refactor: the intermediate representation's exported names say what they hold

CLAUDE.md

@@ -73,9 +73,10 @@ A test is named `TestUnit_<Area>_<Behaviour>` or
   pilot vendor name in non-test source, and no tracked file over 1 MiB.
 - **Never commit generated pilot output or binaries.** Generated provider trees
   live in provider repos; this repo holds only the machinery and its fixtures.
-- **Exit codes are 0, 1 and 2** — success, a verb that ran and refused, and an
-  invocation that was misspelt. The table in `docs/contract.md` is the
-  contract, and a new code is appended rather than renumbering one.
+- **Exit codes are 0, 1 and 2** — success, a verb that ran and stopped on an
+  exclusion, and an invocation that was misspelt. The table in
+  `docs/contract.md` is the contract, and a new code is appended rather than
+  renumbering one.
 - **Vendor OpenAPI specs are committed and embedded.** The third-party
   documents the tests parse live in `internal/vendor_openapi_specs`, taken as
   the vendor published them. They are test input and nothing else: never
@@ -103,7 +104,7 @@ A test is named `TestUnit_<Area>_<Behaviour>` or
   // all for the provider.
 
   // Yes — what, then why.
-  // Refuses one entity rather than the run: an unrenderable shape is a
+  // Excludes one entity rather than the run: an unrenderable shape is a
   // fact about that entity, and the rest still generate.
   ```
 
@@ -124,7 +125,7 @@ change:
   description with no key both fail that test, so the schema and its reference
   cannot drift apart.
 - `docs/emittance_tracker.md` is the only place counts of what the toolkit
-  emits and refuses may live. A count is a fact about one toolkit commit
+  emits and excludes may live. A count is a fact about one toolkit commit
   against one pinned document; stating one in a readme, a comment or another
   doc puts it somewhere it cannot be re-measured, where it goes stale
   invisibly.

docs/comment-style.md

@@ -43,7 +43,7 @@ These are facts, and they are the point of the comment.
   that scope a claim: "`list/schema` attribute types declare no `Sensitive`
   field", "measured against terraform-plugin-framework v1.19.0".
 - **Raw evidence quoted inline** — an SDK accessor spelling
-  (`GetPasswordEscaped`), a refusal reason as the report prints it, an HTTP
+  (`GetPasswordEscaped`), an exclusion reason as the report prints it, an HTTP
   status, a framework type name. They are what makes the surrounding claim
   checkable.
 - **Indented tabular blocks.** They render as godoc code blocks and usually carry
@@ -60,7 +60,7 @@ These are facts, and they are the point of the comment.
   is evidence and stays. Drop a bare URL only when the sentence still stands
   without it.
 - **Contracts** — locking requirements, `nil, nil` returns, ordering guarantees,
-  what a caller must do first, which stage owns a refusal.
+  what a caller must do first, which stage owns an exclusion.
 - **Operator-visible risk in credentialed tests** — why a test is opt-in, what it
   does to somebody's tenant. State it as a standing risk, not as an anecdote.
 

docs/config.md

@@ -22,7 +22,7 @@ The schema is owned by `internal/config`; this page is generated from it, so eve
 
 | Key | Type | Default | Description |
 |---|---|---|---|
-| `generator.version` | string | — | Exact toolkit release tag (vX.Y.Z) the pipeline installs; branch names are refused. |
+| `generator.version` | string | — | Exact toolkit release tag (vX.Y.Z) the pipeline installs; branch names are not accepted. |
 
 ## `spec`
 

docs/contract.md

@@ -26,8 +26,8 @@ succeeded jobs' artifacts persist within the run.
 
 ## The decision gate
 
-Job [6] refuses to write while any correction awaits a decision. That
-refusal is the point, but a refusal alone destroys what it refuses: proposals
+Job [6] stops without writing while any correction awaits a decision. That
+stop is the point, but a stop alone destroys what it set aside: proposals
 written into the runner's workspace by a job that then exits 1 leave with the
 runner, and the operator has nothing to review. Jobs [4] and [5] and the
 `20-corrections.yml` workflow close that loop.
@@ -252,7 +252,7 @@ only `open-correction-prs` and `open-pr` keep write. `secrets: inherit`
 hands the repo's secrets across by name — the `TFPFGEN_AUTH_*` roles, read
 only by the audit job, and `TFPFGEN_APP_ID` / `TFPFGEN_APP_PRIVATE_KEY` if
 the repo has them. Every secret is declared `required: false`; validation,
-not the workflow, is what refuses a missing role.
+not the workflow, is what stops on a missing role.
 
 `20-corrections.yml` is the one caller whose trigger is not a dispatch,
 because it answers a decision rather than starting work:
@@ -295,7 +295,7 @@ follow.
 | Code | Meaning |
 |---|---|
 | 0 | Success. |
-| 1 | Failure: the operation ran and refused, or broke. |
+| 1 | Failure: the operation ran and stopped on an exclusion, or broke. |
 | 2 | Usage: the invocation itself was misspelt. |
 
 New codes are appended, never renumbered.
@@ -331,7 +331,7 @@ The App must be installed on the provider repo with **contents: write**,
 ## Versioning
 
 - Provider repos pin `generator.version` to an exact release tag; branches
-  are refused by validation.
+  are not accepted by validation.
 - Caller workflows reference `deploymenttheory/terraform-plugin-framework-codegen/.github/workflows/<NN-name>.yml`
   at the moving major tag — `@v0` until the 1.0.0 contract freeze, `@v1`
   after it. Compatible releases fast-forward the tag; breaking changes cut
@@ -344,6 +344,6 @@ The App must be installed on the provider repo with **contents: write**,
 
 Everything in a provider repo is derived — regenerated wholesale, digest-
 tracked in `manifest.json` — except the authored data files: `tfpfgen.yaml`,
-`spec/corrections/**`, `audit/inputs.json`. Generation refuses to write an
-authored path; CI refuses a hand edit to a derived one. There are no
+`spec/corrections/**`, `audit/inputs.json`. Generation never writes an
+authored path; CI fails on a hand edit to a derived one. There are no
 hand-owned code files.

docs/emittance_tracker.md

@@ -1,7 +1,7 @@
 # Emittance tracker
 
 What the toolkit currently emits from each pilot document, and what it
-refuses. One measurement per row, taken by running the generator rather than
+excludes. One measurement per row, taken by running the generator rather than
 estimated.
 
 A count here is a fact about a particular toolkit commit against a particular
@@ -18,8 +18,8 @@ were measured against, so a stale row is visible as a stale row.
 - **Resources, data sources, list resources and actions** are the entities that
   survived derivation, binding and emission — what the generated provider
   actually registers, not what the document might have supported.
-- **Refusals** is the `unsupported.json` total, split by the stage that refused:
-  `derivation`, `binding`, `emission`. A refusal is one entity or one attribute
+- **Exclusions** is the `unsupported.json` total, split by the stage that excluded:
+  `derivation`, `binding`, `emission`. An exclusion is one entity or one attribute
   the toolkit declined to emit, each carrying the reason.
 - **Builds** means the generate verb's postcheck passed in that tree: `go mod
   tidy`, `go build`, `go vet`.
@@ -36,7 +36,7 @@ under `tfpfgen provider verify`.
 | ThousandEyes | 1912 | 35 | 95 | 30 | 51 | yes |
 | Total | 10269 | 170 | 629 | 98 | 229 | |
 
-Refusals, by the stage that refused:
+Exclusions, by the stage that excluded:
 
 | Document | Total | Derivation | Binding | Emission |
 |---|---|---|---|---|
@@ -45,23 +45,23 @@ Refusals, by the stage that refused:
 | ThousandEyes | 343 | 88 | 251 | 4 |
 | Total | 1507 | 460 | 1011 | 36 |
 
-A refusal total is not a score, and this one rose while the toolkit refused
+An exclusion total is not a score, and this one rose while the toolkit excluded
 less. Unions now derive as one attribute per variant, which brings each
-variant's own fields into the tree: GitHub's derivation refusals fall by 60 as
-the unions clear, and its binding refusals rise by 130 as the fields those
+variant's own fields into the tree: GitHub's derivation exclusions fall by 60 as
+the unions clear, and its binding exclusions rise by 130 as the fields those
 variants carry are each resolved against the SDK and some deleted. More schema
 is served, so more of it is individually accounted for.
 
-Union refusals, which is the number this measures against, fall from 90 to 13
+Union exclusions, which is the number this measures against, fall from 90 to 13
 — all 13 in GitHub, 11 for a branch referencing no component and 2 for a union
 in a writable position.
 
-Binding refuses most of what is refused, and that is the expected shape: it is
+Binding excludes most of what is excluded, and that is the expected shape: it is
 the only stage that resolves a drafted mapping against the SDK that was
 actually generated, so it is where a document's ambition meets what the
 backend could carry.
 
-Eleven of the emission refusals are one shape: a list element whose key the
+Eleven of the emission exclusions are one shape: a list element whose key the
 document spells its own way, where no rule derives that spelling from the path
 — `/roles/{id}` beside an element carrying `roleId`, `/users/{id}` beside
 `uid`. Each names its candidates in its reason. They need the field named as
@@ -95,7 +95,7 @@ In a provider repo with a committed revised spec and a generated SDK:
 tfpfgen provider generate
 ```
 
-The verb prints the entity counts and the refusal split as its last two lines,
+The verb prints the entity counts and the exclusion split as its last two lines,
 and runs the postcheck. `tfpfgen provider verify` regenerates into a temporary
 tree and byte-compares, which is what proves a committed tree still matches the
 toolkit that claims to produce it.