No-silent-failure contract (Mars lane): audit census + author shared mutation-wrapper/form-hook/lint-guard + codify contract in commons

Fleet no-silent-failure contract, Mars lane (brainstorm bs-mra1eg36m6d, 3-PM unanimous; parity with PLUTO-529 + VENUS-176). Root cause of Elazar's silent form failures = swallowed catch upstream never writes appEvents, so toast+log+PM-DM all no-op at once. Two parts: (A) Mars audit CENSUS (read-only, running via coder-mars) of anti-patterns — unwrapped 'use server' mutations, catch blocks that neither log appEvents nor rethrow (the swallow class), client call-sites that ignore a returned error, required fields w/o validation toast — output file:line gap list; remediate admin-mutation paths FIRST (silent-fail there = data-integrity risk). (B) Mars is the fleet AUTHOR of the shared primitive: mutation-wrapper (guaranteed appEvents write + typed {ok,error}, injected logError+toast deps, vendored like sortable-table) + client form-submit hook (always toasts on \!ok) + lint guard in .gitpush-pre.sh (blocks unwrapped mutation / swallowing catch / required-field w/o error-surface). Leg-4 (error->live-PM-DM) is zero-greenfield: all 3 apps' applog rails already fire on LOGGED errors. Contract also codified once into evolutiva-commons UI-And-Errors (Mars commons-owner drafts, room +1, bin-whey lands). BLOCKED on Elazar ratify of the 4-point plan + Mars-as-author confirm; census (A) safe to run now.