docs: the normalisation door, the refused column and the role map

README gains the partial-refusal paragraph and the soft-hyphen door
with its measured reach; CHANGELOG gets an Unreleased section over
this round; CLAUDE.md's open commitment "R761 is refused whole by
guard 1.4.0 ... that is the security repo's question" is replaced by
what was decided and built, with the alternatives that were felled and
the numbers behind each rule.

No version bump and no tag: `v0.10.1` is not tagged yet and releasing
is the operator's.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,56 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- **One normalisation door in front of the persist gate: U+00AD is removed and
+  COUNTED** (operator decision 2026-09-18). `llm-ingestion-guard` 1.4.0 keeps
+  the soft hyphen in `_ZERO_WIDTH_CPS`, and `output:zero-width-present` is an
+  any-tier carrier — `fail_secure` at every trust level, no sanitisation, no
+  exception. R761 Prosesskoden:2025 carries 71 of them and 0 of the four real
+  zero-width characters; all 71 are Norwegian hyphenation points inside words,
+  so a 701-page process code was unreadable for the whole chain over
+  typography. `extract.normalise_extracted` removes that one character from
+  every extracted text; `ExtractedDocument.soft_hyphens`,
+  `InboxResult.normalised` and the accounting's `normalised_soft_hyphen` carry
+  the number per document and per run, and `log.md` gains a `**Normalisation**`
+  bullet. The guard is untouched, the other four characters and U+00A0 NBSP are
+  untouched, and a real zero-width character is still `fail_secure`. Reach,
+  measured: **0 of the 78** readable documents of the reference corpus carry
+  any of the six, so no bundle measured here moves.
+- **`refused` in the accounting: a partial refusal is never silent.** The
+  report and `log.md` now say how many of M documents the run persisted nothing
+  of. The exit code is unchanged — it belongs to the whole run.
+
+### Fixed
+
+- **The content-accounting gate: a document refused whole is never clean.**
+  Its elements are all booked as coded rejections, so u = 0 and d = 0, and
+  `refused_whole` asks its question only for a corpus that persisted NOTHING —
+  one refused source beside an accepted one read as clean with the content
+  gone. `Unit.refused` is that loss with its own column and the document's code
+  in the note.
+- **The STS JSON role map reads the publisher's own tags.** `count_sts_json`
+  compared the raw tag string where the XML witness has always used `_local`,
+  so `mml:math` reached `tag == "math"` on nothing — 74 formulas in N200
+  Vegbygging:2024 counted as 0. And the publisher's JSON writes a figure's
+  caption as `figcaption` under the `graphic`, not as the `fig/caption`
+  NISO-STS writes — 430 of them over the eight deliveries measured. No other
+  count moves, measured role by role over those eight and the committed twins.
+- **The mutation harness is a gate.** A surviving mutant now exits 1; the run
+  ended `2 if errors else 0`, so `killed 0 of 1` exited 0. PM's X2 mutant — a
+  report may declare a document rejected while the bundle holds it — is in the
+  set and is killed by a new test driven from both sides.
+- **The skipped-row guard measures the machine, not the argument.** Row 6 is
+  SKIPPED exactly when the corpora the arguments name are absent, so asking the
+  arguments made the branch unreachable.
+- **Row 6 says when a corpus measures no element class at all.** On N200 the
+  build proposes 0 plans and exits 2 before the accounting door, so 16 549
+  elements land as unaccounted with no declared fate — a finding about the run
+  that read as a finding about the build.
+
 ## [0.10.1] — 2026-09-18
 
 ### Added