Add family artifact selection and provenance

docs/cli.md

@@ -310,6 +310,12 @@ and precedence.
 
 ## `--artifacts` Selection Rules
 
+An artifact-family key selects all of its concrete character members. A
+concrete generated key selects only that member; mixed family and concrete
+selection is deduplicated and executed as concrete keys. The resulting plan
+and command output identify both the concrete key and, where applicable, its
+family and character ID.
+
 - accepted on `run`, `session plan`, `run-stage`, `analyze`, and `publish`;
 - repeatable and comma-separated values are combined, surrounding whitespace
   is removed, and duplicate names are collapsed;

docs/internal/artifacts.md

@@ -60,6 +60,10 @@ exact named configured definitions become the effective set for that invocation,
 regardless of their `enabled` value. The effective-set resolver itself does not
 expand dependencies; the analyze work planner closes those targets over their
 configured prerequisite graph. Availability is separate from executability.
+Configuration may normalize a family selection into its concrete generated
+members before this resolver runs. The effective set retains optional family
+and character origin metadata, but its keys, catalog sources, and runtime
+lookups remain concrete configured-artifact identities.
 Configured outputs, including non-executable prerequisites, become available
 only when the versioned analyze state identifies a current result whose source,
 contract, canonical configured path, size, and checksum match a confined

docs/internal/manifest.md

@@ -66,6 +66,11 @@ checksum, and positive byte size. Non-current records cannot carry an output,
 so an older file is not advertised through stale, missing, failed, or
 unselected state.
 
+Family-produced records additionally retain optional `family` and
+`character_id` provenance supplied by configuration resolution. These fields
+do not replace the concrete configured key or infer family membership from a
+name, so older records without them remain valid.
+
 The session-stage collection is the reconciled authority across invocations.
 The corresponding collection on an invocation's `analyze` stage record is an
 audit of only the artifacts evaluated or attempted by that run. These records

docs/operations.md

@@ -201,6 +201,11 @@ canonical file into place or editing the manifest. See
 
 ## Artifact Selection
 
+For a configured artifact family, selecting its family key expands to every
+concrete character artifact. Select a concrete generated key to operate on one
+member only. Manifests and plan output retain the concrete key as the durable
+identity and include the family and character ID as optional provenance.
+
 `--artifacts` can be used on `run`, `session plan`, `run-stage`, `analyze`, and
 `publish`. For a bounded run or plan, the selected range must contain `analyze`
 or `publish`.

docs/roadmap/implementation.md

@@ -858,7 +858,7 @@ family-specific dependency syntax before runtime validation.
 
 ## Stage 15 — Family Selection, Origin Reporting, And Reconciliation
 
-**Status: Pending**
+**Status: Completed**
 
 ### Goal