Use explicit fresh hosted capability snapshots for plan checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tools/README.md

@@ -318,4 +318,27 @@ Stable IDs and maturity fields are preserved for agent consumption (UC-RS-019).
 
 - UC-RS-013 — Use registry metadata in agentic coding
 - UC-RS-019 — Publish a machine-readable registry export
-- UC-RS-023 — Validate registry entries against schema
+- UC-RS-023 — Validate registry entries against schema
+### Hosted query-before-build
+
+The default `plan-check` still uses the local composed index. To consult the
+hosted registry explicitly:
+
+```bash
+reuse-surface plan-check --intent "tender document evidence" \
+  --hub-url https://reuse.coulomb.social --no-llm --format json
+```
+
+Hosted mode fetches the public `GET /v1/federated`; it does not send the query or
+a mutation token. It requires a nonempty usable collection, `stale: false`, no
+`X-Federation-Warnings`, and a timezone-aware composition no older than 24 hours
+(overridable with positive finite `--max-index-age-hours`). Malformed, oversized,
+unavailable, stale and partial responses exit **2** with no verdict or opt-in
+outcome/request side effects. There is no automatic local fallback.
+
+`index_source` records URL, capability count, composition/retrieval times and
+SHA-256 of the response bytes. This is evidence about the accepted hub snapshot;
+it does not certify every upstream repository's publication freshness. The
+matching verdict is lexical advice; review candidates and owner contracts before
+building, including when the verdict is `new`. `--no-llm` makes the check free of
+additional model inference. Vergabe-teilnahme consumes it through `make plan-check`.