[zongqichen]

Why

The documentation said credentials never copy implicitly, but ordinary managed cf commands can seed a fresh default workspace. The README, security model, design, and release checks now describe the actual copy modes.

What changed

• Explain automatic auth/API copying with cleared org/space, explicit full-target import, and independent snapshots.
• State named-context and bypass behavior and the limit of offline authentication checks.
• Update release acceptance checks to use synthetic isolated fixtures.

Scope

• Documentation only, with existing CLI behavior as the contract.
• Document the confirmed pre-existing lock-wait race. Its separate fix follows this item before release preparation.

Blast Radius

Users can distinguish automatic initialization from explicit import. Current concurrency limits are stated rather than hidden by an unconditional no-overwrite claim.

Verification

• Compared the claims with the shim, named-context, import, and configuration-copy code. All 14 internal links passed.
• make check, make release-check, and make security pass.

Closes #60.

[zongqichen]

PASS. The corrected release procedure uses two real test entry points.

go test ./internal/app ./internal/cfhome passed with Go 1.27.3. The isolated
official-CF E2E run passed all seven race-enabled journeys with
/home/d072944/bin/cf. The full documentation diff matches the source, all 14
internal links pass, and the detached worktree remains clean at
ea5ea7247db3e793998036165026792e5cbc742f.

The documented pre-lock overwrite remains a separate runtime issue.