fix: stabilize hosted documentation follow-ups

[jlitola]

Summary

• omit observed search bounds from automatic CLI and MCP follow-ups for hosted/crawled HTTP(S) documentation_page targets
• forward page URLs and emitted heading fragments unchanged while preserving repository-document snapshot ranges and explicit caller-supplied read bounds
• update durable CLI/MCP guidance and add regression plus smoke coverage for publication replacement semantics

Verification

• bun test — 4,826 pass
• bun run typecheck
• bun run format:check
• bun run lint — passes with 8 pre-existing warnings in repository-target.ts
• bun run build
• bun run plugins:check
• bun run validate:packages
• bun run smoke:cli:built
• bun run smoke:mcp:built
• source CLI unauthenticated and MCP registration smokes
• Opus review loop — final round clean

Live evidence

After resolving a local keychain prompt, a live source search for routing against site:expressjs.com returned hosted documentation_page hits with observed locator ranges and bounds-free generated followUp values. Human-readable CLI output displayed the exact hosted target without coordinates. An unbounded live read of the returned https://expressjs.com/en/5x/guide/routing/ target then returned the current page from line 1 through its reported total; the 16,278-line aggregate target also completed through source and built CLIs with valid JSON.

After the Express corpus refresh, a live route methods search emitted https://expressjs.com/en/5x/guide/routing/#route-methods with search evidence lines 56–66. The generated follow-up preserved that fragment exactly and omitted bounds. Executing it returned lines 56–112 beginning at ## Route methods, confirming the complete heading subtree rather than replaying the narrower search coordinates.

The full authenticated MCP smoke progressed through live package calls but stopped on an unrelated pkg_upgrade_review success assertion before reaching its documentation block. The focused real-site search-to-read path is verified; a full live MCP-suite pass is not claimed.

Targeted agent evaluation was also attempted. Claude's isolated harness was not logged in. Codex invoked search and docs_list, then timed out after 302 seconds while those service calls remained in progress; its available tool-call and metrics artifacts were inspected, with no final or isolation artifact produced.

Scope

No backend, remote server, release, deployment, retry, snapshot, compatibility, or historical-storage changes are included.