Module disclosure 

Task 34 — per-record/event disclosure classes (spec §9.7).

One typed vocabulary and ONE model-visibility gate. Every boundary that moves content into model context routes through gate_for_model; persistence boundaries consult may_persist. Consent and redaction fail CLOSED: no consent → withheld, no redactor → withheld.

Enums

DisclosureClass

Disclosure class of a record or event (spec §9.7).

ModelVisibility

Outcome of the model-visibility gate.

Functions

gate_for_model

THE model-visibility gate (spec §9.7). consent_granted is per-item explicit consent; redactor transforms text for the after-redaction class. Missing prerequisites fail closed.

may_persist

Persistence gate: only DisclosureClass::NeverPersist refuses disk.