Generate only executable next_commands for compact audit output

[Widthdom]

Summary

Compact audit output generates a next_commands recovery command that the CLI itself rejects.

Recovery commands are part of the machine-facing continuation contract. Emitting an invalid command blocks automated audit paging and teaches users an unsupported command shape.

Environment

• origin/main: c642bc4c3dda4ef659df8e6b699e10f61da3c836
• cdidx v1.44.3, locally built
• fresh and complete repository index
• full net8.0 and net9.0 suites pass

Reproduction

dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll audit \
  phrase-risk-patterns/obsolete-production-code \
  --db .cdidx/codeindex.db --format compact --limit 2 --no-progress

The response contains:

cdidx audit phrase-risk-patterns/obsolete-production-code \
  --json=ndjson --results-only --limit 2 \
  --db .cdidx/codeindex.db --max-json-bytes <bytes>

Execute that shape after replacing the byte placeholder:

dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll audit \
  phrase-risk-patterns/obsolete-production-code \
  --db .cdidx/codeindex.db \
  --json=ndjson --results-only --limit 2 --no-progress

Actual:

E010_USAGE_ERROR:
--json=<format> is only supported by 'search', 'files', 'symbols',
and validate's array output.

Expected behavior

Every next_commands entry is executable after replacing documented placeholders. If NDJSON rows are supported only through search --recipe, generate that canonical entrypoint instead of invalid audit --json=ndjson syntax.

The replay must retain recipe/child selection, cursor, scope, filters, DB choice, limits, and byte budget.

Root cause

src/CodeIndex/Cli/QueryCommandRunner.SearchRecipes.cs:1536-1562 builds replay argv using the current invocation prefix, then unconditionally adds --json=ndjson when resultsOnly is true. It does not account for the different accepted JSON domains of audit and search.

Focused PR scope

One PR should:

1. make replay construction command-capability-aware;
2. generate an accepted audit form or switch intentionally to search --recipe;
3. preserve all selectors, filters, cursors, DB and budget arguments;
4. synchronize help examples if the canonical replay entrypoint changes;
5. add execution-level tests for generated commands;
6. add the required bilingual changelog fragment.

Non-goals

• Do not redesign compact output or recipe ranking.
• Do not add NDJSON support to every command solely to preserve this string.
• Do not rely on string-fragment tests that never execute the generated argv.

Implementation guidance and cautions

• Prefer shared command-capability metadata over hard-coded audit branches.
• Build replay argv structurally, then render it with the existing safe quoting policy.
• Test query names, cursors, paths, and DB values containing spaces or shell metacharacters.
• Preserve path-redaction semantics and mark display-only placeholders clearly.
• Tests should substitute valid placeholder values and call the normal parser/runner.

Required tests

• One and several truncated child queries.
• Audit alias and search --recipe parity.
• With/without cursor, explicit DB/data-dir, path filters, and byte budget.
• POSIX and Windows display quoting.
• Every emitted command parses and continues the intended query after placeholder replacement.

Acceptance criteria

• Compact audit output never emits invalid audit ... --json=ndjson syntax.
• Every generated continuation command is accepted by the current CLI.
• Replay loses no filter, scope, cursor, or selector state.
• Contract tests prevent future parser/generator drift.

Regression history

#4308 introduced compact replay-oriented audit output. This is a residual defect in that continuation workflow. No exact newer issue was found.