docs(okf): the mapping class is inexpressible, and T2 binds import not emission

A consumer measured our frontmatter gate against 0.2.0 and asked us to confirm
against a newer guard, correctly noting that a divergence would be a version
difference rather than a contradiction. Measured at 0.3.1: no divergence. Both
their results reproduce exactly.

Two things are sharper than what we documented yesterday:

ALL THREE ROUTES TO A MAPPING FAIL, each on a different rule -- flow {k: v} on the
disallowed value-start indicator, block on the nested-mapping check, dotted keys on
the key pattern. So the mapping CLASS has no expressible form; it is not a choice
between two shapes where one is better. That matters because OKF v0.2's `generated`
IS a mapping (`by` is required when it is present), so it cannot be expressed at
all. Pinned by a test asserting the three failures stay distinct.

T2 RUNS ON DOOR C ONLY. parse_frontmatter is referenced nowhere in the door A/B
persist path, so the same frontmatter that FAIL_SECUREs through import_bundle
passes screen_output unremarked. The grammar bounds what a consumer can RECEIVE,
never what a producer can EMIT -- which is the question a consumer's emitter design
was blocked on.

Also corrects one of our own rows: we reported "sources block list" as a single
FAIL_SECURE case. The parser distinguishes three shapes -- flat scalars parse
correctly, one key per item misparses silently to a string, two keys per item hard-
rejects. A one-element `verified:` block list passes today.

631 -> 642 passed. README item count synced.

README.md

@@ -215,7 +215,7 @@ a green scan means safe content. The highest-impact items:
   egress, semantic poisoning, trusted-prose lone-HIGH, lexicon dedup (`count=1`),
   pure beaconing, and short opaque URL segments.
 
-**Full list — 26 items, each with the mechanism, plus the out-of-scope boundary:**
+**Full list — 27 items, each with the mechanism, plus the out-of-scope boundary:**
 [`docs/LIMITATIONS.md`](docs/LIMITATIONS.md). Several carry field measurements from
 consumer corpora, including the false positives the URL-shape rule actually produces.
 

docs/LIMITATIONS.md

@@ -44,7 +44,12 @@ items; this is the full list, each with the mechanism.
   silently misparsed.** Gate T2 accepts a line-oriented subset deliberately — full
   YAML is a larger parse-attack surface than a write-time gate needs. Nested mappings
   and flow collections (`[a, b]`, `{k: v}`) are *rejected outright*, which fails
-  secure. The defect is between those two outcomes: a block sequence whose items carry
+  secure. **All three routes to a mapping fail, each on a different rule** — flow
+  (`{k: v}`) on the disallowed value-start indicator, block (`k:\n  sub: v`) on the
+  nested-mapping check, and dotted keys (`k.sub: v`) on the key pattern — so the
+  mapping *class* has no expressible form, rather than one form being preferable to
+  another. What survives is scalars and flat lists of strings. The defect is between
+  those two outcomes: a block sequence whose items carry
   exactly **one** key parses "successfully" into the wrong type —
   `sources:\n  - uri: https://e.com/a` yields the **string** `'uri: https://e.com/a'`,
   not a mapping, while the same list with two keys per item hard-rejects. A pointer
@@ -52,7 +57,14 @@ items; this is the full list, each with the mechanism.
   (`attester:\n  - resource: attesters/sql_equality.py` → WARN), whereas a top-level
   `resource:` with a relative path correctly fails secure. The shape is not conformant
   OKF, so a well-formed bundle will not produce it; a malformed or hostile one can, and
-  mode-b `import_bundle` writes the merged concept verbatim.
+  mode-b `import_bundle` writes the merged concept verbatim. Note the three block-list
+  shapes are *not* one case: flat scalars parse correctly, one key per item misparses
+  silently, two keys per item hard-rejects.
+- **T2 constrains import, not emission.** The frontmatter grammar runs on
+  `okf.import_bundle` (door C) only — `parse_frontmatter` is referenced nowhere in the
+  door A/B persist path, so frontmatter that fails secure on import passes
+  `screen_output` unremarked. The grammar therefore bounds what a consumer can *receive*,
+  never what a producer can *emit*. Verified identical on 0.2.0 and 0.3.1.
 - **Consequence: an OKF v0.2 concept cannot traverse the external-import path.** Both
   of v0.2's backward-breaking migration targets are nested — `timestamp` → `generated.at`,
   and body `# Citations` → a `sources` block list of mappings — so a conformant v0.2

tests/test_okf.py

@@ -37,7 +37,8 @@ from llm_ingestion_guard.okf import (
     OKFLinkError,
 )
 from llm_ingestion_guard.report import Report
-from llm_ingestion_guard.disposition import Trust, Disposition
+from llm_ingestion_guard.disposition import Trust, Disposition, PRESET_USER_UPLOAD
+from llm_ingestion_guard import screen_output
 
 
 # --- happy path: split + parse the minimal flat subset -----------------------
@@ -582,3 +583,60 @@ def test_pointer_in_one_key_sequence_reaches_the_consumer_tree():
            "attester:\n  - resource: attesters/sql_equality.py\n---\n\nbody\n")
     result = import_bundle({"computations/x.md": doc})
     assert result.disposition is Disposition.WARN, "hole closed — update LIMITATIONS.md"
+
+
+def test_every_route_to_a_mapping_fails_on_a_different_rule():
+    # The v0.2 wall is not a choice between two forms where one is better: ALL three
+    # ways to express a mapping fail, each on its own rule, so the mapping *class* has
+    # no expressible form through T2. v0.2's `generated` IS a mapping (`by` required
+    # when present), so it cannot be expressed at all.
+    routes = {
+        "flow":   "generated: { by: x, at: y }\n",
+        "block":  "generated:\n  by: x\n",
+        "dotted": "generated.by: x\n",
+    }
+    errors = {}
+    for name, fm in routes.items():
+        with pytest.raises(OKFFrontmatterError) as exc:
+            parse_frontmatter(f"---\nid: x\n{fm}---\n\nbody\n")
+        errors[name] = str(exc.value)
+    assert "indicator" in errors["flow"]
+    assert "nested mappings" in errors["block"]
+    assert "key" in errors["dotted"]
+    assert len(set(errors.values())) == 3, "routes must fail distinctly, not collapse"
+
+
+_BLOCK_LIST_ITEM_SHAPES = [
+    # A consumer called all three "the sources block list"; the parser does not.
+    ("flat scalars", "sources:\n  - file://x\n  - file://y\n", ["file://x", "file://y"]),
+    ("one key per item", "sources:\n  - id: a\n", ["id: a"]),          # silent misparse
+    ("single-element", "verified:\n  - human:ktg\n", ["human:ktg"]),
+]
+
+
+@pytest.mark.parametrize("cid,fm,expected", _BLOCK_LIST_ITEM_SHAPES,
+                         ids=[c[0] for c in _BLOCK_LIST_ITEM_SHAPES])
+def test_block_lists_admitted_by_item_shape(cid, fm, expected):
+    key = fm.split(":")[0]
+    assert parse_frontmatter(f"---\nid: x\n{fm}---\n\nbody\n")[0][key] == expected
+
+
+def test_two_keys_per_item_is_where_the_block_list_hard_rejects():
+    with pytest.raises(OKFFrontmatterError):
+        parse_frontmatter(
+            "---\nid: x\nsources:\n  - id: a\n    resource: file://x\n---\n\nbody\n"
+        )
+
+
+@pytest.mark.parametrize("fm", [
+    "generated: { by: x, at: y }\n", "sources: [{ id: a }]\n", "tags: [a, b]\n",
+    "generated:\n  by: x\n", "generated.by: x\n",
+    "sources:\n  - id: a\n    resource: file://x\n",
+])
+def test_t2_constrains_import_not_emission(fm):
+    # T2 runs on door C only. The same frontmatter that FAIL_SECUREs through
+    # import_bundle passes the door A/B persist path, so the grammar bounds what a
+    # consumer can IMPORT, never what a producer can EMIT.
+    doc = f"---\nid: x\n{fm}---\n\nbody\n"
+    assert import_bundle({"concepts/x.md": doc}).disposition is Disposition.FAIL_SECURE
+    assert screen_output(doc, PRESET_USER_UPLOAD).disposition is Disposition.WARN