Rectify unqualified folded ledger binding

docs/adr/0016-master-binding-authority.md

@@ -89,13 +89,13 @@ colliding pair surfaces in the unbound list where an operator can see it.
 Failing a whole read to report one collision would block all the work it was
 performed for.
 
-`MasterClass` is `Ledger` or `StockItem`. Both classes failed in practice and
-the identifier rules are identical for both, but **the name fold is not**:
-§9.4d measured ledgers, and whether a stock item matches by the same rule was
-never sent. So a folded stock-item name may *suggest* and may not resolve —
-byte equality is unaffected, since it needs no fold. The class is carried both
-so a report cannot be applied to the wrong catalog and because the evidence
-behind the two differs.
+`MasterClass` is `Ledger` or `StockItem`. The identifier rules are identical
+for both. Gateway measurements remain useful for candidate ordering, but a
+`MasterCatalog` has no product, release, tier, endpoint, or operator-approval
+scope. Therefore every folded name suggests candidates only, for either class;
+byte equality is unaffected because it needs no fold. The class is carried so
+a report cannot be applied to the wrong catalog and because the evidence behind
+the two still differs.
 
 ### 2. The identifier is the key; the name is a hint
 
@@ -207,26 +207,27 @@ signals disagree, and the disagreement is reported
 (`IdentifierNameConflict`) rather than silently settled in the identifier's
 favour.
 
-### 3. Name matching binds only on an exact or normalized-exact unique hit
+### 3. Name matching binds only on byte equality
 
-`Exact` is byte equality with the observed master name. `Normalized` is equality
-under **Tally's own rule for when two master names are the same**, and only when
-exactly one master shares it.
+`Exact` is byte equality with the observed master name. A folded name is a
+candidate even when exactly one observed master shares its key.
 
-**There are two folds, and which one may answer is the whole of this section.**
+**There are two folds, and neither answers in this generic catalog.**
 
-The resolving fold implements exactly the equivalences
-`TALLY_PROTOCOL_REFERENCE.md` §9.4d measured on **licensed TallyPrime 7.1** —
-the SKU this writes to — by naming each spelling in a voucher and reading the
-day book back to see which master it reached:
+The narrower fold is a **historical candidate index**, not a current statement
+of qualified gateway equivalence. It uses the transformations a previous
+implementation treated as equivalent: case, boundary and repeated spaces, and
+ASCII space, `-`, and `/`. That index may be broader than the qualified
+measurements, so it can only order candidate suggestions. The supporting
+observation was scoped to Silver; it measured a slash in the source reaching a
+space in the master, but did not measure the reverse direction. It does not
+establish a generic, symmetric separator rule.
 
-- ASCII case folds;
-- leading and trailing whitespace is ignored;
-- an internal run of spaces collapses;
-- **space, `-` and `/` are one separator**, in both directions.
-
-Everything else is exact on codepoints. The wide fold (`master_identity_key`)
-carries more than that and may only offer candidates.
+The wide fold (`master_identity_key`) carries more still and also only offers
+candidates. `MasterCatalog::new(class, names)` carries no product, release,
+tier, endpoint, or operator-approval scope that could authorize a caller to
+select a folded match. A write gate cannot repair a wrong selection once a
+caller has copied its returned name.
 
 **The two rules that matter are negative, and neither is guessable.** An **en
 dash** and an **underscore** were sent and *rejected*: they are not separators
@@ -245,12 +246,12 @@ authority. That was corrected by narrowing to the three §9.4b had measured,
 which cost 420 of 995 mutation binds and withdrew `X - Y`, a common ledger
 convention.
 
-Then the narrowing turned out to be over-strict, because §9.4b's scope is *Edit
-Log 7.0 Educational* and this project writes to licensed 7.1. Measuring that SKU
-directly (§9.4d) found the gateway wider: the reverse hyphen direction, leading
-whitespace, collapsed runs and slash all match. The fold is symmetric again, one
-key per side, and the asymmetric index the narrow version needed is gone. On the
-mutation book **600 of 995** now bind, against 420 under the narrow fold.
+Then a later historical interpretation treated the index as a wider licensed
+7.1 rule and bound **600 of 995** mutation names, against 420 under the narrow
+fold. That was a prior binding result, not a measured candidate count, and is
+withdrawn as authority: its scope and directional support were overstated. The
+index remains only to make the same possible masters visible to an operator; it
+does not bind in the generic catalog.
 
 The lesson is not "measure more". It is that **the scope line of an inherited
 measurement is part of the measurement**: §9.4b was accurate and its scope was
@@ -394,7 +395,7 @@ Per entity, exactly one of:
 
 | status | meaning |
 | --- | --- |
-| `Bound { catalog_name, basis }` | one master, decided by `Identifier`, `ExactName`, or `NormalizedName` |
+| `Bound { catalog_name, basis }` | one master, decided by `Identifier` or `ExactName` |
 | `Ambiguous { candidates, .. }` | more than one master is defensible, including every identifier conflict |
 | `Unmatched { candidates, .. }` | no rule produced a candidate |
 
@@ -437,16 +438,16 @@ voucher, creates no master, and dispatches nothing.
 ## Consequences
 
 - `agent_import.rs::master_match` and its private `master_key` are deleted and
-  `validate_masters` is re-expressed over the crate. `match_state` gains
-  `normalized` and `identifier` alongside `exact`, `near_miss` and `missing`,
-  and `exact_live_spelling` now appears only on a bound row. A caller reading
-  that field on a near-miss was reading a guess.
-- The old implementation classified *every* normalized-equal name as a
-  near-miss, so a request differing from the live ledger only in case,
-  whitespace, or dash style produced a candidate list instead of an answer.
-  Those now bind and report the live spelling.
+  `validate_masters` is re-expressed over the crate. `match_state` reports
+  `exact`, `identifier`, `near_miss`, or `missing`; folded spellings remain
+  `near_miss` candidates and `exact_live_spelling` appears only on a bound row.
+- Current `BindingBasis` cannot construct or deserialize `NormalizedName`.
+  The core has no binding-report persistence reader; older captured report
+  JSON remains historical evidence, not a current binding input. Persisted
+  operator selections still use their existing separate catalogue-binding
+  representation and require a fresh exact catalogue check before use.
 - `build_import_xml` and the approved-post recheck still admit **`exact` only**.
-  The import file carries the name verbatim, so a normalized or identifier bind
+  The import file carries the name verbatim, so a folded candidate or identifier bind
   informs the operator without widening what may be written. This PR does not
   move the write gate.
 - The MCP result reports an unbound entity's `unresolved_identity` wrapped in

docs/agent/README.md

@@ -208,10 +208,12 @@ licence mode, or manually imported file, and only an unnumbered single-voucher
 2. Call `validate_masters` with every ledger name. **`build_import_xml` admits
    `exact` only**, so replace the payload name for every row that is not
    `exact`, and never invent one:
-   - `normalized` or `identifier` — the row is bound. Copy its
-     `exact_live_spelling` into the payload verbatim; the live name may differ
-     from yours in case, spacing, dash or quote style, and the import file
-     carries whatever you send byte for byte.
+   - `identifier` — the row is bound by a decisive identifier. Copy its
+     `exact_live_spelling` into the payload verbatim; the import file carries
+     whatever you send byte for byte. Folded names do not bind through this
+     generic catalogue, even when exactly one candidate is found. Historical
+     `normalized` records remain readable, but current validation does not
+     produce them; revalidate against the current catalogue before selection.
    - `near_miss` — the row is **not** bound and Bridge chose nothing. Where
      `listing` is `withheld`, `candidates` is empty: there is no listed name to
      pick. This includes `master_binding_no_discriminating_candidate` and

docs/tally/TALLY_PROTOCOL_REFERENCE.md

@@ -1267,6 +1267,14 @@ assuming something nobody has measured.
 
 ### 9.4d Master-name matching on **licensed** TallyPrime 7.1
 
+**Superseded as generic binding authority, 2026-09-12.** The observations below remain
+an exact record for their one licensed 7.1 instance, company, ledger class and import-time
+operation. They do not authorize a scope-free `MasterCatalog` to bind a folded spelling:
+that constructor carries none of the product, release, endpoint or approval information the
+measurement requires. Generic binding therefore presents every folded result as a candidate
+and requires operator selection plus exact revalidation; it must not treat these directional
+observations as a symmetric, portable canonicalization rule.
+
 **VERIFIED 2026-09-12**, and it widens §9.4b rather than confirming it. §9.4b is inherited from a
 2026-07-30 measurement on **Edit Log 7.0 Educational** and marks licensed TallyPrime UNVERIFIED.
 This is that measurement re-run on the SKU this project actually writes to: **TallyPrime 7.1,
@@ -1331,18 +1339,20 @@ more variants, same method, same readback and deletion:
 | `  mb-pilot/alpha  (5550001001) ` | all five at once | **matched** |
 | `  mb probe  ledger a ` against `MB-PROBE-LEDGER-A` | case + space-for-hyphen + surrounding + run | **matched** |
 
-All eight posted against the intended master, confirmed by day-book readback. **So the folds
-compose**, and a canonical form applying every measured transformation before comparing is
-licensed by measurement rather than by extrapolation from the single-axis rows.
+All eight posted against the intended master, confirmed by day-book readback.
 
-**What this says.** On licensed 7.1, Tally treats **space, hyphen and slash** as interchangeable
-separators, collapses internal whitespace runs, ignores leading and trailing whitespace, folds
-**ASCII** case, and is otherwise **exact on codepoints**.
+**Superseded interpretation, 2026-09-12.** The rows above remain the scoped Silver 7.1
+observations. They do **not** license a generic symmetric or canonical separator fold: the
+measured slash direction is a slash in the supplied name reaching a space in the live master;
+the reverse direction was not sent. A scope-free binder must therefore keep all folded spellings
+candidate-only and require operator selection plus exact revalidation. The earlier statements
+that `space`, `-`, and `/` are interchangeable, or that a canonical form is licensed, are
+withdrawn as binding authority rather than erased from the probe history.
 
-> **RULE: separators fold, and the set is `space`, `-`, `/` — nothing else.** An en dash and an
-> underscore are ordinary characters to Tally and are **not** separators, so a fold that treats
-> "punctuation" or "separators" as a class is wider than the gateway and will merge masters it
-> keeps apart.
+**What remains measured in this scope.** The listed forward slash-to-space case, the recorded
+hyphen and whitespace cases, and the rejected en dash, underscore, abbreviation, suffix, and
+NFD cases are observations of this one operation. They do not generalize across product, tier,
+object class, direction, or caller.
 
 That is the trap §9.4b warned about, arriving from the other side: the danger was never only that
 a reader would fold too much, it was that "normalises separators" names no particular set. Two of

docs/tally/TEST_CORPUS.md

@@ -457,8 +457,9 @@ names**.
 | `Zeta Nowhere Traders` | `missing`, `listing: "none"` | an absence stated as an absence, not as an empty list |
 | `MB PARTY BETA` | `near_miss`, 4 candidates | a prefix family surfaced whole |
 
-**`exact_live_spelling` appeared on bound rows only** — `exact`, `identifier`, `normalized` —
-and on no refusal. The same ten names sent to the **previously installed** server, same company
+**`exact_live_spelling` appeared on bound rows only** — `exact`, `identifier`, and the
+historical `normalized` result — and on no refusal. `normalized` is superseded as a generic
+binding state: a current scope-free catalog keeps that result candidate-only. The same ten names sent to the **previously installed** server, same company
 and instance minutes earlier, returned `exact_live_spelling` alongside `match_state: "near_miss"`
 for two of them. That field on a refusal is a guess wearing the shape of an answer, and it is
 what this change deletes; the two runs are the before and after on one real instance.
@@ -471,9 +472,9 @@ the MCP consumer; the desktop consumer shares the crate but was not driven.
 **Superseded in part, 2026-09-12.** The separator row below was read as a defect and drove a
 narrowing of the resolving fold. `TALLY_PROTOCOL_REFERENCE.md` §9.4d then measured that same
 equivalence directly on **licensed** TallyPrime 7.1 and found Tally does accept it — along with
-leading whitespace, collapsed runs and a slash — so the fold was widened back to what the gateway
-actually does. Read the paragraph below as the history it is: the row's `normalized` result was
-right, and the reasoning that called it wrong was working from §9.4b's Educational scope.
+leading whitespace, collapsed runs and a slash — so the capture retained the result as a scoped observation. Read the paragraph below as history:
+the row records what that one gateway accepted, but it does not license a generic catalog to
+resolve a folded name without an operator's selected target and exact revalidation.
 
 **It found a defect, which is the reason to run these.** On the first run the third row *bound*
 `MB-PILOT-ALPHA-(5550001001)` to a master carrying spaces. That is the **reverse** of the

docs/tally/compatibility/compatibility-matrix.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "bridge_commit_sha": "be1c20cc3fd66fa1ece196505c69f26e555e4b8e",
-  "compatibility_surface_sha256": "125f7f9f6eb890ea5bb98da0402454c77ac5b33bb17ff9af455a10f6d1d02a78",
+  "compatibility_surface_sha256": "f0e1a2c88e5905abe06daccf580611d011b11dc3f126fe799b74ea779f7fcd05",
   "claims": [
     {
       "claim_id": "erp9-6-6-3-windows-education-xml-one-company",

docs/tally/compatibility/compatibility-surface.json

@@ -35,7 +35,7 @@
     },
     {
       "path": "docs/tally/TALLY_PROTOCOL_REFERENCE.md",
-      "sha256": "724cf4ae4c34ae39858959eb3da8ca488b740db8c5234a651d0574228ae5bbcf"
+      "sha256": "2a115ee06c8f26caae7f8fb703e709599f3ca01dc87c6484bb0ec88b1ff870dd"
     },
     {
       "path": "docs/tally/compatibility/README.md",
@@ -143,7 +143,7 @@
     },
     {
       "path": "src-tauri/crates/bridge-tally-core/src/master_binding.rs",
-      "sha256": "daa8640b0cd90799d108591f723481063794dfd6bc44d17b8b371601fb433284"
+      "sha256": "4caadad956d18f20012c413c24f391569cf92ede237fc5e83d67ede1fa62dc83"
     },
     {
       "path": "src-tauri/crates/bridge-tally-core/src/pack_models.rs",
@@ -331,7 +331,7 @@
     },
     {
       "path": "src-tauri/src/agent_import.rs",
-      "sha256": "aaed843e02cb3410b9aca9ab5bae46ea15b0d7bc7866f37f5c45edfaa1b8f117"
+      "sha256": "709a76ae4daa0f2e2485f8c02d0126360705782a51e87d65ec001670acfe5c6e"
     },
     {
       "path": "src-tauri/src/agent_ledgers.rs",
@@ -583,7 +583,7 @@
     },
     {
       "path": "src-tauri/src/source_draft/catalog.rs",
-      "sha256": "9b6fce29bb15eb0f71e48bcd364244b1e16893e13f24050cead465642a640184"
+      "sha256": "e4fd8adb261120298c7f02f32fb05e14860f3bd433c472116b1e38c384068581"
     },
     {
       "path": "src-tauri/src/source_draft/files.rs",
@@ -850,5 +850,5 @@
       "sha256": "a8ac2714fecf51947f2822c8c46d7ce2e8602c732780ff60566a7771f0836f9a"
     }
   ],
-  "manifest_sha256": "125f7f9f6eb890ea5bb98da0402454c77ac5b33bb17ff9af455a10f6d1d02a78"
+  "manifest_sha256": "f0e1a2c88e5905abe06daccf580611d011b11dc3f126fe799b74ea779f7fcd05"
 }

scripts/fixtures/source-draft-capture-bindings.json

@@ -12,15 +12,18 @@
       "unbound_reason": null
     },
     {
-      "bound_basis": "normalized_name",
-      "bound_target": "WR2 Sales",
-      "candidate_count": 0,
+      "bound_basis": null,
+      "bound_target": null,
+      "candidate_count": 2,
       "candidate_count_is_lower_bound": false,
-      "candidate_listing": "none",
-      "candidates": [],
+      "candidate_listing": "listed",
+      "candidates": [
+        "WR2 Sales",
+        "WR2 XML Café Naïve Ledger 01A01A2F"
+      ],
       "entry_position": 2,
       "row_position": 1,
-      "unbound_reason": null
+      "unbound_reason": "master_binding_near_miss"
     },
     {
       "bound_basis": null,
@@ -44,6 +47,11 @@
     "response_sha256": "f354993704f0feddc27a46d73b4ca10787b6028d9f385d8323994b18e5b34e0f",
     "state": "complete"
   },
+  "provenance": {
+    "catalogue": "captured StandardLedgerCatalogV1 response",
+    "source_xml": "authored test input",
+    "binding_dto": "derived by the production parser and binder"
+  },
   "source_sha256": "41c4de4324e0eb03c46b92aee7b0be0a0a1ff29feb63ffc3b8435cce559810aa",
   "targets": [
     "Bridge Nested Debtor WR4",

scripts/source-draft-screen.test.tsx

@@ -600,9 +600,9 @@ test("distinguishes the two other refusals that are not weak matches", async ()
 test("the picker groups a real captured catalogue, not a shape the test invented", async () => {
   // Every other test here writes both the catalogue and its bindings, so they
   // show the component agrees with an assumed response. This one reads
-  // `scripts/fixtures/source-draft-capture-bindings.json`, which is the DTO the
-  // **producer** emits from a `StandardLedgerCatalogV1` response captured on
-  // licensed TallyPrime 7.1 — nine real ledger names, including Devanagari, an
+  // `scripts/fixtures/source-draft-capture-bindings.json`, a DTO derived by the
+  // producer from a `StandardLedgerCatalogV1` response captured on licensed
+  // TallyPrime 7.1 and authored source XML — nine real ledger names, including Devanagari, an
   // `&` name, and an NFD ledger beside NFC ones.
   //
   // The Rust test `the_binder_meets_a_real_catalogue_through_the_production_parse`