@cspeach/cli 1.1.35 → 1.1.36

package/.gitattributes

@@ -0,0 +1 @@
+test/unit/recorded/golden/*.json -text

package/dist/agent/loop.js

@@ -44,6 +44,7 @@ import { consumeTodoSetThisTurn } from '../ui/todo-emitter.js';
 import { runSaveCommand, runPromoteCommand, detectArtifactSkill, offerAnswerBlockers } from '../projects/index.js';
 import { planLaneBlockForTurn } from '../projects/plan-lane.js';
 import { clearAppFlow, getAppFlow, setGapConfirmed, startAppFlow } from '../lane/app-flow.js';
+import { getLatestSkeletonDecision } from '../rap/skeleton-session.js';
 import { afterRebuildTurn } from '../journey/rebuild.js';
 import { afterJourneyTurn, gateJourneyForTurn, journeyAsk, journeyCardConfirm, journeyStoppedOnError, journeyTurnBlock, pauseJourneyForInterruptedTurn } from '../journey/chain.js';
 import { addJourneyLeftOut, addJourneySkips, getJourneyFlow } from '../journey/flow.js';
@@ -427,6 +428,7 @@ export async function maybeOfferSave(p) {
             // the skill it saves (the /abap-plan turn that got the lane block); a plan
             // found in another skill's output (detectArtifactSkill) never gets it.
             ...(p.lane && p.skill === saveSkill ? { lane: p.lane } : {}),
+            ...(p.latestSkeleton && p.skill === saveSkill ? { latestSkeleton: p.latestSkeleton } : {}),
             onNotSaved: (reason) => { notSaved = reason; },
             ...(p.onProjectId ? { onProjectId: p.onProjectId } : {}),
             // Never headless: a headless journey queues nothing.
@@ -1841,6 +1843,10 @@ ${imageExpansion.error}`));
                             const flowLane = getAppFlow(session)?.lane;
                             return flowLane ? { lane: { ...flowLane, cwd: params.ctx.cwd } } : {};
                         })(),
+                        ...(() => {
+                            const sk = getLatestSkeletonDecision(session);
+                            return sk ? { latestSkeleton: { path: sk.path, sha256: sk.sha256 } } : {};
+                        })(),
                         // Sessions/folders (Task 6) — the first save tags the session with
                         // its folder's project id, only when the session belongs to this
                         // folder (ruling 18). Saved to disk right after the hook.

package/dist/agent/parallel-write-guard.js

@@ -21,7 +21,7 @@
  *
  * Scope of "write-class" matches the spec for this bug fix and is narrower
  * than tools/write-mode.ts WRITE_TOOLS: only the four tools that perform
- * net-new source mutation are gated here.
+ * net-new source mutation (and the RAP generator, which creates objects) are gated here.
  */
 /** Tools that mutate ABAP source. Narrower than WRITE_TOOLS — excludes
  *  activate / publish / transport_release / message_maintain. The bug
@@ -31,6 +31,8 @@ export const WRITE_CLASS_TOOLS = new Set([
     'sap_update_method',
     'sap_delete_object',
     'sap_create_object',
+    // Final review I2 — SAP's RAP generator creates up to 9 objects in one call.
+    'sap_generate_objects',
 ]);
 export function isWriteClassTool(name) {
     return WRITE_CLASS_TOOLS.has(name);

package/dist/commands/plan-audit-evidence.js

@@ -44,8 +44,13 @@ import { checkpointsRoot } from '../agent/skill-checkpoint.js';
  * contract branch depends on it — so it must NEVER be evicted by the row cap:
  * PROTECTED, not the fillable existence tier. Matched EXACTLY (^…$ anchored) so
  * a near-miss tool name can never masquerade as consent.
+ *
+ * RAP generator (2026-10-14): sap_generate_objects is a write (SAP's generator
+ * creates the whole stack) and rap_finish_check is the F1–F5 proof of a RAP
+ * phase — both PROTECTED in any phase. rap_finish_check is matched EXACTLY.
+ * The R26 rule for the fiori_* smokes (cap.* phases only) is unchanged.
  */
-const PROTECTED_TOOL_RE = /^sap_(set_source|update_method|create_object|delete_object|activate|syntax_check|atc_run|inactive_objects|transport_create|transport_release|service_binding_publish|snapshot)|^request_approval$/;
+const PROTECTED_TOOL_RE = /^sap_(set_source|update_method|create_object|delete_object|activate|syntax_check|atc_run|inactive_objects|transport_create|transport_release|service_binding_publish|snapshot|generate_objects)|^request_approval$|^rap_finish_check$/;
 /**
  * D-F (2026-07-05): EXISTENCE / VERIFY-READ evidence. A verify-only phase
  * re-run (object already built in a prior attempt; this attempt proves it

package/dist/commands/plan-gate.js

@@ -64,9 +64,14 @@ let planPhaseActive = false;
  * plan object-list grant covers requests only for THIS plan; a step started
  * without an id (null) is never covered. Cleared with the flag. */
 let activePlanId = null;
-export function setPlanPhaseActive(active, planId) {
+/* RAP generator final review M1 — the running plan's file, so a tool resolves
+ * the plan's pinned files (skeleton decision) from the plan's own root first,
+ * like the lane reader does. Cleared with the flag. */
+let activePlanPath = null;
+export function setPlanPhaseActive(active, planId, planPath) {
     planPhaseActive = active;
     activePlanId = active && typeof planId === 'string' && planId ? planId : null;
+    activePlanPath = active && typeof planPath === 'string' && planPath ? planPath : null;
 }
 export function isPlanPhaseActive() {
     return planPhaseActive;
@@ -75,6 +80,10 @@ export function isPlanPhaseActive() {
 export function getActivePlanId() {
     return planPhaseActive ? activePlanId : null;
 }
+/** The running plan's file path, or null (no step, or started without one). */
+export function getActivePlanPath() {
+    return planPhaseActive ? activePlanPath : null;
+}
 /* Task 7 — per-phase subagent dispatch counter. agent_run increments it on
  * every dispatch made while a plan phase is active; the REPL reads it
  * (read+reset) in the runTurn finally that clears the plan-phase flag and

package/dist/commands/plan-resume.js

@@ -59,6 +59,7 @@ import { FLOORPLAN_TO_TEMPLATE } from '../tools/fiori/floorplan-map.js';
 import { getCurrentTransport, setCurrentTransport } from '../repl/current-transport.js';
 import { askYesNo, isYes } from '../projects/yes-no.js';
 import { formatAttention, formatInfo } from '../renderer/notice-shape.js';
+import { skeletonWriteBackConflict } from '../projects/plan-skeleton.js';
 import { checkLaneConsistency, checkRequiredDeploy, isDeployPhase, loadPlanLaneForRun, renderLaneBlock } from '../projects/plan-lane.js';
 import { askDeployCard } from './deploy-card.js';
 import { isCredentialHandoverApproved } from '../repl/credential-handover-gate.js';
@@ -925,6 +926,14 @@ export async function finishPlanResume(args) {
             logNotSaved(args, laneConflict ? 'a step no longer fits the app type the plan was made for. Re-run /abap-plan to rebuild the plan.' : 'it dropped the deploy step this app needs', (laneConflict ?? deployConflict));
             return null;
         }
+        // RAP generator plan, Task 8 — the skeleton decision is fixed for the run:
+        // a write-back may not change, drop or add a phase's work.skeleton. A plan
+        // without one that stays without one is untouched (older plans, spec §8).
+        const skeletonConflict = priorParsed.ok ? skeletonWriteBackConflict(priorParsed.content, extract.content) : null;
+        if (skeletonConflict) {
+            logNotSaved(args, 'it changed the skeleton decision, which cannot change during the run. Re-run /abap-plan to change it.', skeletonConflict);
+            return null;
+        }
     }
     const nowIso = new Date().toISOString();
     const statuses = extract.statuses;

package/dist/one-shot.js

@@ -63,6 +63,9 @@ import './tools/cap/metadata-import.js';
 import './tools/cap/sap-link-tool.js';
 import './tools/cap/link-smoke.js';
 import './tools/lane/app-lane-resolve.js';
+import './tools/rap/skeleton-resolve.js';
+import './tools/rap/generate-objects.js';
+import './tools/rap/finish-check.js';
 import './tools/extend-model/tool.js';
 import './tools/text-elements/tools.js';
 import './tools/capability/tool.js';

package/dist/projects/extract-plan.js

@@ -84,6 +84,12 @@ function expandCompactContent(changedRaw, prior, rawStatuses) {
         if (ow && typeof ow === 'object' && ow.plannedObjects === undefined && priorWork?.plannedObjects !== undefined) {
             ow.plannedObjects = priorWork.plannedObjects;
         }
+        // RAP generator plan, Task 8 — the skeleton decision is plan-create-only too:
+        // a step's write-back that omits it keeps it (plan-resume refuses a change).
+        const priorSkeleton = priorWork?.skeleton;
+        if (ow && typeof ow === 'object' && ow.skeleton === undefined && priorSkeleton !== undefined) {
+            ow.skeleton = priorSkeleton;
+        }
     }
     // 1:1 map over the PRIOR phase list — changed entries overlay their phase,
     // everything else passes through verbatim from the envelope.

package/dist/projects/plan-objects.js

@@ -9,7 +9,7 @@ export const OBJECT_TYPE_LABELS = {
 const NEVER_ON_LIST = new Set(['WAPA', 'CTS', 'DEVC']);
 const TYPE_RE = /^[A-Z]{4}$/;
 const NAME_RE = /^(\/[A-Z0-9_]{1,10}\/)?[A-Z0-9_]{1,40}$/;
-const PKG_RE = /^(\$[A-Z0-9_]{1,29}|(\/[A-Z0-9_]{1,10}\/)?[A-Z0-9_]{1,30})$/;
+export const PKG_RE = /^(\$[A-Z0-9_]{1,29}|(\/[A-Z0-9_]{1,10}\/)?[A-Z0-9_]{1,30})$/;
 export const MAX_PLANNED_OBJECTS = 200;
 /** ADT type code from a raw type: `'ddls/df'` → `'DDLS'`. */
 export function normalizeObjectType(raw) {

package/dist/projects/plan-skeleton.js

@@ -0,0 +1,93 @@
+// cspeach-cli/src/projects/plan-skeleton.ts
+//
+// RAP generator plan, Task 8 — a RAP lane plan must carry the CLI's skeleton
+// decision unchanged (spec §3.3). Checked at plan create; an older plan without
+// a skeleton phase still resumes exactly as before (no regression, spec §8).
+//
+// - checkSkeletonDecision: at save. The phase whose `work.skeleton` holds the
+//   Plan block from rap_skeleton_resolve must name the builder the decision
+//   file (sha-pinned) records, and on the generator path list exactly the
+//   objects SAP's generator will create.
+// - skeletonWriteBackConflict: at resume. A write-back may not change, drop or
+//   add a `work.skeleton` — the decision is fixed for the run.
+import { cardLine } from '../lane/card.js';
+import { readSkeletonDecision } from '../rap/skeleton-store.js';
+import { toPlannedObject } from './plan-objects.js';
+// Final review M3 — the developer reads these on screen ([save] lines, no
+// detail split there): plain words only, no tool, field, layer or phase ids.
+export const SKELETON_PHASE_MISSING = 'This RAP plan is missing its skeleton step. Run /abap-plan again.';
+export const SKELETON_DECISION_STALE = 'This plan uses an older skeleton choice, not the newest one. Run /abap-plan again.';
+export const SKELETON_CHANGED_ON_RESUME = 'The skeleton choice cannot change during a run. Run /abap-plan again.';
+const SKELETON_TWO_PHASES = 'This plan has more than one skeleton step. Run /abap-plan again.';
+const SKELETON_BUILDER_DIFFERS = 'This plan builds the skeleton differently from the choice on the skeleton card. Run /abap-plan again.';
+const key = (o) => `${o.type} ${o.name} ${o.package ?? ''}`.trim();
+const skeletonOf = (p) => p.work?.skeleton;
+/** True when any phase carries a `work.skeleton`. */
+export function hasSkeletonPhase(content) {
+    return content.phases.some((p) => !!skeletonOf(p));
+}
+export async function checkSkeletonDecision(content, rec, laneRoot, opts) {
+    if (rec.final.backend !== 'rap')
+        return null;
+    const phases = content.phases.filter((p) => !!skeletonOf(p));
+    if (phases.length === 0) {
+        // Fix round 1 — keyed on CLI-owned state only (`creating`, from the prior
+        // envelope), never on the model-written project.mode.
+        return opts.creating ? SKELETON_PHASE_MISSING : null;
+    }
+    if (phases.length > 1) {
+        return SKELETON_TWO_PHASES;
+    }
+    const phase = phases[0];
+    const work = phase.work;
+    const d = work.skeleton.decision;
+    // Fix round 1 — the plan must cite the decision rap_skeleton_resolve wrote
+    // last in this session (not an older sha-valid file, e.g. from before an
+    // owner override). No session decision (a later session): any sha-valid file.
+    if (opts.latest) {
+        const cited = String(d?.path ?? '').replace(/\\/g, '/');
+        if (cited !== opts.latest.path || String(d?.sha256 ?? '') !== opts.latest.sha256)
+            return SKELETON_DECISION_STALE;
+    }
+    const read = await readSkeletonDecision(laneRoot, String(d?.path ?? ''), String(d?.sha256 ?? ''));
+    if (!read.ok)
+        return read.message;
+    const decided = read.rec.decision.by;
+    if (work.skeleton.by !== decided) {
+        return SKELETON_BUILDER_DIFFERS;
+    }
+    if (decided === 'sap-generator') {
+        const norm = (list) => (Array.isArray(list) ? list : [])
+            .map(toPlannedObject).filter((o) => !!o).map(key);
+        const planned = new Set(norm(work.plannedObjects));
+        const wanted = new Set(norm(read.rec.objects));
+        const missing = [...wanted].find((k) => !planned.has(k));
+        const extra = [...planned].find((k) => !wanted.has(k));
+        if (missing || extra) {
+            const shown = (k) => cardLine(k.split(' ').slice(0, 2).join(' '));
+            return "This plan's skeleton step does not list exactly the objects SAP's generator will create. "
+                + `${missing ? `Missing: ${shown(missing)}. ` : ''}${extra ? `Not created by the generator: ${shown(extra)}. ` : ''}Run /abap-plan again.`;
+        }
+    }
+    return null;
+}
+/** JSON with object keys sorted, so a re-ordered but equal skeleton compares equal. */
+function stable(v) {
+    if (Array.isArray(v))
+        return `[${v.map(stable).join(',')}]`;
+    if (v && typeof v === 'object') {
+        const o = v;
+        return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${stable(o[k])}`).join(',')}}`;
+    }
+    return JSON.stringify(v) ?? 'null';
+}
+const skeletonMap = (c) => stable(c.phases.filter((p) => !!skeletonOf(p)).map((p) => [p.id, skeletonOf(p)]));
+/**
+ * Resume write-back guard: every phase's `work.skeleton` must be exactly as it
+ * was (none changed, dropped or added). A plan with no skeleton that stays
+ * without one is untouched (older plans resume unchanged). Returns the plain
+ * refusal, or null.
+ */
+export function skeletonWriteBackConflict(prior, next) {
+    return skeletonMap(prior) === skeletonMap(next) ? null : SKELETON_CHANGED_ON_RESUME;
+}

package/dist/projects/save-command.js

@@ -22,6 +22,8 @@ import { resolveProjectFolderSync, ensureProjectId } from './project-folder.js';
 import { askYesNo, isYes } from './yes-no.js';
 import { checkLaneConsistency, checkRequiredDeploy, LANE_CHANGED_AT_CREATE, readPlanLane } from './plan-lane.js';
 import { specGapRefForSave } from './plan-sources.js';
+import { checkSkeletonDecision, hasSkeletonPhase } from './plan-skeleton.js';
+import { laneRootFor } from '../lane/roots.js';
 const SKILL_REGISTRY = {
     'abap-spec-gap': {
         artefactType: 'spec-gap',
@@ -369,6 +371,21 @@ export async function runSaveCommand(args) {
             args.log('[save] The plan was not saved.');
             return null;
         }
+        // RAP generator plan, Task 8 — a RAP plan holds to the CLI's skeleton
+        // decision. The file was written under laneRootFor(cwd) by
+        // rap_skeleton_resolve, so it is read from the same root here. A new plan
+        // (or a revision of one that already carried a skeleton) must have it; a
+        // revision of an older plan without one saves as before (spec §8).
+        const skel = await checkSkeletonDecision(planExtract.content, lr.rec, await laneRootFor(args.lane?.cwd ?? args.cwd), {
+            creating: !prior || (priorContent !== undefined && hasSkeletonPhase(priorContent)),
+            ...(args.latestSkeleton ? { latest: args.latestSkeleton } : {}),
+        });
+        if (skel) {
+            args.log('');
+            args.log(`[save] ${skel}`);
+            args.log('[save] The plan was not saved.');
+            return null;
+        }
     }
     // C1 review fix — name the revision target BEFORE the confirm so the user
     // knows what a 'y' will do. Log line only, deliberately NOT a second

package/dist/rap/finish-checks.js

@@ -0,0 +1,389 @@
+// cspeach-cli/src/rap/finish-checks.ts
+//
+// RAP generator plan, Task 10 — Finish items F1–F5 (spec 2026-10-14 §6),
+// checked mechanically on the app's sources so the model cannot claim them
+// done. Pure: the tool `rap_finish_check` reads the live sources and calls
+// checkFinish. SAP's real generated skeleton is the failing fixture.
+//
+// Problem texts are short, plain sentences a developer understands; the only
+// ids in them are object and field names.
+//
+// Fix round 1: comments (`//`, `--`, `/* */`) are stripped from the BDEF, CDS,
+// DDLX and table sources before any rule reads them, so commented-out code never
+// passes a check. A view field the parser cannot read is a problem, never a
+// silent skip.
+export const FINISH_TITLES = {
+    F1: 'Authorization',
+    F2: 'Access control',
+    F3: 'Admin fields',
+    F4: 'Labels',
+    F5: 'Coded fields',
+};
+const ADMIN_FIELDS = ['CreatedBy', 'CreatedAt', 'LastChangedBy', 'LastChangedAt', 'LocalLastChangedAt', 'LocalLastChangedBy'];
+const item = (id, problems) => ({ id, ok: problems.length === 0, problems });
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const eqi = (a, b) => a.toLowerCase() === b.toLowerCase();
+const unreadable = (line, object) => `Could not read the field on line ${line} of ${object}; check it by hand`;
+/**
+ * CDS / BDEF source without comments: `// …` and `-- …` to end of line, and
+ * `/* … *\/` blocks. Quoted literals ('…') are kept as they are. Line breaks
+ * inside a block comment are kept, so line numbers do not move.
+ */
+export function stripCdsComments(src) {
+    let out = '';
+    let i = 0;
+    const n = src.length;
+    while (i < n) {
+        const c = src[i];
+        const d = src[i + 1];
+        if (c === "'") {
+            const j = src.indexOf("'", i + 1);
+            const e = j < 0 ? n : j + 1;
+            out += src.slice(i, e);
+            i = e;
+        }
+        else if ((c === '/' && d === '/') || (c === '-' && d === '-')) {
+            while (i < n && src[i] !== '\n' && src[i] !== '\r')
+                i++;
+        }
+        else if (c === '/' && d === '*') {
+            const j = src.indexOf('*/', i + 2);
+            const e = j < 0 ? n : j + 2;
+            out += src.slice(i, e).replace(/[^\r\n]/g, '');
+            i = e;
+        }
+        else {
+            out += c;
+            i++;
+        }
+    }
+    return out;
+}
+/** Annotation lines directly above line index `i` of `lines`, joined. */
+function annotationsAt(lines, i) {
+    const ann = [];
+    let depth = 0;
+    for (let j = i - 1; j >= 0; j--) {
+        const t = lines[j].trim();
+        depth += (t.match(/[\]}]/g)?.length ?? 0) - (t.match(/[[{]/g)?.length ?? 0);
+        if (t === '' && depth <= 0)
+            break;
+        if (depth <= 0 && !t.startsWith('@') && !/^[\]}]/.test(t))
+            break;
+        ann.unshift(t);
+    }
+    return ann.join('\n');
+}
+/** Annotation lines that sit directly above `element` (DDLS or DDLX), joined. Comments are ignored. */
+export function annotationsFor(source, element) {
+    const lines = stripCdsComments(source).split(/\r?\n/);
+    const re = new RegExp(`^\\s*(key\\s+)?([a-z0-9_.]+\\s+as\\s+)?${escapeRe(element)}\\s*[,;]?\\s*$`, 'i');
+    const i = lines.findIndex((l) => re.test(l));
+    return i < 0 ? '' : annotationsAt(lines, i);
+}
+/** Splits an annotation block into single annotations (each starts with '@'). */
+function splitAnnotations(block) {
+    const out = [];
+    for (const line of block.split('\n')) {
+        if (line.startsWith('@') || out.length === 0)
+            out.push(line);
+        else
+            out[out.length - 1] += `\n${line}`;
+    }
+    return out.filter((a) => a.trim() !== '');
+}
+/**
+ * Field labels in an annotation block. Left out: @UI.facet (a section title)
+ * and lineItem/identification entries of `type: #FOR_ACTION` (an action button).
+ */
+function fieldLabels(block) {
+    const labels = [];
+    for (const a of splitAnnotations(block)) {
+        if (/^@UI\.facet\b/i.test(a))
+            continue;
+        const fieldOnly = a.replace(/\{[^{}]*#FOR_ACTION\b[^{}]*\}/gi, '');
+        for (const m of fieldOnly.matchAll(/\blabel\s*:\s*'([^']*)'/gi))
+            labels.push(m[1]);
+    }
+    return labels;
+}
+/**
+ * Fields of a view entity body. Handles `key X`, `X`, `x as X`, `path.x as X`,
+ * `virtual X : …`, and expressions ending in `as X` (`cast( … ) as X`, a
+ * `case … end as X` over several lines). Association exposures (`_Assoc`,
+ * `_Assoc : redirected to …`) are skipped. Anything else, and two fields on
+ * one line, is reported in `unreadable`; it is never skipped silently.
+ */
+export function ddlsElements(source) {
+    const text = stripCdsComments(source);
+    const lines = text.split(/\r?\n/);
+    const def = text.search(/\bdefine\b/i);
+    const open = text.indexOf('{', def < 0 ? 0 : def);
+    const close = text.lastIndexOf('}');
+    if (open < 0 || close <= open)
+        return { elements: [], unreadable: [] };
+    const lineOf = (pos) => text.slice(0, pos).match(/\n/g)?.length ?? 0;
+    const colOf = (pos) => pos - (text.lastIndexOf('\n', pos - 1) + 1);
+    const openLine = lineOf(open);
+    const closeLine = lineOf(close);
+    const body = [];
+    for (let k = openLine; k <= closeLine; k++) {
+        const l = lines[k];
+        const from = k === openLine ? colOf(open) + 1 : 0;
+        const to = k === closeLine ? colOf(close) : l.length;
+        body.push(l.slice(from, to));
+    }
+    // Blank the annotations (they may span lines and contain commas).
+    let depth = 0;
+    for (let k = 0; k < body.length; k++) {
+        const t = body[k].trim();
+        if (depth > 0 || t.startsWith('@')) {
+            const bare = t.replace(/'[^']*'/g, '');
+            depth = Math.max(0, depth + (bare.match(/[[{(]/g)?.length ?? 0) - (bare.match(/[\]})]/g)?.length ?? 0));
+            body[k] = '';
+        }
+    }
+    const chunks = [];
+    let cur = '';
+    let first = -1;
+    let last = -1;
+    let nest = 0;
+    let inQuote = false;
+    const flush = () => {
+        if (cur.trim() !== '')
+            chunks.push({ text: cur, first, last });
+        cur = '';
+        first = -1;
+        last = -1;
+    };
+    for (let k = 0; k < body.length; k++) {
+        for (const ch of `${body[k]}\n`) {
+            if (!/\s/.test(ch)) {
+                if (first < 0)
+                    first = k;
+                last = k;
+            }
+            if (inQuote) {
+                if (ch === "'")
+                    inQuote = false;
+                cur += ch;
+                continue;
+            }
+            if (ch === "'")
+                inQuote = true;
+            else if ('([{'.includes(ch))
+                nest++;
+            else if (')]}'.includes(ch))
+                nest--;
+            else if (ch === ',' && nest === 0) {
+                flush();
+                continue;
+            }
+            cur += ch;
+        }
+    }
+    flush();
+    const usage = new Map();
+    for (const c of chunks)
+        for (let k = c.first; k <= c.last; k++)
+            usage.set(k, (usage.get(k) ?? 0) + 1);
+    const bad = new Set();
+    const elements = [];
+    for (const c of chunks) {
+        const line = openLine + c.first;
+        const shared = [...Array(c.last - c.first + 1).keys()].map((d) => c.first + d).find((k) => (usage.get(k) ?? 0) > 1);
+        if (shared !== undefined) {
+            bad.add(openLine + shared + 1);
+            continue;
+        }
+        const s = c.text.replace(/\s+/g, ' ').trim();
+        if (/^_\w+(\s*:.*)?$/.test(s))
+            continue;
+        const virt = /^(?:key\s+)?virtual\s+([A-Za-z_]\w*)\s*:/i.exec(s);
+        if (virt) {
+            elements.push({ name: virt[1], line });
+            continue;
+        }
+        const m = /^(?:key\s+)?(?:(.+?)\s+as\s+)?([A-Za-z_]\w*)$/i.exec(s);
+        if (!m) {
+            bad.add(line + 1);
+            continue;
+        }
+        elements.push(m[1] && /^[\w.]+$/.test(m[1]) ? { name: m[2], source: m[1], line } : { name: m[2], line });
+    }
+    return { elements, unreadable: [...bad].sort((x, y) => x - y) };
+}
+/** ABAP source without comment lines (`*` in column 1) and end-of-line `"` comments. */
+function stripAbapComments(src) {
+    return src.split(/\r?\n/).filter((l) => !l.startsWith('*')).map((l) => l.replace(/".*$/, '')).join('\n');
+}
+/** F1 — instance authorization with a real AUTHORITY-CHECK. Expects comment-free BDEF. */
+function checkAuth(src, opts) {
+    const problems = [];
+    if (!/authorization\s+master\s*\(\s*instance\s*\)/i.test(src.rootBdef)) {
+        problems.push(/authorization\s+master\s*\(\s*global\s*\)/i.test(src.rootBdef)
+            ? 'Authorization is global; it must be instance'
+            : `${opts.root} has no instance authorization; add authorization master ( instance )`);
+    }
+    const code = stripAbapComments(src.ccimp);
+    const start = /\bMETHOD\s+get_instance_authorizations\s*\./i.exec(code);
+    if (!start) {
+        problems.push('get_instance_authorizations is not implemented');
+        return item('F1', problems);
+    }
+    const rest = code.slice(start.index + start[0].length);
+    const end = /\bENDMETHOD\b/i.exec(rest);
+    const body = end ? rest.slice(0, end.index) : rest;
+    if (!/\bAUTHORITY-CHECK\b/i.test(body)) {
+        problems.push('get_instance_authorizations has no AUTHORITY-CHECK');
+    }
+    else if (opts.authObject && !new RegExp(`\\bOBJECT\\s+'${escapeRe(opts.authObject)}'`, 'i').test(body)) {
+        problems.push(`get_instance_authorizations does not check ${opts.authObject}`);
+    }
+    return item('F1', problems);
+}
+/** F2 — an access control for the root view and for the projection. */
+function checkDcl(src, opts) {
+    const have = new Set(src.dclsNames.map((n) => n.toUpperCase()));
+    const problems = [opts.root, opts.projection]
+        .filter((n) => !have.has(n.toUpperCase()))
+        .map((n) => `No access control for ${n}`);
+    return item('F2', problems);
+}
+const ABP_ADMIN_TYPE = /^abp_(?:creation_(?:user|tstmpl)|lastchange_(?:user|tstmpl)|locinst_\w+)$/i;
+/** Columns of a `define table` source typed with an abp_* admin type (lower-case names). */
+function abpAdminColumns(table) {
+    if (!table)
+        return [];
+    const cols = [];
+    for (const m of table.matchAll(/^\s*(?:key\s+)?([A-Za-z_]\w*)\s*:\s*([A-Za-z_]\w*)/gim)) {
+        if (ABP_ADMIN_TYPE.test(m[2]))
+            cols.push(m[1].toLowerCase());
+    }
+    return cols;
+}
+/** F3 — admin fields read-only; a UUID key uses managed numbering. Expects comment-free sources. */
+function checkAdminReadOnly(src, opts) {
+    const root = ddlsElements(src.rootDdls);
+    const problems = root.unreadable.map((l) => unreadable(l, opts.root));
+    const readonly = new Set();
+    for (const m of src.rootBdef.matchAll(/field\s*\(\s*readonly\s*\)\s*([^;]+);/gi)) {
+        for (const f of m[1].split(','))
+            readonly.add(f.trim().toLowerCase());
+    }
+    const names = new Set(root.elements.map((e) => e.name.toLowerCase()));
+    // Final review M7 — with the table source, the admin fields are also the
+    // columns typed abp_* (creation/lastchange user + timestamp, locinst_*),
+    // under whatever alias the root view gives them. The fixed names stay the fallback.
+    const admin = ADMIN_FIELDS.filter((f) => names.has(f.toLowerCase()));
+    for (const col of abpAdminColumns(src.table)) {
+        const el = root.elements.find((e) => e.source !== undefined && e.source.split('.').pop().toLowerCase() === col);
+        if (el && !admin.some((f) => f.toLowerCase() === el.name.toLowerCase()))
+            admin.push(el.name);
+    }
+    for (const f of admin) {
+        if (!readonly.has(f.toLowerCase()))
+            problems.push(`${f} can be edited; make it read-only`);
+    }
+    const uuidKey = src.table ? /\bkey\s+(\w+)\s*:\s*sysuuid_x16\b/i.exec(src.table) : null;
+    if (uuidKey && !/numbering\s*:\s*managed/i.test(src.rootBdef)) {
+        problems.push(`The key ${uuidKey[1]} is a UUID; add numbering : managed`);
+    }
+    return item('F3', problems);
+}
+/** F4 — every visible field has a real label; the app title is a business name. Expects comment-free sources. */
+function checkLabels(src, opts) {
+    if (src.ddlx === undefined)
+        return item('F4', [`No metadata extension for ${opts.projection}`]);
+    const ddlx = src.ddlx;
+    const proj = ddlsElements(src.projectionDdls);
+    const root = ddlsElements(src.rootDdls).elements;
+    const projLines = src.projectionDdls.split(/\r?\n/);
+    const rootLines = src.rootDdls.split(/\r?\n/);
+    const problems = proj.unreadable.map((l) => unreadable(l, opts.projection));
+    let emptyAttributed = 0;
+    for (const el of proj.elements) {
+        const xBlock = annotationsFor(ddlx, el.name);
+        const pBlock = annotationsAt(projLines, el.line);
+        const rootEl = root.find((r) => eqi(r.name, el.source ?? el.name));
+        const rBlock = rootEl ? annotationsAt(rootLines, rootEl.line) : '';
+        const xLabels = fieldLabels(xBlock);
+        const empties = xLabels.filter((l) => l.trim() === '').length;
+        emptyAttributed += empties;
+        if (empties > 0)
+            problems.push(`${el.name} has an empty label`);
+        if (xLabels.some((l) => l.length > 8 && !/\s/.test(l) && eqi(l, el.name))) {
+            problems.push(`${el.name} label is just the field name`);
+        }
+        const hidden = /@UI\.hidden\s*:\s*true\b/i.test(`${xBlock}\n${pBlock}`);
+        const endUser = (b) => [...b.matchAll(/@EndUserText\.label\s*:\s*'([^']*)'/gi)].map((m) => m[1]);
+        const all = [...xLabels, ...endUser(pBlock), ...endUser(rBlock)];
+        if (!hidden && empties === 0 && !all.some((l) => l.trim() !== ''))
+            problems.push(`${el.name} has no label`);
+    }
+    const emptyTotal = [...ddlx.matchAll(/\blabel\s*:\s*''/gi)].length;
+    if (emptyTotal > emptyAttributed)
+        problems.push('A section of the metadata extension has an empty label');
+    const header = `${ddlx}\n${src.projectionDdls}`;
+    const typeName = /\btypeName\s*:\s*'([^']*)'/i.exec(header)?.[1]?.trim();
+    const plural = /\btypeNamePlural\s*:\s*'([^']*)'/i.exec(header)?.[1]?.trim();
+    if (!typeName)
+        problems.push('The app has no title (headerInfo typeName)');
+    else if (eqi(typeName, opts.entity))
+        problems.push(`The app title is ${typeName}; use the business name`);
+    if (!plural)
+        problems.push('The app has no plural title (headerInfo typeNamePlural)');
+    else if (eqi(plural, opts.entity) || eqi(plural, `${opts.entity}s`)) {
+        problems.push(`The plural app title is ${plural}; use the business name`);
+    }
+    return item('F4', problems);
+}
+/**
+ * F5 — coded fields show a value help and their text, not the raw code. The
+ * text element must be a field of the projection (a path starting with `_` is
+ * accepted), or the field uses @ObjectModel.text.association. Expects comment-free sources.
+ */
+function checkCodedFields(src, opts) {
+    const problems = [];
+    const elements = ddlsElements(src.projectionDdls).elements;
+    const projLines = src.projectionDdls.split(/\r?\n/);
+    for (const f of opts.codedFields ?? []) {
+        const el = elements.find((e) => eqi(e.name, f));
+        if (!el) {
+            problems.push(`${f} is not in ${opts.projection}`);
+            continue;
+        }
+        const ann = `${annotationsAt(projLines, el.line)}\n${src.ddlx ? annotationsFor(src.ddlx, el.name) : ''}`;
+        if (!/@Consumption\.valueHelpDefinition\b/i.test(ann))
+            problems.push(`${f} has no value help`);
+        if (!/@ObjectModel\.text\.association\b/i.test(ann)) {
+            const te = /@ObjectModel\.text\.element\s*:\s*\[\s*'([^']+)'/i.exec(ann)?.[1]?.trim();
+            if (!te)
+                problems.push(`${f} has no text`);
+            else if (!te.startsWith('_') && !elements.some((e) => eqi(e.name, te))) {
+                problems.push(`${f} shows text ${te}, which is not in ${opts.projection}`);
+            }
+        }
+        if (!/#TEXT_ONLY\b/i.test(ann))
+            problems.push(`${f} does not show its text (#TEXT_ONLY)`);
+    }
+    return item('F5', problems);
+}
+/** F1–F5, always five items, in order. Comments are stripped first. */
+export function checkFinish(src, opts) {
+    const clean = {
+        ...src,
+        rootDdls: stripCdsComments(src.rootDdls),
+        projectionDdls: stripCdsComments(src.projectionDdls),
+        rootBdef: stripCdsComments(src.rootBdef),
+        ...(src.ddlx !== undefined ? { ddlx: stripCdsComments(src.ddlx) } : {}),
+        ...(src.table !== undefined ? { table: stripCdsComments(src.table) } : {}),
+    };
+    return [
+        checkAuth(clean, opts),
+        checkDcl(clean, opts),
+        checkAdminReadOnly(clean, opts),
+        checkLabels(clean, opts),
+        checkCodedFields(clean, opts),
+    ];
+}