@cosyte/astm 0.0.7 → 0.0.8

package/dist/index.d.cts

@@ -51,7 +51,11 @@ interface AstmPosition {
  * ```
  */
 declare const WARNING_CODES: {
-    /** A record's type letter is not one of the modeled types: surfaced as an unsupported record. */
+    /**
+     * A record's type letter is not one of the modeled types: surfaced as an unsupported record,
+     * never dropped. Treat it as a possible lost message boundary, because a header the reader did
+     * not recognize as one does not open a new message.
+     */
     readonly ASTM_RECORD_UNKNOWN_TYPE: "ASTM_RECORD_UNKNOWN_TYPE";
     /** The header declared delimiters other than the canonical `H|\^&`: tolerated, noted. */
     readonly ASTM_NONSTANDARD_DELIMITERS: "ASTM_NONSTANDARD_DELIMITERS";
@@ -185,6 +189,11 @@ interface AstmRecordWarning {
  * Build an `ASTM_RECORD_UNKNOWN_TYPE` warning. The record is still surfaced (as
  * an unsupported record), never dropped.
  *
+ * **This one is not cosmetic.** Message grouping decides where a message starts by
+ * reading each record's type letter, so an unrecognized letter may be a header the
+ * reader failed to see, and two messages then read as one. A profile is therefore
+ * not permitted to tolerate this code.
+ *
  * @example
  * ```ts
  * import { unknownRecordType } from "@cosyte/astm";
@@ -986,10 +995,11 @@ declare function detectFraming(bytes: Uint8Array, options?: DetectFramingOptions
  *
  * 1. **A profile can never tolerate a safety-critical warning code**: a result
  *    value, abnormal flag, result status, reference range, units, patient/comment
- *    context, message-kind ambiguity, code system, or any frame/LTP integrity
- *    warning (see `src/profiles/safety.ts`). Naming one is a *definition-time
- *    throw*, not a silent relaxation, so a profile can never make a bad checksum
- *    "ok" or a cancelled result read "final."
+ *    context, message-kind ambiguity, code system, an unrecognized record type, or
+ *    any frame/LTP integrity warning (see `src/profiles/safety.ts`). Naming one is
+ *    a *definition-time throw*, not a silent relaxation, so a profile can never
+ *    make a bad checksum "ok", a cancelled result read "final", or quiet the
+ *    warning that says two messages were read as one.
  * 2. **A tolerated deviation is downgraded, never dropped.** The parser still
  *    records it (re-coded {@link WARNING_CODES.PROFILE_QUIRK_APPLIED}, flagged
  *    `expected: true`, carrying the original `toleratedCode`) so nothing is
@@ -1124,7 +1134,7 @@ interface AstmProfile {
  * const opts: DefineAstmProfileOptions = {
  *   name: "my-analyzer",
  *   transport: "raw",
- *   tolerate: [{ code: "ASTM_RECORD_UNKNOWN_TYPE", rationale: "partial vendor grammar" }],
+ *   tolerate: [{ code: "ASTM_NONSTANDARD_DELIMITERS", rationale: "declares its own set" }],
  * };
  * const p = defineAstmProfile(opts);
  * ```
@@ -1685,6 +1695,11 @@ interface TerminatorRecord extends RecordBase {
  * `H`/`P`/`O`/`R`/`C`/`Q`/`M`/`S`/`L` are all modeled; anything else is surfaced
  * with its raw fields intact and flagged with an
  * `ASTM_RECORD_UNKNOWN_TYPE` warning, never dropped.
+ *
+ * **One of these may be a header.** Message grouping decides where a message
+ * starts by reading the type letter, so a header the reader could not recognize
+ * arrives here instead, opens no message, and the messages either side of it are
+ * grouped as one. Check `rawType` before trusting a split.
  */
 interface UnsupportedRecord extends RecordBase {
     readonly type: "unsupported";
@@ -2436,6 +2451,26 @@ declare function query(msg: AstmMessage): readonly QueryRecord[];
  * is made this way because it is the boundary this parser already enforces for delimiters,
  * and because it never drops a record.
  *
+ * **What that costs, and where the cost is paid.** Grouping reads a record's **type letter**,
+ * so it is only as good as the reader's ability to recognize one. A header carrying a stray
+ * leading byte reads as an unsupported record, opens no message, and the two messages either
+ * side of it merge: a patient from the first is then paired with results from the second, which
+ * is the precise pairing {@link messages} exists to prevent. The parser does report it, as an
+ * `ASTM_RECORD_UNKNOWN_TYPE` warning against that record, and a strict parse refuses the stream
+ * outright. The cost is not only misattribution: delimiters are re-read at each `H` too, so an
+ * unrecognized header does not re-scope them either, and where the sets differ the merged tail is
+ * tokenized with the previous header's delimiters and its fields are lost rather than merely
+ * misfiled. Because that warning is the only report the merge produces, a profile is **not**
+ * permitted to tolerate the code and quiet it; the safety gate refuses the code when a profile is
+ * defined, and declines to downgrade the warning whatever profile is in force. Read an
+ * `ASTM_RECORD_UNKNOWN_TYPE` on a stream you are about to group as "a message boundary may be
+ * missing here", not as cosmetic noise.
+ *
+ * Recognizing a mangled header *as* a header is deliberately not attempted. Deciding that an
+ * unsupported record was "really" an `H` means guessing at a byte the sender did not send, and
+ * that guess would silently split a stream a different way; a warning that the reader lost its
+ * place is the honest answer, and refusing the stream in strict mode is the safe one.
+ *
  * **What is deliberately not modeled.** ASTM's within-message record hierarchy, which `P`
  * a given `R` files against when one message carries several patients, is not modeled
  * here. The clauses that would ground it (the message-level structure diagram, and the `P`
@@ -2912,7 +2947,7 @@ declare function deepFreeze<T>(value: T): T;
  *   description: "Acme's inbound raw-TCP analyzer",
  *   transport: "raw",
  *   tolerate: [
- *     { code: "ASTM_RECORD_UNKNOWN_TYPE", rationale: "emits a vendor QC record letter" },
+ *     { code: "ASTM_NONSTANDARD_DELIMITERS", rationale: "declares its own delimiter set" },
  *   ],
  *   provenance: { source: "Acme host-interface manual", reference: "internal-2026" },
  * });
@@ -2938,7 +2973,8 @@ declare function defineAstmProfile(opts: DefineAstmProfileOptions): AstmProfile;
  * `tolerate` entry whose code is unknown, whose `rationale` is empty, or, the
  * load-bearing safety rule, whose code is **safety-critical** (a result value,
  * abnormal flag, result status, reference range, units, patient/comment context,
- * message-kind, code system, or any frame/LTP integrity warning). Carries the
+ * message-kind, code system, an unrecognized record type, or any frame/LTP
+ * integrity warning). Carries the
  * offending profile's `name` when it is known, so a multi-profile build names the
  * culprit.
  *
@@ -3059,6 +3095,17 @@ declare function getDefaultAstmProfile(): AstmProfile | undefined;
  * never reallocated). A warning that is already `expected` (e.g. re-processed) is
  * passed through untouched.
  *
+ * **The safety gate is re-checked here, and that is not redundant.**
+ * {@link defineAstmProfile} refuses a safety-critical code at definition time, but
+ * {@link AstmProfile} is a plain interface: a hand-authored object literal
+ * type-checks, and `parseAstmRecords(raw, { profile })` and `setDefaultAstmProfile`
+ * both accept one without re-running the factory. A definition-time-only gate
+ * therefore guards a door that has a second entrance. A safety-critical code is
+ * **not downgraded here whatever the profile says**, so the original warning
+ * survives and `strict` still escalates it. Silently declining to downgrade, rather
+ * than throwing, is the fail-safe direction: the signal is preserved either way, and
+ * a parse is not turned into an exception by a profile the caller built by hand.
+ *
  * @param profile - The active profile.
  * @param warning - One accumulated warning.
  * @returns The re-badged warning when tolerated, else the original.
@@ -3109,7 +3156,7 @@ declare function resolveProfileTransport(profile: AstmProfile | undefined): Astm
  * The safety spine of the profile subsystem: the set of warning codes a profile is
  * **forbidden** to tolerate. A vendor profile exists to quiet known, benign
  * structural noise: never to hide a deviation that could change a clinical
- * reading or corrupt the wire.
+ * reading, lose track of where one message ends, or corrupt the wire.
  *
  * **Design: default-deny.** Rather than enumerate the *forbidden* codes (a list you
  * can forget to extend when a new warning ships, the exact incompleteness a
@@ -3121,43 +3168,93 @@ declare function resolveProfileTransport(profile: AstmProfile | undefined): Astm
  * the allow-list below. Widening the allow-list can only ever be an explicit,
  * argued act; forgetting to touch this file can never *weaken* the gate.
  *
- * The four tolerable codes are the only deviations that (a) are structural/
- * syntactic vendor noise and (b) **cannot alter, drop, or fabricate an extracted
- * value**: because a profile only ever re-badges a *warning*, never re-parses. In
- * every one, the underlying datum is already surfaced verbatim regardless of the
- * profile:
+ * **The test for admitting a code has two parts, and the second one is easy to
+ * miss.** A code may sit on the allow-list only while
+ *
+ * 1. it is structural or syntactic noise that **cannot alter, drop, or fabricate
+ *    an extracted value** (a profile re-badges a *warning*, it never re-parses, so
+ *    the underlying datum is surfaced identically with or without the profile);
+ *    **and**
+ * 2. **nothing else in this package reads the condition the warning reports.**
+ *
+ * Part 2 is a claim about the whole library, not about the warning, and it is the
+ * part that can stop being true without anyone touching this file. A code admitted
+ * as benign stops being benign the moment a later feature starts making a decision
+ * out of the very condition the warning is reporting, and adding that feature does
+ * not force this file to be revisited. That is not hypothetical: it happened once
+ * here, to `ASTM_RECORD_UNKNOWN_TYPE`, and the consequence was a wrong-patient
+ * path.
+ *
+ * **A record's type letter acquired two load-bearing readers, and the code was
+ * admitted before either existed.** Message grouping reads the letter to decide
+ * where one message ends and the next begins, so an unrecognized header opens no
+ * message and two messages are read as one, pairing a patient with results that
+ * arrived under a different header. Message classification counts `Q` / `R` / `O`
+ * records by the same letter, so an unrecognized `Q` costs a host-query request its
+ * `Q`-dominates guarantee: it reads as a result set, and the
+ * `ASTM_RECORD_AMBIGUOUS_MESSAGE_KIND` warning that flags that contradiction goes
+ * with it. In both cases `ASTM_RECORD_UNKNOWN_TYPE` is the only warning left on the
+ * stream, while the allow-list still described it as harmless. Tolerating it
+ * re-badged the single report that the reader had lost its place, and a strict parse
+ * then accepted the stream. It is off the list for that reason, and its removal is
+ * what part 2 above is written down to prevent a repeat of.
+ *
+ * **So the three that remain are recorded with the reading each one survives**, not
+ * merely with the value it preserves. Each was re-derived against both readers of
+ * record structure above, plus the single-message / single-patient guards:
  *
- * - `ASTM_RECORD_UNKNOWN_TYPE`: an unmodeled record type, surfaced verbatim as an
- *   `unsupported` record carrying no interpreted clinical field.
  * - `ASTM_NONSTANDARD_DELIMITERS`: the header's own declared delimiters are read
- *   and honored either way; this only notes they differ from the canonical set.
- * - `ASTM_UNKNOWN_ESCAPE_SEQUENCE`: an unrecognized `&…&` body is **preserved
- *   byte-for-byte** in the decoded value (the escape codec never guesses); the
- *   warning is a purely syntactic advisory, the value is identical with or without
- *   the profile.
- * - `ASTM_RECORD_UNINTERPRETED_QUERY_STATUS`: a `Q`-record request-information
- *   status surfaced verbatim on a *request* record; the code set is paywalled and
- *   is never interpreted, profile or not.
+ *   and honored either way, and this notes only that they differ from the canonical
+ *   set. Neither reader sees them: the stream is cut into records on a line break,
+ *   and a record's type letter is the first character of its line, both taken before
+ *   any delimiter-driven tokenization runs.
+ * - `ASTM_UNKNOWN_ESCAPE_SEQUENCE`: an unrecognized escape body is **preserved
+ *   byte-for-byte** in the decoded value (the escape codec does not guess at one),
+ *   so the value is identical with or without the profile. Neither reader sees it
+ *   either: a decoded field value is never cut back into records, and the type
+ *   letter is read before decoding.
+ * - `ASTM_RECORD_UNINTERPRETED_QUERY_STATUS`: a request-information status carried
+ *   verbatim as a leaf field on a `Q` record; the code set is paywalled and is not
+ *   interpreted, profile or not. Classification reads whether a `Q` record is
+ *   *present*, never what this field says, and grouping does not read `Q` at all.
  *
  * Everything a wrong value could hide from: a result value split ambiguity, an
  * undefined abnormal flag or result status, an unparseable reference range, absent
  * units, a mis-attached comment, a partial timestamp, a query-vs-result ambiguity,
- * a bad frame checksum / sequence gap / unterminated / oversize frame, an
- * ambiguous transport, an unexpected protocol event, or a rejected frame: is
- * forbidden.
+ * an unrecognized record type, a bad frame checksum / sequence gap / unterminated /
+ * oversize frame, an ambiguous transport, an unexpected protocol event, or a
+ * rejected frame: is forbidden.
+ *
+ * **What this file cannot do for you.** Part 2 is a review obligation, not a
+ * mechanical one. There is no honest automatic check for "nothing load-bearing
+ * reads this", because deciding whether a future reader of record structure has put
+ * an allow-listed code back in the path takes reading the reader. What is
+ * mechanical is the direction of the failure: default-deny means a *new* code is
+ * refused until argued in, so the residual risk is confined to the small, explicit
+ * list below. Re-derive that list whenever something new starts reading record
+ * structure.
  */
 
 /**
- * The **only** warning codes a profile may list in its `tolerate` set: benign,
- * structural/syntactic vendor noise that cannot alter, drop, or fabricate an
- * extracted value. Frozen so it cannot be mutated at runtime to smuggle a code in.
- * Adding to this set is a deliberate, reviewable act (and each addition must be an
- * `expected: false` non-safety code by the same reasoning as the four here).
+ * The **only** warning codes a profile may list in its `tolerate` set: benign
+ * structural or syntactic vendor noise that cannot alter, drop, or fabricate an
+ * extracted value, **and** whose reported condition nothing else in this package
+ * reads: not to decide where one message ends and the next begins, and not to
+ * decide what kind of message it is. Frozen so it cannot be mutated at runtime to
+ * smuggle a code in. Adding to this set is a deliberate, reviewable act, and an
+ * addition has to satisfy both halves of that test, not just the first.
+ *
+ * `ASTM_RECORD_UNKNOWN_TYPE` is **not** on this list, and used to be. An
+ * unrecognized record type may be a header the reader did not recognize as one, in
+ * which case two messages have been read as one, or a `Q` it did not recognize, in
+ * which case a host-query request reads as a result set. Tolerating it can quiet
+ * the only report either happened.
  *
  * @example
  * ```ts
  * import { TOLERABLE_CODES } from "@cosyte/astm";
  * TOLERABLE_CODES.has("ASTM_UNKNOWN_ESCAPE_SEQUENCE"); // true
+ * TOLERABLE_CODES.has("ASTM_RECORD_UNKNOWN_TYPE"); // false
  * TOLERABLE_CODES.has("ASTM_FRAME_BAD_CHECKSUM"); // false
  * ```
  */
@@ -3182,6 +3279,7 @@ declare const ALL_ASTM_WARNING_CODES: ReadonlySet<AnyAstmWarningCode>;
  * ```ts
  * import { SAFETY_CRITICAL_CODES } from "@cosyte/astm";
  * SAFETY_CRITICAL_CODES.has("ASTM_RECORD_UNDEFINED_RESULT_STATUS"); // true
+ * SAFETY_CRITICAL_CODES.has("ASTM_RECORD_UNKNOWN_TYPE"); // true
  * SAFETY_CRITICAL_CODES.has("ASTM_FRAME_BAD_CHECKSUM"); // true
  * ```
  */
@@ -3199,6 +3297,7 @@ declare const SAFETY_CRITICAL_CODES: ReadonlySet<AnyAstmWarningCode>;
  * import { isSafetyCriticalCode } from "@cosyte/astm";
  * isSafetyCriticalCode("ASTM_UNKNOWN_ESCAPE_SEQUENCE"); // false (tolerable)
  * isSafetyCriticalCode("ASTM_RECORD_AMBIGUOUS_VALUE_SPLIT"); // true
+ * isSafetyCriticalCode("ASTM_RECORD_UNKNOWN_TYPE"); // true (it can mean a lost message boundary)
  * ```
  */
 declare function isSafetyCriticalCode(code: string): boolean;
@@ -3255,8 +3354,11 @@ declare const defaultProfile: AstmProfile;
  * only re-badges the *warning*: no value, flag, status, or identifier is altered
  * or dropped. And by the safety gate in `defineAstmProfile`, it **cannot** tolerate
  * a result value / flag / status / range / units, a patient or comment context, a
- * message-kind ambiguity, or any frame / LTP integrity warning: those always
- * surface, profile or not.
+ * message-kind ambiguity, an unrecognized record type, or any frame / LTP integrity
+ * warning: those always surface, profile or not. The unrecognized-record-type case
+ * matters because message grouping reads a record's type letter, so a letter the
+ * reader does not recognize may be a header, and a header read as something else
+ * joins two messages into one.
  *
  * **Honesty.** This is a *reference-corpus* profile, not a claim about any named
  * analyzer vendor. No per-vendor ("cobas does X") behaviour is asserted; a named

package/dist/index.d.ts

@@ -51,7 +51,11 @@ interface AstmPosition {
  * ```
  */
 declare const WARNING_CODES: {
-    /** A record's type letter is not one of the modeled types: surfaced as an unsupported record. */
+    /**
+     * A record's type letter is not one of the modeled types: surfaced as an unsupported record,
+     * never dropped. Treat it as a possible lost message boundary, because a header the reader did
+     * not recognize as one does not open a new message.
+     */
     readonly ASTM_RECORD_UNKNOWN_TYPE: "ASTM_RECORD_UNKNOWN_TYPE";
     /** The header declared delimiters other than the canonical `H|\^&`: tolerated, noted. */
     readonly ASTM_NONSTANDARD_DELIMITERS: "ASTM_NONSTANDARD_DELIMITERS";
@@ -185,6 +189,11 @@ interface AstmRecordWarning {
  * Build an `ASTM_RECORD_UNKNOWN_TYPE` warning. The record is still surfaced (as
  * an unsupported record), never dropped.
  *
+ * **This one is not cosmetic.** Message grouping decides where a message starts by
+ * reading each record's type letter, so an unrecognized letter may be a header the
+ * reader failed to see, and two messages then read as one. A profile is therefore
+ * not permitted to tolerate this code.
+ *
  * @example
  * ```ts
  * import { unknownRecordType } from "@cosyte/astm";
@@ -986,10 +995,11 @@ declare function detectFraming(bytes: Uint8Array, options?: DetectFramingOptions
  *
  * 1. **A profile can never tolerate a safety-critical warning code**: a result
  *    value, abnormal flag, result status, reference range, units, patient/comment
- *    context, message-kind ambiguity, code system, or any frame/LTP integrity
- *    warning (see `src/profiles/safety.ts`). Naming one is a *definition-time
- *    throw*, not a silent relaxation, so a profile can never make a bad checksum
- *    "ok" or a cancelled result read "final."
+ *    context, message-kind ambiguity, code system, an unrecognized record type, or
+ *    any frame/LTP integrity warning (see `src/profiles/safety.ts`). Naming one is
+ *    a *definition-time throw*, not a silent relaxation, so a profile can never
+ *    make a bad checksum "ok", a cancelled result read "final", or quiet the
+ *    warning that says two messages were read as one.
  * 2. **A tolerated deviation is downgraded, never dropped.** The parser still
  *    records it (re-coded {@link WARNING_CODES.PROFILE_QUIRK_APPLIED}, flagged
  *    `expected: true`, carrying the original `toleratedCode`) so nothing is
@@ -1124,7 +1134,7 @@ interface AstmProfile {
  * const opts: DefineAstmProfileOptions = {
  *   name: "my-analyzer",
  *   transport: "raw",
- *   tolerate: [{ code: "ASTM_RECORD_UNKNOWN_TYPE", rationale: "partial vendor grammar" }],
+ *   tolerate: [{ code: "ASTM_NONSTANDARD_DELIMITERS", rationale: "declares its own set" }],
  * };
  * const p = defineAstmProfile(opts);
  * ```
@@ -1685,6 +1695,11 @@ interface TerminatorRecord extends RecordBase {
  * `H`/`P`/`O`/`R`/`C`/`Q`/`M`/`S`/`L` are all modeled; anything else is surfaced
  * with its raw fields intact and flagged with an
  * `ASTM_RECORD_UNKNOWN_TYPE` warning, never dropped.
+ *
+ * **One of these may be a header.** Message grouping decides where a message
+ * starts by reading the type letter, so a header the reader could not recognize
+ * arrives here instead, opens no message, and the messages either side of it are
+ * grouped as one. Check `rawType` before trusting a split.
  */
 interface UnsupportedRecord extends RecordBase {
     readonly type: "unsupported";
@@ -2436,6 +2451,26 @@ declare function query(msg: AstmMessage): readonly QueryRecord[];
  * is made this way because it is the boundary this parser already enforces for delimiters,
  * and because it never drops a record.
  *
+ * **What that costs, and where the cost is paid.** Grouping reads a record's **type letter**,
+ * so it is only as good as the reader's ability to recognize one. A header carrying a stray
+ * leading byte reads as an unsupported record, opens no message, and the two messages either
+ * side of it merge: a patient from the first is then paired with results from the second, which
+ * is the precise pairing {@link messages} exists to prevent. The parser does report it, as an
+ * `ASTM_RECORD_UNKNOWN_TYPE` warning against that record, and a strict parse refuses the stream
+ * outright. The cost is not only misattribution: delimiters are re-read at each `H` too, so an
+ * unrecognized header does not re-scope them either, and where the sets differ the merged tail is
+ * tokenized with the previous header's delimiters and its fields are lost rather than merely
+ * misfiled. Because that warning is the only report the merge produces, a profile is **not**
+ * permitted to tolerate the code and quiet it; the safety gate refuses the code when a profile is
+ * defined, and declines to downgrade the warning whatever profile is in force. Read an
+ * `ASTM_RECORD_UNKNOWN_TYPE` on a stream you are about to group as "a message boundary may be
+ * missing here", not as cosmetic noise.
+ *
+ * Recognizing a mangled header *as* a header is deliberately not attempted. Deciding that an
+ * unsupported record was "really" an `H` means guessing at a byte the sender did not send, and
+ * that guess would silently split a stream a different way; a warning that the reader lost its
+ * place is the honest answer, and refusing the stream in strict mode is the safe one.
+ *
  * **What is deliberately not modeled.** ASTM's within-message record hierarchy, which `P`
  * a given `R` files against when one message carries several patients, is not modeled
  * here. The clauses that would ground it (the message-level structure diagram, and the `P`
@@ -2912,7 +2947,7 @@ declare function deepFreeze<T>(value: T): T;
  *   description: "Acme's inbound raw-TCP analyzer",
  *   transport: "raw",
  *   tolerate: [
- *     { code: "ASTM_RECORD_UNKNOWN_TYPE", rationale: "emits a vendor QC record letter" },
+ *     { code: "ASTM_NONSTANDARD_DELIMITERS", rationale: "declares its own delimiter set" },
  *   ],
  *   provenance: { source: "Acme host-interface manual", reference: "internal-2026" },
  * });
@@ -2938,7 +2973,8 @@ declare function defineAstmProfile(opts: DefineAstmProfileOptions): AstmProfile;
  * `tolerate` entry whose code is unknown, whose `rationale` is empty, or, the
  * load-bearing safety rule, whose code is **safety-critical** (a result value,
  * abnormal flag, result status, reference range, units, patient/comment context,
- * message-kind, code system, or any frame/LTP integrity warning). Carries the
+ * message-kind, code system, an unrecognized record type, or any frame/LTP
+ * integrity warning). Carries the
  * offending profile's `name` when it is known, so a multi-profile build names the
  * culprit.
  *
@@ -3059,6 +3095,17 @@ declare function getDefaultAstmProfile(): AstmProfile | undefined;
  * never reallocated). A warning that is already `expected` (e.g. re-processed) is
  * passed through untouched.
  *
+ * **The safety gate is re-checked here, and that is not redundant.**
+ * {@link defineAstmProfile} refuses a safety-critical code at definition time, but
+ * {@link AstmProfile} is a plain interface: a hand-authored object literal
+ * type-checks, and `parseAstmRecords(raw, { profile })` and `setDefaultAstmProfile`
+ * both accept one without re-running the factory. A definition-time-only gate
+ * therefore guards a door that has a second entrance. A safety-critical code is
+ * **not downgraded here whatever the profile says**, so the original warning
+ * survives and `strict` still escalates it. Silently declining to downgrade, rather
+ * than throwing, is the fail-safe direction: the signal is preserved either way, and
+ * a parse is not turned into an exception by a profile the caller built by hand.
+ *
  * @param profile - The active profile.
  * @param warning - One accumulated warning.
  * @returns The re-badged warning when tolerated, else the original.
@@ -3109,7 +3156,7 @@ declare function resolveProfileTransport(profile: AstmProfile | undefined): Astm
  * The safety spine of the profile subsystem: the set of warning codes a profile is
  * **forbidden** to tolerate. A vendor profile exists to quiet known, benign
  * structural noise: never to hide a deviation that could change a clinical
- * reading or corrupt the wire.
+ * reading, lose track of where one message ends, or corrupt the wire.
  *
  * **Design: default-deny.** Rather than enumerate the *forbidden* codes (a list you
  * can forget to extend when a new warning ships, the exact incompleteness a
@@ -3121,43 +3168,93 @@ declare function resolveProfileTransport(profile: AstmProfile | undefined): Astm
  * the allow-list below. Widening the allow-list can only ever be an explicit,
  * argued act; forgetting to touch this file can never *weaken* the gate.
  *
- * The four tolerable codes are the only deviations that (a) are structural/
- * syntactic vendor noise and (b) **cannot alter, drop, or fabricate an extracted
- * value**: because a profile only ever re-badges a *warning*, never re-parses. In
- * every one, the underlying datum is already surfaced verbatim regardless of the
- * profile:
+ * **The test for admitting a code has two parts, and the second one is easy to
+ * miss.** A code may sit on the allow-list only while
+ *
+ * 1. it is structural or syntactic noise that **cannot alter, drop, or fabricate
+ *    an extracted value** (a profile re-badges a *warning*, it never re-parses, so
+ *    the underlying datum is surfaced identically with or without the profile);
+ *    **and**
+ * 2. **nothing else in this package reads the condition the warning reports.**
+ *
+ * Part 2 is a claim about the whole library, not about the warning, and it is the
+ * part that can stop being true without anyone touching this file. A code admitted
+ * as benign stops being benign the moment a later feature starts making a decision
+ * out of the very condition the warning is reporting, and adding that feature does
+ * not force this file to be revisited. That is not hypothetical: it happened once
+ * here, to `ASTM_RECORD_UNKNOWN_TYPE`, and the consequence was a wrong-patient
+ * path.
+ *
+ * **A record's type letter acquired two load-bearing readers, and the code was
+ * admitted before either existed.** Message grouping reads the letter to decide
+ * where one message ends and the next begins, so an unrecognized header opens no
+ * message and two messages are read as one, pairing a patient with results that
+ * arrived under a different header. Message classification counts `Q` / `R` / `O`
+ * records by the same letter, so an unrecognized `Q` costs a host-query request its
+ * `Q`-dominates guarantee: it reads as a result set, and the
+ * `ASTM_RECORD_AMBIGUOUS_MESSAGE_KIND` warning that flags that contradiction goes
+ * with it. In both cases `ASTM_RECORD_UNKNOWN_TYPE` is the only warning left on the
+ * stream, while the allow-list still described it as harmless. Tolerating it
+ * re-badged the single report that the reader had lost its place, and a strict parse
+ * then accepted the stream. It is off the list for that reason, and its removal is
+ * what part 2 above is written down to prevent a repeat of.
+ *
+ * **So the three that remain are recorded with the reading each one survives**, not
+ * merely with the value it preserves. Each was re-derived against both readers of
+ * record structure above, plus the single-message / single-patient guards:
  *
- * - `ASTM_RECORD_UNKNOWN_TYPE`: an unmodeled record type, surfaced verbatim as an
- *   `unsupported` record carrying no interpreted clinical field.
  * - `ASTM_NONSTANDARD_DELIMITERS`: the header's own declared delimiters are read
- *   and honored either way; this only notes they differ from the canonical set.
- * - `ASTM_UNKNOWN_ESCAPE_SEQUENCE`: an unrecognized `&…&` body is **preserved
- *   byte-for-byte** in the decoded value (the escape codec never guesses); the
- *   warning is a purely syntactic advisory, the value is identical with or without
- *   the profile.
- * - `ASTM_RECORD_UNINTERPRETED_QUERY_STATUS`: a `Q`-record request-information
- *   status surfaced verbatim on a *request* record; the code set is paywalled and
- *   is never interpreted, profile or not.
+ *   and honored either way, and this notes only that they differ from the canonical
+ *   set. Neither reader sees them: the stream is cut into records on a line break,
+ *   and a record's type letter is the first character of its line, both taken before
+ *   any delimiter-driven tokenization runs.
+ * - `ASTM_UNKNOWN_ESCAPE_SEQUENCE`: an unrecognized escape body is **preserved
+ *   byte-for-byte** in the decoded value (the escape codec does not guess at one),
+ *   so the value is identical with or without the profile. Neither reader sees it
+ *   either: a decoded field value is never cut back into records, and the type
+ *   letter is read before decoding.
+ * - `ASTM_RECORD_UNINTERPRETED_QUERY_STATUS`: a request-information status carried
+ *   verbatim as a leaf field on a `Q` record; the code set is paywalled and is not
+ *   interpreted, profile or not. Classification reads whether a `Q` record is
+ *   *present*, never what this field says, and grouping does not read `Q` at all.
  *
  * Everything a wrong value could hide from: a result value split ambiguity, an
  * undefined abnormal flag or result status, an unparseable reference range, absent
  * units, a mis-attached comment, a partial timestamp, a query-vs-result ambiguity,
- * a bad frame checksum / sequence gap / unterminated / oversize frame, an
- * ambiguous transport, an unexpected protocol event, or a rejected frame: is
- * forbidden.
+ * an unrecognized record type, a bad frame checksum / sequence gap / unterminated /
+ * oversize frame, an ambiguous transport, an unexpected protocol event, or a
+ * rejected frame: is forbidden.
+ *
+ * **What this file cannot do for you.** Part 2 is a review obligation, not a
+ * mechanical one. There is no honest automatic check for "nothing load-bearing
+ * reads this", because deciding whether a future reader of record structure has put
+ * an allow-listed code back in the path takes reading the reader. What is
+ * mechanical is the direction of the failure: default-deny means a *new* code is
+ * refused until argued in, so the residual risk is confined to the small, explicit
+ * list below. Re-derive that list whenever something new starts reading record
+ * structure.
  */
 
 /**
- * The **only** warning codes a profile may list in its `tolerate` set: benign,
- * structural/syntactic vendor noise that cannot alter, drop, or fabricate an
- * extracted value. Frozen so it cannot be mutated at runtime to smuggle a code in.
- * Adding to this set is a deliberate, reviewable act (and each addition must be an
- * `expected: false` non-safety code by the same reasoning as the four here).
+ * The **only** warning codes a profile may list in its `tolerate` set: benign
+ * structural or syntactic vendor noise that cannot alter, drop, or fabricate an
+ * extracted value, **and** whose reported condition nothing else in this package
+ * reads: not to decide where one message ends and the next begins, and not to
+ * decide what kind of message it is. Frozen so it cannot be mutated at runtime to
+ * smuggle a code in. Adding to this set is a deliberate, reviewable act, and an
+ * addition has to satisfy both halves of that test, not just the first.
+ *
+ * `ASTM_RECORD_UNKNOWN_TYPE` is **not** on this list, and used to be. An
+ * unrecognized record type may be a header the reader did not recognize as one, in
+ * which case two messages have been read as one, or a `Q` it did not recognize, in
+ * which case a host-query request reads as a result set. Tolerating it can quiet
+ * the only report either happened.
  *
  * @example
  * ```ts
  * import { TOLERABLE_CODES } from "@cosyte/astm";
  * TOLERABLE_CODES.has("ASTM_UNKNOWN_ESCAPE_SEQUENCE"); // true
+ * TOLERABLE_CODES.has("ASTM_RECORD_UNKNOWN_TYPE"); // false
  * TOLERABLE_CODES.has("ASTM_FRAME_BAD_CHECKSUM"); // false
  * ```
  */
@@ -3182,6 +3279,7 @@ declare const ALL_ASTM_WARNING_CODES: ReadonlySet<AnyAstmWarningCode>;
  * ```ts
  * import { SAFETY_CRITICAL_CODES } from "@cosyte/astm";
  * SAFETY_CRITICAL_CODES.has("ASTM_RECORD_UNDEFINED_RESULT_STATUS"); // true
+ * SAFETY_CRITICAL_CODES.has("ASTM_RECORD_UNKNOWN_TYPE"); // true
  * SAFETY_CRITICAL_CODES.has("ASTM_FRAME_BAD_CHECKSUM"); // true
  * ```
  */
@@ -3199,6 +3297,7 @@ declare const SAFETY_CRITICAL_CODES: ReadonlySet<AnyAstmWarningCode>;
  * import { isSafetyCriticalCode } from "@cosyte/astm";
  * isSafetyCriticalCode("ASTM_UNKNOWN_ESCAPE_SEQUENCE"); // false (tolerable)
  * isSafetyCriticalCode("ASTM_RECORD_AMBIGUOUS_VALUE_SPLIT"); // true
+ * isSafetyCriticalCode("ASTM_RECORD_UNKNOWN_TYPE"); // true (it can mean a lost message boundary)
  * ```
  */
 declare function isSafetyCriticalCode(code: string): boolean;
@@ -3255,8 +3354,11 @@ declare const defaultProfile: AstmProfile;
  * only re-badges the *warning*: no value, flag, status, or identifier is altered
  * or dropped. And by the safety gate in `defineAstmProfile`, it **cannot** tolerate
  * a result value / flag / status / range / units, a patient or comment context, a
- * message-kind ambiguity, or any frame / LTP integrity warning: those always
- * surface, profile or not.
+ * message-kind ambiguity, an unrecognized record type, or any frame / LTP integrity
+ * warning: those always surface, profile or not. The unrecognized-record-type case
+ * matters because message grouping reads a record's type letter, so a letter the
+ * reader does not recognize may be a header, and a header read as something else
+ * joins two messages into one.
  *
  * **Honesty.** This is a *reference-corpus* profile, not a claim about any named
  * analyzer vendor. No per-vendor ("cobas does X") behaviour is asserted; a named