io has no stated contract: javascript counts an identifier named path, sqlite counts every DML keyword, and tcl's source/close are claimed by two rules each #2841

Roadmap Phase 3 family (docs/contract_roadmap.md, epic #2812), next by the mechanical audit: io carries 4 of the report's 39 open-defect cells (javascript, jcl, sqlite, tcl — all extraction), and the sheet row is draft:

_c("io", "safety", "site", "Interaction with the disk, network, or external systems", planted=True)

Nothing states what one io hit is, and the four red cells are four different answers:

• javascript — the rule is a bare-token alternation, \b(fetch|axios|http|https|fs|path|database|sql|…)\b. An ordinary identifier that spells a menu keyword counts: probeIo's parameter named path reads io +1 (ledger identifier-name-token-collision, still reproducing). sql, http, database have the same surface.
• sqlite — two shapes at once: .read/.import are claimed by both import and io (ledger sqlite-dot-read-dual-import-io, still reproducing), and the rule counts every DML keyword (SELECT|INSERT|UPDATE|DELETE|REPLACE) as an I/O boundary — in a language where DML is the entire program, that is a length proxy, not a boundary count.
• tcl — source is import+io and close is cleanup+io (ledger batch4-dual-keyword-overlaps, still reproducing); open|close|read|gets|file are bare tokens with the javascript collision surface.
• jcl — the cell is categorized extraction through batch4's signal×language cross-product (jcl's itemized dual there is SET, which is globals+state_mutation, not an io token); whether DSN|DSNAME|SYSOUT|SYSPRINT|DISP= actually over- or under-counts needs the rule-probe measurement, not a guess.

The contract has to decide the four shapes every audit so far has hit:

1. Reference vs declaration/identifier — a token only counts anchored to its I/O construct (call form, statement position), never as a bare identifier. This is the javascript/tcl fix.
2. Dual ownership — which rule owns a token that is also an acquisition (open), a release (close), a dependency (source, .read, @import)? The batch4 entry itemizes which duals are deliberate; the contract must say which survive, the same way state_mutation has no stated contract: three incompatible definitions across 46 languages, and it governs the corpus's two worst metrics #2765 settled ENV/popdef/clear and branch has no stated contract: handler keywords, the syntax words of one conditional, and goto count as decisions in some languages and not in others #2822 settled the handler keywords.
3. What counts as a boundary in a language whose every statement is I/O (sqlite, jcl): a site-kind count that fires on every line measures program length. The contract needs a per-construct answer (e.g. statements that cross the database/file/network boundary vs. in-engine computation), or a declared stratum.
4. Contract-level absence — css and solidity deliberately carry io: None (ledgers css-import-url-io-triple-overlap, solidity-io-observable-output-via-events: the intent is measured under more specific signals). The contract must state the absence rule so language 47 knows when None is correct, and settle the css entry's RE-SCOPED loose end (non-import url() fetches).

Not in scope: probe-idiom-collides-with-measured-signal (c, haskell, jcl, lua, tcl — intended morphology, the probe idiom itself is I/O; those cells are not defects and must not move).

Done in the #2765/#2822 shape: one sentence + corollaries in docs/io_rule_contract.md, rules fixed to the sentence with the matching keyword-rosetta plants, sheet row → stated, io open defects 4 → 0 (or filed), duals retired from batch4's itemization or recorded as the deliberate exceptions.