fix(docs): fail closed on unscoped workflows

docs/INSTANCE_AWARE_DOCUMENTATION.md

@@ -34,6 +34,14 @@ opens the user projection: each contributed workflow still needs its own
 module, capability, permission, and runtime-policy conditions so baseline Help
 Center access does not imply authority to perform every documented task.
 
+This permission binding is a strict source contract. Every user workflow topic
+must declare at least one `DocumentationCondition`, and every alternative in
+its `conditions` tuple must include `required_scopes` or `any_scopes`. Module,
+capability, or configuration conditions alone are not sufficient because topic
+conditions are alternatives: one unscoped alternative would bypass all scoped
+ones. Manifest validation blocks a release containing such a topic, and Docs
+omits a non-compliant runtime-provider topic from the user projection.
+
 ## Conditions
 
 Documentation topics can declare: