feat(kbc): coverage v2 — media assets auto-attach via citing docs

[LikiosSedo]

What

Media assets (images under assets/) are document attachments, not first-class sources. Coverage v2 auto-accounts an image against any document that embeds it in its body, once that document is itself cited or excluded. compiled_from no longer needs a token per image and the exclusion ledger no longer needs a row per image.

Implements S1 (siclaw/kbc) of the raw reference contract v2. Design: DESIGN-kb-asset-provenance-2026-07-22.md §四 (normative).

Motivation

• cf bloat: aggregated compiled_from drowns in image tokens (UHI 昇腾.md: 139 entries = 35 docs + 104 images), unreadable to a human.
• exclusion-ledger noise: images as first-class sources force ~563 of UHI's 603 exclusion rows to be mechanical asset entries.
• attribution gap: the schema could not express which document embeds this image, so mediaverify and the collapse UI each guessed with heuristics.

Math (v2)

auto        = { a ∈ media_assets | ∃d ∈ (cited ∪ excluded): edge(d→a) }
unaccounted = sources − cited − excluded − auto

• Edges are derived from the raw tree — each document's body ![](…), [](…), and HTML <img src> links — resolved relative to the document + posixpath.normpath + URL-decoded. A link to a nonexistent / non-media path yields no edge, no error.
• An orphan image (embedded by no accounted document — upload residue) is not auto-attached; it stays unaccounted and must be excluded with a reason, so a human still sees it (anti fail-open).
• A directly-cited asset still counts as cited (v1 compatibility).

Monotonicity — old green libraries stay green

v2 only adds an accounting path, so unaccounted can only shrink. All pre-existing selfcheck tests pass unchanged — none asserted "unreferenced asset ⇒ unaccounted" over an assets/ path (the media-asset predicate requires an assets/ segment, which no existing test used, so no assertion needed updating).

Sheet-placeholder carve-out

assets/sheets/*.md table placeholders are content files, not media (is_media_asset requires an image extension). They stay first-class sources — auto-attaching them would launder "the table data was never compiled" into "covered".

Observability

coverage gains auto_attached (count) and auto_attached_sample (≤20 asset ← via edges), so auto-accounting is never a silent fail-open.

Two-repo fixture (byte-for-byte contract)

kbc/platform/pod/fixtures/asset-provenance/ = shared raw tree + candidate + EXCLUSIONS.json + expected.json. The sicore adoption ledger (S2) will assert the same expected.json. Cases: relative link, ../ cross-dir, HTML <img>, URL-encoded path, missing target, 0-byte download-failed placeholder, assets/sheets/*.md (not media), image shared by a cited + an unaccounted document, orphan image, image inheriting a document's exclusion, directly-cited asset.

S1b — compile discipline

The box constitution (prompts/{en,zh}/box_role.md) now tells the compile agent: cite documents only; images auto-attach — do not cite or exclude them one-by-one; orphan images still need a reasoned exclusion; assets/sheets/ placeholders handled as usual.

Test

python test_selfcheck.py — all green (4 new: is_media_asset, document_link_targets, coverage_v2_auto_attach, asset_provenance_fixture). test_mediaverify / test_incremental / test_redblue / test_compile_box also green.