Clarify decoder diagnostic boundaries

Document lm_analyze as a developer-only tool and explain why the sealed, policy-oriented learning-mode decoder does not directly reuse the diagnostic console's real-time display consumer.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: dfea4d42-e8a5-42ef-978a-6434e8bf89ec

Author: richiemsft

src/backends/learning_mode/windows/examples/lm_analyze.rs

@@ -4,6 +4,10 @@
 //! Decode a sealed learning-mode `.etl` into the captureDenials RFC 7464
 //! JSON text sequence, or dump its raw ETW events for schema discovery.
 //!
+//! This is a developer diagnostic for inspecting captured traces manually.
+//! End users and SDK agents do not invoke it: the BaseContainer runner seals
+//! and consumes the trace automatically during normal `captureDenials` use.
+//!
 //! Usage:
 //!
 //! ```text

src/backends/learning_mode/windows/src/etl_decode.rs

@@ -14,6 +14,15 @@
 //! [`EtlDenialAnalyzer`] implements the cross-platform
 //! [`learning_mode_core::DenialAnalyzer`] trait so the runner and tests can
 //! depend on the abstraction rather than this Windows-specific decoder.
+//!
+//! The diagnostic console has a separate real-time, display-oriented ETW
+//! consumer in `tools/mxc_diagnostic_console`. It is a binary-private module
+//! that owns trace sessions and channels arbitrary provider events to a UI.
+//! This backend instead reads sealed files synchronously, filters a fixed
+//! provider/event vocabulary, bounds results, and propagates target decode
+//! failures. Depending on the tool would invert the workspace dependency
+//! direction; shared generic TDH primitives can be extracted later if another
+//! runtime consumer needs them.
 
 use std::collections::HashSet;
 use std::os::windows::ffi::OsStrExt;

src/backends/learning_mode/windows/src/extractors.rs

@@ -10,6 +10,12 @@
 //! de-duplicates them into the public
 //! [`learning_mode_core::DeniedResource`].
 //!
+//! These policy-oriented extractors intentionally do not reuse the diagnostic
+//! console's display mapping. The console accepts broad real-time provider
+//! traffic and formats it for humans; this module accepts only the
+//! learning-mode providers and produces the stable cross-platform denial
+//! model used for policy generation.
+//!
 //! ## Event vocabulary
 //!
 //! The learning-mode ETL carries a set of event IDs that map onto the