docs: name what is blocked instead of a blanket fail-closed claim

README.md

@@ -8,14 +8,13 @@
 # @cosyte/deid
 
 > Healthcare **de-identification** for Node.js and TypeScript: a HIPAA-grounded policy engine that
-> **fails closed** and emits a **value-free manifest**.
+> emits a **value-free manifest**.
 
 `@cosyte/deid` applies a de-identification **policy** (HIPAA Safe Harbor by default) to a
 structurally-located model of a healthcare document and returns a transformed model plus a value-free
 audit of everything it acted on. It is a **consumer** of the `@cosyte/*` parsers, not a parser sibling:
 it borrows the archetype's disciplines (typed diagnostics, immutable output, a policy/profile system)
-but **inverts the reflex**: where a parser is liberal on input, a de-identifier is conservative and
-**fails closed**. Third-party runtime dependencies: **zero** (every primitive is `node:crypto`).
+but **inverts the reflex**: where a parser is liberal on input, a de-identifier is conservative. Third-party runtime dependencies: **zero** (every primitive is `node:crypto`).
 
 > **The honesty line.** Results are **"Safe-Harbor-transformed per the configured policy"**, never
 > "de-identified" and never "HIPAA-compliant". Safe Harbor is implemented mechanically; the
@@ -660,8 +659,8 @@ determination**.
 - **Five transforms**: redact, generalize (date→year, ZIP→3-digit/`000`, age→`90+`), keyed date-shift,
   keyed-HMAC pseudonymize, keyed hash.
 - **18 Safe Harbor categories**: §164.514(b)(2)(i)(A) to (R), including the open-ended catch-all (R).
-- **Fail-closed rule**: anything uncertain is blocked, never passed through; clinical values are
-  retained untouched.
+- **Fail-closed rule**: an unrecognized structure, an un-locatable identifier or free text is
+  blocked, never passed through; clinical values are retained untouched.
 - **Value-free manifest**: category + transform + locus + count + disposition + code + a boolean
   `reidentificationCode` (`true` only where a keyed surrogate was emitted) + a `partyRole` code (only
   where a party was left in place because its role sits outside the scope clause), never a value, never

docs-content/concepts-archetype.md

@@ -11,7 +11,7 @@ sidebar_position: 1
 
 ## Fail closed (the inverted reflex)
 
-A parser is liberal in what it accepts. A de-identifier is the opposite: on **any** ambiguity (an
+A parser is liberal in what it accepts. A de-identifier is the opposite: on each of these ambiguities (an
 unrecognized structure, an un-locatable identifier, a field it cannot classify, a free-text blob, a
 date/ZIP it cannot generalize), it **blocks** the value (withholds it), and records the decision. It
 never passes a value through as "probably safe". Liberality here leaks patients.

docs-content/intro.md

@@ -12,9 +12,8 @@ reading 45 CFR §164.514 or hand-writing a scrubber.
 
 `@cosyte/deid` is a consumer-tier library, **not a parser**. It borrows the cosyte parser archetype's
 disciplines (typed diagnostics, immutable output, a policy/profile system) but **inverts the parser's
-reflex**: where a parser is liberal on input (Postel's Law), a de-identifier is conservative; it
-**fails closed**. An unrecognized structure or an un-locatable identifier is **blocked**, never passed
-through as safe.
+reflex**: where a parser is liberal on input (Postel's Law), a de-identifier is conservative: an
+unrecognized structure or an un-locatable identifier is **blocked**, never passed through as safe.
 
 > **The honesty line that governs the whole library.** Results are **"Safe-Harbor-transformed per the
 > configured policy"**, never "de-identified" and never "HIPAA-compliant". Safe Harbor is implemented

docs-content/limitations.md

@@ -5,8 +5,9 @@ Harbor by default) and emits a value-free manifest of what it acted on. It never
 "de-identified," and it never certifies HIPAA de-identification.** Safe Harbor is implemented
 mechanically; **Expert Determination is _supported_, never _rendered_.** The structured-field core is
 the guarantee; **free text is blocked by default**; **DICOM is metadata-only** (burned-in pixels are
-flagged, not cleaned). The library **fails closed**: on any ambiguity it blocks or removes, never
-passes a value through as "probably safe."
+flagged, not cleaned). On an unrecognized structure, an un-locatable identifier, an unknown segment
+or extension, or a free-text blob, the library blocks or removes, never passing a value through as
+"probably safe."
 
 Read this page before you rely on the library for anything that leaves your control.
 
@@ -345,9 +346,9 @@ report.determination; // => null
 report.disclaimer.includes("NOT a determination"); // => true
 ```
 
-The library's promise is narrow and honest: **structured-field, fail-closed, policy-driven
-Safe-Harbor transformation with a value-free manifest, never a leaked patient, never a destroyed
-clinical value, and never a claim of "de-identified."**
+The library's promise is narrow and honest: **structured-field, policy-driven Safe-Harbor
+transformation with a value-free manifest, never a leaked patient, and never a claim of
+"de-identified."**
 
 ## NCPDP Telecom: one transaction per message
 

docs-content/quickstart.md

@@ -7,8 +7,8 @@ sidebar_position: 1
 # Quickstart
 
 De-identify a structurally-located model under a policy and read the value-free manifest.
-`@cosyte/deid` **fails closed**: anything it cannot confidently handle is **blocked**, never passed
-through as safe. The result is **"Safe-Harbor-transformed per the configured policy"**, never
+In `@cosyte/deid`, an unrecognized structure or an un-locatable identifier is **blocked**, never
+passed through as safe. The result is **"Safe-Harbor-transformed per the configured policy"**, never
 "de-identified".
 
 ## De-identify a model

examples/fail-closed.ts

@@ -1,8 +1,8 @@
 /**
  * Fail closed: what `@cosyte/deid` does when it cannot be sure, shown case by case.
  *
- * A parser is liberal about what it accepts. A de-identifier is the opposite: anything it cannot
- * confidently handle is blocked or refused, never passed through as safe.
+ * A parser is liberal about what it accepts. A de-identifier is the opposite: each case below is
+ * blocked or refused, never passed through as safe.
  *
  * - Free text is blocked by default. The library ships no NLP model and no regex scrub.
  * - A redactor you bring is used, and its output is recorded as consumer-asserted: the engine does