feat: add m2 local import context edge integrity dry run

Author: rostok2112

docs/adr/0012-m2-local-extraction-import-scope.md

@@ -577,3 +577,27 @@ The next allowed step is:
 ```text
 m2_explicit_local_import_context_edge_integrity_dry_run
 ```
+
+## Explicit Local-Import Context-Edge Integrity Dry-Run
+
+The aggregate-only context-edge integrity dry-run is:
+
+```text
+scripts/run_m2_explicit_local_import_context_edge_integrity_dry_run.py
+```
+
+It reopens one explicit workspace-private JSON export under
+`workspace/local-private/extraction-indexing/input/`, requires the prior envelope, record-shape,
+context-edge-shape, and context-edge-reference compatibility gates, and reports only aggregate
+self-edge and duplicate-edge counts. Optional redacted output remains private under
+`workspace/local-private/extraction-indexing/import/context-edge-integrity/`.
+
+The helper does not emit ids, relation values, duplicate tuples, source text, paths, filenames,
+hashes, logs, payloads, or runtime evidence. It does not map retrieval buckets, import a DB,
+construct an index, construct a graph, or complete any original M2 criterion.
+
+The next allowed step is:
+
+```text
+m2_explicit_local_import_context_edge_integrity_dry_run_review_gate
+```

docs/devlog/DECISIONS_PENDING.md

@@ -1,5 +1,11 @@
 # Decisions Pending
 
+- The M2 explicit local-import context-edge integrity dry-run is implemented. Add
+  `m2_explicit_local_import_context_edge_integrity_dry_run_review_gate` next using redacted
+  summary evidence only.
+- Keep selected-export reopening during review, id emission, relation emission, duplicate tuple
+  emission, retrieval-bucket mapping, real DB import, line-index construction, context-graph
+  construction, and every original M2 completion flag false.
 - The M2 explicit local-import context-edge integrity contract is defined. Implement
   `m2_explicit_local_import_context_edge_integrity_dry_run` next as an aggregate-only dry-run.
 - Keep id emission, id normalization, id hashing, relation emission, retrieval-bucket mapping,

docs/devlog/KNOWN_RISKS.md

@@ -1,5 +1,15 @@
 # Known Risks
 
+- The M2 explicit local-import context-edge integrity dry-run reopens one explicit private UTF-8
+  JSON export, decodes it with no size cap, and counts self-edge and duplicate-edge occurrences in
+  memory. A large selected file may consume substantial memory.
+- The dry-run output is aggregate-only. Do not treat it as permission to emit ids, relation values,
+  duplicate tuples, source text, paths, filenames, hashes, logs, payloads, or runtime evidence.
+- Keep optional context-edge integrity dry-run JSON under
+  `workspace/local-private/extraction-indexing/import/context-edge-integrity/` and out of tracked
+  files, chat, reports, and commits.
+- A future `m2_explicit_local_import_context_edge_integrity_dry_run_review_gate` must read only
+  redacted integrity summary JSON and must not reopen the selected export.
 - The M2 explicit local-import context-edge integrity contract is static policy only. Do not
   describe it as reopening or decoding an export, checking real edges, emitting ids or relation
   values, mapping retrieval buckets, importing a DB, building an index, or constructing a graph.

docs/devlog/NEXT_ACTIONS.md

@@ -1,5 +1,21 @@
 # Next Actions
 
+After the original M2 explicit local-import context-edge integrity dry-run:
+
+1. Treat `scripts/run_m2_explicit_local_import_context_edge_integrity_dry_run.py` as the
+   aggregate-only self-edge and duplicate-edge dry-run over one explicit workspace-private export.
+2. Keep ids, relation values, duplicate tuples, source text, paths, filenames, hashes, logs,
+   payloads, and runtime evidence out of stdout, output JSON, tracked files, reports, and commits.
+3. Keep retrieval-bucket mapping, real DB import, line-index construction, context-graph
+   construction, and every original M2 completion flag blocked.
+4. Add only a redacted review gate for the integrity summary next.
+
+Recommended next safe step:
+
+- Implement `m2_explicit_local_import_context_edge_integrity_dry_run_review_gate`.
+
+---
+
 After the original M2 explicit local-import context-edge integrity contract:
 
 1. Treat `docs/m2-explicit-local-import-context-edge-integrity-contract.md`,

docs/devlog/SESSION_SUMMARY.md

@@ -1,5 +1,25 @@
 # Session Summary
 
+Original M2 explicit local-import context-edge integrity dry-run is implemented.
+
+Completed in the latest session:
+- Added `scripts/run_m2_explicit_local_import_context_edge_integrity_dry_run.py` and
+  `tests/test_m2_explicit_local_import_context_edge_integrity_dry_run.py`.
+- The helper reopens only one explicit workspace-private JSON export and requires the approved
+  envelope, record-shape, context-edge-shape, and context-edge-reference preconditions.
+- The dry-run reports only aggregate `self_edge_count` and `duplicate_edge_count`; record ids,
+  edge ids, relation values, duplicate tuples, source text, paths, filenames, hashes, logs,
+  payloads, and runtime evidence remain sealed.
+- Optional redacted JSON output is restricted to
+  `workspace/local-private/extraction-indexing/import/context-edge-integrity/`.
+- Wired the temp-workspace self-test into `scripts/check_all.py`.
+- Retrieval-bucket mapping, DB import, line-index construction, context-graph construction, and
+  every original M2 completion flag remain blocked.
+- The only approved next step is
+  `m2_explicit_local_import_context_edge_integrity_dry_run_review_gate`.
+
+---
+
 Original M2 explicit local-import context-edge integrity contract is defined.
 
 Completed in the latest session:

docs/m2-explicit-local-import-context-edge-integrity-contract.md

@@ -92,3 +92,35 @@ The next allowed step is:
 ```text
 m2_explicit_local_import_context_edge_integrity_dry_run
 ```
+
+## Context-Edge Integrity Dry-Run
+
+The aggregate-only dry-run helper is:
+
+```text
+scripts/run_m2_explicit_local_import_context_edge_integrity_dry_run.py
+```
+
+It reopens only one explicit workspace-private JSON export under
+`workspace/local-private/extraction-indexing/input/`, verifies the approved envelope,
+record-shape, context-edge-shape, and context-edge-reference preconditions, and reports only
+aggregate self-edge and duplicate-edge counts. Optional redacted JSON output remains private under
+`workspace/local-private/extraction-indexing/import/context-edge-integrity/`.
+
+The dry-run does not emit ids, relation values, duplicate tuples, source text, paths, filenames,
+hashes, logs, payloads, or runtime evidence. It does not normalize ids, hash ids, map retrieval
+buckets, import a DB, construct a line index, construct a context graph, or complete any original
+M2 criterion. It intentionally applies no decode-size cap, matching the earlier explicit private
+JSON dry-runs.
+
+Validate the dry-run smoke with:
+
+```powershell
+python scripts/run_m2_explicit_local_import_context_edge_integrity_dry_run.py --self-test --quiet
+```
+
+The next allowed step is:
+
+```text
+m2_explicit_local_import_context_edge_integrity_dry_run_review_gate
+```

scripts/check_all.py

@@ -479,6 +479,15 @@ def main() -> int:
                 "--quiet",
             ],
         ),
+        (
+            "M2 explicit local-import context-edge integrity dry-run smoke",
+            [
+                sys.executable,
+                "scripts/run_m2_explicit_local_import_context_edge_integrity_dry_run.py",
+                "--self-test",
+                "--quiet",
+            ],
+        ),
         (
             "BepInEx bridge safety smoke",
             [