Entire

Bottom line

It doesn't exist anywhere — not in entiredb either, because nobody wrote positional-arg completion. This codebase has zero ValidArgsFunction usages; the only completion in the whole CLI is flag completion via RegisterFlagCompletionFunc (in search_cmd.go). So there's nothing to "find" — it needs to be written.
auth use <context> is the spot that wants it (cmd/entire/cli/auth_context.go:22, currently just Args: cobra.ExactArgs(1) with no completion).
The enumerator already exists: auth.Contexts() → ([]*contexts.Context, currentName, error) at cmd/entire/cli/auth/context_store.go:114.

What to wire

The established pattern (from completeRepoFlag) but applied as a ValidArgsFunction instead of flag completion:

Mirrors the local conventions: swallow errors (completion runs on every TAB), ShellCompDirectiveNoFileComp, same func signature. Cobra auto-registers ValidArgsFunction — no separate RegisterFlagCompletionFunc call needed since it's a positional arg.

Two refinements worth deciding

Cobra's \tdescription convention: you can append name\tHandle (core URL) to each entry and it shows as completion help in zsh/fish. Could mark the current context too.
Optional: add the same ValidArgsFunction to any other command that takes <context> (e.g. a remove/delete if one exists — the search only surfaced use + contexts).

Want me to implement it (just use, with \t-descriptions and the current-context marker), and add a small test?

Completion is done and compiles. But the naming answers don't line up with what the code already does — I need to flag that before changing anything.

Bottom line

Tab completion: done. auth use <ctx> now completes stored context names with handle coreURL (active) descriptions. Builds clean.
Naming change: blocked on a concrete example — your answers describe what the code already does.

The contradiction

Today, pickContextName (cmd/entire/cli/auth/contexts.go:126) already does, on collision:

And contextNameForCoreURL returns the full u.Host. So given core URL https://us.auth.entire.io, a collision already yields alice@us.auth.entire.io — which is exactly handle@us.auth.<host> with full host, on collision. Your three answers (derived-from-core-URL prefix + full host + collision-only) appear to already be the current behavior.

So one of these must be true, and I can't tell which from here:

Core URLs don't contain us.auth. today, and you want to inject it — i.e. transform core.entire.io → us.auth.core.entire.io. That's the "derived" rule I'd need spelled out (where does us.auth come from — region claim? fixed? a host rewrite?).
You actually want the us.auth.<host> form as the bare default too (not just collision) — but you answered collision-only.

What I need

One concrete before→after, e.g.:

core URL = https://__________
handle = alice
desired name = alice@us.auth.__________

Once you've got that from your poking-around, I'll wire the rule into pickContextName/contextNameForCoreURL and add a test. Want me to hold here?

Bottom line

Tab completion: done. auth use <ctx> completes stored context names with handle coreURL (active) descriptions. Builds + vets clean.
Naming: already correct, already tested. No code change — current pickContextName gives first login us.auth.partial.to, second identity alice@us.auth.partial.to, covered by TestRecordLoginContext_SameCoreDifferentHandlesCoexist.
Dropped the completion test — agreed, it was just re-asserting string formatting on thin glue.

Only change is cmd/entire/cli/auth_context.go (the ValidArgsFunction + completeContextNames helper). I didn't run mise run fmt/lint since you declined trusting the worktree's mise.toml — gofmt/go vet pass; run mise run check yourself when ready.