fix(safety): report a doNotPerform value this library cannot read, instead of reading it as absent (FHIR-XML-UNREADABLE-BOOLEAN-IS-SILENT)

[NSchatz]

What this fixes

FHIR-XML-UNREADABLE-BOOLEAN-IS-SILENT, a STOP-THE-LINE filed under meta-repo ADR 0016, raised by
#79's gate outside its slice and reproduced independently by the coordinator and by this slice's own
probe at the base commit 05ecc5a:

<doNotPerform value="true"/>   negations: ["do-not-perform"]   issues: []  safeToSummarize: true  assert clean
<doNotPerform value="1"/>      negations: []                   issues: []  safeToSummarize: true  assert clean
<doNotPerform value="Y"/>      negations: []                   issues: []  safeToSummarize: true  assert clean
<doNotPerform value="0"/>      negations: []                   issues: []  safeToSummarize: true  assert clean
<doNotPerform value="N"/>      negations: []                   issues: []  safeToSummarize: true  assert clean

#79 closed the first row. "1" and "Y" are ordinary v2 and C-CDA converter output for a boolean,
and R4's boolean lexical space is true|false (datatypes.html), so they are not readable rather
than false. The reading was indistinguishable from "0" / "N": an author who wrote "yes, do not
administer" got the same answer as one who wrote "no", with nothing recorded anywhere.

The gap was structural, and it was the item. SafetyReadout had location channels for content the
codec could not read (nestedArrays, droppedText) and none for "value written, not readable".

The change: a REPORT, not a wider read

booleanOf is byte-identical to #79's and doNotPerform still reads undefined. Widening the read
to accept "1" / "Y" would have been a worse defect than the one filed: it invents a reading R4 does
not license, and it turns <doNotPerform value="0"/> and value="N" into a JS false that
serializeResource then emits, authoring a value and laundering it across a format change, which is
what #74 refused. "1" and "Y" also arrive on real wires meaning a boolean's true and,
elsewhere, its opposite, so there is no safe direction to guess in.

What is added is SafetyReadout.unreadableBooleans, a third not-readable location channel beside
nestedArrays and droppedText, with unreadableBooleans(resource, path) exported beside them. It
feeds safeToSummarize and assertSafeToSummarize, and it is value-free: the text that failed to
read reaches neither the locations nor the error message.

Detection is hasUnreadableBoolean, the exact complement of the read: the same values through the
same array wrapper (scalarValues), the same booleanOf. A location is emitted for precisely the
values primitiveBooleans declined, so the report cannot drift from the read by growing a rule of its
own.

Decided in the safety layer, not the reader. The reader is schema-free: <doNotPerform value="1"/>
and <status value="1"/> are the same node to the codec, so nothing at parse time knows the text should
spell a boolean. The safety layer is the first place that knows the datatype.

Consumer-side additivity, established from the consumers and measured

#79 paid a refuted pass for the rule that additivity is a property of the consumers, not the
helper. That class is unreachable here by construction, in its strongest form: this slice widens no
read at all. No value that was undefined becomes defined anywhere, so nothing that treats
undefined as inherit or absent ever sees a new value.

what is added	who reads it	can it remove anything
SafetyReadout.unreadableBooleans	nothing in tree before this slice	new field, no prior consumer
safeToSummarize	assertSafeToSummarize only (every other mention in src/ is prose)	conjunction of empty-list tests, one term added: monotone true -> false, never the reverse
assertSafeToSummarize locations	FhirSafetyError.locations	appended last, no existing location dropped or reordered
the read (booleanOf, readDoNotPerform, primitiveBoolean)	unchanged	nothing added at all

Measured in a real 05ecc5a worktree over a 33-document corpus, comparing every SafetyReadout
field that exists on both trees, both writers' output, the parse issues, the ValidationIssue list and
valid: 13 documents move, and in every one the only field that moves is safeToSummarize,
true -> false. The other 20 are identical on every channel. No diagnostic moves anywhere. One
public surface moves outside that set and is disclosed: FhirSafetyError's message now names the
sixth shape, so the string changes for every refusal it raises; locations and the thrown type are
unchanged.

Does safeToSummarize move? Yes, and that is the answer rather than a side effect

Its contract is that the library declines when a summary would have to assert something it cannot
establish. value="1" and value="0" are indistinguishable to a reader with no licence to guess, so
affirming over either affirms over a coin flip, and the coin decides whether a medication is given.
Both now refuse. The fix does not make "Y" and "N" read differently: they still read alike,
because they are alike to this library. What changed is that the shared answer is a refusal.

The census, wider than the filed line

Booleans the safety spine reads out of a document: exactly one. MedicationRequest.doNotPerform.
retracted and noKnownAllergy are derived from codes and codings, not from a boolean element. So the
channel is complete for its own layer and for nothing beyond it, and its docblock says so.

site	read via	unreadable value at head	disposition
MedicationRequest.doNotPerform	primitiveBooleans (safety)	REPORTED	FIXED
ElementDefinition.mustSupport	primitiveBoolean (convenience)	silent	standing, pinned
ElementDefinition.slicing.ordered	primitiveBoolean (convenience)	silent	standing, pinned
ElementDefinition.min (unsignedInt)	parseMin	silent	standing, pinned
Quantity magnitude (+5, 05, .5, 5.)	readQuantity	silent	standing, #78's pin
FHIRPath numberOf	FHIRPath	silent	standing, #79's census

The two profile booleans have nowhere to go as well as #79's measured retirement reason: a
StructureDefinition is not a safety resource and has no SafetyReadout.

One deliberate asymmetry: no ValidationIssue of its own

On the default path this is the first place a safeToSummarize: false sits beside valid: true.
The reason is availability and nothing stronger, after two refuted attempts to say more:
MedicationRequest has no built-in schema (BUILTIN_SCHEMAS is [Patient]), so the validator is
silent about this element's datatype unless a caller supplies one, and a readout that must hold on
every document cannot rest on a diagnostic that only exists on request. The shape channels are not
scoped that way and still fire with no schema at all. Both paths pinned.

Measurements

• Red-at-base 18-of-30, 30-of-30 at head, in a real 05ecc5a worktree with a base shim supplying
  the new surface with base's own semantics (an always-empty channel), so each test measures behaviour
  rather than a missing export. The 12 both-states pins, named: the conformant true and false
  spellings, the absent element, a value-less primitive carrying only metadata, the
  non-MedicationRequest type gate, a conformant JSON MedicationRequest, this package's own XML
  round trip, the no-ValidationIssue pin, the object / empty-array shape, the JSON null, the two
  profile booleans, and the non-boolean datatype.
• Non-vacuity by mutation, seven, each reds at least one pin: dropping the MedicationRequest type
  gate reds 1; stopping hasUnreadableBoolean reading through the array wrapper reds 2; firing it on a
  value-less primitive reds 2; dropping the new term from safeToSummarize reds 13; accepting "1" in
  booleanOf reds 1; reading only node.properties and not the shadowed duplicates reds 1; dropping
  the channel from assertSafeToSummarize's location list reds 1.
• verify.sh fhir green: 11 ==> step headers, 11 ran: entries, zero (FAIL), no
  unladdered-script warning. Suite 65 files / 1,346 tests = #79's 1,316 + this file's 30, so no
  existing test moved.

The pin this closes, rewritten rather than deleted

#79's residual pin "still affirms safeToSummarize over a doNotPerform this reader cannot read"
looped over ["true", "1"]. The "1" arm is what this slice closes, so the pin now covers the "true"
arm only, is renamed to say so, and names where the other half went. It was the only test in the
whole suite that moved.

The gate

conformance-refuter, REFUTED -> REFUTED -> NOT REFUTED, cumulative 3 (d96f97d, 9760562,
23cd9fa).

• Pass 1 REFUTED, two majors, both claim defects. A false universal, "the validator is schema-free
  and every rule it carries is about a shape FHIR gives no meaning to at any position", measured false:
  validateResource takes { schemas } and decides boolean on the resolved datatype. And the carrier
  sweep stopped one short of #79's pending changeset, which still carried both clauses this slice
  falsifies; since CHANGELOG.md has no released heading, the changesets are the release body, so
  changeset version would have published a release note asserting both that the shape survives and
  that it is closed. Both cut, not qualified.
• Pass 2 REFUTED, one major, again a claim: pass 1's replacement conclusion, "it draws
  TYPE_MISMATCH on the conformant value="true" too, so it does not separate readable from
  unreadable", was drawn from three XML rows and is false on the JSON wire, where a conformant
  true validates clean with a schema supplied. Deleted at six carriers, along with the test
  assertion that existed only to support it.
• Pass 3 NOT REFUTED, narrow, against the remedy diff only. No blocker, no major. It
  independently re-derived the docblock-only remedy, the suite, both repo gates, BUILTIN_SCHEMAS, the
  JSON counterexample, the corrected window wording, the CHANGELOG direction fix, and that the deleted
  assertion is already held more strongly by test/xml-quantity-magnitude.test.ts.

Not one pass refuted the code. Every finding across all three was the reason reaching past the
measurement. All three independently verified booleanOf unwidened, the complement exact,
safeToSummarize monotone toward refusal, and the report's window a superset of the read.

One commit is UNGRADED and disclosed: 98e78ef applies pass 3's two minors (narrowing "silent
about this element" to its datatype, and scoping a test comment's rebuttal to its wire). It is
documentation and one test comment; git diff 23cd9fa 98e78ef -- src/ is docblock text and the suite is
unchanged. Applied rather than deferred because one carrier is CHANGELOG.md, frozen while #73 is open,
where an over-wide clause would be permanent under ADR 0001. ADR 0027 is not invoked and is not
needed: the gate converged on its own.

Raised by the gate, PRE-EXISTING, and each wants a backlog item

• ServiceRequest.doNotPerform and CommunicationRequest.doNotPerform are ?! boolean modifiers the
  safety spine never reads. Neither type is in SAFETY_RESOURCE_TYPES, so a conformant
  {"resourceType":"ServiceRequest","doNotPerform":true} reads negations: [],
  safeToSummarize: true, assertSafeToSummarize clean. Identical at 05ecc5a.
• readDoNotPerform is root-only, so a Bundle whose entry[0].resource is a conformant
  MedicationRequest with doNotPerform: true reads negations: [] and safeToSummarize: true, while
  the unreadable spelling at the same location is reported. Pass 3's disposition, adopted: fold it
  into the item above, since both are the spine's read scope and not a report.
• README.md and six src/ sites say "the six safety resource types" while SAFETY_RESOURCE_TYPES
  holds seven. Stale count, unrelated to this item, left standing.

Both safety findings are recorded in documentation/agent-notes/xml-unreadable-boolean.md; the backlog
items are the coordinator's to file.

Budget

documentation/agent-notes.md stood at 249,983 of its 250,000-byte cap, so the cursor did not fit.
The ceiling is not raised. #77's "untaggable resourceType" narrative is relocated verbatim
to documentation/agent-notes/untaggable-resource-type.md with a cursor left behind (it had zero
inbound anchors), bringing the archive to 239,092. Nothing was deleted; pass 1 verified the relocation
line-for-line.

Corpus caveat

Hand-authored XML and JSON fixtures, mutations and hand-built probes, not the FHIR R4
published-examples corpus. Nothing here is corpus-wide.

Not touched

PR #73 (Version Packages) is untouched and stays open. No umbrella pointer bump in this PR.