
+        //
+        // The fixture is what makes this discriminate. A bundle that already holds a file the
+        // regeneration does not produce is the only shape where reset and no-reset differ observably:
+        // without the alias the run refuses the non-empty directory, and with it the stray file is gone.
+        using var workspace = NewWorkspace(out var repo, out var bundle);
+        Assert.Equal(0, Run("generate", "--repo", repo, "--out", bundle).ExitCode);
+
+        var stray = Path.Combine(bundle, "hand-written.md");
+        File.WriteAllText(stray, "---\ntype: Note\ntitle: t\ndescription: d\n---\n\nbody\n");
+
+        var result = Run("generate", "--repo", repo, "--out", bundle, "--force");
+
+        Assert.Equal(0, result.ExitCode);
+        Assert.False(File.Exists(stray), "--force did not recreate the bundle, so it is not behaving as --reset.");
+    }
     // ---- assertions -------------------------------------------------------------------------
 
     private sealed record CliResult(int ExitCode, string Output, string Error);
diff --git a/producers/tests/OkfProducer.Tests/CodeGraph/CodeGraphBuilderTests.cs b/producers/tests/OkfProducer.Tests/CodeGraph/CodeGraphBuilderTests.cs
index 58a9f2c4..26d4e456 100644
--- a/producers/tests/OkfProducer.Tests/CodeGraph/CodeGraphBuilderTests.cs
+++ b/producers/tests/OkfProducer.Tests/CodeGraph/CodeGraphBuilderTests.cs
@@ -4,8 +4,35 @@
 
 namespace OkfProducer.Tests.CodeGraph;
 
-public class CodeGraphBuilderTests
+public class CodeGraphBuilderTests : IDisposable
 {
+    /// <summary>
+    /// Every temp repository <c>SnapshotWith</c> made, deleted on the way out. It used to make one per
+    /// call and delete none -- nine per run, forever, in the user's temp directory.
+    /// </summary>
+    private readonly List<string> _tempDirectories = [];
+
+    /// <inheritdoc/>
+    public void Dispose()
+    {
+        foreach (var directory in _tempDirectories)
+        {
+            try
+            {
+                Directory.Delete(directory, recursive: true);
+            }
+            catch (IOException)
+            {
+                // Best-effort: a locked file on the way out must not fail a green run.
+            }
+            catch (UnauthorizedAccessException)
+            {
+            }
+        }
+
+        GC.SuppressFinalize(this);
+    }
+
     private static readonly LanguageProfile CSharpProfile =
         new("csharp", "tree-sitter-c-sharp", "", "", "///", [".cs"]);
 
@@ -19,10 +46,13 @@ private sealed class StubExtractor(params SymbolFact[] symbols) : ILanguageExtra
     {
         public IReadOnlyList<CallSite> Sites { get; init; } = [];
 
+        /// <summary>What this stub reports for a file it IS asked about. <see cref="FileStatus.Extracted"/> unless a test needs a skip.</summary>
+        public FileStatus Status { get; init; } = FileStatus.Extracted;
+
         public ExtractionResult Extract(string relativePath, string absolutePath, LanguageProfile profile, ExtractionLimits limits) =>
             new([.. symbols.Where(s => s.RelativePath == relativePath)],
                 [.. Sites.Where(s => s.RelativePath == relativePath)],
-                FileStatus.Extracted);
+                Status);
     }
 
     private sealed class CapturingExtractor : ILanguageExtractor
@@ -157,6 +187,18 @@ public void A_file_matching_no_profile_is_skipped_without_affecting_completeness
 
         Assert.Empty(graph.Symbols);
         Assert.True(graph.Status.IsComplete);
+
+        // The control, without which the assertion above could not fail: the stub reports Extracted
+        // for anything it is asked about, so `IsComplete` was true for BOTH the property under test
+        // and its negation. Same builder over a file a profile DOES claim, reporting a skip, moves it
+        // -- so `true` above is a fact about the .txt file being unreached, not about the stub.
+        var skipped = new CodeGraphBuilder(
+                new StubExtractor(Member("T", "Caller")) { Status = FileStatus.SkippedTooLarge },
+                CSharpProfiles,
+                [])
+            .Build(SnapshotWith("A.cs"), ExtractionLimits.Default, ScopeOptions.Default);
+
+        Assert.False(skipped.Status.IsComplete);
     }
 
     [Fact]
@@ -283,9 +325,10 @@ public void A_private_declaration_of_the_same_name_makes_the_call_ambiguous_even
     /// <see cref="RepositorySnapshot.RepoPath"/>, the same way <see cref="RepositoryScanner"/> does
     /// for manifests.
     /// </summary>
-    private static RepositorySnapshot SnapshotWith(params string[] relativePaths)
+    private RepositorySnapshot SnapshotWith(params string[] relativePaths)
     {
         var repoPath = Directory.CreateTempSubdirectory("okfproducer-codegraph-").FullName;
+        _tempDirectories.Add(repoPath);
         foreach (var relativePath in relativePaths)
         {
             var fullPath = Path.Combine(repoPath, relativePath.Replace('/', Path.DirectorySeparatorChar));
@@ -295,4 +338,46 @@ private static RepositorySnapshot SnapshotWith(params string[] relativePaths)
 
         return new RepositorySnapshot(repoPath, "test-repo", [], []);
     }
+
+    /// <summary>Answers a site nobody gave it, which is precisely what <see cref="ISymbolResolver.Resolve"/>'s contract forbids.</summary>
+    private sealed class PhantomResolver(CallSite phantom) : ISymbolResolver
+    {
+        public bool Owns(string relativePath) => true;
+
+        public IReadOnlyList<ResolvedEdge> Resolve(IReadOnlyList<CallSite> sites, IReadOnlyList<SymbolFact> symbols) =>
+            [new ResolvedEdge(phantom, "T", phantom.CalledName, EdgeConfidence.Exact)];
+    }
+
+    [Fact]
+    public void An_edge_for_a_site_the_extractor_never_emitted_is_dropped()
+    {
+        // The verdict dictionary used to take whatever a resolver handed back -- `verdicts[key] = edge`
+        // with no membership test -- so an edge naming a site nobody extracted was added to the graph.
+        // A stale offset, a file the resolver read for itself, an off-by-one in an engine's own
+        // conversion: any of them produced a `## Calls` link attributed to a caller that does not exist,
+        // and the contract Resolve states ("answer the sites you were given") was enforced nowhere.
+        //
+        // The phantom differs from the real site only by OFFSET, and its caller is a REAL declared
+        // symbol -- both deliberate. An unknown caller is already filtered later, by the invariant that
+        // no edge may name a caller absent from Symbols, so a phantom with a made-up caller would be
+        // caught by machinery that has nothing to do with this contract and the test would pass over a
+        // missing guard. Measured: the first version of this fixture did exactly that.
+        // Offset is also the identity half an engine is most likely to get wrong, and the half no
+        // name-based assertion would notice.
+        var real = new CallSite("T", "Caller", "Callee", "A.cs", 42);
+        var phantom = new CallSite("T", "Caller", "Callee", "A.cs", 999);
+
+        var builder = new CodeGraphBuilder(
+            new StubExtractor(Member("T", "Caller"), Member("T", "Callee")) { Sites = [real] },
+            CSharpProfiles,
+            [new PhantomResolver(phantom)]);
+
+        var graph = builder.Build(SnapshotWith("A.cs"), ExtractionLimits.Default, ScopeOptions.Default);
+
+        // The real site is still there, unresolved -- the phantom did not displace it either.
+        var edge = Assert.Single(graph.Edges);
+        Assert.Equal(42, edge.Site.Offset);
+        Assert.Equal("Caller", edge.Site.CallerName);
+        Assert.Equal(EdgeConfidence.Unresolved, edge.Confidence);
+    }
 }
diff --git a/producers/tests/OkfProducer.Tests/CodeGraph/HostileInputTests.cs b/producers/tests/OkfProducer.Tests/CodeGraph/HostileInputTests.cs
index 25a291c6..21304129 100644
--- a/producers/tests/OkfProducer.Tests/CodeGraph/HostileInputTests.cs
+++ b/producers/tests/OkfProducer.Tests/CodeGraph/HostileInputTests.cs
@@ -158,15 +158,39 @@ public void A_file_over_the_size_cap_is_skipped_whole_never_truncated()
     [Fact]
     public void The_size_check_never_loads_an_oversized_file_into_memory()
     {
-        // The file's declared length alone must decide SkippedTooLarge -- the extractor is never
-        // given a chance to read its bytes at all. A file that reports itself too large but whose
-        // actual bytes (if ever read) would decode fine still gets rejected on length.
+        // The claim is about an operation that does NOT happen, so no FileStatus can carry it:
+        // rejecting on the declared length and reading first then rejecting both end at
+        // SkippedTooLarge. Before the reader seam existed this test asserted only that status, and
+        // MEASURED green with `File.ReadAllBytes` hoisted above the length check -- it named an
+        // ordering it could not see. The recording reader is what turns the claim into an assertion.
         using var tmp = new TempDir();
         var path = tmp.Write("big.cs", "namespace N;\npublic class T {}");
+        var reader = new RecordingReader();
+        using var extractor = new TreeSitterExtractor(reader);
 
-        var result = Extract(path, ExtractionLimits.Default with { MaxFileBytes = 1 });
+        var result = extractor.Extract(
+            "big.cs", path, CSharpProfile.Instance, ExtractionLimits.Default with { MaxFileBytes = 1 });
 
         Assert.Equal(FileStatus.SkippedTooLarge, result.Status);
+        Assert.False(reader.Opened);
+    }
+
+    /// <summary>
+    /// An <see cref="IFileSystemReader"/> over the real filesystem that records whether the bytes were
+    /// ever opened. Length still comes from disk, so the size decision under test is the production
+    /// one.
+    /// </summary>
+    private sealed class RecordingReader : IFileSystemReader
+    {
+        public bool Opened { get; private set; }
+
+        public long? TryGetLength(string absolutePath) => SystemFileReader.Instance.TryGetLength(absolutePath);
+
+        public Stream OpenRead(string absolutePath)
+        {
+            Opened = true;
+            return SystemFileReader.Instance.OpenRead(absolutePath);
+        }
     }
 
     [Fact]
@@ -1052,4 +1076,39 @@ public void Dispose()
             }
         }
     }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-1)]
+    public void A_non_positive_timeout_is_refused_at_construction_rather_than_mid_run(int seconds)
+    {
+        // A non-positive deadline cancels the linked source immediately, so `CodeGraphBuilder.Build`
+        // RAISED out of the walk instead of returning an incomplete RunStatus -- the honest reporting
+        // path this type exists to feed. An operator who typed a bad number got a stack trace where
+        // the design promises a run that says what it could not do.
+        Assert.Throws<ArgumentOutOfRangeException>(
+            () => ExtractionLimits.Default with { Timeout = TimeSpan.FromSeconds(seconds) });
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-1)]
+    public void A_non_positive_size_or_depth_is_refused_too(int value)
+    {
+        // Same rule, same reason: a bound of zero does not bound a run, it empties one, and doing that
+        // silently is worse than saying no.
+        Assert.Throws<ArgumentOutOfRangeException>(() => ExtractionLimits.Default with { MaxFileBytes = value });
+        Assert.Throws<ArgumentOutOfRangeException>(() => ExtractionLimits.Default with { MaxDepth = value });
+    }
+
+    [Fact]
+    public void The_default_limits_are_themselves_valid()
+    {
+        // The control: the validation above runs in the property initialisers, so a wrong predicate
+        // would make the type unconstructable and every other test in this solution would fail with a
+        // reason that has nothing to do with what it was testing.
+        Assert.True(ExtractionLimits.Default.MaxFileBytes > 0);
+        Assert.True(ExtractionLimits.Default.MaxDepth > 0);
+        Assert.True(ExtractionLimits.Default.Timeout > TimeSpan.Zero);
+    }
 }
diff --git a/producers/tests/OkfProducer.Tests/CodeGraph/RoslynResolverTests.cs b/producers/tests/OkfProducer.Tests/CodeGraph/RoslynResolverTests.cs
index c44d607b..590ee501 100644
--- a/producers/tests/OkfProducer.Tests/CodeGraph/RoslynResolverTests.cs
+++ b/producers/tests/OkfProducer.Tests/CodeGraph/RoslynResolverTests.cs
@@ -133,8 +133,8 @@ public void An_unknown_language_version_costs_its_own_project_and_no_other()
         Assert.Contains("99", stranded.Detail, StringComparison.Ordinal);
 
         // The run continued, and said honestly that it is partial.
-        Assert.True(resolver.IsAvailable, Describe(resolver));
-        Assert.False(resolver.IsComplete);
+        Assert.True(AnyCompiled(resolver), Describe(resolver));
+        Assert.False(AllCompiled(resolver));
 
         // The stranded project is left to the baseline; the sound one still resolves exactly.
         Assert.False(resolver.Owns("stranded/Stranded.cs"));
@@ -331,8 +331,8 @@ public void A_project_that_cannot_be_queried_is_reported_unavailable_rather_than
 
         var resolver = RoslynResolver.Create(RepoRoot(), [missing]);
 
-        Assert.False(resolver.IsAvailable);
-        Assert.False(resolver.IsComplete);
+        Assert.False(AnyCompiled(resolver));
+        Assert.False(AllCompiled(resolver));
         Assert.False(resolver.Owns("src/OKF4net/ConceptId.cs"));
         var report = Assert.Single(resolver.Projects);
         Assert.Equal(RoslynProjectAvailability.MsBuildQueryFailed, report.Availability);
@@ -356,8 +356,8 @@ public void A_resolver_that_ran_cleanly_says_so_even_when_it_resolves_nothing()
         // moved: Resolve builds its result by iterating `sites`, so it returns empty for ANY
         // implementation of it, including a broken one. That assertion could not fail. The three
         // below can: each names a value this fixture's own restore-and-compile has to have produced.
-        Assert.True(_scratch.Resolver.IsAvailable);
-        Assert.True(_scratch.Resolver.IsComplete);
+        Assert.True(AnyCompiled(_scratch.Resolver));
+        Assert.True(AllCompiled(_scratch.Resolver));
         Assert.All(_scratch.Resolver.Projects, p => Assert.Equal(RoslynProjectAvailability.Compiled, p.Availability));
     }
 
@@ -373,16 +373,71 @@ public void A_resolver_with_no_projects_at_all_is_not_complete()
         // What that wrong answer costs is a SILENT report, not a deletion. Task 11 settled that this
         // property is not the pruning gate and cannot be one: no resolver contributes a symbol to
         // CodeGraph.Symbols, so a degraded resolver can turn a call link into a code span but never
-        // make a concept absent, and pruning acts on absence. See RoslynResolver.IsComplete's own doc
+        // make a concept absent, and pruning acts on absence. See this file's AllCompiled doc
         // comment; pruning gates on RunStatus.TraversalComplete plus the per-file FileStatus.
         var resolver = RoslynResolver.Create(RepoRoot(), []);
 
-        Assert.False(resolver.IsComplete);
-        Assert.False(resolver.IsAvailable);
+        Assert.False(AllCompiled(resolver));
+        Assert.False(AnyCompiled(resolver));
         Assert.Empty(resolver.Projects);
         Assert.False(resolver.Owns("src/OKF4net/ConceptId.cs"));
     }
 
+    [Fact]
+    public void An_exhausted_budget_abandons_the_stage_whole_rather_than_publishing_what_finished()
+    {
+        // The property that makes an opt-in budget safe to offer at all. Returning the projects that
+        // happened to finish first would emit a bundle whose exact and name-matched links are divided
+        // by how fast the machine was, with nothing recording where the line fell -- §2.1 rates that
+        // below having no exact resolver, because its reader cannot tell which half they are holding.
+        //
+        // The budget is deterministic rather than racy despite naming a duration: it is checked at the
+        // top of each per-project iteration, and the FIRST `dotnet msbuild` query is a subprocess that
+        // cannot return in under a millisecond. So by the time the compile loop looks, the budget is
+        // spent, on any machine.
+        using var repository = new TwoProjectRepository();
+
+        var completed = RoslynResolver.TryCreateWithin(
+            repository.Root, [repository.ApplicationProject], limits: null, TimeSpan.FromMilliseconds(1), out var resolver);
+
+        Assert.False(completed);
+        Assert.Null(resolver);
+    }
+
+    [Fact]
+    public void An_ample_budget_resolves_exactly_what_an_unbounded_run_does()
+    {
+        // The other half: opting in must change nothing when the budget is not the binding constraint,
+        // or the option would be a second code path rather than a bound on the one that exists. Both
+        // sides go through the same private core; this is what says so out loud.
+        using var repository = new TwoProjectRepository();
+
+        var unbounded = RoslynResolver.Create(repository.Root, [repository.ApplicationProject]);
+        var completed = RoslynResolver.TryCreateWithin(
+            repository.Root, [repository.ApplicationProject], limits: null, TimeSpan.FromMinutes(5), out var bounded);
+
+        Assert.True(completed);
+        Assert.NotNull(bounded);
+        Assert.Equal(
+            unbounded.Projects.Select(p => (p.ProjectPath, p.Availability)),
+            bounded.Projects.Select(p => (p.ProjectPath, p.Availability)));
+        Assert.Equal(
+            unbounded.Owns(repository.ApplicationSourceFile[(repository.Root.Length + 1)..].Replace('\\', '/')),
+            bounded.Owns(repository.ApplicationSourceFile[(repository.Root.Length + 1)..].Replace('\\', '/')));
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-1)]
+    public void A_budget_that_is_not_positive_is_a_caller_error_rather_than_an_instant_abandonment(int seconds)
+    {
+        // Zero would abandon before the stage started, which is what `--no-msbuild` already says, and
+        // says better -- it names the two things that are lost. Silently accepting it here would give
+        // the CLI two spellings of one behaviour, one of them undocumented.
+        Assert.Throws<ArgumentOutOfRangeException>(
+            () => RoslynResolver.TryCreateWithin(RepoRoot(), [], limits: null, TimeSpan.FromSeconds(seconds), out _));
+    }
+
     // Source for the test below. Roslyn strips the @ from a verbatim identifier and the grammar keeps
     // it, so the two disagree about this method's name on both sides of the join at once.
     public const string VerbatimSource = """
@@ -473,7 +528,7 @@ public class @class
     // The other half of the same defect, and it needs no verbatim identifier at all: Roslyn mangles
     // an explicit interface implementation's name to its qualified form (Explicitly.IShape.Draw), so
     // a local function declared inside one reports a container carrying two extra dots -- and
-    // therefore two extra SEGMENTS -- that the extractor's `Explicitly.Square.Draw` does not have.
+    // therefore two extra SEGMENTS -- that the extractor's `Explicitly.Square.IShape.Draw` does not have.
     public const string ExplicitImplementationSource = """
         namespace Explicitly;
         public interface IShape { void Draw(); }
@@ -515,16 +570,22 @@ public void A_verbatim_identifier_keeps_its_at_sign_in_the_container_as_well_as_
     [Fact]
     public void An_explicit_interface_implementation_contributes_the_segment_source_spells()
     {
+        // The segment reads `IShape.Draw` rather than `Draw` since an explicitly implemented member is
+        // named apart from a public one of the same name (D1b-I2). What this test pins is unchanged and
+        // is the point: BOTH sides say the same thing. It is what caught the drift when only the
+        // extractor learnt the rule -- an ancestor spelled one way here and another way there makes
+        // `CodeGraphBuilder` overwrite the baseline with a non-joining `Exact` and then degrade it,
+        // leaving the graph strictly worse than not running the resolver at all.
         var site = Assert.Single(_scratch.SitesIn("ExplicitImplementation.cs"), s => s.CalledName == "Nested");
 
         var baseline = Assert.Single(new NameMatchResolver().Resolve([site], _scratch.Symbols));
         Assert.Equal(EdgeConfidence.ByName, baseline.Confidence);
-        Assert.Equal("Explicitly.Square.Draw", baseline.TargetContainer);
+        Assert.Equal("Explicitly.Square.IShape.Draw", baseline.TargetContainer);
 
         var edge = Assert.Single(_scratch.Resolver.Resolve([site], _scratch.Symbols));
 
         Assert.Equal(EdgeConfidence.Exact, edge.Confidence);
-        Assert.Equal("Explicitly.Square.Draw", edge.TargetContainer);
+        Assert.Equal("Explicitly.Square.IShape.Draw", edge.TargetContainer);
         Assert.Contains(_scratch.Symbols, s => s.Container == edge.TargetContainer && s.Name == edge.TargetName);
     }
 
@@ -591,7 +652,7 @@ public void A_project_completed_by_a_source_generator_degrades_rather_than_resol
 
         var resolver = RoslynResolver.Create(repository.Root, [repository.Project]);
 
-        Assert.False(resolver.IsAvailable);
+        Assert.False(AnyCompiled(resolver));
         var report = Assert.Single(resolver.Projects);
         Assert.Equal(RoslynProjectAvailability.CompilationHadErrors, report.Availability);
         Assert.False(resolver.Owns("Serialization.cs"));
@@ -616,7 +677,7 @@ public void A_failed_project_does_not_retract_correct_edges_in_the_clean_project
         Assert.Equal(RoslynProjectAvailability.CompilationHadErrors, library.Availability);
         var application = Assert.Single(resolver.Projects, p => p.ProjectPath == repository.ApplicationProject);
         Assert.Equal(RoslynProjectAvailability.Compiled, application.Availability);
-        Assert.False(resolver.IsComplete);
+        Assert.False(AllCompiled(resolver));
 
         using var extractor = new TreeSitterExtractor();
         var extracted = extractor.Extract("app/Program.cs", repository.ApplicationSourceFile, CSharpProfile.Instance, ExtractionLimits.Default);
@@ -721,7 +782,7 @@ public void A_call_across_an_unbuilt_project_reference_still_resolves_Exact()
 
         var resolver = RoslynResolver.Create(repository.Root, [repository.ApplicationProject]);
 
-        Assert.True(resolver.IsComplete, Describe(resolver));
+        Assert.True(AllCompiled(resolver), Describe(resolver));
         Assert.Equal(2, resolver.Projects.Count);
 
         using var extractor = new TreeSitterExtractor();
@@ -762,7 +823,7 @@ public void A_compile_item_over_the_size_cap_is_refused_by_the_roslyn_engine_too
 
         Assert.False(capped.Owns("Big.cs"));
         // Still a cap and not a collapse: the project compiled and its in-bounds file is owned.
-        Assert.True(capped.IsComplete, Describe(capped));
+        Assert.True(AllCompiled(capped), Describe(capped));
         Assert.True(capped.Owns("Small.cs"), Describe(capped));
     }
 
@@ -960,6 +1021,29 @@ private static (int ExitCode, string Output, string Error) Generate(string repoP
     private static string Describe(RoslynResolver resolver) =>
         string.Join("; ", resolver.Projects.Select(p => $"{Path.GetFileName(p.ProjectPath)}: {p.Availability} {p.Detail}"));
 
+    /// <summary>
+    /// Whether at least one project compiled -- "ran, and resolved nothing" as against "could not run".
+    /// </summary>
+    /// <remarks>
+    /// These two predicates were <c>RoslynResolver.IsAvailable</c> and <c>RoslynResolver.IsComplete</c>
+    /// until this file became their only reader and they were removed. They live here now because that
+    /// is where they are used, and a derived one-liner over <see cref="RoslynResolver.Projects"/> is
+    /// what any caller wanting the summary would write.
+    /// </remarks>
+    private static bool AnyCompiled(RoslynResolver resolver) =>
+        resolver.Projects.Any(p => p.Availability == RoslynProjectAvailability.Compiled);
+
+    /// <summary>
+    /// Whether the repository was covered completely: at least one project, and every one compiled.
+    ///
+    /// <para>The <c>Count &gt; 0</c> clause is the point, not a formality. <c>All</c> over an empty list
+    /// is vacuously true, and an empty project list is precisely the state in which EVERY call fell back
+    /// to name matching -- reachable rather than theoretical, since finding no <c>.csproj</c> yields an
+    /// empty list and not an error.</para>
+    /// </summary>
+    private static bool AllCompiled(RoslynResolver resolver) =>
+        resolver.Projects.Count > 0 && resolver.Projects.All(p => p.Availability == RoslynProjectAvailability.Compiled);
+
     /// <summary>
     /// A hand-built <see cref="ProjectInputs"/> for the tests that only exercise
     /// <see cref="CompilationFactory"/>'s parse options: no MSBuild round trip, no files, nothing that
@@ -983,7 +1067,7 @@ private static (int Attached, int Total, int Exact, int Joined, string Unjoined)
         var resolver = RoslynResolver.Create(repositoryRoot, [projectPath]);
 
         Assert.True(
-            resolver.IsAvailable,
+            AnyCompiled(resolver),
             $"no project compiled, so attachment cannot be measured. This test needs a restored repository. {Describe(resolver)}");
 
         using var extractor = new TreeSitterExtractor();
@@ -1091,7 +1175,7 @@ public ScratchProject()
             Restore(projectPath);
 
             Resolver = RoslynResolver.Create(Root, [projectPath]);
-            Assert.True(Resolver.IsComplete, Describe(Resolver));
+            Assert.True(AllCompiled(Resolver), Describe(Resolver));
 
             using var extractor = new TreeSitterExtractor();
             var symbols = new List<SymbolFact>();
@@ -1902,4 +1986,80 @@ private static void Dotnet(string verb, string projectPath)
             process.ExitCode == 0,
             $"`dotnet {verb} {projectPath}` exited {process.ExitCode}: {stdout.GetAwaiter().GetResult()} {stderr.GetAwaiter().GetResult()}");
     }
+
+    [Fact]
+    public void A_missing_dotnet_cli_degrades_one_project_rather_than_ending_the_run()
+    {
+        // The "MSBuild absent" path, reachable until now only by uninstalling the SDK. What matters is
+        // not that it fails but HOW: as MsBuildQueryException, the one type RoslynResolver catches, so
+        // the project is reported unavailable and the name-matching baseline carries it. Anything else
+        // escaping here skips per-project degradation and takes generation down for the whole
+        // repository -- which is exactly what C2-1 was, and this absent test is why it went unnoticed.
+        using var repo = new OkfProducer.Tests.Generation.ProducerFixture.TempDir();
+        var project = Path.Combine(repo.Path, "Absent.csproj");
+        File.WriteAllText(project, "<Project Sdk=\"Microsoft.NET.Sdk\"><PropertyGroup><TargetFramework>net10.0</TargetFramework></PropertyGroup></Project>");
+
+        var ex = Record.Exception(() => MsBuildProjectQuery.Query(project, "okfgen-no-such-executable", TimeSpan.FromMinutes(2)));
+
+        Assert.IsType<MsBuildQueryException>(ex);
+        Assert.Contains("Absent.csproj", ex.Message, StringComparison.Ordinal);
+
+        // The MESSAGE, not just the type: `Run` guards a missing working directory separately and
+        // reports that instead, and both refusals are MsBuildQueryException. Asserting only the type
+        // let either answer for the other -- and the wrong one sends an operator hunting for an SDK
+        // that is installed.
+        Assert.Contains("dotnet CLI was not found", ex.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void A_query_that_outruns_its_deadline_is_killed_and_reported_as_a_timeout()
+    {
+        // The other branch spawning hid: reachable otherwise only by waiting two minutes.
+        //
+        // THE EXECUTABLE IS THE REAL ONE, and the previous fixture is why that matters. It substituted
+        // `sleep` for `dotnet` off Windows and `powershell` on it -- but `Run` always appends MSBuild's
+        // own argument list, so what actually launched was `sleep msbuild <proj> -nodeReuse:false ...`.
+        // GNU sleep rejects "msbuild" as a duration and exits 1 within milliseconds, so control reached
+        // the EXIT-CODE branch and never the deadline branch: the assertion below was red on Linux and
+        // macOS -- two thirds of the only guarantee `producers/` has, since it is outside CI. On
+        // Windows it passed, but on a race: PowerShell's startup merely happens to exceed the budget.
+        //
+        // Substituting the executable was the wrong idea rather than the wrong choice of stand-in,
+        // because no stand-in can both ignore MSBuild's arguments and refuse to exit. So this runs the
+        // real `dotnet msbuild` under a budget no real evaluation can meet: the host's own startup
+        // exceeds 200 ms before MSBuild reads a line of the project. That is deterministic on every
+        // platform, and it exercises the production path exactly as a two-minute overrun would.
+        using var repo = new OkfProducer.Tests.Generation.ProducerFixture.TempDir();
+        var project = Path.Combine(repo.Path, "Slow.csproj");
+        File.WriteAllText(project, "<Project Sdk=\"Microsoft.NET.Sdk\"><PropertyGroup><TargetFramework>net10.0</TargetFramework></PropertyGroup></Project>");
+
+        var ex = Record.Exception(() => MsBuildProjectQuery.Query(project, "dotnet", TimeSpan.FromMilliseconds(200)));
+
+        Assert.IsType<MsBuildQueryException>(ex);
+        Assert.Contains("did not finish within", ex.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Every_call_site_in_a_non_ascii_file_still_finds_its_index_entry()
+    {
+        // The equivalence guard for the one-pass offset walk in BuildIndex. It used to call
+        // `Utf8Offsets.ToUtf8` per callee, which counts from the start of the text every time --
+        // O(file size x call sites). Accumulating instead is O(file size), and the danger of that
+        // trade is precise: this offset is the JOIN KEY between two engines, so a drift of one byte
+        // does not lose a call, it credits it to whatever sits nearby.
+        //
+        // The two sides really are computed differently, which is what makes this an equivalence test
+        // rather than a tautology: the extractor converts each site with the per-site method, the
+        // resolver now walks the file once. A non-ASCII file is the fixture because every offset after
+        // the first accented character differs between UTF-8 and UTF-16 -- on ASCII the two agree and
+        // any drift would be invisible.
+        var sites = _scratch.SitesIn("NonAscii.cs");
+        Assert.NotEmpty(sites);
+
+        var edges = _scratch.Resolver.Resolve(sites, _scratch.Symbols);
+
+        // One verdict per site: a site whose offset did not land on an index entry gets no edge at all,
+        // so a count short of the input is exactly the drift this pins.
+        Assert.Equal(sites.Count, edges.Count);
+    }
 }
diff --git a/producers/tests/OkfProducer.Tests/CodeGraph/ScopeTests.cs b/producers/tests/OkfProducer.Tests/CodeGraph/ScopeTests.cs
index 8d74e43e..0c250bcd 100644
--- a/producers/tests/OkfProducer.Tests/CodeGraph/ScopeTests.cs
+++ b/producers/tests/OkfProducer.Tests/CodeGraph/ScopeTests.cs
@@ -85,19 +85,71 @@ public void A_project_not_referencing_a_test_SDK_is_included()
         Assert.True(FileEligibility.IsEligible("lib/OkfProducer.Core/Foo.cs", snapshot, ScopeOptions.Default));
     }
 
+    [Theory]
+    // A public member of an internal type: capped at internal, so out of scope by default and in scope
+    // with the flag. This is the case that shipped wrong -- filtering read the declared modifier alone,
+    // so the member was emitted in a default-scope bundle AND tagged `public`, a visibility C# does not
+    // give it. An operator who left --include-internal off precisely to keep internal API out of a
+    // knowledge bundle got it published anyway. The producer's own fixture carries the shape, so the
+    // golden blessed it: `code/csharp/n/shapes/hidden/never` and the container it forced into
+    // existence are both gone now.
+    [InlineData(SymbolVisibility.Public, SymbolVisibility.Internal, false, true)]
+    // Both public: unaffected, and asserted so a fix that simply hid more is visible as one.
+    [InlineData(SymbolVisibility.Public, SymbolVisibility.Public, true, true)]
+    // The cap only ever REDUCES: a public container cannot lift an internal member into scope.
+    [InlineData(SymbolVisibility.Internal, SymbolVisibility.Public, false, true)]
+    // Private wins over everything, including the flag.
+    [InlineData(SymbolVisibility.Public, SymbolVisibility.Private, false, false)]
+    public void A_members_scope_is_capped_by_the_type_that_encloses_it(
+        SymbolVisibility member, SymbolVisibility container, bool inDefaultScope, bool withInternal)
+    {
+        var enclosing = new SymbolFact(SymbolKind.Type, "csharp", "N", "Hidden", "class Hidden",
+            container, "src/T.cs", 0, 1, 1, 2, null);
+        var declared = new Dictionary<(string Container, string Name), SymbolFact>
+        {
+            [("N", "Hidden")] = enclosing,
+        };
+
+        var fact = new SymbolFact(SymbolKind.Member, "csharp", "N.Hidden", "Never", "void Never()",
+            member, "src/T.cs", 2, 3, 3, 4, null);
+
+        Assert.Equal(inDefaultScope, FileEligibility.IsInScope(fact, declared, ScopeOptions.Default));
+        Assert.Equal(withInternal, FileEligibility.IsInScope(fact, declared, new ScopeOptions(IncludeTests: false, IncludeInternal: true)));
+    }
+
+    [Fact]
+    public void An_unknown_container_caps_nothing_rather_than_hiding_what_it_encloses()
+    {
+        // The direction this must fail in. A container absent from the declared set is a namespace, or
+        // a type in a file this run could not read -- treating it as private would delete concepts over
+        // a file that merely failed to open, and §2.3 rates a wrongly-narrowed bundle below a wide one.
+        // Reached on every ordinary member, whose container chain ends at a namespace.
+        var fact = new SymbolFact(SymbolKind.Member, "csharp", "N.Nowhere", "Visible", "void Visible()",
+            SymbolVisibility.Public, "src/T.cs", 0, 1, 1, 2, null);
+
+        Assert.True(FileEligibility.IsInScope(fact, new Dictionary<(string, string), SymbolFact>(), ScopeOptions.Default));
+    }
+
     [Fact]
     public void Project_ownership_matching_is_case_sensitive()
     {
         // M-1: a case-sensitive filesystem can hold both src/Foo and src/foo as genuinely distinct
-        // directories. Every other path comparison in this codebase is Ordinal (§6.2's "never a
-        // culture-dependent comparison" rule) -- matching a file's owning project with
-        // OrdinalIgnoreCase instead could pick the wrong project for a file that only differs in
-        // case from that project's own directory.
+        // directories, so a file in one is not owned by a project in the other.
+        //
+        // ON A PLATFORM WHERE THAT IS TRUE. This test used to assert `true` unconditionally, which is
+        // a platform-independent claim about a platform-dependent fact: on Windows the two paths name
+        // ONE directory, so the file really is owned by that project and excluding it is correct. It
+        // passed there only because the production comparison was blind in the same way -- and that
+        // blindness is B1-3, where a `.sln` entry cased differently from disk made a test project go
+        // unrecognised and its files silently INCLUDED with `--include-tests` off.
+        //
+        // `BundlePaths.PathComparison` is the rule both findings actually want, and this assertion is
+        // now the rule rather than one operating system's answer to it.
         var snapshot = SnapshotWithTestProject(projectDirectory: "src/Foo");
 
-        // "src/foo/Bar.cs" differs from the test project's own "src/Foo" only by case -- it must not
-        // be treated as owned by that project.
-        Assert.True(FileEligibility.IsEligible("src/foo/Bar.cs", snapshot, ScopeOptions.Default));
+        Assert.Equal(
+            !OperatingSystem.IsWindows(),
+            FileEligibility.IsEligible("src/foo/Bar.cs", snapshot, ScopeOptions.Default));
     }
 
     [Theory]
@@ -196,12 +248,13 @@ private string CreateRepository(params (string RelativePath, string Source)[] fi
     /// <see cref="RepositoryScanner"/> scan of a repo with a test project would produce, without
     /// widening <see cref="RepositorySnapshot"/>'s own shape.
     /// </summary>
-    private static RepositorySnapshot SnapshotWithTestProject(string projectDirectory = "tests/OKF4net.Tests") =>
+    private RepositorySnapshot SnapshotWithTestProject(string projectDirectory = "tests/OKF4net.Tests") =>
         SnapshotWithProject(referencesTestSdk: true, projectDirectory);
 
-    private static RepositorySnapshot SnapshotWithProject(bool referencesTestSdk, string projectDirectory)
+    private RepositorySnapshot SnapshotWithProject(bool referencesTestSdk, string projectDirectory)
     {
         var repoPath = Directory.CreateTempSubdirectory("okfproducer-scope-").FullName;
+        _tempDirectories.Add(repoPath);
         var projectName = projectDirectory.Split('/')[^1];
         var csprojRelativePath = $"{projectDirectory}/{projectName}.csproj";
         var csprojFullPath = Path.Combine(repoPath, csprojRelativePath.Replace('/', Path.DirectorySeparatorChar));
@@ -221,4 +274,59 @@ private static RepositorySnapshot SnapshotWithProject(bool referencesTestSdk, st
         var package = new PackageManifest("nuget", csprojRelativePath, projectName, null);
         return new RepositorySnapshot(repoPath, "test-repo", [package], []);
     }
+
+
+    [Fact]
+    public void A_test_project_named_with_a_different_case_in_the_solution_is_still_excluded()
+    {
+        // The two sides of this comparison come from different places, which is what the old flat
+        // Ordinal missed. A file's path is walked off disk; the project's comes from
+        // `PackageManifest.RelativePath`, which `RepositoryScanner` may have read out of a `.sln`'s
+        // TEXT and never normalised against disk. On Windows a differently-cased entry there still
+        // passes `File.Exists`, so the project was found and its `.csproj` read -- and then the path
+        // comparison rejected it, silently INCLUDING a test project with `--include-tests` off.
+        //
+        // On a case-sensitive filesystem the two really are different directories, so the file is
+        // genuinely not owned by that project and staying included is correct. The assertion is
+        // therefore conditioned on the platform, which is what `BundlePaths.PathComparison` encodes:
+        // this test pins the rule, not one operating system's answer to it.
+        var snapshot = SnapshotWithTestProject(projectDirectory: "integration/OKF4net.Verify");
+        var differentlyCased = "Integration/OKF4net.Verify/AuditTests.cs";
+
+        var eligible = FileEligibility.IsEligible(differentlyCased, snapshot, ScopeOptions.Default);
+
+        Assert.Equal(!OperatingSystem.IsWindows(), eligible);
+    }
+    [Fact]
+    public void An_unreadable_project_file_leaves_the_run_going_instead_of_ending_it()
+    {
+        // ReferencesTestSdk is reached from CodeGraphBuilder.Build's per-file loop, whose body is
+        // deliberately NOT wrapped -- so an exception escaping this call does not skip one file, it
+        // ends the whole repository's run. UnauthorizedAccessException is the reachable case (an ACL
+        // that denies read on a .csproj), and it cannot be provoked on a real file without an
+        // elevation this suite does not have: that is why the read is a seam and this reader is a
+        // double rather than a chmod.
+        var snapshot = SnapshotWithTestProject(projectDirectory: "integration/OKF4net.Verify");
+
+        var eligible = FileEligibility.IsEligible(
+            "integration/OKF4net.Verify/AuditTests.cs", snapshot, ScopeOptions.Default, new DenyingReader());
+
+        // Unreadable means "not demonstrably owned by a test project", so the file stays in scope.
+        // That direction is deliberate: the alternative -- treating an unreadable .csproj as a test
+        // project -- would silently drop real source on a permissions accident.
+        Assert.True(eligible);
+    }
+
+    /// <summary>
+    /// Reports every path as present and then refuses to open it: the shape of an ACL that grants
+    /// metadata and denies read. Remove the matching <c>catch</c> from
+    /// <c>FileEligibility.ReferencesTestSdk</c> and the test above throws instead of failing, which is
+    /// exactly the production behaviour it exists to forbid.
+    /// </summary>
+    private sealed class DenyingReader : IFileSystemReader
+    {
+        public long? TryGetLength(string absolutePath) => 1;
+
+        public Stream OpenRead(string absolutePath) => throw new UnauthorizedAccessException(absolutePath);
+    }
 }
diff --git a/producers/tests/OkfProducer.Tests/CodeGraph/TreeSitterExtractorTests.cs b/producers/tests/OkfProducer.Tests/CodeGraph/TreeSitterExtractorTests.cs
index fdeb2fdf..cdb50438 100644
--- a/producers/tests/OkfProducer.Tests/CodeGraph/TreeSitterExtractorTests.cs
+++ b/producers/tests/OkfProducer.Tests/CodeGraph/TreeSitterExtractorTests.cs
@@ -2,6 +2,7 @@
 using OkfProducer.CodeGraph.TreeSitter;
 using OkfProducer.CodeGraph.TreeSitter.Profiles;
 using OkfProducer.Core.CodeGraph;
+using OkfProducer.Core.Scanning;
 
 namespace OkfProducer.Tests.CodeGraph;
 
@@ -491,6 +492,168 @@ public class T
         Assert.Equal(first.Sites.Select(s => s.CalledName), second.Sites.Select(s => s.CalledName));
     }
 
+    [Fact]
+    public void Generic_types_of_different_arity_are_distinct_symbols()
+    {
+        // `Foo`, `Foo<T>` and `Foo<T, U>` all report `name` as `Foo`, so they used to collapse into one
+        // symbol group and render as overloads of a single member -- §3.2's merge rule, written for
+        // method overloads, silently extended to unrelated types.
+        //
+        // The separator was `_N` first, chosen so "arity 1" would not read as the registry's "second
+        // thing called Foo" (`-2`). It is a backtick now, because legibility was the wrong thing to
+        // optimise: `_` and a digit are both C# identifier characters, so the qualification was NOT
+        // injective and a real `Foo_1` collapsed back together with `Foo<T>` -- see the sibling test
+        // below. A backtick cannot occur in a C# identifier under any spelling, and it is the CLR's own
+        // arity convention.
+        var result = ExtractSource("""
+            namespace N;
+            public class Foo { }
+            public class Foo<T> { }
+            public class Foo<T, U> { }
+            """);
+
+        Assert.Equal(
+            ["Foo", "Foo`1", "Foo`2"],
+            result.Symbols.Where(s => s.Kind == SymbolKind.Type).Select(s => s.Name).OrderBy(n => n, StringComparer.Ordinal));
+    }
+
+    [Fact]
+    public void A_type_named_like_an_arity_suffix_stays_distinct_from_the_generic_it_would_have_collided_with()
+    {
+        // The injectivity the separator exists for, and the defect that changed it. Under `_N`, a type
+        // genuinely named `Holder_1` and a type named `Holder<T>` both produced the SymbolFact.Name
+        // "Holder_1": one SymbolKey group, one concept listing both `public class Holder_1` and
+        // `public class Holder<T>`, one description taken from whichever sorted first, and the members
+        // of two unrelated types shown as siblings under it. That is exactly the merge the arity rule
+        // was added to remove, reachable from perfectly legal C#.
+        //
+        // Asserted on the extractor, where the qualification happens, rather than on the emitted ids:
+        // `CodeConceptIds` deliberately does not treat `_` as a word boundary, so under the old rule
+        // the two also slugified identically and the id level could not tell them apart either.
+        var result = ExtractSource("""
+            namespace N;
+            public class Holder_1 { }
+            public class Holder<T> { }
+            """);
+
+        var names = result.Symbols.Where(s => s.Kind == SymbolKind.Type).Select(s => s.Name).OrderBy(n => n, StringComparer.Ordinal).ToList();
+
+        Assert.Equal(2, names.Distinct(StringComparer.Ordinal).Count());
+        Assert.Contains("Holder_1", names);
+        Assert.Contains("Holder`1", names);
+    }
+
+    [Fact]
+    public void A_generic_method_keeps_its_bare_name_so_calls_still_match_it()
+    {
+        // The deliberate asymmetry, and the reason it is not an oversight. A call site captures its
+        // callee as the bare identifier -- `Bar<int>()` yields `Bar` -- so suffixing a generic METHOD
+        // would stop every call to it from matching by name. That trades a merged concept for a lost
+        // edge, which is the worse of the two, so arity is a TYPE rule only.
+        var result = ExtractSource("""
+            namespace N;
+            public class T { public void Bar<U>() { } }
+            """);
+
+        Assert.Contains("Bar", result.Symbols.Select(s => s.Name));
+    }
+
+    [Fact]
+    public void An_explicit_interface_implementation_is_named_apart_from_the_public_member()
+    {
+        // Both report `name` as `Bar`, so at THIS layer the two were one symbol. The qualified form
+        // takes the interface as a dotted prefix, which is how C# writes it.
+        //
+        // What that does NOT do, measured rather than assumed after the register claimed otherwise:
+        // it does not split a merged CONCEPT, because there was never a merged concept to split. An
+        // explicit interface implementation carries no access modifier, so `VisibilityOf` classes it
+        // Private, and Private is out of scope under every flag -- `--include-internal` included. It is
+        // filtered before ConceptGenerator ever groups anything. The register's D1b-I2 said the two
+        // collapsed into "one concept, one description, both signatures"; that outcome is not
+        // reachable through the shipped pipeline, and the golden confirms it -- the fixture's explicit
+        // `IEquatable<Boxed>.Equals` produces no concept at all.
+        //
+        // The fix is still right, one layer down: two different members sharing one name is wrong for
+        // any consumer reading SymbolFacts before the scope filter, and name matching would otherwise
+        // bind a call to `Bar()` -- which cannot reach the explicit member on the type -- to it.
+        var result = ExtractSource("""
+            namespace N;
+            public interface IFoo { void Bar(); }
+            public class Impl : IFoo
+            {
+                public void Bar() { }
+                void IFoo.Bar() { }
+            }
+            """);
+
+        var names = result.Symbols.Where(s => s.Container == "N.Impl").Select(s => s.Name).OrderBy(n => n, StringComparer.Ordinal);
+        Assert.Equal(["Bar", "IFoo.Bar"], names);
+    }
+
+    [Fact]
+    public void A_call_inside_an_indexer_or_an_operator_yields_no_edge_at_all()
+    {
+        // The documented gap: indexers, operator overloads and conversion operators are not extracted
+        // as symbols, because none of them has a `name` field in this grammar (an indexer is written
+        // `this[...]`; an operator's symbol is an anonymous child after the anonymous keyword). Naming
+        // them would need bespoke, unverified rules, so the profile accepts the gap.
+        //
+        // What that gap RIPPLES into was never stated or tested: a call inside one of those members
+        // finds no ancestor in CallerMemberAncestorNodeTypes, so the site comes out with an empty
+        // caller. An edge naming a caller that does not exist is exactly what §2.1 calls worse than no
+        // edge -- so what must be true is that NONE survives, and that is what this pins.
+        //
+        // It is not the extractor that drops it: the site is emitted with an empty caller and
+        // CodeGraphBuilder's invariant (no edge may name a caller absent from Symbols) is what removes
+        // it. Stated here because a future change to either half would silently let the orphan through.
+        var result = ExtractSource(IndexerAndOperatorSource);
+
+        // The gap itself, asserted so this test fails loudly rather than vacuously if the profile ever
+        // starts extracting them -- at which point the ripple below stops being the right behaviour.
+        Assert.DoesNotContain(result.Symbols, s => s.Name is "this" or "+" or "op_Addition");
+
+        // Every call site found inside those two members carries no caller to hang a concept off.
+        Assert.All(
+            result.Sites.Where(s => s.CalledName == "Target"),
+            site => Assert.True(
+                site.CallerName.Length == 0,
+                $"expected no caller for a call inside an indexer or operator, got '{site.CallerName}'."));
+
+        // THE SECOND HALF, which this test named ("yields no edge at all") and did not make. Everything
+        // above is computed from the extractor alone, so deleting `CodeGraphBuilder`'s invariant -- no
+        // edge may name a caller absent from Symbols -- left the orphan edge in the graph with this
+        // test still green, and `CSharpProfile`'s doc comment claimed it "pins both halves". Building
+        // the graph is what turns that claim into an assertion, and it is cheap: the same source, the
+        // real profile, no resolver, so nothing but the invariant can remove the edge.
+        using var extractor = new TreeSitterExtractor();
+        var repoPath = Directory.CreateTempSubdirectory("okfproducer-indexer-").FullName;
+        _tempDirectories.Add(repoPath);
+        File.WriteAllText(Path.Combine(repoPath, "T.cs"), IndexerAndOperatorSource);
+
+        var graph = new CodeGraphBuilder(extractor, [CSharpProfile.Instance], [])
+            .Build(new RepositorySnapshot(repoPath, "indexer-repo", [], []), ExtractionLimits.Default, ScopeOptions.Default);
+
+        Assert.DoesNotContain(graph.Edges, e => e.Site.CallerName.Length == 0);
+        Assert.Empty(graph.Edges);
+    }
+
+    /// <summary>
+    /// The fixture for <c>A_call_inside_an_indexer_or_an_operator_yields_no_edge_at_all</c>, shared by
+    /// its two halves so the extractor assertions and the graph assertion cannot drift onto different
+    /// source and quietly stop being about the same calls.
+    /// </summary>
+    private const string IndexerAndOperatorSource = """
+        namespace N;
+        public class T
+        {
+            public void Target() { }
+
+            public int this[int i] { get { Target(); return i; } }
+
+            public static T operator +(T a, T b) { a.Target(); return a; }
+        }
+        """;
+
     private ExtractionResult ExtractSource(string source, string relativePath = "T.cs")
     {
         var directory = Directory.CreateTempSubdirectory("okfproducer-treesitter-").FullName;
diff --git a/producers/tests/OkfProducer.Tests/CodeGraph/Utf8OffsetsTests.cs b/producers/tests/OkfProducer.Tests/CodeGraph/Utf8OffsetsTests.cs
index 64b336c0..4b65a459 100644
--- a/producers/tests/OkfProducer.Tests/CodeGraph/Utf8OffsetsTests.cs
+++ b/producers/tests/OkfProducer.Tests/CodeGraph/Utf8OffsetsTests.cs
@@ -92,6 +92,7 @@ public void ToUtf8_at_the_very_start_and_end_matches_zero_and_the_full_byte_coun
 
     [Theory]
     [InlineData(-1)]
+    [InlineData(int.MinValue)]
     public void ToUtf8_rejects_a_negative_offset(int utf16Offset)
     {
         Assert.Throws<ArgumentOutOfRangeException>(() => Utf8Offsets.ToUtf8("abc", utf16Offset));
@@ -105,6 +106,7 @@ public void ToUtf8_rejects_an_offset_past_the_end_of_the_text()
 
     [Theory]
     [InlineData(-1)]
+    [InlineData(int.MinValue)]
     public void ToUtf16_rejects_a_negative_offset(int utf8Offset)
     {
         Assert.Throws<ArgumentOutOfRangeException>(() => Utf8Offsets.ToUtf16("abc", utf8Offset));
@@ -115,4 +117,43 @@ public void ToUtf16_rejects_an_offset_past_the_end_of_the_text()
     {
         Assert.Throws<ArgumentOutOfRangeException>(() => Utf8Offsets.ToUtf16("abc", 4));
     }
+
+    [Fact]
+    public void An_offset_that_splits_a_surrogate_pair_is_refused_rather_than_converted()
+    {
+        // The failure mode this type exists to prevent is a PLAUSIBLE WRONG NUMBER, not a missing one:
+        // it is the join key between two engines, so a bad conversion credits a call to whatever sits a
+        // few bytes away rather than dropping it (§2.1).
+        //
+        // Measured before the guard: `GetByteCount` over a span ending on a lone high surrogate runs it
+        // through the replacement fallback and scores 3 bytes -- neither the 0 of the codepoint's start
+        // nor the 4 of its end. Exactly the shape of answer that looks usable and is not.
+        const string Text = "A\U0001D11EB";   // A, a four-byte musical symbol (two UTF-16 units), B
+
+        Assert.Equal(1, Utf8Offsets.ToUtf8(Text, 1));   // the boundary before the pair
+        Assert.Equal(5, Utf8Offsets.ToUtf8(Text, 3));   // the boundary after it
+
+        Assert.Throws<ArgumentOutOfRangeException>(() => Utf8Offsets.ToUtf8(Text, 2));
+    }
+
+    [Fact]
+    public void A_utf8_offset_inside_a_sequence_is_refused_rather_than_rounded_up()
+    {
+        // The other direction, and the one that was silently wrong rather than merely undefined: the
+        // walk tested `utf8Count >= utf8Offset`, so an offset one byte into the four-byte codepoint
+        // returned the index AFTER it -- a real UTF-16 index, for a different position than the caller
+        // asked about.
+        const string Text = "A\U0001D11EB";
+
+        Assert.Equal(1, Utf8Offsets.ToUtf16(Text, 1));   // the boundary before the codepoint
+        Assert.Equal(3, Utf8Offsets.ToUtf16(Text, 5));   // the boundary after it
+
+        foreach (var inside in new[] { 2, 3, 4 })
+        {
+            Assert.Throws<ArgumentOutOfRangeException>(() => Utf8Offsets.ToUtf16(Text, inside));
+        }
+
+        // And the two mistakes are still told apart, so the guard did not swallow the pre-existing one.
+        Assert.Throws<ArgumentOutOfRangeException>(() => Utf8Offsets.ToUtf16(Text, 99));
+    }
 }
diff --git a/producers/tests/OkfProducer.Tests/Generation/BlastRadiusTests.cs b/producers/tests/OkfProducer.Tests/Generation/BlastRadiusTests.cs
index 18be4e6f..d725c9b4 100644
--- a/producers/tests/OkfProducer.Tests/Generation/BlastRadiusTests.cs
+++ b/producers/tests/OkfProducer.Tests/Generation/BlastRadiusTests.cs
@@ -112,8 +112,13 @@ public void A_commit_that_does_not_touch_code_changes_only_overview()
         // This row LOOKS like it says "nothing" and does not. `overview` carries `revision` and
         // `generated.at`, both read off the HEAD commit, so any commit rewrites it -- one file out of
         // the bundle. That bound is the property being asserted; "nothing changes" would be false, and
-        // an assertion that can never pass is worse than none. With a wall-clock stamp instead of the
-        // HEAD one, this same assertion would come back with every concept in the bundle.
+        // an assertion that can never pass is worse than none.
+        //
+        // This comment used to end "with a wall-clock stamp instead of the HEAD one, this same
+        // assertion would come back with every concept in the bundle", and that is false: only
+        // `overview` carries `at` and `revision` at all -- `DeterminismTests.Only_overview_carries_at_and_revision`
+        // pins it -- so a wall-clock stamp would still return exactly `["overview"]` here and this row
+        // would stay green. The leak IS caught, by the `AddPrivateMember` row, not by this one.
         Assert.Equal(["overview"], ConceptsChangedBy(Mutation.CommitUnrelatedFile));
     }
 
diff --git a/producers/tests/OkfProducer.Tests/Generation/CheckTests.cs b/producers/tests/OkfProducer.Tests/Generation/CheckTests.cs
index 576ffdc9..c8d12e5e 100644
--- a/producers/tests/OkfProducer.Tests/Generation/CheckTests.cs
+++ b/producers/tests/OkfProducer.Tests/Generation/CheckTests.cs
@@ -101,6 +101,11 @@ public void Check_ignores_source_text_that_declares_nothing()
         var report = RunCheck(workspace, ProducerFixture.GoldenBundle);
 
         Assert.True(report.IsClean, Explain(report));
+
+        // The exit code too, which every sibling in this file asserts and this one did not: IsClean
+        // and ExitCode are separate fields on DriftReport, so a report can be clean and still exit
+        // non-zero, and nothing here would have noticed.
+        Assert.Equal(0, report.ExitCode);
     }
 
     [Fact]
@@ -124,6 +129,10 @@ public void Check_reports_a_concept_deleted_from_the_bundle_by_hand()
             report.Differences,
             d => d.StartsWith("code/csharp/n/scanner/normalize.md:", StringComparison.Ordinal)
                 && d.Contains("missing from the bundle", StringComparison.Ordinal));
+
+        // Drift found means a non-zero exit, and this test asserted the drift without the exit code --
+        // the half a CI gate actually reads.
+        Assert.NotEqual(0, report.ExitCode);
     }
 
     [Fact]
@@ -498,7 +507,7 @@ public void A_real_regeneration_reports_how_many_concepts_it_wrote()
         // The_golden_bundle_holds_one_occurrence_of_each_shape.
         using var workspace = ProducerFixture.CopyRepoOutsideGit();
 
-        Assert.Equal(15, RunCheck(workspace, ProducerFixture.GoldenBundle).ConceptsRegenerated);
+        Assert.Equal(35, RunCheck(workspace, ProducerFixture.GoldenBundle).ConceptsRegenerated);
     }
 
     [Fact]
@@ -544,9 +553,14 @@ public void The_golden_bundle_validates_with_no_error_and_only_the_warnings_we_k
         // the kinds we have accepted, so a NEW kind cannot hide inside an unchanged total. One kind is
         // left, a §4.3 consequence:
         //
-        //  * three "missing recommended frontmatter field `resource`" -- `overview` and the two
-        //    container concepts. A container is not declared in one file, so there is no line span to
-        //    build a permalink from, and §4.3 admits only a URL there.
+        //  * four "missing recommended frontmatter field `resource`" -- `overview` and the three
+        //    container concepts (`n`, `n/sub`, `n/shapes`). A container is not declared in one file, so
+        //    there is no line span to build a permalink from, and §4.3 admits only a URL there.
+        //
+        //    There was a fifth, `n/shapes/hidden`: a container synthesized for an internal type because
+        //    its public member stayed in scope. Scope filters on EFFECTIVE visibility now -- a member
+        //    is capped by every type enclosing it -- so the member is out and the container it forced
+        //    into existence is gone with it.
         //
         // The four "frontmatter path ... not found" this fixture used to carry are gone. `packages/*`
         // and `docs/*` wrote a repo-relative `resource` AND repeated it in a one-entry `sources` block,
@@ -562,7 +576,7 @@ public void The_golden_bundle_validates_with_no_error_and_only_the_warnings_we_k
         Assert.True(outcome.IsConformant, string.Join("\n", outcome.DiagnosticLines));
         Assert.DoesNotContain(outcome.DiagnosticLines, line => line.Contains("BrokenLink", StringComparison.Ordinal));
 
-        Assert.Equal(3, outcome.WarningCount);
+        Assert.Equal(4, outcome.WarningCount);
         Assert.All(
             outcome.DiagnosticLines.Where(line => line.StartsWith("[warning]", StringComparison.Ordinal)),
             line => Assert.True(
@@ -588,7 +602,7 @@ public void The_golden_bundle_holds_one_occurrence_of_each_shape()
             .OrderBy(id => id, StringComparer.Ordinal)
             .ToList();
 
-        Assert.InRange(concepts.Count, 15, 20);
+        Assert.InRange(concepts.Count, 35, 40);
 
         Assert.Equal(
             [
@@ -601,6 +615,26 @@ public void The_golden_bundle_holds_one_occurrence_of_each_shape()
                 "code/csharp/n/scanner/normalize",      // the one resolved call target
                 "code/csharp/n/scanner/root",
                 "code/csharp/n/scanner/scan",
+                "code/csharp/n/shapes",                 // a BLOCK-scoped namespace, where every other is file-scoped
+                "code/csharp/n/shapes/boxed",           // the one type whose header spans three lines
+                "code/csharp/n/shapes/boxed/boxed",     // a constructor
+                "code/csharp/n/shapes/boxed/builder",   // a type nested in a type
+                "code/csharp/n/shapes/boxed/builder/build",
+                "code/csharp/n/shapes/boxed/changed",   // an event
+                "code/csharp/n/shapes/boxed/render",    // whose doc comment carries [brackets], a backtick and a tag
+                "code/csharp/n/shapes/corner",          // an enum, whose members are deliberately not concepts
+                "code/csharp/n/shapes/holder",          // three types differing only by arity (D1b-I1) --
+                "code/csharp/n/shapes/holder-1",        // and each one's members under IT, not under the first.
+                "code/csharp/n/shapes/holder-1/value",  // The arity concepts sort BEFORE `holder/count` because
+                "code/csharp/n/shapes/holder-2",        // Ordinal puts `-` (0x2D) ahead of `/` (0x2F) -- they did
+                "code/csharp/n/shapes/holder-2/find",   // not under the old `_N` spelling (`_` is 0x5F).
+                "code/csharp/n/shapes/holder/count",
+                "code/csharp/n/shapes/i-shape",         // an interface
+                "code/csharp/n/shapes/i-shape/render",
+                "code/csharp/n/shapes/point",           // a struct
+                "code/csharp/n/shapes/point/x",         // two declarators on one field, which nothing else reaches
+                "code/csharp/n/shapes/point/y",
+                "code/csharp/n/shapes/size",            // a positional record, with no body at all
                 "code/csharp/n/sub",                    // a nested container
                 "code/csharp/n/sub/formatter",
                 "code/csharp/n/sub/formatter/format",
@@ -613,6 +647,16 @@ public void The_golden_bundle_holds_one_occurrence_of_each_shape()
         // The private member `Scanner.Cache` is in the fixture source and must NOT be here (§5.4).
         Assert.DoesNotContain("code/csharp/n/scanner/cache", concepts);
 
+        // Nor is `Boxed`'s explicit `IEquatable<Boxed>.Equals`, and for a reason worth pinning: an
+        // explicit interface implementation carries no access modifier, so it is Private and out of
+        // scope under every flag. The register's D1b-I2 claimed the two collapsed into one concept
+        // with both signatures; measured here, the explicit one produces no concept at all.
+        Assert.DoesNotContain(concepts, id => id.Contains("equals", StringComparison.Ordinal));
+
+        // The local function inside `Render` is Private too, so it is not a concept either.
+        Assert.DoesNotContain(concepts, id => id.Contains("compose", StringComparison.Ordinal));
+        Assert.DoesNotContain("code/csharp/n/scanner/cache", concepts);
+
         var register = File.ReadAllText(Path.Combine(ProducerFixture.GoldenBundle, "code/csharp/n/registry/register.md"));
         var count = File.ReadAllText(Path.Combine(ProducerFixture.GoldenBundle, "code/csharp/n/registry/count.md"));
 
@@ -622,6 +666,46 @@ public void The_golden_bundle_holds_one_occurrence_of_each_shape()
         Assert.Contains("## Calls (unresolved)\n", count, StringComparison.Ordinal);  // an unresolved one
     }
 
+    [Fact]
+    public void Check_leaves_the_bundle_it_was_given_byte_for_byte_unchanged()
+    {
+        // The property every OTHER test in this file silently depends on. Six of them run Check against
+        // the COMMITTED golden, so a regression that regenerated in place would rewrite the golden --
+        // and every one of those tests would go on passing, comparing the bundle against itself. A
+        // self-disarming suite is the failure this branch spent its remediation on; this is the
+        // assertion that stops it happening to the golden.
+        //
+        // Byte for byte over every file, not a count and not a timestamp: regenerating in place would
+        // leave the same file names, and `generated.at` would not move either, since the golden is
+        // captured outside git where that field is excluded from the COMPARISON but not from a write.
+        using var workspace = ProducerFixture.CopyRepoOutsideGit();
+
+        var before = Snapshot(ProducerFixture.GoldenBundle);
+        var report = RunCheck(workspace, ProducerFixture.GoldenBundle);
+        var after = Snapshot(ProducerFixture.GoldenBundle);
+
+        // Asserted first, so a Check that somehow performed no comparison at all cannot satisfy the
+        // real assertions below by having done nothing.
+        Assert.True(report.IsClean, Explain(report));
+
+        Assert.Equal(
+            before.Keys.OrderBy(key => key, StringComparer.Ordinal),
+            after.Keys.OrderBy(key => key, StringComparer.Ordinal));
+
+        foreach (var (path, hash) in before)
+        {
+            Assert.True(after[path].SequenceEqual(hash), $"Check rewrote '{path}' in the bundle it was given.");
+        }
+    }
+
+    /// <summary>Every file under <paramref name="bundlePath"/>, keyed by relative path, with its bytes hashed.</summary>
+    private static Dictionary<string, byte[]> Snapshot(string bundlePath) =>
+        Directory.EnumerateFiles(bundlePath, "*", SearchOption.AllDirectories)
+            .ToDictionary(
+                path => Path.GetRelativePath(bundlePath, path).Replace(Path.DirectorySeparatorChar, '/'),
+                path => System.Security.Cryptography.SHA256.HashData(File.ReadAllBytes(path)),
+                StringComparer.Ordinal);
+
     // -- fixture ----------------------------------------------------------------------------------
 
     private static string RepoIn(ProducerFixture.TempDir workspace) =>
diff --git a/producers/tests/OkfProducer.Tests/Generation/CodeConceptGeneratorTests.cs b/producers/tests/OkfProducer.Tests/Generation/CodeConceptGeneratorTests.cs
index 83a8b954..e27c01c9 100644
--- a/producers/tests/OkfProducer.Tests/Generation/CodeConceptGeneratorTests.cs
+++ b/producers/tests/OkfProducer.Tests/Generation/CodeConceptGeneratorTests.cs
@@ -44,11 +44,19 @@ public void Unresolved_calls_are_code_spans_not_links()
     {
         // 54-58% of call sites have no declaration in the repo. Linking them
         // would emit that many BrokenLink diagnostics and drown `validate`.
+        //
+        // THE CALLEE IS A BARE IDENTIFIER, and that is the fixture rather than a detail. This used to
+        // say `string.Substring`, a shape `CSharpProfile.CallQuery` cannot produce: an UNRESOLVED
+        // entry renders `edge.Site.CalledName`, which is the identifier as written at the call, and
+        // the query captures the name node alone -- the golden proves it, where `int.Parse(raw)` in
+        // `Registry.cs` comes out as `- ``Parse`` `, not `int.Parse`. A dotted name reaches this
+        // section only down the defensive branch, from a RESOLVED target. So the old assertions
+        // guarded the rendering of a string that could never arrive.
         var body = Single(Generate(), "code/csharp/n/scanner/scan").Document.Body;
 
         Assert.Contains("## Calls (unresolved)", body, StringComparison.Ordinal);
-        Assert.Contains("`string.Substring`", body, StringComparison.Ordinal);
-        Assert.DoesNotContain("[string.Substring]", body, StringComparison.Ordinal);
+        Assert.Contains("`Substring`", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("[Substring]", body, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -61,10 +69,18 @@ public void Overloads_are_one_concept_listing_every_signature()
     }
 
     [Fact]
-    public void With_repo_url_the_resource_is_a_url_and_earns_no_path_warning()
+    public void With_repo_url_the_resource_is_an_absolute_url_with_a_line_span()
     {
         // §4.3: a bare relative resource resolves against the CONCEPT directory,
         // not the bundle root, so it would miss for every code concept.
+        //
+        // This was called `..._and_earns_no_path_warning`, which named a VALIDATOR verdict. No
+        // validator runs here -- this reads one frontmatter field off one document -- so that half of
+        // the name was a promise the body could not keep, and it is dropped rather than left to be
+        // trusted. The verdict itself is covered where a validator actually runs:
+        // `CheckTests.The_golden_bundle_validates_with_no_error_and_only_the_warnings_we_know_about`
+        // puts the real `BundleValidator` over a real bundle generated with a repo URL, and enumerates
+        // the warnings it is allowed to have.
         var fm = Single(Generate(repoUrl: "https://github.com/o/r", rev: "main"), "code/csharp/n/scanner/scan").Document.Frontmatter;
 
         Assert.StartsWith("https://github.com/o/r/blob/main/", fm.Resource, StringComparison.Ordinal);
@@ -111,8 +127,21 @@ public void A_type_concept_and_its_member_concept_coexist()
     }
 
     [Fact]
-    public void A_signature_line_names_the_file_with_forward_slashes_and_a_line_span()
+    public void A_signature_line_names_the_file_and_a_line_span()
     {
+        // This was called `..._with_forward_slashes_and_a_line_span`, and that half of the name was a
+        // claim this test cannot make: every fixture path here is the literal `src/Scanner.cs`, so a
+        // forward slash goes in and a forward slash comes out whatever the generator does with
+        // separators. Deleting `ConceptGenerator.NormalizeSeparators` from the signature line would
+        // leave it green.
+        //
+        // WHERE THE PROPERTY ACTUALLY LIVES, since dropping the name should not lose the fact:
+        // `CodeGraphBuilder.EnumerateFiles` normalizes once, at the only place a separator is ever
+        // chosen -- `Path.GetRelativePath` against the walk -- so everything downstream, this
+        // generator included, already receives `/`. It is covered, and by execution rather than by
+        // name: deleting that `Replace` turns six tests red, across `HostileInputTests` and
+        // `CliTests` (measured, on Windows, where `GetRelativePath` returns backslashes). The call in
+        // this file is a second belt on an already-normalized value.
         var body = Single(Generate(), "code/csharp/n/scanner/scan").Document.Body;
 
         Assert.Contains("## Signatures", body, StringComparison.Ordinal);
@@ -301,14 +330,24 @@ public void Signature_bullets_are_ordered_by_declaration_site_not_by_input_order
     }
 
     [Fact]
-    public void The_registry_spans_the_code_family_as_well_as_packages_and_docs()
+    public void A_doc_titled_overview_coexists_with_the_overview_concept()
     {
-        // §3.4: one registry, one allocation record for the whole run. Being exact about what that
-        // means, because the tempting claim is false: the four families use disjoint prefixes, so a doc
-        // titled "overview" lands on `docs/overview` and CANNOT collide with the bare `overview` id --
-        // they coexist, which is what this asserts. What the shared registry buys is that `code/` is in
-        // the same record as the rest (the old Generate-local usedIds never covered it) and that
-        // `overview` is allocated rather than assumed.
+        // NAMED FOR WHAT IT PINS, after a review found the old name
+        // (`The_registry_spans_the_code_family_as_well_as_packages_and_docs`) promising something no
+        // assertion here could fail on: the graph is empty, so no `code/` id is produced at all and
+        // reverting the code family to a `Generate`-local `usedIds` leaves both assertions green.
+        //
+        // Adding code concepts would not fix that, and the reason is worth stating rather than
+        // rediscovering. §3.4's "one registry" has no observable consequence through this surface: the
+        // four families use DISJOINT PREFIXES by construction (`overview`, `docs/`, `packages/`,
+        // `code/`), so a cross-family collision cannot be built, and a code-local registry would
+        // disambiguate code ids among themselves exactly as the shared one does. The property is
+        // structural -- it is why a whole class of collision is impossible -- not behavioural, and a
+        // test cannot separate it from its absence without changing the id scheme itself.
+        //
+        // What this DOES pin, and what a regression could break: a doc titled "overview" lands on
+        // `docs/overview` and the bare `overview` id is allocated rather than assumed, so the two
+        // coexist instead of one overwriting the other.
         var snapshot = new RepositorySnapshot("/repo", "my-repo", [], [new DocFile("O.md", "overview")]);
 
         var ids = Ids(new ConceptGenerator().Generate(snapshot, GraphOf(), Options()));
@@ -841,10 +880,19 @@ public void Neutralizing_never_doubles_an_escape_the_author_already_wrote()
     {
         // An already-escaped bracket must be copied through, not escaped again: `\\]` renders a visible
         // backslash, which would be this fix corrupting the very text it exists to preserve.
+        //
+        // The two assertions below are both about what must NOT appear, and between them they left a
+        // gap: a producer that DELETED the author's backslash -- shipping `Keep [a]` -- satisfies
+        // both. `[a]` on its own is not a link, so the scanner still finds none, and with the
+        // backslash gone there is no `\\]` either. "Copied through" is a claim about the exact bytes,
+        // so it is now asserted as exact bytes, and that is what makes the deletion visible. MEASURED:
+        // with the guard rewritten to swallow the author's backslash, the exact-bytes assertion goes
+        // red and the two below stay green on their own.
         var graph = GraphOf(Member("N.Scanner", "Doc", "public void Doc()", doc: "Keep [a\\] and [b](c)."));
 
         var body = Single(new ConceptGenerator().Generate(Snapshot(), graph, Options()), "code/csharp/n/scanner/doc").Document.Body;
 
+        Assert.Contains("Keep [a\\] and [b\\](c).", body, StringComparison.Ordinal);
         Assert.Empty(LinkScanner.ExtractLinks(body));
         Assert.DoesNotContain("\\\\]", body, StringComparison.Ordinal);
     }
@@ -880,6 +928,88 @@ public void Without_a_code_graph_the_output_is_unchanged()
         Assert.Equal(["overview"], ids);
     }
 
+    [Fact]
+    public void The_engine_versions_reach_overview_as_a_sibling_key_and_not_inside_the_actor()
+    {
+        // §6.2: determinism holds at a FIXED extractor version, not absolutely, so the artefact has to
+        // say which engines produced it -- a golden that moved is otherwise uninterpretable, and a lock
+        // file pins the versions without recording them.
+        //
+        // BOTH HALVES ARE ASSERTED, and the second is the one this test exists for now. This used to
+        // write the engines INTO `by`, as `okfgen/0.1.0 tree-sitter/1.3.0 roslyn/5.3.0`, and its own
+        // comment called that "the spec's own shape". It is the opposite: §5.2 makes `generated.by` an
+        // actor and §7 defines an actor as exactly one of `<producer>/<version>`, `human:<id>`,
+        // `process:<id>`. A space-separated list is none of them.
+        //
+        // The failure was silent, which is why nothing caught it. `OKF4net.Actor.Parse` splits on the
+        // FIRST slash, so it returned IsWellFormed:true with Version = "0.1.0 tree-sitter/1.3.0
+        // roslyn/5.3.0"; `BundleValidator` warns only on a malformed actor, so `okf validate` reported
+        // the bundle clean while every consumer reading the version off this producer's own output got
+        // a string naming no release of anything. The golden shipped it.
+        var options = Options() with { EngineVersions = ["tree-sitter/1.3.0", "roslyn/5.3.0"] };
+
+        var generated = Single(new ConceptGenerator().Generate(Snapshot(), GraphOf(), options), "overview")
+            .Document.Frontmatter.Get("generated")?.AsMapping();
+
+        Assert.NotNull(generated);
+
+        // `by` is an actor and nothing else -- the assertion that goes red if the engines creep back in.
+        Assert.Equal(ConceptGenerator.ProducerActor, generated.Get("by")?.AsDisplayString());
+
+        // And the provenance survives, in a producer key OKF preserves across a round-trip.
+        var engines = generated.Get("engines")?.AsSequence();
+        Assert.NotNull(engines);
+        Assert.Equal(
+            ["tree-sitter/1.3.0", "roslyn/5.3.0"],
+            engines.Select(i => i.AsDisplayString()));
+    }
+
+    [Fact]
+    public void Overviews_actor_is_well_formed_and_reads_back_the_producer_version()
+    {
+        // The consumer-side half, asserted through the reader that actually matters rather than by
+        // inspecting the string ourselves: OKF4net's own Actor.Parse is what a bundle's consumers use,
+        // and under the old multi-token spelling it reported this exact artefact as well-formed while
+        // returning a Version of "0.1.0 tree-sitter/1.3.0 roslyn/5.3.0". Parsing the field is the only
+        // way to state that as a test; a string comparison cannot see it.
+        var options = Options() with { EngineVersions = ["tree-sitter/1.3.0", "roslyn/5.3.0"] };
+
+        var by = Single(new ConceptGenerator().Generate(Snapshot(), GraphOf(), options), "overview")
+            .Document.Frontmatter.Get("generated")?.AsMapping()?.Get("by")?.AsDisplayString();
+
+        var actor = Actor.Parse(by!);
+
+        Assert.True(actor.IsWellFormed);
+        Assert.Equal(ActorKind.Producer, actor.Kind);
+        Assert.Equal("okfgen", actor.Producer);
+        Assert.DoesNotContain(" ", actor.Version!, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void With_no_engine_versions_overview_carries_the_producer_token_alone()
+    {
+        // The --no-code path, and every caller that supplies none. Emitting a trailing space, or engine
+        // tokens for engines that never ran, would attach a determinism claim to an artefact no engine
+        // produced.
+        var by = Single(Generate(), "overview")
+            .Document.Frontmatter.Get("generated")?.AsMapping()?.Get("by")?.AsDisplayString();
+
+        Assert.Equal(ConceptGenerator.ProducerActor, by);
+    }
+
+    [Fact]
+    public void A_code_concept_does_not_repeat_the_engine_versions()
+    {
+        // On `overview` alone, like `at` and for the same reason (6.1): the engines are a fact about the
+        // RUN, and repeating them on hundreds of `code/` concepts would rewrite every file on a version
+        // bump that changed nothing else in them.
+        var options = Options() with { EngineVersions = ["tree-sitter/1.3.0", "roslyn/5.3.0"] };
+        var by = Single(new ConceptGenerator().Generate(Snapshot(), Graph(), options), "code/csharp/n/scanner/scan")
+            .Document.Frontmatter.Get("generated")?.AsMapping()?.Get("by")?.AsDisplayString();
+
+        Assert.Equal(ConceptGenerator.ProducerActor, by);
+    }
+
     // -- fixture ----------------------------------------------------------------------------------
 
     private static IReadOnlyList<GeneratedConcept> Generate(
@@ -911,8 +1041,14 @@ private static Frontmatter ExistingFrontmatter(string description, string descri
 
     /// <summary>
     /// The fixture graph: <c>N.Scanner.Scan</c> calls <c>N.Other.Callee</c> exactly (twice, from two
-    /// sites, so the dedup is exercised) and <c>string.Substring</c> not at all; <c>N.T.Validate</c> is
+    /// sites, so the dedup is exercised) and <c>Substring</c> not at all; <c>N.T.Validate</c> is
     /// two overloads on one concept and reaches <c>N.Other.Helper</c> by name only.
+    ///
+    /// <para><b>Every <c>CalledName</c> here is what the extractor would really hand over.</b> The
+    /// unresolved one is a bare identifier because that is all <c>CSharpProfile.CallQuery</c>
+    /// captures; the dotted <c>Other.Callee</c> on the exact edges never reaches any output -- a
+    /// resolved entry is rendered from the TARGET's title -- so it is left as documentation of which
+    /// call the site stands for.</para>
     /// </summary>
     private static CodeGraphModel Graph() => new(
         [
@@ -934,7 +1070,7 @@ private static Frontmatter ExistingFrontmatter(string description, string descri
                 "N.Other", "Callee", EdgeConfidence.Exact),
             new ResolvedEdge(new CallSite("N.Scanner", "Scan", "Other.Callee", "src/Scanner.cs", 140),
                 "N.Other", "Callee", EdgeConfidence.Exact),
-            new ResolvedEdge(new CallSite("N.Scanner", "Scan", "string.Substring", "src/Scanner.cs", 180),
+            new ResolvedEdge(new CallSite("N.Scanner", "Scan", "Substring", "src/Scanner.cs", 180),
                 null, null, EdgeConfidence.Unresolved),
             new ResolvedEdge(new CallSite("N.T", "Validate", "Helper", "src/T.cs", 60),
                 "N.Other", "Helper", EdgeConfidence.ByName),
@@ -943,6 +1079,115 @@ private static Frontmatter ExistingFrontmatter(string description, string descri
 
     private static CodeGraphModel GraphOf(params SymbolFact[] symbols) => new(symbols, [], RunStatus.Complete);
 
+    [Fact]
+    public void A_namespace_and_a_type_of_the_same_name_get_separate_concepts()
+    {
+        // A class `Bar` in namespace `Foo`, and a class `Baz` in namespace `Foo.Bar`. Both reduce to
+        // the raw path [code, csharp, Foo, Bar] for their parent, so the container was never
+        // synthesized and Baz registered under the TYPE's id. MEASURED before the fix, with exactly
+        // this fixture: overview, code/csharp/foo, code/csharp/foo/bar, code/csharp/foo/bar/baz,
+        // code/csharp/foo/bar/m, code/csharp/foo/bar/baz/q -- a top-level type rendered as a nested
+        // one, and the namespace with no concept at all.
+        //
+        // ContainerNamespace is what separates them: the parent is a namespace exactly when its depth
+        // equals the namespace's. Two of the four facts below have IDENTICAL raw segments and
+        // different parents, which is what no flat container string can express.
+        var graph = GraphOf(
+            new SymbolFact(SymbolKind.Type, "csharp", "Foo", "Bar", "public class Bar",
+                SymbolVisibility.Public, "src/Bar.cs", 0, 1, 1, 2, null)
+            { ContainerNamespace = "Foo" },
+            new SymbolFact(SymbolKind.Member, "csharp", "Foo.Bar", "M", "public void M()",
+                SymbolVisibility.Public, "src/Bar.cs", 2, 3, 3, 4, null)
+            { ContainerNamespace = "Foo" },
+            new SymbolFact(SymbolKind.Type, "csharp", "Foo.Bar", "Baz", "public class Baz",
+                SymbolVisibility.Public, "src/Baz.cs", 0, 1, 1, 2, null)
+            { ContainerNamespace = "Foo.Bar" },
+            new SymbolFact(SymbolKind.Member, "csharp", "Foo.Bar.Baz", "Q", "public void Q()",
+                SymbolVisibility.Public, "src/Baz.cs", 2, 3, 3, 4, null)
+            { ContainerNamespace = "Foo.Bar" });
+
+        var ids = Ids(new ConceptGenerator().Generate(Snapshot(), graph, Options()));
+
+        // The TYPE keeps the path it already had -- only the namespace moves, so no existing type's id
+        // shifts under this change.
+        Assert.Contains("code/csharp/foo/bar", ids);
+        Assert.Contains("code/csharp/foo/bar/m", ids);
+
+        // The namespace is a concept of its own now, and its contents hang off IT.
+        Assert.Contains("code/csharp/foo/bar-2", ids);
+        Assert.Contains("code/csharp/foo/bar-2/baz", ids);
+        Assert.Contains("code/csharp/foo/bar-2/baz/q", ids);
+
+        // The assertion that fails without the fix.
+        Assert.DoesNotContain("code/csharp/foo/bar/baz", ids);
+    }
+
+    [Fact]
+    public void A_marked_top_level_namespace_is_registered_under_its_real_name()
+    {
+        // The twin of the test above, at the depth where the fix above did NOT reach. There the
+        // namespace is nested, so its parent (`code/csharp/foo`) is already registered and
+        // `RegisterContainerId` takes the branch that cleans the leaf with `SegmentName`. Here the
+        // namespace is TOP-LEVEL, its parent key `[code, csharp]` is never registered, and the
+        // fallback ran instead -- which passed the RAW segments to `CodeConceptIds.ForContainer`.
+        //
+        // So the internal discriminator `
ns` was slugified rather than stripped, and the bundle
+        // shipped `code/csharp/foo-ns.md` carrying `title: Foo`, with `"code/csharp/foo-ns"` recorded
+        // in the manifest and every id in that subtree marked permanently. Reproduced end to end
+        // before the fix on two files -- a global-namespace `class Foo` beside a `namespace Foo` --
+        // which is the ordinary shape of a repository whose root type shares its namespace's name.
+        //
+        // Nothing caught it because the suite's only namespace-vs-type fixture was the nested one, and
+        // for a top-level namespace the fallback is not an edge case: it is always the path taken.
+        var graph = GraphOf(
+            new SymbolFact(SymbolKind.Type, "csharp", string.Empty, "Foo", "public class Foo",
+                SymbolVisibility.Public, "src/a/Foo.cs", 0, 1, 1, 2, null)
+            { ContainerNamespace = string.Empty },
+            new SymbolFact(SymbolKind.Member, "csharp", "Foo", "Ping", "public void Ping()",
+                SymbolVisibility.Public, "src/a/Foo.cs", 2, 3, 3, 4, null)
+            { ContainerNamespace = string.Empty },
+            new SymbolFact(SymbolKind.Type, "csharp", "Foo", "Bar", "public class Bar",
+                SymbolVisibility.Public, "src/b/Bar.cs", 0, 1, 1, 2, null)
+            { ContainerNamespace = "Foo" },
+            new SymbolFact(SymbolKind.Member, "csharp", "Foo.Bar", "Run", "public void Run()",
+                SymbolVisibility.Public, "src/b/Bar.cs", 2, 3, 3, 4, null)
+            { ContainerNamespace = "Foo" });
+
+        var ids = Ids(new ConceptGenerator().Generate(Snapshot(), graph, Options()));
+
+        // The type keeps the bare path; the namespace takes the ordinary numeric tie-break.
+        Assert.Contains("code/csharp/foo", ids);
+        Assert.Contains("code/csharp/foo/ping", ids);
+        Assert.Contains("code/csharp/foo-2", ids);
+        Assert.Contains("code/csharp/foo-2/bar", ids);
+        Assert.Contains("code/csharp/foo-2/bar/run", ids);
+
+        // The assertion that fails without the fix, and it is about the whole subtree rather than the
+        // container alone: the marker propagated into every id below it.
+        Assert.DoesNotContain(ids, id => id.Contains("-ns", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void A_type_nested_in_another_type_still_hangs_off_it()
+    {
+        // The control for the test above, and the reason the fix is a depth comparison rather than a
+        // rule about names. `Baz` here has the SAME raw segments as the `Baz` above -- container
+        // "Foo.Bar", name "Baz" -- and must land in the opposite place, because its namespace stops one
+        // level higher. A fix that keyed on the container string alone would move this one too.
+        var graph = GraphOf(
+            new SymbolFact(SymbolKind.Type, "csharp", "Foo", "Bar", "public class Bar",
+                SymbolVisibility.Public, "src/Bar.cs", 0, 1, 1, 2, null)
+            { ContainerNamespace = "Foo" },
+            new SymbolFact(SymbolKind.Type, "csharp", "Foo.Bar", "Baz", "public class Baz",
+                SymbolVisibility.Public, "src/Bar.cs", 2, 3, 3, 4, null)
+            { ContainerNamespace = "Foo" });
+
+        var ids = Ids(new ConceptGenerator().Generate(Snapshot(), graph, Options()));
+
+        Assert.Contains("code/csharp/foo/bar/baz", ids);
+        Assert.DoesNotContain("code/csharp/foo/bar-2", ids);
+    }
+
     private static SymbolFact Type(string container, string name, string path, string? doc = null) =>
         new(SymbolKind.Type, "csharp", container, name, $"public class {name}",
             SymbolVisibility.Public, path, 0, 1, 1, 2, doc);
diff --git a/producers/tests/OkfProducer.Tests/Generation/CodeConceptIdsTests.cs b/producers/tests/OkfProducer.Tests/Generation/CodeConceptIdsTests.cs
index 62d4ae1c..48e8ff0f 100644
--- a/producers/tests/OkfProducer.Tests/Generation/CodeConceptIdsTests.cs
+++ b/producers/tests/OkfProducer.Tests/Generation/CodeConceptIdsTests.cs
@@ -49,6 +49,13 @@ public void A_case_only_collision_is_broken_by_ordinal_order_of_the_original_nam
     {
         // §3.3: ordinal on the NAME, not on (file, line), so the tie-break
         // survives a file move or a line shift.
+        //
+        // And not more than that, which this test should not be read as saying. The suffix is
+        // POSITIONAL: a third declaration named `PARSE` would sort ahead of both of these and take the
+        // bare `parse`, pushing each of them one place down -- `Parse` to `-2`, `parse` to `-3` --
+        // without either declaration having changed. That is real id churn, it is recorded on
+        // `ConceptIdRegistry` with the reason it is not being fixed today, and nothing here or there
+        // prevents it. What is asserted below is stability under a file move, and only that.
         var registry = new ConceptIdRegistry();
 
         var first = registry.Register("code/go/pkg", "Parse");
@@ -58,6 +65,37 @@ public void A_case_only_collision_is_broken_by_ordinal_order_of_the_original_nam
         Assert.Equal("code/go/pkg/parse-2", second.ToString());
     }
 
+    [Fact]
+    public void A_new_name_that_sorts_first_renumbers_the_declarations_already_there()
+    {
+        // The limit of the rule above, asserted rather than described, because a limit nobody can
+        // execute is a limit nobody believes. This is the accepted churn recorded on
+        // `ConceptIdRegistry`: the suffix is POSITIONAL, so a candidate arriving ahead of the others
+        // takes the bare slug and pushes each of them one place down, though their own declarations
+        // did not change. §3.1 calls id churn unrecoverable; this is the one route to it the scheme
+        // still has.
+        //
+        // Ordinal puts `PARSE` first: `P` ties, then `A` (0x41) precedes `a` (0x61), and `parse`'s
+        // leading `p` (0x70) sorts after both. Callers register in that order, so this is the sequence
+        // a later run really would produce.
+        var before = new ConceptIdRegistry();
+        var beforeParse = before.Register("code/go/pkg", "Parse");
+        var beforeLower = before.Register("code/go/pkg", "parse");
+
+        var after = new ConceptIdRegistry();
+        var afterUpper = after.Register("code/go/pkg", "PARSE");
+        var afterParse = after.Register("code/go/pkg", "Parse");
+        var afterLower = after.Register("code/go/pkg", "parse");
+
+        Assert.Equal("code/go/pkg/parse", afterUpper.ToString());
+
+        // Both existing declarations moved, and neither was edited.
+        Assert.Equal("code/go/pkg/parse", beforeParse.ToString());
+        Assert.Equal("code/go/pkg/parse-2", afterParse.ToString());
+        Assert.Equal("code/go/pkg/parse-2", beforeLower.ToString());
+        Assert.Equal("code/go/pkg/parse-3", afterLower.ToString());
+    }
+
     [Fact]
     public void The_registry_sees_collisions_across_families()
     {
diff --git a/producers/tests/OkfProducer.Tests/Generation/DescriptionTests.cs b/producers/tests/OkfProducer.Tests/Generation/DescriptionTests.cs
index d5a0b910..3e236f4f 100644
--- a/producers/tests/OkfProducer.Tests/Generation/DescriptionTests.cs
+++ b/producers/tests/OkfProducer.Tests/Generation/DescriptionTests.cs
@@ -430,6 +430,56 @@ public void The_scan_stops_re_reading_a_comment_once_no_bracket_can_end_a_tag()
     public void Unwrapping_a_tag_does_not_leave_a_double_space_behind()
         => Assert.Equal("Scans a body.", Resolver.Resolve(Member("T", "Scan", "Scans a <para></para> body."), existing: null).Text);
 
+    [Fact]
+    public void A_code_block_contributes_nothing_to_the_description()
+    {
+        // `IDescriptionSource.Describe` documents its Text as "a complete sentence, not a fragment".
+        // A `<code>` block's content is source, and it used to flow through and be collapsed onto one
+        // line: `var a = 1; var b = 2;` reading as if it were the tail of a sentence -- neither the code
+        // nor a description. Same argument the viewer's sanitizer makes for `<script>` and `<style>`:
+        // an opaque tag's content is dropped, not kept as text.
+        var described = new DocCommentSource().Describe(Member("N.T", "Register", """
+            Registers a scanner.
+            <code>
+            var a = 1;
+            var b = 2;
+            </code>
+            """));
+
+        Assert.NotNull(described);
+        Assert.Equal("Registers a scanner.", described.Value.Text);
+    }
+
+    [Fact]
+    public void An_inline_code_span_stays_in_the_description()
+    {
+        // The other half of the rule, and the reason `<c>` is deliberately not in the opaque set:
+        // inline code is part of the sentence, and dropping its content would delete the words the
+        // sentence is about -- "returns when the file is missing" instead of "returns `null`".
+        var described = new DocCommentSource().Describe(Member("N.T", "Register", "Returns <c>null</c> when the file is missing."));
+
+        Assert.NotNull(described);
+        Assert.Equal("Returns null when the file is missing.", described.Value.Text);
+    }
+
+    [Fact]
+    public void An_unclosed_code_opener_is_prose_by_the_same_rule_that_protects_a_generic()
+    {
+        // MEASURED, after this test first asserted truncation and was simply wrong about the code. An
+        // opener nothing ever closed is not marked as a tag at all, so the opaque-content rule never
+        // sees it and it comes out verbatim -- the same branch that keeps `List<T> of results` intact
+        // instead of eating `T`.
+        //
+        // That is the right answer here too, for the same reason: this producer reads arbitrary
+        // repositories, where a `<code>` with no closer is far likelier to be prose that happens to look
+        // like markup than a block whose content should vanish. Dropping to the end of the comment on a
+        // lone opener would delete real sentences.
+        var described = new DocCommentSource().Describe(Member("N.T", "Register", "Registers a scanner. <code>var a = 1;"));
+
+        Assert.NotNull(described);
+        Assert.Equal("Registers a scanner. <code>var a = 1;", described.Value.Text);
+    }
+
     private static SymbolFact Member(string container, string name, string? doc = null, string path = "A.cs") =>
         new(SymbolKind.Member, "csharp", container, name, $"public void {name}()",
             SymbolVisibility.Public, path, 0, 10, 1, 1, doc);
diff --git a/producers/tests/OkfProducer.Tests/Generation/DeterminismTests.cs b/producers/tests/OkfProducer.Tests/Generation/DeterminismTests.cs
index 029d132e..500846ee 100644
--- a/producers/tests/OkfProducer.Tests/Generation/DeterminismTests.cs
+++ b/producers/tests/OkfProducer.Tests/Generation/DeterminismTests.cs
@@ -133,6 +133,20 @@ public void Only_overview_carries_at_and_revision()
         // `by` alone survives on a code concept -- but not on every family: packages/* and docs/*
         // carry no `generated` block at all, only code and container concepts do.
         Assert.NotNull(Single(concepts, "code/csharp/n/scanner/scan").Document.Frontmatter.Get("generated")?.AsMapping()?.Get("by"));
+
+        // And the caveat that qualifies `revision` travels with it, in the body where a reader of the
+        // bundle is. It said this only in a code comment on GitRevision until now: `revision` names the
+        // committed HEAD, never the working tree, so with uncommitted edits it names a commit the
+        // bundle was not generated from -- and `--check` cannot see the difference either, both sides
+        // carrying the same revision.
+        //
+        // Asserted HERE rather than against the golden on purpose: the golden is captured outside git,
+        // so it has no `revision` and correctly carries no caveat. This is the only fixture in the
+        // solution where the sentence can appear at all, which is also why its absence went unnoticed.
+        Assert.Contains(
+            "names the committed HEAD, not the working tree",
+            Single(concepts, "overview").Document.Body,
+            StringComparison.Ordinal);
     }
 
     [Fact]
@@ -171,6 +185,14 @@ public void Outside_a_git_repository_the_wall_clock_stands_in_and_no_revision_is
         Assert.NotNull(overview.Document.Frontmatter.GeneratedAt);
         Assert.EndsWith("Z", overview.Document.Frontmatter.GeneratedAt, StringComparison.Ordinal);
         Assert.Null(overview.Document.Frontmatter.Get("revision"));
+
+        // And no caveat about a field that is not there. The sentence qualifies `revision`; emitting it
+        // unconditionally would have every bundle generated outside git warn about a value it does not
+        // carry, which is how a warning stops being read.
+        Assert.DoesNotContain(
+            "names the committed HEAD, not the working tree",
+            overview.Document.Body,
+            StringComparison.Ordinal);
     }
 
     // -- fixture ----------------------------------------------------------------------------------
diff --git a/producers/tests/OkfProducer.Tests/Generation/ProducerFixture.cs b/producers/tests/OkfProducer.Tests/Generation/ProducerFixture.cs
index 13c0d38e..c824612f 100644
--- a/producers/tests/OkfProducer.Tests/Generation/ProducerFixture.cs
+++ b/producers/tests/OkfProducer.Tests/Generation/ProducerFixture.cs
@@ -20,10 +20,16 @@ namespace OkfProducer.Tests.Generation;
 /// <see cref="CheckTests"/> and <see cref="BlastRadiusTests"/> go through, and the golden bundle beside
 /// it is what holds its output still.</para>
 ///
-/// <para><b>It is not the shipped composition.</b> The CLI does not compose the code-graph stage yet
-/// (Task 13 owns its flags), so this is the producer's pipeline assembled here, from the same
-/// production types. What it verifies is those types; what it cannot verify is a CLI that wires them
-/// differently -- which is why <see cref="ExistingBundleFrontmatter"/> lives in
+/// <para><b>It is not the shipped composition.</b> This used to say the CLI did not compose the
+/// code-graph stage yet and that Task 13 owned its flags; that task landed, and <c>GenerateRun</c>
+/// composes the stage today. The divergence is now a deliberate one rather than a gap waiting to
+/// close: this fixture runs tree-sitter and <c>NameMatchResolver</c> and stops there, because
+/// composing the Roslyn stage would put a <c>dotnet msbuild</c> evaluation -- SDK- and
+/// network-dependent -- inside every golden comparison (the reason is stated again at
+/// <see cref="Run"/>, at the line that omits it). So this is the producer's pipeline assembled here,
+/// from the same production types, minus one stage on purpose. What it verifies is those types; what
+/// it cannot verify is a CLI that wires them differently -- which is why
+/// <see cref="ExistingBundleFrontmatter"/> lives in
 /// <c>OkfProducer.Core</c> rather than in this file: it is the one piece a CLI could forget and
 /// silently destroy hand-written descriptions with, so it is production code that both callers share
 /// rather than a helper only the tests have.</para>
@@ -70,11 +76,40 @@ public static RunOutcome Run(string repoPath, string outPath)
         var graph = new CodeGraphBuilder(extractor, [CSharpProfile.Instance], [new NameMatchResolver()])
             .Build(snapshot, ExtractionLimits.Default, ScopeOptions.Default);
 
+        // Supplied by hand rather than by MSBuild, and that is a deliberate, recorded limit on what the
+        // golden covers. The fixture repository is never restored -- committing an `obj/` would be
+        // machine-specific -- so `dotnet msbuild` fails on it (NETSDK1004: no project.assets.json) and
+        // Roslyn compiles nothing. Composing the real query would add a network- and SDK-dependent
+        // restore to the one test that is fast and offline, and would still capture zero `Exact` edges
+        // unless that restore succeeded.
+        //
+        // What supplying the map directly RECOVERS, and what the golden had been captured without: the
+        // package -> namespace containment link, whose absence made the whole `code/` family an orphan
+        // in the captured bundle -- 0 of 12 concepts reachable from `overview`, measured -- plus
+        // `## Also compiled by` and `## Target frameworks`.
+        //
+        // What stays absent, on purpose: every `Exact` edge. `RoslynResolverTests` exercises that
+        // engine directly, against repositories it restores itself.
+        var sources = Directory
+            .EnumerateFiles(Path.Combine(repoPath, "src"), "*.cs", SearchOption.AllDirectories)
+            .OrderBy(path => path, StringComparer.Ordinal)
+            .ToList();
+        var ownership = SourceOwnershipMap.From(
+            repoPath,
+            [new ProjectCompileItems(Path.Combine(repoPath, "src", "Fixture.csproj"), "net10.0", sources)]);
+
         var options = new GenerateOptions
         {
             RepoUrl = RepoUrl,
             Rev = Rev,
             Profiles = [CSharpProfile.Instance],
+            SourceOwnership = ownership,
+
+            // Tree-sitter alone, because tree-sitter alone ran: naming a Roslyn version here would
+            // attach a determinism claim to an engine this capture never invoked. Bumping the
+            // TreeSitter.DotNet package therefore rewrites `overview`, which is exactly the reviewed
+            // migration §6.2 asks for rather than a drift.
+            EngineVersions = [TreeSitterExtractor.EngineVersion],
 
             // The line that makes a manual description survive a regeneration -- and therefore the
             // line without which --check would report every hand-edited concept as drift for ever.
@@ -411,7 +446,17 @@ public static void Git(string cwd, params string[] arguments)
         }
     }
 
-    /// <summary>A temporary directory, deleted on <see cref="Dispose"/>.</summary>
+    /// <summary>A temporary directory, deleted on <see cref="Dispose"/>.
+    ///
+    /// <para><b>Four test files carry their own <c>TempDir</c> beside this one</b> --
+    /// <c>HostileInputTests</c>, <c>ContainmentTests</c>, <c>DeterminismTests</c>,
+    /// <c>PruningTests</c> -- and that duplication is a decision, not an oversight. Each of those
+    /// carries a <c>Write</c> helper that this one does not, and the versions are not interchangeable:
+    /// a <c>Write</c> that creates missing parent directories and one that does not make a test over a
+    /// path whose directory is absent assert two different things, silently. Unifying them means
+    /// settling that semantics for four suites at once, on a helper whose whole job is to set up the
+    /// conditions those suites are measuring. The duplication is visible and inert; the merge is the
+    /// part with a way to be wrong.</para></summary>
     public sealed class TempDir : IDisposable
     {
         public TempDir()
diff --git a/producers/tests/OkfProducer.Tests/Generation/PruningTests.cs b/producers/tests/OkfProducer.Tests/Generation/PruningTests.cs
index 76e69c75..43d3632c 100644
--- a/producers/tests/OkfProducer.Tests/Generation/PruningTests.cs
+++ b/producers/tests/OkfProducer.Tests/Generation/PruningTests.cs
@@ -68,6 +68,14 @@ public void An_incomplete_run_deletes_nothing()
 
         // §6.3 rule 1: a degraded run "deletes nothing AND SAYS SO".
         Assert.Contains(result.Notes, n => n.Contains("did not visit every eligible file", StringComparison.Ordinal));
+
+        // And says WHICH concepts it kept, by prefix rather than as a bare count. Nothing asserted any
+        // part of this sentence until now, so its wording was free to drift: on `--update --no-code`
+        // the number is every code concept the previous run claimed, and a bare "678 concept(s) this
+        // run did not generate" reads as a loss report on a run that wrote its other families fine.
+        Assert.Contains(
+            result.Notes,
+            n => n.Contains("1 concept(s) under 'code' that this run did not generate were kept", StringComparison.Ordinal));
     }
 
     [Fact]
@@ -1443,18 +1451,40 @@ public void The_manifest_sorts_what_it_is_handed_rather_than_recording_the_order
     {
         // Handed in reverse, so the sort chain is what puts it right: delete either OrderBy in
         // GenerationManifest.Normalized and this goes red rather than passing by luck.
+        //
+        // THE PAIRS ARE THE TEST. This used to hand in `a`/`b` and `src/A.cs`/`src/Z.cs`, which sort
+        // the same way under every comparer there is -- so it measured SORTEDNESS and called it
+        // Ordinal. Swapping every `StringComparer.Ordinal` in `Normalized` for `CurrentCulture` left
+        // it green, though §6.2 pins Ordinal, and the reason it is pinned is that this file is
+        // compared byte for byte by `--check`: a linguistic sort makes the bytes depend on the
+        // machine's locale, so a bundle generated under one culture reports drift under another with
+        // nothing in the source changed.
+        //
+        // Both pairs below were MEASURED to invert between the two, against `InvariantCulture` as
+        // well as `CurrentCulture`, so this discriminates wherever it runs rather than only under the
+        // author's locale:
+        //
+        //   ids:   `_` is 0x5F and `0` is 0x30, so Ordinal puts `m0` first; a linguistic comparer
+        //          weighs punctuation below digits and puts `m_1` first.
+        //   paths: `Z` is 0x5A and `a` is 0x61, so Ordinal puts `Z.cs` first; a linguistic comparer
+        //          treats case as a tertiary difference and puts `a.cs` first.
+        //
+        // Each is handed in the LINGUISTIC order, which is the order a culture-sensitive sort would
+        // leave untouched -- so that mutation cannot pass by leaving the input alone.
+        const string firstId = "code/csharp/n/t/m0";
+        const string secondId = "code/csharp/n/t/m_1";
         using var tmp = new TempDir();
         new GenerationManifest(
                 Prefix,
-                [new ManifestConcept(B, ["src/Z.cs", "src/A.cs"]), new ManifestConcept(A, [])],
-                ["src/Z.cs", "src/A.cs"],
+                [new ManifestConcept(secondId, ["src/a.cs", "src/Z.cs"]), new ManifestConcept(firstId, [])],
+                ["src/a.cs", "src/Z.cs"],
                 ScopeOptions.Default)
             .WriteTo(tmp.Path);
 
         var text = File.ReadAllText(Path.Combine(tmp.Path, GenerationManifest.FileName));
 
-        Assert.True(text.IndexOf($"\"{A}\"", StringComparison.Ordinal) < text.IndexOf($"\"{B}\"", StringComparison.Ordinal));
-        Assert.True(text.IndexOf("src/A.cs", StringComparison.Ordinal) < text.IndexOf("src/Z.cs", StringComparison.Ordinal));
+        Assert.True(text.IndexOf($"\"{firstId}\"", StringComparison.Ordinal) < text.IndexOf($"\"{secondId}\"", StringComparison.Ordinal));
+        Assert.True(text.IndexOf("src/Z.cs", StringComparison.Ordinal) < text.IndexOf("src/a.cs", StringComparison.Ordinal));
     }
 
     [Fact]
@@ -1718,6 +1748,102 @@ public void The_manifest_records_the_scope_the_run_covered()
         Assert.Equal(new ScopeOptions(IncludeTests: true, IncludeInternal: false), GenerationManifest.TryRead(tmp.Path)?.Scope);
     }
 
+    [Fact]
+    public void The_directory_ladder_stops_at_the_owned_prefix_root_and_not_above_it()
+    {
+        // `IsWithinPrefixRoot` is the only thing between RemoveEmptyDirectories' walk and the bundle
+        // root, and no test put it on the critical path: every other fixture here leaves a sibling
+        // directory that breaks the loop after one rung, so the walk never climbs far enough for the
+        // guard to be what stops it.
+        //
+        // The prefix is two segments deep on purpose. With `code`, the rung above the prefix root is
+        // the bundle root, which `overview.md` already protects through the files check -- so deleting
+        // the guard changes nothing observable and a test written that way proves nothing. With
+        // `code/csharp`, the rung above is `code`, which is empty by then and has no file and no
+        // sibling to protect it. The guard is the only reason it survives.
+        using var tmp = new TempDir();
+
+        WriteRun(tmp, [A], complete: true, ownedPrefix: "code/csharp");
+        var codeDirectory = Path.Combine(tmp.Path, "code");
+        Assert.True(Directory.Exists(Path.Combine(codeDirectory, "csharp", "n", "t")));
+
+        var result = WriteRun(tmp, [], complete: true, ownedPrefix: "code/csharp");
+
+        // The ladder did climb -- without this the assertion below would pass over a walk that never
+        // ran at all, which is the failure mode the finding is about.
+        Assert.Contains(A, result.Pruned.Select(id => id.ToString()));
+        Assert.False(Directory.Exists(Path.Combine(codeDirectory, "csharp")));
+
+        // And it stopped where it had to.
+        Assert.True(Directory.Exists(codeDirectory));
+    }
+
+    [Fact]
+    public void A_rename_prunes_the_old_id_and_writes_the_new_one_in_the_same_run()
+    {
+        // The one destructive interaction no test ran. §6.3's "not visited AND not on disk" inference
+        // was accepted partly on the claim that a rename is covered; it was not. It is also the shape
+        // this producer causes on itself: any change to the id scheme renames every concept it touches,
+        // so the run that follows such a change IS this test.
+        //
+        // Ordering is what makes it safe and what makes it worth pinning: Reconcile runs AFTER
+        // CommitStaging, and its candidates exclude this run's own ids -- so the new file is on disk
+        // before the old one is considered for deletion, and a scheme where the new id sorted before
+        // the old could not delete the new one by mistake.
+        using var tmp = new TempDir();
+
+        WriteRun(tmp, [A], complete: true);
+        Assert.True(File.Exists(Path.Combine(tmp.Path, "code/csharp/n/t/a.md")));
+
+        var result = WriteRun(tmp, [B], complete: true);
+
+        // Both directions, because a writer that deleted everything would satisfy the first alone and a
+        // writer that deleted nothing would satisfy the second alone.
+        Assert.False(File.Exists(Path.Combine(tmp.Path, "code/csharp/n/t/a.md")));
+        Assert.True(File.Exists(Path.Combine(tmp.Path, "code/csharp/n/t/b.md")));
+        Assert.Equal([A], result.Pruned.Select(id => id.ToString()));
+
+        // And the manifest tracks the rename rather than accumulating: a manifest still claiming the old
+        // id would make the NEXT run treat it as a candidate all over again.
+        var claimed = GenerationManifest.TryRead(tmp.Path)!.ConceptIds.Select(id => id.ToString()).ToList();
+        Assert.Contains(B, claimed);
+        Assert.DoesNotContain(A, claimed);
+    }
+
+    [Fact]
+    public void The_manifest_write_leaves_no_temporary_behind_and_lands_readable()
+    {
+        // WHAT THIS DOES NOT WITNESS, named first because the test used to be called
+        // `..._is_staged_and_moved_...` and could not see either half of that.
+        //
+        // The reason `GenerationManifest.WriteTo` stages is that `File.WriteAllBytes` truncates first
+        // and fills after, so a process dying between the two leaves a manifest that is present, short
+        // and not JSON -- the one truncate-then-write in a design whose whole point is that a bundle is
+        // never observed half-written. That window opens and closes INSIDE one call, so no in-process
+        // test can stand in it: both assertions below hold identically for the plain
+        // `File.WriteAllBytes(path, ...)` the staging replaced -- no `.tmp` is ever created, and the
+        // manifest is written in full. MEASURED with that mutation in place: this test stays green.
+        //
+        // Witnessing it would need the same kind of collaborator seam `TreeSitterExtractor` took for
+        // its size check (`IFileSystemReader`, added because "the guarantee is about an operation that
+        // did not happen, and only a collaborator can witness that"). That seam does not exist on the
+        // write side, and inventing one is a production change this test is not the place to make. The
+        // argument for staging is at `WriteTo`; this is not its proof.
+        //
+        // What IS asserted here is real and was worth a test of its own: the staged file does not
+        // survive. A leftover would accumulate one per run in the user's bundle, and
+        // `ReportUnownedFiles` would have nothing to say about it -- it is not a concept and not under
+        // the owned prefix. That is the one mutation this catches: staging without moving.
+        using var tmp = new TempDir();
+        WriteRun(tmp, [A], complete: true);
+
+        Assert.Empty(Directory.EnumerateFiles(tmp.Path, "*.tmp", SearchOption.AllDirectories));
+
+        // And the manifest that landed is readable, so a staged file was not left in place under
+        // another name in place of the real one.
+        Assert.NotNull(GenerationManifest.TryRead(tmp.Path));
+    }
+
     // ---------------------------------------------------------------------------------------------
     // Helpers.
     // ---------------------------------------------------------------------------------------------
diff --git a/producers/tests/OkfProducer.Tests/Generation/SourceOwnershipMapTests.cs b/producers/tests/OkfProducer.Tests/Generation/SourceOwnershipMapTests.cs
index e0209308..784468f1 100644
--- a/producers/tests/OkfProducer.Tests/Generation/SourceOwnershipMapTests.cs
+++ b/producers/tests/OkfProducer.Tests/Generation/SourceOwnershipMapTests.cs
@@ -40,6 +40,15 @@ public void A_file_outside_the_repository_is_dropped_rather_than_keyed_absolutel
 
         Assert.Null(map.OwnerOf(outside));
         Assert.Empty(map.ClaimantsOf(outside.Replace('\\', '/')));
+
+        // The spelling the guard's REMOVAL produces, and the only one that separates the two
+        // behaviours. Both assertions above query the ABSOLUTE form; Relativize does not store that
+        // form under any branch, so deleting the escape guard leaves the entry keyed as
+        // `../elsewhere/Far.cs` and both of them stay green over a map that did keep the file.
+        var relativized = Path.GetRelativePath(root, outside).Replace('\\', '/');
+        Assert.StartsWith("../", relativized, StringComparison.Ordinal);
+        Assert.Null(map.OwnerOf(relativized));
+        Assert.Empty(map.ClaimantsOf(relativized));
     }
 
     [Fact]
@@ -47,14 +56,21 @@ public void Claimants_come_back_in_ordinal_order_whatever_order_they_arrived_in(
     {
         // The Ordinal-first rule is only a rule if the order does not depend on which project the
         // caller queried first, so the fixture supplies them in the opposite order.
+        //
+        // The names are `Z` and `a`, not `A` and `Z`, and that is the fixture rather than a detail.
+        // §6.2 pins ORDINAL, but an `A`/`Z` pair sorts the same way under every culture on earth, so
+        // the assertion measured sortedness and called it Ordinal: swapping every
+        // `StringComparer.Ordinal` in this type for `CurrentCulture` left it green. Ordinal compares
+        // code points, where `Z` (0x5A) precedes `a` (0x61); a linguistic comparison puts `a` first.
+        // The two orders are now opposite, so only one of them passes.
         var map = SourceOwnershipMap.From("/repo",
             [
+                new ProjectCompileItems("src/a/a.csproj", "net10.0", ["shared/Thing.cs"]),
                 new ProjectCompileItems("src/Z/Z.csproj", "net10.0", ["shared/Thing.cs"]),
-                new ProjectCompileItems("src/A/A.csproj", "net10.0", ["shared/Thing.cs"]),
             ]);
 
-        Assert.Equal(["src/A/A.csproj", "src/Z/Z.csproj"], map.ClaimantsOf("shared/Thing.cs"));
-        Assert.Equal("src/A/A.csproj", map.OwnerOf("shared/Thing.cs"));
+        Assert.Equal(["src/Z/Z.csproj", "src/a/a.csproj"], map.ClaimantsOf("shared/Thing.cs"));
+        Assert.Equal("src/Z/Z.csproj", map.OwnerOf("shared/Thing.cs"));
     }
 
     [Fact]
diff --git a/producers/tests/OkfProducer.Tests/fixtures/README.md b/producers/tests/OkfProducer.Tests/fixtures/README.md
index 202f8d21..2c9ae51d 100644
--- a/producers/tests/OkfProducer.Tests/fixtures/README.md
+++ b/producers/tests/OkfProducer.Tests/fixtures/README.md
@@ -8,6 +8,12 @@ Two directories:
 `CheckTests` regenerates `golden/` over a copy of itself and compares the bytes; `BlastRadiusTests`
 mutates a copy of `fixture-repo/` and asserts exactly which concepts move.
 
+**The committed `golden/` is this solution's only CROSS-PROCESS determinism oracle**, and that is
+worth knowing before deleting it as redundant with `DeterminismTests`. Those two runs happen in one
+process, so they share the per-process string hash seed: any ordering that leaked from a dictionary
+compares equal to itself and the test stays green. The bytes here were written by a different
+process on a different day, so they do not.
+
 ## Read this first: the discipline here is the OPPOSITE of `tests/fixtures/`
 
 The repository's other golden directory, `tests/fixtures/`, holds **byte-exact captures of the
@@ -28,15 +34,23 @@ an unintended one loud, so read the diff before you accept it.
 OKFGEN_UPDATE_GOLDEN=1 dotnet test producers/OkfProducer.sln --filter "FullyQualifiedName~CheckTests.Check_passes_on_an_unchanged_bundle"
 ```
 
-That rewrites `golden/` from scratch (it is machine output, so it is captured, never merged into) and
-then asserts against what it just wrote. Review `git diff producers/tests/OkfProducer.Tests/fixtures/golden`
-and commit it with the change that caused it.
+**That command exits RED, by design, and a green run would be the bug.** It rewrites `golden/` from
+scratch (it is machine output, so it is captured, never merged into) and then *refuses to assert*,
+failing with a notice saying so. The reason is worth stating: in update mode the expected side is
+produced by the very harness that produced the actual side, so a comparison between them is a
+tautology — and a tautology reported green is exactly how a stale variable left in someone's shell
+disarms a golden test without anyone noticing.
+
+So the procedure is two runs, not one. Rewrite, review
+`git diff producers/tests/OkfProducer.Tests/fixtures/golden`, then **re-run without the variable** to
+actually check it, and commit the diff with the change that caused it.
 
 **Two intentional changes will rewrite the whole golden**, and neither is drift:
 
 - **A version bump.** `generated.by` is derived from `OkfProducer.Core`'s assembly version
-  (`okfgen/0.1.0`), so bumping it rewrites the `generated` block of every concept. Regenerate,
-  read the diff, commit it as part of the bump.
+  (`okfgen/0.1.0`), so bumping it rewrites the `generated` block of every concept. The engine
+  versions sit beside it in `generated.engines`, on `overview` alone, and a package bump rewrites
+  that line the same way. Regenerate, read the diff, commit it as part of the bump.
 - **A tool-version bump.** Determinism is guaranteed *at a fixed extractor version*, not in the
   absolute: a tree-sitter grammar or Roslyn upgrade can move symbols, spans or descriptions over
   unchanged source (§6.2). Same treatment — a reviewed migration, never a silent drift.
@@ -57,8 +71,13 @@ in this plan, on a fixture that survived only because nobody had checked it out.
 
 ## What `fixture-repo/` contains, and why each piece is there
 
-Fifteen concepts, one occurrence of each shape. A golden of 480 concepts is not reviewable in a diff,
-and a diff nobody can read is not a test.
+Thirty-seven concepts, one occurrence of each shape. A golden of 480 concepts is not reviewable in a
+diff, and a diff nobody can read is not a test.
+
+It said "fifteen" until the review that also found the shape table below had gained no row for any of
+the declaration shapes `Shapes.cs` added — in the document a reviewer is pointed at *before* accepting
+a golden diff. Both are corrected; if you grow the fixture, grow this table in the same commit, or the
+next reader accepts a diff against a description of a bundle that no longer exists.
 
 | Shape | Where | Concept |
 |---|---|---|
@@ -69,12 +88,35 @@ and a diff nobody can read is not a test.
 | a type | `Scanner`, `Registry`, `Formatter` | `code/csharp/n/scanner`, … |
 | a merged overload pair (§3.2) | `Registry.Register` ×2 | `code/csharp/n/registry/register` |
 | a resolved call (§4.5) | `Register` → `Scanner.Normalize` | `## Calls` on `register` |
-| an unresolved call | `Count` → `int.Parse` | `## Calls (unresolved)` on `count` |
+| an unresolved call | `Count` → `int.Parse(raw)`, rendered `` `Parse` `` | `## Calls (unresolved)` on `count` |
 | a description from a doc comment | most members | `description_source: doc-comment` |
 | a description from a signature | `Registry.Count` | `description_source: generated` |
 | a private member, which gets no concept (§5.4) | `Scanner.Cache` | — none, deliberately |
 | a symbol a mutation deletes (§6.3) | `Scanner.Gone` | `code/csharp/n/scanner/gone` |
 
+The declaration shapes `src/Shapes.cs` adds, which exist to make the span-capping and identity rules
+fail visibly rather than silently:
+
+| Shape | Where | Concept |
+|---|---|---|
+| an interface | `IShape` | `code/csharp/n/shapes/i-shape` |
+| a struct | `Point` | `code/csharp/n/shapes/point` |
+| a record | `Boxed` | `code/csharp/n/shapes/boxed` |
+| an enum, whose members are deliberately not concepts | `Corner` | `code/csharp/n/shapes/corner` |
+| three types differing only by generic arity (§3.2) | `Holder`, `Holder<T>`, `Holder<T,U>` | `holder`, `holder-1`, `holder-2` |
+| a constructor | `Boxed(..)` | under `boxed` |
+| an event | `Point.Moved` | under `point` |
+| a two-declarator field | `Point.X, Y` | `point/x`, `point/y` |
+| a block-scoped namespace | `namespace N.Shapes { }` | `code/csharp/n/shapes` |
+| an `internal` type, and its `public` member, both out of scope | `Hidden`, `Hidden.Never` | — none, deliberately |
+| a type whose header spans three lines (R48's cap) | `Size` | `code/csharp/n/shapes/size` |
+
+Two shapes `Shapes.cs` contains and the golden does **not** hold a concept for, said plainly because
+the file's own header once implied the opposite: an **explicit interface implementation**
+(`IEquatable<Boxed>.Equals`) and a **local function**. Both are `Private` — neither carries an access
+modifier — so `FileEligibility.IsInScope` filters them with `--include-internal` off, which is the
+default this capture uses. They exercise the extractor, not the emitted bundle.
+
 Two placement rules the tests depend on, so keep them if you edit the fixture:
 
 - **`Scanner.Gone` is the last declaration in its file.** Deleting text above another declaration
diff --git a/producers/tests/OkfProducer.Tests/fixtures/fixture-repo/src/Shapes.cs b/producers/tests/OkfProducer.Tests/fixtures/fixture-repo/src/Shapes.cs
new file mode 100644
index 00000000..ac076c21
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/fixture-repo/src/Shapes.cs
@@ -0,0 +1,120 @@
+// Declaration shapes the golden did not cover. Before this file, the captured bundle held three
+// classes and their methods and nothing else: no interface, struct, record or enum, no constructor,
+// event, field or local function, no nested or generic type, no explicit interface implementation,
+// no block-scoped namespace, no non-public visibility, and no type whose header spans more than one
+// line. Deleting the whole escaping layer, or returning `StartLine + 1` from the header cap, would
+// not have moved one golden byte. Two of those shapes still reach no CONCEPT -- the explicit
+// interface implementation and the local function are Private, so scope filters them; they exercise
+// the extractor only. See `fixtures/README.md`.
+namespace N.Shapes
+{
+    /// <summary>A contract with one member, so an <c>interface_declaration</c> reaches the golden.</summary>
+    public interface IShape
+    {
+        /// <summary>Renders the shape.</summary>
+        string Render();
+    }
+
+    /// <summary>An enum, whose members are deliberately NOT emitted as concepts of their own.</summary>
+    public enum Corner
+    {
+        Sharp,
+        Round,
+    }
+
+    /// <summary>A struct, so the value-type arm of the declaration query is exercised.</summary>
+    public struct Point
+    {
+        /// <summary>Two declarators on one field, which is the rule no fixture reached.</summary>
+        public int X, Y;
+    }
+
+    /// <summary>A positional record, whose header carries no body at all.</summary>
+    public record Size(int Width, int Height);
+
+    /// <summary>
+    /// A type whose header spans three lines, which nothing else here does. The header cap (R48) is
+    /// the churn bound the whole id scheme rests on, and with every fixture type putting <c>{</c> on
+    /// the next line it would produce a byte-identical golden if it simply returned
+    /// <c>StartLine + 1</c>. This declaration is what makes that substitution visible.
+    /// </summary>
+    public sealed class Boxed
+        : IShape,
+          System.IEquatable<Boxed>
+    {
+        /// <summary>Raised when the box changes. An <c>event_field_declaration</c>.</summary>
+        public event System.Action? Changed;
+
+        private readonly Corner _corner;
+
+        /// <summary>A constructor, which is its own declaration kind.</summary>
+        public Boxed(Corner corner)
+        {
+            _corner = corner;
+        }
+
+        /// <summary>
+        /// Renders the box. The doc comment carries <see cref="Corner"/> and markdown-significant
+        /// characters -- [brackets], a `backtick` and a &lt;tag&gt; -- so the neutralisation layer is
+        /// exercised by the golden rather than only by unit tests.
+        /// </summary>
+        public string Render()
+        {
+            string Compose(string prefix) => prefix + _corner;
+
+            return Compose("box:");
+        }
+
+        /// <summary>Compares two boxes. Explicitly implemented, so the extractor spells its name apart from any public <c>Equals</c> -- but it is Private, so it reaches no concept.</summary>
+        bool System.IEquatable<Boxed>.Equals(Boxed? other)
+        {
+            return other is not null && other._corner == _corner;
+        }
+
+        /// <summary>A nested type, so the containment spine has a type inside a type to describe.</summary>
+        public sealed class Builder
+        {
+            /// <summary>Builds a box.</summary>
+            public Boxed Build(Corner corner)
+            {
+                return new Boxed(corner);
+            }
+        }
+    }
+
+    /// <summary>Non-generic, and the first of three declarations that differ only by arity.</summary>
+    public class Holder
+    {
+        /// <summary>Held count.</summary>
+        public int Count()
+        {
+            return 0;
+        }
+    }
+
+    /// <summary>Arity one. A separate concept from <see cref="Holder"/>, which it was not before.</summary>
+    public class Holder<T>
+    {
+        /// <summary>The held value.</summary>
+        public T? Value { get; set; }
+    }
+
+    /// <summary>Arity two.</summary>
+    public class Holder<TKey, TValue>
+    {
+        /// <summary>Looks the value up.</summary>
+        public TValue? Find(TKey key)
+        {
+            return default;
+        }
+    }
+
+    /// <summary>Internal rather than public, so scope filtering has something to filter here.</summary>
+    internal class Hidden
+    {
+        /// <summary>Not in scope by default.</summary>
+        public void Never()
+        {
+        }
+    }
+}
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/.okfgen-manifest.json b/producers/tests/OkfProducer.Tests/fixtures/golden/.okfgen-manifest.json
index f969aabc..fb7a8540 100644
--- a/producers/tests/OkfProducer.Tests/fixtures/golden/.okfgen-manifest.json
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/.okfgen-manifest.json
@@ -8,6 +8,7 @@
   "extractedFiles": [
     "src/Registry.cs",
     "src/Scanner.cs",
+    "src/Shapes.cs",
     "src/Sub/Formatter.cs"
   ],
   "concepts": [
@@ -16,6 +17,7 @@
       "sources": [
         "src/Registry.cs",
         "src/Scanner.cs",
+        "src/Shapes.cs",
         "src/Sub/Formatter.cs"
       ]
     },
@@ -67,6 +69,126 @@
         "src/Scanner.cs"
       ]
     },
+    {
+      "id": "code/csharp/n/shapes",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/boxed",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/boxed/boxed",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/boxed/builder",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/boxed/builder/build",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/boxed/changed",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/boxed/render",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/corner",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/holder",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/holder-1",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/holder-1/value",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/holder-2",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/holder-2/find",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/holder/count",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/i-shape",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/i-shape/render",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/point",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/point/x",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/point/y",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
+    {
+      "id": "code/csharp/n/shapes/size",
+      "sources": [
+        "src/Shapes.cs"
+      ]
+    },
     {
       "id": "code/csharp/n/sub",
       "sources": [
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/index.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/index.md
index 8346bc6e..4110fcb3 100644
--- a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/index.md
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/index.md
@@ -4,4 +4,4 @@
 
 # Subdirectories
 
-* [n](n/index.md) - Contains 6: registry, N.Registry, scanner, N.Scanner, sub, N.Sub.
+* [n](n/index.md) - Contains 8: registry, N.Registry, scanner, N.Scanner, shapes, N.Shapes, sub, N.Sub.
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n.md
index d14d17b5..040a5e40 100644
--- a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n.md
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n.md
@@ -18,4 +18,5 @@ N, a top-level code container.
 
 - [N.Registry](/code/csharp/n/registry)
 - [N.Scanner](/code/csharp/n/scanner)
+- [N.Shapes](/code/csharp/n/shapes)
 - [N.Sub](/code/csharp/n/sub)
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/index.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/index.md
index d1e8851a..ff71c3ec 100644
--- a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/index.md
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/index.md
@@ -1,5 +1,6 @@
 # C# Container
 
+* [N.Shapes](shapes.md) - Shapes, a code container in N.
 * [N.Sub](sub.md) - Sub, a code container in N.
 
 # C# Type
@@ -11,4 +12,5 @@
 
 * [registry](registry/index.md) - Contains 2: Registry.Count, Registry.Register.
 * [scanner](scanner/index.md) - Contains 4: Scanner.Gone, Scanner.Normalize, Scanner.Root, Scanner.Scan.
+* [shapes](shapes/index.md) - Contains 14: boxed, Shapes.Boxed, Shapes.Corner, holder, holder-1, Shapes.Holder`1, holder-2, Shapes.Holder`2, Shapes.Holder, i-shape, Shapes.IShape, point, Shapes.Point, Shapes.Size.
 * [sub](sub/index.md) - Contains 2: formatter, Sub.Formatter.
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes.md
new file mode 100644
index 00000000..dd66ef4e
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes.md
@@ -0,0 +1,26 @@
+---
+type: C# Container
+title: N.Shapes
+description: Shapes, a code container in N.
+tags:
+  - csharp
+  - container
+description_source: generated
+generated:
+  by: okfgen/0.1.0
+---
+
+# N.Shapes
+
+Shapes, a code container in N.
+
+## Contains
+
+- [Shapes.Boxed](/code/csharp/n/shapes/boxed)
+- [Shapes.Corner](/code/csharp/n/shapes/corner)
+- [Shapes.Holder&#96;1](/code/csharp/n/shapes/holder-1)
+- [Shapes.Holder&#96;2](/code/csharp/n/shapes/holder-2)
+- [Shapes.Holder](/code/csharp/n/shapes/holder)
+- [Shapes.IShape](/code/csharp/n/shapes/i-shape)
+- [Shapes.Point](/code/csharp/n/shapes/point)
+- [Shapes.Size](/code/csharp/n/shapes/size)
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed.md
new file mode 100644
index 00000000..da323def
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed.md
@@ -0,0 +1,28 @@
+---
+type: C# Type
+title: Shapes.Boxed
+description: A type whose header spans three lines, which nothing else here does. The header cap (R48) is the churn bound the whole id scheme rests on, and with every fixture type putting { on the next line it would produce a byte-identical golden if it simply returned StartLine + 1. This declaration is what makes that substitution visible.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L41-L44
+tags:
+  - csharp
+  - type
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Shapes.Boxed
+
+A type whose header spans three lines, which nothing else here does. The header cap (R48) is the churn bound the whole id scheme rests on, and with every fixture type putting { on the next line it would produce a byte-identical golden if it simply returned StartLine + 1. This declaration is what makes that substitution visible.
+
+## Signatures
+
+- `public sealed class Boxed : IShape, System.IEquatable<Boxed>` — `src/Shapes.cs#L41-L44`
+
+## Contains
+
+- [Boxed.Boxed](/code/csharp/n/shapes/boxed/boxed)
+- [Boxed.Builder](/code/csharp/n/shapes/boxed/builder)
+- [Boxed.Changed](/code/csharp/n/shapes/boxed/changed)
+- [Boxed.Render](/code/csharp/n/shapes/boxed/render)
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/boxed.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/boxed.md
new file mode 100644
index 00000000..fd26f25e
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/boxed.md
@@ -0,0 +1,21 @@
+---
+type: C# Member
+title: Boxed.Boxed
+description: A constructor, which is its own declaration kind.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L51-L54
+tags:
+  - csharp
+  - member
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Boxed.Boxed
+
+A constructor, which is its own declaration kind.
+
+## Signatures
+
+- `public Boxed(Corner corner)` — `src/Shapes.cs#L51-L54`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/builder.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/builder.md
new file mode 100644
index 00000000..dcea467e
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/builder.md
@@ -0,0 +1,25 @@
+---
+type: C# Type
+title: Boxed.Builder
+description: A nested type, so the containment spine has a type inside a type to describe.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L75-L76
+tags:
+  - csharp
+  - type
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Boxed.Builder
+
+A nested type, so the containment spine has a type inside a type to describe.
+
+## Signatures
+
+- `public sealed class Builder` — `src/Shapes.cs#L75-L76`
+
+## Contains
+
+- [Builder.Build](/code/csharp/n/shapes/boxed/builder/build)
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/builder/build.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/builder/build.md
new file mode 100644
index 00000000..3e4dda33
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/builder/build.md
@@ -0,0 +1,21 @@
+---
+type: C# Member
+title: Builder.Build
+description: Builds a box.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L78-L81
+tags:
+  - csharp
+  - member
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Builder.Build
+
+Builds a box.
+
+## Signatures
+
+- `public Boxed Build(Corner corner)` — `src/Shapes.cs#L78-L81`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/builder/index.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/builder/index.md
new file mode 100644
index 00000000..d6cd5c63
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/builder/index.md
@@ -0,0 +1,3 @@
+# C# Member
+
+* [Builder.Build](build.md) - Builds a box.
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/changed.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/changed.md
new file mode 100644
index 00000000..52e8ff13
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/changed.md
@@ -0,0 +1,21 @@
+---
+type: C# Member
+title: Boxed.Changed
+description: Raised when the box changes. An event_field_declaration.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L46
+tags:
+  - csharp
+  - member
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Boxed.Changed
+
+Raised when the box changes. An event_field_declaration.
+
+## Signatures
+
+- `public event System.Action? Changed` — `src/Shapes.cs#L46`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/index.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/index.md
new file mode 100644
index 00000000..5f5d4a28
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/index.md
@@ -0,0 +1,13 @@
+# C# Member
+
+* [Boxed.Boxed](boxed.md) - A constructor, which is its own declaration kind.
+* [Boxed.Changed](changed.md) - Raised when the box changes. An event_field_declaration.
+* [Boxed.Render](render.md) - Renders the box. The doc comment carries Corner and markdown-significant characters -- [brackets], a `backtick` and a <tag> -- so the neutralisation layer is exercised by the golden rather than only by unit tests.
+
+# C# Type
+
+* [Boxed.Builder](builder.md) - A nested type, so the containment spine has a type inside a type to describe.
+
+# Subdirectories
+
+* [builder](builder/index.md) - Builds a box.
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/render.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/render.md
new file mode 100644
index 00000000..c29af8ff
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/boxed/render.md
@@ -0,0 +1,25 @@
+---
+type: C# Member
+title: Boxed.Render
+description: Renders the box. The doc comment carries Corner and markdown-significant characters -- [brackets], a `backtick` and a <tag> -- so the neutralisation layer is exercised by the golden rather than only by unit tests.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L61-L66
+tags:
+  - csharp
+  - member
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Boxed.Render
+
+Renders the box. The doc comment carries Corner and markdown-significant characters -- [brackets\], a `backtick` and a <tag> -- so the neutralisation layer is exercised by the golden rather than only by unit tests.
+
+## Signatures
+
+- `public string Render()` — `src/Shapes.cs#L61-L66`
+
+## Calls (unresolved)
+
+- `Compose`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/corner.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/corner.md
new file mode 100644
index 00000000..bfefde74
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/corner.md
@@ -0,0 +1,21 @@
+---
+type: C# Type
+title: Shapes.Corner
+description: An enum, whose members are deliberately NOT emitted as concepts of their own.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L19-L20
+tags:
+  - csharp
+  - type
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Shapes.Corner
+
+An enum, whose members are deliberately NOT emitted as concepts of their own.
+
+## Signatures
+
+- `public enum Corner` — `src/Shapes.cs#L19-L20`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-1.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-1.md
new file mode 100644
index 00000000..7782fbf1
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-1.md
@@ -0,0 +1,25 @@
+---
+type: C# Type
+title: Shapes.Holder`1
+description: Arity one. A separate concept from Holder, which it was not before.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L96-L97
+tags:
+  - csharp
+  - type
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Shapes.Holder`1
+
+Arity one. A separate concept from Holder, which it was not before.
+
+## Signatures
+
+- `public class Holder<T>` — `src/Shapes.cs#L96-L97`
+
+## Contains
+
+- [Holder&#96;1.Value](/code/csharp/n/shapes/holder-1/value)
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-1/index.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-1/index.md
new file mode 100644
index 00000000..14745992
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-1/index.md
@@ -0,0 +1,3 @@
+# C# Member
+
+* [Holder`1.Value](value.md) - The held value.
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-1/value.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-1/value.md
new file mode 100644
index 00000000..4bd9560b
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-1/value.md
@@ -0,0 +1,21 @@
+---
+type: C# Member
+title: Holder`1.Value
+description: The held value.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L99
+tags:
+  - csharp
+  - member
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Holder`1.Value
+
+The held value.
+
+## Signatures
+
+- `public T? Value` — `src/Shapes.cs#L99`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-2.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-2.md
new file mode 100644
index 00000000..fea3f55e
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-2.md
@@ -0,0 +1,25 @@
+---
+type: C# Type
+title: Shapes.Holder`2
+description: Arity two.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L103-L104
+tags:
+  - csharp
+  - type
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Shapes.Holder`2
+
+Arity two.
+
+## Signatures
+
+- `public class Holder<TKey, TValue>` — `src/Shapes.cs#L103-L104`
+
+## Contains
+
+- [Holder&#96;2.Find](/code/csharp/n/shapes/holder-2/find)
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-2/find.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-2/find.md
new file mode 100644
index 00000000..41460c85
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-2/find.md
@@ -0,0 +1,21 @@
+---
+type: C# Member
+title: Holder`2.Find
+description: Looks the value up.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L106-L109
+tags:
+  - csharp
+  - member
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Holder`2.Find
+
+Looks the value up.
+
+## Signatures
+
+- `public TValue? Find(TKey key)` — `src/Shapes.cs#L106-L109`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-2/index.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-2/index.md
new file mode 100644
index 00000000..4996e38c
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder-2/index.md
@@ -0,0 +1,3 @@
+# C# Member
+
+* [Holder`2.Find](find.md) - Looks the value up.
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder.md
new file mode 100644
index 00000000..a5732624
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder.md
@@ -0,0 +1,25 @@
+---
+type: C# Type
+title: Shapes.Holder
+description: Non-generic, and the first of three declarations that differ only by arity.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L86-L87
+tags:
+  - csharp
+  - type
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Shapes.Holder
+
+Non-generic, and the first of three declarations that differ only by arity.
+
+## Signatures
+
+- `public class Holder` — `src/Shapes.cs#L86-L87`
+
+## Contains
+
+- [Holder.Count](/code/csharp/n/shapes/holder/count)
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder/count.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder/count.md
new file mode 100644
index 00000000..e769d455
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder/count.md
@@ -0,0 +1,21 @@
+---
+type: C# Member
+title: Holder.Count
+description: Held count.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L89-L92
+tags:
+  - csharp
+  - member
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Holder.Count
+
+Held count.
+
+## Signatures
+
+- `public int Count()` — `src/Shapes.cs#L89-L92`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder/index.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder/index.md
new file mode 100644
index 00000000..315e7ad6
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/holder/index.md
@@ -0,0 +1,3 @@
+# C# Member
+
+* [Holder.Count](count.md) - Held count.
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/i-shape.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/i-shape.md
new file mode 100644
index 00000000..5bbf6fa5
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/i-shape.md
@@ -0,0 +1,25 @@
+---
+type: C# Type
+title: Shapes.IShape
+description: A contract with one member, so an interface_declaration reaches the golden.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L12-L13
+tags:
+  - csharp
+  - type
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Shapes.IShape
+
+A contract with one member, so an interface_declaration reaches the golden.
+
+## Signatures
+
+- `public interface IShape` — `src/Shapes.cs#L12-L13`
+
+## Contains
+
+- [IShape.Render](/code/csharp/n/shapes/i-shape/render)
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/i-shape/index.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/i-shape/index.md
new file mode 100644
index 00000000..e2d6819c
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/i-shape/index.md
@@ -0,0 +1,3 @@
+# C# Member
+
+* [IShape.Render](render.md) - Renders the shape.
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/i-shape/render.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/i-shape/render.md
new file mode 100644
index 00000000..9a4e4181
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/i-shape/render.md
@@ -0,0 +1,21 @@
+---
+type: C# Member
+title: IShape.Render
+description: Renders the shape.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L15
+tags:
+  - csharp
+  - member
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# IShape.Render
+
+Renders the shape.
+
+## Signatures
+
+- `string Render()` — `src/Shapes.cs#L15`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/index.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/index.md
new file mode 100644
index 00000000..e695c092
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/index.md
@@ -0,0 +1,19 @@
+# C# Type
+
+* [Shapes.Boxed](boxed.md) - A type whose header spans three lines, which nothing else here does. The header cap (R48) is the churn bound the whole id scheme rests on, and with every fixture type putting { on the next line it would produce a byte-identical golden if it simply returned StartLine + 1. This declaration is what makes that substitution visible.
+* [Shapes.Corner](corner.md) - An enum, whose members are deliberately NOT emitted as concepts of their own.
+* [Shapes.Holder](holder.md) - Non-generic, and the first of three declarations that differ only by arity.
+* [Shapes.Holder`1](holder-1.md) - Arity one. A separate concept from Holder, which it was not before.
+* [Shapes.Holder`2](holder-2.md) - Arity two.
+* [Shapes.IShape](i-shape.md) - A contract with one member, so an interface_declaration reaches the golden.
+* [Shapes.Point](point.md) - A struct, so the value-type arm of the declaration query is exercised.
+* [Shapes.Size](size.md) - A positional record, whose header carries no body at all.
+
+# Subdirectories
+
+* [boxed](boxed/index.md) - Contains 5: Boxed.Boxed, builder, Boxed.Builder, Boxed.Changed, Boxed.Render.
+* [holder](holder/index.md) - Held count.
+* [holder-1](holder-1/index.md) - The held value.
+* [holder-2](holder-2/index.md) - Looks the value up.
+* [i-shape](i-shape/index.md) - Renders the shape.
+* [point](point/index.md) - Contains 2: Point.X, Point.Y.
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point.md
new file mode 100644
index 00000000..e80986af
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point.md
@@ -0,0 +1,26 @@
+---
+type: C# Type
+title: Shapes.Point
+description: A struct, so the value-type arm of the declaration query is exercised.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L26-L27
+tags:
+  - csharp
+  - type
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Shapes.Point
+
+A struct, so the value-type arm of the declaration query is exercised.
+
+## Signatures
+
+- `public struct Point` — `src/Shapes.cs#L26-L27`
+
+## Contains
+
+- [Point.X](/code/csharp/n/shapes/point/x)
+- [Point.Y](/code/csharp/n/shapes/point/y)
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point/index.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point/index.md
new file mode 100644
index 00000000..db18e698
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point/index.md
@@ -0,0 +1,4 @@
+# C# Member
+
+* [Point.X](x.md) - Two declarators on one field, which is the rule no fixture reached.
+* [Point.Y](y.md) - Two declarators on one field, which is the rule no fixture reached.
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point/x.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point/x.md
new file mode 100644
index 00000000..c9a4b9f1
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point/x.md
@@ -0,0 +1,21 @@
+---
+type: C# Member
+title: Point.X
+description: Two declarators on one field, which is the rule no fixture reached.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L29
+tags:
+  - csharp
+  - member
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Point.X
+
+Two declarators on one field, which is the rule no fixture reached.
+
+## Signatures
+
+- `public int X, Y` — `src/Shapes.cs#L29`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point/y.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point/y.md
new file mode 100644
index 00000000..4945b421
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/point/y.md
@@ -0,0 +1,21 @@
+---
+type: C# Member
+title: Point.Y
+description: Two declarators on one field, which is the rule no fixture reached.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L29
+tags:
+  - csharp
+  - member
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Point.Y
+
+Two declarators on one field, which is the rule no fixture reached.
+
+## Signatures
+
+- `public int X, Y` — `src/Shapes.cs#L29`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/size.md b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/size.md
new file mode 100644
index 00000000..9e220baa
--- /dev/null
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/code/csharp/n/shapes/size.md
@@ -0,0 +1,21 @@
+---
+type: C# Type
+title: Shapes.Size
+description: A positional record, whose header carries no body at all.
+resource: https://example.com/acme/fixture/blob/main/src/Shapes.cs#L33
+tags:
+  - csharp
+  - type
+  - public
+description_source: doc-comment
+generated:
+  by: okfgen/0.1.0
+---
+
+# Shapes.Size
+
+A positional record, whose header carries no body at all.
+
+## Signatures
+
+- `public record Size(int Width, int Height)` — `src/Shapes.cs#L33`
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/overview.md b/producers/tests/OkfProducer.Tests/fixtures/golden/overview.md
index 64a603e4..007b1414 100644
--- a/producers/tests/OkfProducer.Tests/fixtures/golden/overview.md
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/overview.md
@@ -6,7 +6,9 @@ tags:
   - repository
 generated:
   by: okfgen/0.1.0
-  at: 2026-09-03T12:28:06Z
+  at: 2026-09-07T10:17:58Z
+  engines:
+    - tree-sitter/1.3.0
 ---
 
 # fixture-repo
diff --git a/producers/tests/OkfProducer.Tests/fixtures/golden/packages/fixture.md b/producers/tests/OkfProducer.Tests/fixtures/golden/packages/fixture.md
index f96b84e4..2b02514a 100644
--- a/producers/tests/OkfProducer.Tests/fixtures/golden/packages/fixture.md
+++ b/producers/tests/OkfProducer.Tests/fixtures/golden/packages/fixture.md
@@ -10,3 +10,7 @@ tags:
 # Fixture
 
 The one package of the producer's fixture repository.
+
+## Contains
+
+- [N](/code/csharp/n)