[stacknil]

Summary

Correct the bounded-correlation explanation when a config investigation has no attached policy denials or follow-on events. CCI-003 currently uses an affirmative attachment sentence despite its empty arrays and explicit zero-evidence Markdown report.

Why

Refs #94. The evidence matrix and reproduction distinguish consistent identities/severity/counts from the separate wording defect. Independent review accepted this exact seven-file patch with documented local platform limitations.

Behavior change

Both attachment arrays empty selects an explicit no-attached-evidence sentence naming the target and time window. Either array nonempty preserves the existing positive sentence exactly. Update the contract clarification, regressions and four corresponding artifact explanation locations.

Validation

• Unchanged-base regression: 1 failed / 3 passed; corrected generator: 4 passed.
• Focused config/schema modules: 24 passed. Complete Windows/Python 3.12 suite: 251 passed / 3 platform skips. Syntax compilation and offline wheel build passed.
• Independent generator AST, alternate-target/window and all artifact-value comparisons passed. Only the four intended explanations change; deterministic replay and exact seven-file diff verified.
• PR CI on Ubuntu 24.04 / Python 3.11.17: 254 passed, 0 skipped, covering the locally skipped FIFO and two directory-symlink cases. Repo Sentinel: passed, no findings. Push-triggered checks also passed.

Compatibility

Preserve schemas/versions, runtime inputs, correlation predicates and inclusive boundaries, severity, evidence counts, source identities and every other artifact value. The wording describes scoped attachments and makes no global-absence, causality, incident, clearance or safety claim. Fixtures remain sanitized.

Risk and rollback

Consumers comparing explanation strings will observe the corrected empty-case sentence. Revert this single commit, including its matching fixtures, to restore the prior wording. Leave #94 open for review.