Widen the capability-citation gate to the documentation folder

This gate's own header names the failure it exists to prevent — two artifacts
encoding one fact with nothing forcing agreement, where fixing one copy is not
fixing the fact. It then guarded exactly one artifact.

Measured: planting a claim that doxa-vision-card is the capability 1 exemplar
into documentation/reference.md passed both this gate and the exemplars gate.
That is precisely the error this file was written to catch, sitting one directory
outside its scan. doxa-vision-card ships an instances file with two entries, so
the classifier types it parameterized — capability 2, not 1.

The documentation folder states the tier correctly today, so this is not fixing a
live defect; it closes the hole that would let the same one recur unnoticed in a
second place. Negative-tested: the planted claim that used to pass now fails with
the file named, and removing it returns to green.

The same stale citation also lives in the plugin-designer skill, which is outside
this repo and so beyond any gate here. That half stays a Driver edit; the repo
now holds the checkable half.

internal/check-capability-citations.mjs

@@ -31,7 +31,7 @@
  * bundle, its claimed tier and its real one; restoring all-people-groups returns PASS. A run that
  * parses fewer than MIN_EXPECTED citations FAILS rather than passing vacuously.
  */
-import { readFileSync, existsSync } from 'node:fs'
+import { readFileSync, existsSync, readdirSync } from 'node:fs'
 import { resolve, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -39,6 +39,27 @@ const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 const README = join(ROOT, 'README.md')
 const MANIFEST = join(ROOT, 'public', 'doxa-maps', 'manifest.json')
 
+// ★ WIDENED 2026-09-22 TO documentation/ AS WELL AS README.md.
+//
+// This file's own header names the failure it exists to prevent: "Two artifacts encoding one fact,
+// with nothing forcing agreement — fixing one copy is not fixing the fact." It then guarded exactly
+// ONE artifact. Measured: planting `doxa-vision-card is the capability 1 exemplar` into
+// documentation/reference.md PASSED both this gate and check:capability-exemplars — the precise
+// error this file was built to catch, sitting one directory outside its scan.
+//
+// documentation/ currently states the tier CORRECTLY (reference-capability-exemplars.md types it
+// `parameterized`, and reference.md:52 warns that "folder's apparent simplicity does not decide its
+// tier"), so this widening is not fixing a live defect — it is closing the hole that let the same
+// defect recur unnoticed in a second place.
+//
+// NOT COVERED, and it cannot be: the /plugin-designer SKILL carries the same stale citation and
+// lives outside this repo, so no gate here can reach it. That is why the fix is a Driver edit; the
+// repo's job is to hold the checkable half (see BUILD-PLUGIN-DESIGNER-SKILL-MEANS-REAL-WORK).
+const DOC_DIR = join(ROOT, 'documentation')
+const DOC_FILES = existsSync(DOC_DIR)
+  ? readdirSync(DOC_DIR).filter(f => f.endsWith('.md')).map(f => join(DOC_DIR, f))
+  : []
+
 if (!existsSync(README) || !existsSync(MANIFEST)) {
   console.log('CAPABILITY-CITATIONS: SKIP — README.md or manifest.json not present.')
   process.exit(0)
@@ -66,7 +87,10 @@ for (const b of (mf.bundles || [])) {
   if (best) capOfBundle.set(b.bundle, best)
 }
 
-const doc = readFileSync(README, 'utf8')
+// Every scanned artifact, concatenated with a file marker so a finding can name its source.
+// README stays first so its citations are reported in the same order as before.
+const SOURCES = [README, ...DOC_FILES]
+const doc = SOURCES.map(f => `\n<!-- FILE:${f.replace(ROOT + '/', '')} -->\n` + readFileSync(f, 'utf8')).join('\n')
 
 // `![Capability N — ... (bundle)](...)` — the caption form that names its subject in parentheses.
 const CAPTION = /!\[Capability\s+(\d)\s*[—-][^\]]*\(([a-z0-9-]+)\)\]/gi