Expand scoped demo analysis access

docs/API_CONTRACTS.md

@@ -64,8 +64,12 @@ one client/username combination within five minutes temporarily return HTTP
 Optional guest access is a configuration-gated demonstration mode. It creates
 a shorter signed session with role `guest`, scopes that session to the
 idempotently seeded demo project and blocks mutating operator routes. Project
-listing is filtered to the bound demo project. The frontend exposes only the
-map and the already calculated quality evidence. This is deliberately **not**
+listing is filtered to the bound demo project. The frontend exposes the same
+exploration, assistant, model-selection, analysis, QA and export workspaces as
+an operator. Model catalogs are globally readable; every run, result and export
+request remains explicitly bound to the demo-project UUID. Project and area
+management, uploads, source/runtime configuration, evidence review and other
+administrative mutations remain unavailable. This is deliberately **not**
 a substitute for user accounts, authorization or tenant isolation; expose it
 only on a dedicated demo installation without private or operational data.
 
@@ -119,11 +123,13 @@ Disabled guest access returns HTTP 403 `GUEST_ACCESS_DISABLED`. A guest request
 for a different project returns HTTP 403 `GUEST_PROJECT_SCOPE_REQUIRED`; a
 blocked mutation returns HTTP 403 `GUEST_READ_ONLY`. Unscoped read routes that
 are not needed by the demo return HTTP 403 `GUEST_ROUTE_NOT_AVAILABLE`.
-Guest reads are limited to the filtered project list, provider metadata and the
-bound project tree. A small, explicit set of `POST` selection/read-analysis
-routes remains available because those routes query persisted evidence without
-exposing operator administration. Coverage resolution additionally verifies
-the `project_id` in the request body against the guest-session scope.
+Guest reads are limited to the filtered project list, provider/model metadata,
+the bound project tree and project-scoped detection, segmentation and export
+results. An explicit set of `POST` selection, assistant, AI/QA and export routes
+is available for that bound demo project. Unscoped analysis routes require the
+same UUID as a `project_id` query parameter; cross-project values fail before
+route execution. Coverage resolution additionally verifies the `project_id` in
+the request body against the guest-session scope.
 
 ### POST `/api/v1/auth/logout`