fix(rules): finish the v3 sweep and record the guards that misfired

MSA-011 is the last confirmed instance: a clause that explicitly DECLINES to
allocate IP ownership names background and foreground IP — the very terms the
rule looks for — so leaving ownership deliberately unresolved scored clean.
Ownership then falls to default law, which for commissioned work usually
leaves it with the supplier: the outcome the customer is paying to avoid.

MSA-002 is REJECTED, not fixed. Its candidate denial was "Customer is not
entitled to control the defense" — but that is ordinary drafting, since the
indemnitor normally controls the defense. A guard there would accuse a standard
indemnity clause.

The narrowing MSA-011 needed makes the same point: my first frame included
"does not ASSIGN ownership", which is exactly what a well-drafted MSA says —
each party keeps its own background IP. Only verbs that decline to RESOLVE the
question count. Both the denial and that decoy are now in the harness.

docs/express-denial-sweep.md now covers v3 as well as v4, and gains a table of
the six guards written during this sweep that accused compliant drafting and
had to be narrowed — the § 2870 statutory carve-out, the combined bond-or-
surety waiver, landlord-side insurance, a claims carve-out, legal-hold
retention, and this one. The common thread is that the compliant clause very
often CONTAINS a negation, so a frame keyed on "not <verb>" alone will find it.
That table is the most useful thing in the document for anyone writing the next
guard.

23 rules fixed across v3 and v4. 340 goldens re-baselined, result_hash only.

Author: clay-good

docs/express-denial-sweep.md

@@ -34,6 +34,23 @@ const CASES: [Rule[], string, string, boolean, string][] = [
     true,
     "Supplier does not indemnify Customer for any third-party IP infringement claim.",
   ],
+  [
+    MSA_DEEP_RULES,
+    "MSA-011",
+    CLEAN_MSA,
+    true,
+    "This Agreement does not allocate ownership of background IP or foreground IP created hereunder; ownership remains unresolved.",
+  ],
+  [
+    // A well-drafted MSA says the agreement "does not assign ownership of
+    // background IP" — each party keeps its own. Only a refusal to RESOLVE
+    // ownership is a denial, so this decoy must stay silent.
+    MSA_DEEP_RULES,
+    "",
+    CLEAN_MSA,
+    false,
+    "Each party retains its background IP and grants a licence; this Agreement does not assign ownership of background IP to the other party.",
+  ],
   [
     MSA_DEEP_RULES,
     "MSA-016",
@@ -135,7 +152,10 @@ const denied = (rules: Rule[], text: string): string[] =>
   rules
     .filter((r) => {
       const f = r.check(buildContext(["Agreement", text]));
-      return f !== null && /disclaim|denied/i.test(f.title);
+      // "declined" joins the vocabulary with MSA-011. None of the
+      // missing-clause titles in these packs use these words, so the filter
+      // still proves it was `denied_if` that matched.
+      return f !== null && /disclaim|denied|declined/i.test(f.title);
     })
     .map((r) => r.id);
 

src/engine/rules/v3/msa-addenda-nda-express-denial.test.ts

@@ -411,7 +411,7 @@ export const MSA_DEEP_RULES: Rule[] = [
   // ────────────────────────────────────────────────────────────────
   presence({
     id: "MSA-011",
-    version: "1.1.0",
+    version: "1.2.0",
     name: "Background / foreground IP allocation",
     description:
       "MSA must allocate ownership of background IP (pre-existing) and foreground IP (created during the engagement).",
@@ -433,6 +433,22 @@ export const MSA_DEEP_RULES: Rule[] = [
       /(background\s+(?:IP|intellectual\s+property)|pre[- ]existing\s+(?:IP|intellectual\s+property))/i,
       /(foreground\s+(?:IP|intellectual\s+property)|(?:developed|created|made|conceived)\s+(?:hereunder|under\s+this\s+Agreement))/i,
     ],
+    // Express-denial guard: a clause that explicitly DECLINES to allocate IP
+    // names background and foreground IP, the very terms the rule looks for,
+    // so it satisfied the presence check. Leaving ownership unresolved on
+    // purpose is the failure this rule exists to surface.
+    denied_if: [
+      // NOT "assign": "this Agreement does not assign ownership of background
+      // IP to the other party" is exactly what a well-drafted MSA says — each
+      // party keeps its own background IP. Only verbs that decline to RESOLVE
+      // the question count as a denial.
+      /\b(?:does|do|shall|will)\s+not\s+(?:allocate|determine|address|resolve)\b[^.]{0,60}?\bownership/i,
+      /\bownership\b[^.]{0,40}?\b(?:remains|is)\s+(?:unresolved|undetermined|unallocated)/i,
+      /\bno\s+allocation\s+of\s+(?:ip|intellectual\s+property)\s+ownership/i,
+    ],
+    denied_title: "IP ownership allocation expressly declined",
+    denied_description:
+      "The agreement states that it does not allocate ownership of background or foreground IP. Ownership then falls to default law, which for commissioned work usually leaves it with the supplier — the outcome the customer is paying to avoid, and worse than silence because it is deliberate.",
     default_severity: "warning",
   }),
   language({