@formicoidea/labre-core 0.32.0 → 0.34.1

package/dist/_pkgs/affine-block-surface/extensions/validation.js

@@ -2,7 +2,9 @@ import { createIdentifier } from '../../global/di/index.js';
 import { Bound, lineIntersects } from '../../global/gfx/index.js';
 import { GfxGroupLikeElementModel, GfxPrimitiveElementModel, InteractivityExtension, roleIsA, } from '../../std/gfx/index.js';
 import { effect, signal } from '@preact/signals-core';
+import { backgroundPlot } from '../framework-background/def.js';
 import { backgroundAxisFact, backgroundTransitionBands, backgroundTransitionVisibleProps, } from '../framework-background/facts.js';
+import { backgroundInVariant } from '../framework-background/labels.js';
 import { Overlay, OverlayIdentifier } from '../renderer/overlay.js';
 import { QualityNudgeIdentifier } from './map-quality.js';
 import { ViolationTimeline } from './violation-timeline.js';
@@ -62,7 +64,8 @@ function resolveProfile(rule, chosenId, index) {
     return index.defaults.get(rule.framework);
 }
 /**
- * The profile id each role-carrying element names, in one pass.
+ * The profile id each role-carrying element names, in one pass — then the same
+ * for the ones that name none but SIT INSIDE one that does.
  *
  * Role-carrying only: a profile is a decision about a framework's background,
  * and a neutral element cannot be one. That keeps the pass on exactly the same
@@ -70,17 +73,98 @@ function resolveProfile(rule, chosenId, index) {
  */
 function readChosenProfiles(elements) {
     const chosen = new Map();
+    const roleCarrying = [];
     for (const el of elements) {
         if (el.role === undefined)
             continue;
+        roleCarrying.push(el);
         const id = el.validationProfile;
         // Whatever a peer wrote: a client that got it wrong must not break
         // evaluation on this one.
         if (typeof id === 'string')
             chosen.set(el.id, id);
     }
+    // Nobody chose anything => no inheritance to compute, and not one bound read
+    // on the whole surface. The overwhelmingly common case: choosing the default
+    // profile back WRITES NOTHING (`setProfile` clears the field), so `chosen` is
+    // empty on every document whose author never left the default.
+    if (chosen.size > 0)
+        inheritChosenProfiles(roleCarrying, chosen);
     return chosen;
 }
+/**
+ * A frame that named no profile inherits the one chosen on the frame it is
+ * DRAWN INSIDE — the innermost of them.
+ *
+ * ## The question this answers
+ *
+ * A profile is chosen per root instance (PF9.1), and a finding is judged by the
+ * profile of the instance it is ATTRIBUTED to ({@link applyProfiles}). Those two
+ * sentences only describe the same element while every attribution target is
+ * something the author can reach a picker on. They stop describing the same
+ * element the moment a framework frames a question against an INNER frame — a
+ * C4 boundary, a BPMN lane — and the picker is offered on the outer one alone,
+ * which is the arbitration C4's recette settled (PO, 28/08/2026: the board
+ * arbitrates the checklist, the boundary does not). Without this, raising a
+ * board to its review level would harden the eleven rules framed against the
+ * board and silently leave the two framed against a boundary at the default
+ * for ever.
+ *
+ * Inheritance is the general form of that fix and carries no framework name: an
+ * instance with no choice of its own is governed by the choice made on the
+ * frame it sits in, which is what a reader looking at the two nested rectangles
+ * already assumes. An instance that DOES name a profile keeps it — a nested
+ * frame can still be arbitrated separately the day a framework offers a picker
+ * on one.
+ *
+ * ## The arithmetic
+ *
+ * Centre-in-frame, innermost first, ties to the smaller id — the same reading
+ * {@link plotContaining}, the audit and the C4 export use to answer "which frame
+ * is this drawn on", so a board can never read two different answers to that
+ * question. The element BOX rather than the plot: a plot needs the frame's
+ * geometry declaration, which is a per-RULE datum, and this map is built once
+ * for every rule at once. The margin only matters to an artefact lying on a
+ * title band, and inheriting a level of requirement there is harmless where
+ * counting it as a member would not be.
+ *
+ * Cross-framework nesting resolves itself downstream and needs no test here:
+ * {@link resolveProfile} ignores a profile id belonging to another framework, so
+ * a frame that inherits a foreign one falls back to its own framework's default
+ * — exactly what it got before inheriting anything.
+ */
+function inheritChosenProfiles(elements, chosen) {
+    const frames = elements
+        .filter(el => chosen.has(el.id))
+        .map(el => ({ id: el.id, bound: el.elementBound }));
+    // Read off the map BEFORE writing to it: an inherited id must never be
+    // inherited on again, or a chain of frames would depend on the walk order.
+    const inherited = [];
+    for (const el of elements) {
+        if (chosen.has(el.id))
+            continue;
+        const centre = el.elementBound.center;
+        let inner = null;
+        for (const frame of frames) {
+            if (!frame.bound.containsPoint(centre))
+                continue;
+            if (inner === null ||
+                isInside(frame.bound, inner.bound, frame.id, inner.id)) {
+                inner = frame;
+            }
+        }
+        if (inner !== null)
+            inherited.push([el.id, chosen.get(inner.id)]);
+    }
+    for (const [id, profileId] of inherited)
+        chosen.set(id, profileId);
+}
+/** Whether `a` is the tighter frame of the two — smaller area, then smaller id. */
+function isInside(a, b, aId, bId) {
+    const areaA = a.w * a.h;
+    const areaB = b.w * b.h;
+    return areaA === areaB ? aId < bId : areaA < areaB;
+}
 /**
  * Whether `rule` is `'off'` under EVERY profile in play on this surface — in
  * which case it is not evaluated at all, which is what `'off'` is for.
@@ -207,14 +291,24 @@ export function backgroundElementIds(rules, elements) {
  * Same question `evaluateElementInBackground` answers inline, asked by the
  * families whose subjects normally ARE on the map — an inertia bar, an arrow, a
  * pair of overlapping labels. Ties go to the smaller id so a persisted
- * arbitration never depends on the order a `Y.Map` was rebuilt in.
+ * arbitration never depends on the order a `Y.Map` was rebuilt in — on BOTH
+ * halves of the question: a small chart dropped on a big one contains the same
+ * artefact twice, and returning whichever of the two the walk met first would
+ * have made the promise above true only of the near miss. Same walk and same
+ * tie-break as {@link containingBackground}, which asks the containment half
+ * alone.
  */
 function attributeBackground(bound, backgrounds) {
+    let containing = null;
     let nearest = null;
     let nearestDistance = Infinity;
     for (const background of backgrounds) {
-        if (background.bound.contains(bound))
-            return background;
+        if (background.bound.contains(bound)) {
+            if (containing === null || background.id < containing.id) {
+                containing = background;
+            }
+            continue;
+        }
         const distance = gapSquared(background.bound, bound);
         if (distance < nearestDistance ||
             (distance === nearestDistance &&
@@ -224,7 +318,116 @@ function attributeBackground(bound, backgrounds) {
             nearest = background;
         }
     }
-    return nearest;
+    return containing ?? nearest;
+}
+/**
+ * The PLOT of one instance, in model coordinates — the element box minus the
+ * declared margin, i.e. the region the frame actually draws its content in.
+ *
+ * A rule that carries no {@link ValidationRule.background} declaration has no
+ * margin to subtract and the whole element box is its plot. That is the honest
+ * answer rather than a refusal: `backgroundRole` alone is a complete declaration
+ * for a family that only needs to know WHICH frame something is on, and
+ * demanding a geometry declaration to count elements inside a box would be
+ * asking a framework to declare axes its rule never reads (the same argument
+ * `relation-endpoints` makes about its own optional frame).
+ *
+ * ## The degenerate plot
+ *
+ * `backgroundPlot` subtracts the declared margins with no guard, so a frame
+ * dragged narrower than `margin.left + margin.right` yields a NEGATIVE extent —
+ * and a `Bound` of negative width contains no point at all, anywhere. Left
+ * alone, a membership family would then tally zero for a frame the user can see
+ * holding something, and a `min` rule would answer "this frame holds none" while
+ * pointing at one that visibly does. A false accusation whose only remedy —
+ * widen the frame — is nowhere in the sentence.
+ *
+ * So a plot that has collapsed falls back to the element box: the same answer
+ * this function already gives a rule that declares no geometry at all, and the
+ * one reading under which the artefact the user is looking at still counts.
+ * Silence would be defensible too; being wrong in the accusing direction is not.
+ */
+function plotOf(def, frame) {
+    const bound = frame.bound;
+    if (def === undefined)
+        return bound;
+    const plot = backgroundPlot(def, bound.w, bound.h);
+    if (!(plot.width > 0) || !(plot.height > 0))
+        return bound;
+    return new Bound(bound.x + plot.x0, bound.y + plot.y0, plot.width, plot.height);
+}
+/**
+ * The instance an element BELONGS TO: the one whose plot contains its centre,
+ * and nothing else.
+ *
+ * ## The deliberate divergence from {@link attributeBackground}
+ *
+ * `attributeBackground` answers "which map is this finding about", and falls
+ * back to the NEAREST frame when none contains the subject — which is right for
+ * a finding that has already been raised and needs somewhere to be waived.
+ *
+ * This answers a different question: "is this artefact IN that frame". A
+ * nearest-fallback here would be a bug with a plausible face — a start event
+ * floating just outside a pool would satisfy "this pool has a start event", and
+ * a sequence flow from inside the pool to that floating task would read as
+ * staying inside it. Membership has to mean membership, or the two families
+ * built on it certify drawings that show the opposite of what they claim.
+ *
+ * The CENTRE, and the plot rather than the element box: the centre is where the
+ * eye puts an artefact (the reading {@link ElementInZoneDef.measure} already
+ * defaults to) and the plot is the region the frame draws in, so an artefact
+ * lying on the pool's own title band is not counted as being in the pool. Same
+ * resolution the audit uses to place an element, so a board never reads two
+ * different answers to "which frame is this on".
+ *
+ * Ties go to the smaller id, never to the order a `Y.Map` was rebuilt in — the
+ * invariant every attribution in this file holds, and it matters here for the
+ * same reason: the answer decides which frame a persisted arbitration is
+ * written on.
+ */
+function plotContaining(centre, frames) {
+    let found = null;
+    for (const frame of frames) {
+        if (!frame.plot.containsPoint(centre))
+            continue;
+        if (found === null || frame.instance.id < found.id)
+            found = frame.instance;
+    }
+    return found;
+}
+/**
+ * Every instance of the rule's frame, each with its plot resolved once.
+ *
+ * A board carries units of frames and hundreds of subjects, so the margin
+ * arithmetic is done per FRAME and never per subject.
+ */
+function framePlots(rule, elements) {
+    return backgroundsOf(rule, elements).map(instance => ({
+        instance,
+        plot: plotOf(rule.background, instance),
+    }));
+}
+/**
+ * Whether a rule whose whole question is asked ABOUT a frame forgot to name one
+ * — and, if so, says so once.
+ *
+ * `backgroundsOf` answers `[]` both for "this rule names no frame role" and for
+ * "this board carries no such frame", and the second is a legitimate silence
+ * every family in this file honours: a sketch drawn before the frame is a
+ * sketch. The first is a typo in the data, and left undistinguished it produces
+ * a rule that never fires and never says why — the failure the missing-bound
+ * warnings a few lines below exist to prevent, under a comment saying it is the
+ * worst thing declarative data can do.
+ *
+ * The two are distinguishable statically, so they are distinguished here, before
+ * a single element is walked.
+ */
+function missingFrameRole(rule, family) {
+    if (rule.backgroundRole !== undefined)
+        return false;
+    warnOnce(`${family} rule "${rule.id}" names no frame role, and its whole question ` +
+        `is asked about a frame — the rule is not evaluated.`);
+    return true;
 }
 /**
  * Build the finding of `rule` against `elementIds`. One place, so every family
@@ -357,7 +560,8 @@ function cubicAt(p0, c0, c1, p1, t) {
 /** Anything but a rounding difference away from `p`. */
 function departsFrom(candidate, p) {
     return (isPoint(candidate) &&
-        (Math.abs(candidate[0] - p[0]) > 1e-6 || Math.abs(candidate[1] - p[1]) > 1e-6));
+        (Math.abs(candidate[0] - p[0]) > 1e-6 ||
+            Math.abs(candidate[1] - p[1]) > 1e-6));
 }
 /**
  * The POLYLINE a directional element exposes, in absolute model coordinates —
@@ -593,7 +797,8 @@ function evaluateAttachment(rule, elements) {
     for (const el of elements) {
         if (el.role === undefined)
             continue;
-        if (carrierRole !== undefined && roleIsA(el.role, carrierRole, rule.roles)) {
+        if (carrierRole !== undefined &&
+            roleIsA(el.role, carrierRole, rule.roles)) {
             const path = elementPath(el);
             if (path !== null)
                 carriers.push(path);
@@ -745,7 +950,8 @@ function subjectsCollide(a, b, minPenetration) {
     if (!boundsOverlap(a.bound, b.bound))
         return false;
     if (a.path === null && b.path === null) {
-        return (minPenetration <= 0 || boundsPenetration(a.bound, b.bound) > minPenetration);
+        return (minPenetration <= 0 ||
+            boundsPenetration(a.bound, b.bound) > minPenetration);
     }
     // Two paths: zero-width lines, so there is no depth to measure and a declared
     // crossing is reported as it always was.
@@ -755,7 +961,7 @@ function subjectsCollide(a, b, minPenetration) {
     const bound = a.path === null ? a.bound : b.bound;
     if (!pathHitsBound(path, bound))
         return false;
-    return (minPenetration <= 0 || pathPenetration(path, bound) > minPenetration);
+    return minPenetration <= 0 || pathPenetration(path, bound) > minPenetration;
 }
 /**
  * How far two overlapping boxes reach INTO each other: the smaller of the two
@@ -1421,7 +1627,8 @@ function evaluateMajorityFact(rule, elements) {
     return violations;
 }
 /**
- * The two ids a typed edge BINDS, or `null`.
+ * The two ids a typed edge points at, or `null` — the EXTRACTION alone, with no
+ * opinion on what the pair means.
  *
  * Duck-typed exactly like {@link elementPath}, and for the same reason: the
  * engine knows roles and geometry, and must not import a connector model. An
@@ -1431,19 +1638,31 @@ function evaluateMajorityFact(rule, elements) {
  * tool over empty canvas produces such an edge at any time, and a palette
  * sample of a stroke style is one by construction. An edge that relates nothing
  * is never evaluated.
+ *
+ * Whether a SELF-LOOP is one of the answers is a policy, and each family states
+ * its own on top of this: see {@link boundEnds} and {@link endpointIds}.
  */
-function boundEnds(el) {
+function rawEndpointIds(el) {
     const edge = el;
     const source = edge.source?.id;
     const target = edge.target?.id;
     if (typeof source !== 'string' || typeof target !== 'string')
         return null;
-    // A self-loop states nothing about an order: it is one element, compared with
-    // itself, and no move can ever resolve it.
-    if (source === target)
-        return null;
     return [source, target];
 }
+/**
+ * The two ids a typed edge BINDS, self-loops excluded.
+ *
+ * A self-loop states nothing about an ORDER: it is one element, compared with
+ * itself, and no move can ever resolve the finding — so the families that read
+ * a layout treat it exactly like an edge that relates nothing.
+ */
+function boundEnds(el) {
+    const ends = rawEndpointIds(el);
+    if (ends === null || ends[0] === ends[1])
+        return null;
+    return ends;
+}
 /**
  * "Are these two in the order their relation states?" — W4 (`docs/adr/0010`).
  *
@@ -1541,6 +1760,1296 @@ function evaluateRelativeOrder(rule, elements) {
     }
     return violations;
 }
+/**
+ * The two ids a typed edge points at, SELF-LOOP INCLUDED — the one difference
+ * with {@link boundEnds}, and the reason this family reads the raw pair.
+ *
+ * `boundEnds` answers `null` for an edge whose two ends are the same element,
+ * because an order rule genuinely has nothing to say about one: it would be
+ * comparing an element with itself and no move could ever resolve the finding.
+ * A GRAMMAR rule is the opposite case — a loop is a sentence about the same
+ * artefact twice, which is exactly what {@link RelationEndpointsDef.forbidSelfLoop}
+ * exists to arbitrate. Folding the loop into the null here would make that flag
+ * unreachable, silently.
+ */
+const endpointIds = rawEndpointIds;
+/**
+ * The roles the sanctioned sentences speak of — the ALPHABET of the rule. See
+ * {@link RelationEndpointsDef.allowed} for why an end outside it is silence.
+ */
+function endpointAlphabet(allowed) {
+    const roles = [];
+    for (const triplet of allowed) {
+        for (const role of [triplet.source, triplet.target]) {
+            if (!roles.includes(role))
+                roles.push(role);
+        }
+    }
+    return roles;
+}
+/**
+ * Whether `role` is one the rule's own framework DECLARES.
+ *
+ * The FALLBACK half of {@link RelationEndpointsDef.flagNeutral}'s vocabulary
+ * test — used on its own only by a rule that declares no matrix, and composed
+ * with the grammar's own alphabet when there is one (see the call site).
+ *
+ * A membership test on the vocabulary the rule already carries, and deliberately
+ * not a prefix match on the `framework:` half of the id: the namespace is a
+ * naming convention (`role.ts` types a role id as a bare string and says as
+ * much), while the vocabulary is data the framework hands the engine. Reading
+ * the data cannot be wrong about a framework that spells its own prefix
+ * differently — `ddd-context-map` roles are `context-map:` — and it keeps this
+ * file free of string surgery on ids it does not own.
+ *
+ * `roleIsA` against every declared role would give the same answer at a higher
+ * price: a role outside the vocabulary has no parent chain to walk here, since
+ * the walk reads `rule.roles`, so it can only ever match itself.
+ *
+ * `Object.hasOwn`, and never a bare index: `role` comes off a `Y.Map`, so it is
+ * whatever a peer or an importer wrote, and an element persisted with
+ * `role: 'toString'` would answer "declared" against a bag containing no such
+ * entry. The same threat model {@link elementExceptions} guards with its
+ * `Array.isArray`. Every other read of a role bag in this file goes through
+ * `roleIsA`, which writes `defs[current]?.parent` and terminates harmlessly on
+ * a prototype hit; this is the only place that tests for the PRESENCE of a key.
+ */
+function declaresRole(rule, role) {
+    return role !== undefined && Object.hasOwn(rule.roles, role);
+}
+/** The elements a finding names, deduplicated and sorted. */
+function namedElements(ids) {
+    return Array.from(new Set(ids)).sort();
+}
+/**
+ * "Does this relation say something the framework's grammar allows?"
+ *
+ * The second family whose subject is a RELATION, and the first that reads
+ * nothing but MEANING: no axis, no coordinate, no distance. For every element
+ * carrying the declared edge role it reads the persisted `source → target` pair
+ * and the roles at the two ends, and confronts the sentence with the ones the
+ * framework sanctions — an actor issues a command, a command lands on an
+ * aggregate. A relation drawn upside-down on a Wardley map is a layout mistake;
+ * a relation drawn between the wrong two artefacts is a modelling one, and no
+ * amount of dragging fixes it.
+ *
+ * ## What it stays silent about, and why each one matters
+ *
+ * - **an edge carrying no role, or another role** — proportionality (PRD
+ *   principle 8): a free connector is not a claim. Unless the rule declares
+ *   {@link RelationEndpointsDef.flagNeutral}, which asks for exactly one kind of
+ *   role-less link back: one drawn between two artefacts of this framework's own
+ *   vocabulary, i.e. a relation the user drew and the model does not contain;
+ * - **an edge with a free end** — it relates nothing;
+ * - **an end whose element is gone** — a dangling id says nothing about a model;
+ * - **an end OUTSIDE the alphabet of {@link RelationEndpointsDef.allowed}** —
+ *   the hard requirement of this family. A flow onto a hotspot, onto a neutral
+ *   shape, onto an artefact of another framework: the user is sketching, and a
+ *   grammar that indicted the sketch would be switched off within a day (see
+ *   {@link RelationEndpointsDef.allowed});
+ * - **a self-loop, unless the framework asked** — see
+ *   {@link RelationEndpointsDef.forbidSelfLoop}. Silence here is TOTAL: a loop
+ *   the framework tolerates is not then judged against the matrix, where it
+ *   would fail for a reason nobody meant.
+ *
+ * ## One finding per edge, at most
+ *
+ * An edge already indicted for the sentence it says is not indicted again for
+ * saying it twice: the duplicate and exclusivity passes only see relations that
+ * got through the matrix. Two badges on one link, for one gesture to fix, is
+ * pedantry the canvas cannot afford.
+ *
+ * ## The frame
+ *
+ * {@link ValidationRule.backgroundRole} is optional here and buys ATTRIBUTION
+ * only — the map a finding is written against, so the map-wide arbitration has
+ * somewhere to live (the `no-overlap` pattern). No background DECLARATION is
+ * required: this family reads no fact off the frame, and demanding one would be
+ * asking a framework to declare geometry its grammar never consults.
+ *
+ * ## Cost
+ *
+ * Linear in the elements plus linear in the EDGES: one indexing pass, one pass
+ * over the edges, then one pass over the node pairs that actually carry more
+ * than one relation — which on any real board is a handful. There is no
+ * pair-wise sweep over the nodes: the rule is about relations somebody drew,
+ * never about every couple that could have had one.
+ *
+ * An {@link IncrementalContext} is deliberately NOT honoured, exactly like
+ * `relative-order-along-axis`: a dirty set names the elements that moved, and
+ * this family's verdict does not depend on where anything is. Re-reading every
+ * edge is the cost of the linear pass it already was.
+ */
+function evaluateRelationEndpoints(rule, elements) {
+    const endpoints = rule.endpoints;
+    if (endpoints === undefined)
+        return [];
+    const byId = new Map();
+    const edges = [];
+    // Role-less connectors, kept only when the rule asked to hear about them —
+    // and only the ones that are connectors at all, which the persisted pair is
+    // the duck-typed proof of. A board is mostly neutral elements, and a rule
+    // declaring no `flagNeutral` must not allocate one entry per rectangle.
+    const neutral = [];
+    for (const el of elements) {
+        byId.set(el.id, el);
+        // Cheapest possible exit for a neutral element: no role, no evaluation…
+        if (el.role === undefined) {
+            // …unless the rule is precisely about the links that carry none.
+            if (endpoints.flagNeutral !== undefined && rawEndpointIds(el) !== null) {
+                neutral.push(el);
+            }
+            continue;
+        }
+        if (roleIsA(el.role, endpoints.edgeRole, rule.roles)) {
+            edges.push({ el, role: el.role });
+        }
+    }
+    if (edges.length === 0 && neutral.length === 0)
+        return [];
+    const backgrounds = backgroundsOf(rule, elements);
+    // An EMPTY matrix is a matrix that says nothing, which is the same claim as
+    // declaring none — the reading `allowed`'s own header gives it — so it is
+    // normalised to `undefined` here rather than left to mean an empty alphabet.
+    // Left as one it would silence the rule WHOLE, self-loops and duplicates
+    // included, since every end is outside an alphabet of no roles: exactly the
+    // opposite of what a framework that lists no sentence and forbids loops
+    // asked for. A matrix says nothing about the other three verdicts; it never
+    // switches them off.
+    const allowed = endpoints.allowed === undefined || endpoints.allowed.length === 0
+        ? undefined
+        : endpoints.allowed;
+    const alphabet = allowed === undefined ? null : endpointAlphabet(allowed);
+    // `roleIsA` walks a parent chain, and the two questions below ask it about
+    // the same handful of roles once per edge on the board — a Context Mapping
+    // board draws one vocabulary a hundred times over. Memoised for the duration
+    // of THIS pass and no longer: the precedent is `evaluateNoOverlap`, which
+    // precomputes each subject's slot memberships once instead of re-asking per
+    // couple.
+    const spoken = new Map();
+    const speaks = (role) => {
+        if (alphabet === null)
+            return true;
+        if (role === undefined)
+            return false;
+        const memo = spoken.get(role);
+        if (memo !== undefined)
+            return memo;
+        const answer = alphabet.some(known => roleIsA(role, known, rule.roles));
+        spoken.set(role, answer);
+        return answer;
+    };
+    // Keyed by the whole triplet of roles, joined by NUL — which no vocabulary
+    // contains — so no two sentences can ever fold into one answer.
+    const sanctioned = new Map();
+    const inMatrix = (edgeRole, sourceRole, targetRole) => {
+        const key = `${edgeRole}\u0000${sourceRole}\u0000${targetRole}`;
+        const memo = sanctioned.get(key);
+        if (memo !== undefined)
+            return memo;
+        const answer = allowed.some(triplet => roleIsA(edgeRole, triplet.edge, rule.roles) &&
+            roleIsA(sourceRole, triplet.source, rule.roles) &&
+            roleIsA(targetRole, triplet.target, rule.roles));
+        sanctioned.set(key, answer);
+        return answer;
+    };
+    const exclusivePairs = endpoints.exclusivePairs ?? [];
+    // Hoisted above the walk: the pair bookkeeping is a `DrawnRelation`, a sorted
+    // id list and a map entry PER EDGE, and a rule that judges sentences only
+    // would have allocated all three just to drop them. This runs on the gesture
+    // path, inside the 16 ms the drawing has.
+    const needsPairs = endpoints.forbidDuplicate === true || exclusivePairs.length > 0;
+    const violations = [];
+    // Every relation drawn between one UNORDERED pair of elements, which is the
+    // grain both the duplicate and the exclusivity questions are asked at. Filled
+    // in the same pass that judges the sentences, walked once afterwards.
+    const between = new Map();
+    for (const { el: edge, role } of edges) {
+        const ends = endpointIds(edge);
+        if (ends === null)
+            continue;
+        const [sourceId, targetId] = ends;
+        const source = byId.get(sourceId);
+        const target = byId.get(targetId);
+        if (source === undefined || target === undefined)
+            continue;
+        // Outside the grammar entirely: the user is sketching.
+        if (!speaks(source.role) || !speaks(target.role))
+            continue;
+        // A node, not the edge's own box: the box of a diagonal link spans both
+        // ends and would attribute a relation to whichever map its corner grazes.
+        const frameId = attributeBackground(source.elementBound, backgrounds)?.id;
+        if (sourceId === targetId) {
+            if (endpoints.forbidSelfLoop) {
+                violations.push(raise(rule, namedElements([edge.id, sourceId, targetId]), frameId, endpoints.selfLoop ?? rule));
+            }
+            continue;
+        }
+        if (allowed !== undefined && !inMatrix(role, source.role, target.role)) {
+            violations.push(raise(rule, namedElements([edge.id, sourceId, targetId]), frameId, endpoints.offMatrix ?? rule));
+            continue;
+        }
+        if (!needsPairs)
+            continue;
+        const key = sourceId < targetId
+            ? `${sourceId} ${targetId}`
+            : `${targetId} ${sourceId}`;
+        const drawn = between.get(key);
+        const relation = {
+            id: edge.id,
+            role,
+            sourceId,
+            targetId,
+            ids: namedElements([edge.id, sourceId, targetId]),
+            ...(frameId !== undefined ? { frameId } : {}),
+        };
+        if (drawn === undefined)
+            between.set(key, [relation]);
+        else
+            drawn.push(relation);
+    }
+    // Which roles a role-less link may be flagged BETWEEN.
+    //
+    // The rule's own ALPHABET when it declares a matrix — the roles its grammar
+    // actually has endpoints for, which is the tightest honest reading and gets
+    // `roleIsA` inheritance and the memo above for free. It also excludes, by
+    // construction and with nothing for an author to remember, the roles a
+    // framework declares for things that are not endpoints of anything: a
+    // background role, a legend glyph, a lane. Presuming somebody meant to draw a
+    // typed relation onto a POOL is exactly the over-firing this test exists to
+    // prevent.
+    //
+    // `speaks` cannot do the job alone, and the reason is worth stating: with no
+    // matrix it answers `true` for everything, `undefined` included, because
+    // "outside the alphabet" has no meaning when there is no alphabet. A
+    // matrix-less rule therefore falls back to membership in the vocabulary
+    // ({@link declaresRole}), which stays purely the dictionary `roleIsA` walks —
+    // the bag is NOT overloaded into a filter, so an author never has to shrink
+    // their inheritance dictionary in order to change what gets flagged.
+    const inVocabulary = (role) => alphabet === null ? declaresRole(rule, role) : speaks(role);
+    // The NEUTRAL pass: a link carrying no role at all, drawn between two
+    // artefacts this rule's grammar could have related. See
+    // {@link RelationEndpointsDef.flagNeutral} — the gesture that produces one is
+    // quick-connect, which stamps nothing, so the user has drawn a relation the
+    // model does not contain.
+    //
+    // The edge is judged on WHAT it joins and never against the matrix: the matrix
+    // says which sentences are legal, and this edge says no sentence at all. A
+    // self-loop is skipped for the same reason `boundEnds` skips one everywhere
+    // else — a link from an artefact to itself is not evidence that a typed
+    // relation was meant.
+    for (const el of neutral) {
+        const ends = boundEnds(el);
+        if (ends === null)
+            continue;
+        const [sourceId, targetId] = ends;
+        const source = byId.get(sourceId);
+        const target = byId.get(targetId);
+        if (source === undefined || target === undefined)
+            continue;
+        if (!inVocabulary(source.role) || !inVocabulary(target.role))
+            continue;
+        violations.push(raise(rule, namedElements([el.id, sourceId, targetId]), attributeBackground(source.elementBound, backgrounds)?.id, endpoints.flagNeutral));
+    }
+    if (!needsPairs)
+        return violations;
+    // Sorted, so a board holding several offending pairs always reports them the
+    // same way whichever order the surface happened to be walked in.
+    for (const key of [...between.keys()].sort()) {
+        const drawn = between.get(key);
+        if (drawn.length < 2)
+            continue;
+        // By edge id, so the relation that keeps its innocence is the same one on
+        // every peer and after every reload — never the one a Y.Map rebuild
+        // happened to yield first.
+        const relations = [...drawn].sort((a, b) => (a.id < b.id ? -1 : 1));
+        if (endpoints.forbidDuplicate) {
+            const seen = new Set();
+            for (const relation of relations) {
+                // Same role AND same ordered pair: A → B and B → A are two different
+                // sentences, and a framework that wants them exclusive says so in
+                // `exclusivePairs`.
+                const sentence = `${relation.role} ${relation.sourceId} ${relation.targetId}`;
+                // The FIRST one is not a duplicate of anything; every copy after it is.
+                if (seen.has(sentence)) {
+                    violations.push(raise(rule, relation.ids, relation.frameId, endpoints.duplicate ?? rule));
+                }
+                seen.add(sentence);
+            }
+        }
+        // Two declared pairs can both cover the same two relations (a pair written
+        // on a parent role and one on its specialisation): one situation, one
+        // finding.
+        const reported = new Set();
+        for (const [first, second] of exclusivePairs) {
+            for (let i = 0; i < relations.length; i++) {
+                for (let j = i + 1; j < relations.length; j++) {
+                    const a = relations[i];
+                    const b = relations[j];
+                    const matched = (roleIsA(a.role, first, rule.roles) &&
+                        roleIsA(b.role, second, rule.roles)) ||
+                        (roleIsA(a.role, second, rule.roles) &&
+                            roleIsA(b.role, first, rule.roles));
+                    if (!matched)
+                        continue;
+                    const couple = `${a.id} ${b.id}`;
+                    if (reported.has(couple))
+                        continue;
+                    reported.add(couple);
+                    // BOTH relations and both ends: either link is a legitimate
+                    // resolution, so neither may be left out of the finding, and the pair
+                    // of artefacts is what makes the two of them one situation.
+                    //
+                    // The frame is the SMALLER of the two the relations were attributed
+                    // to — the house tie-break, and it has to be one: each relation is
+                    // attributed by its OWN source node, so two links drawn from opposite
+                    // ends can name two frames, and taking the first one's would write a
+                    // map-wide arbitration wherever the surface happened to be walked.
+                    const frameId = b.frameId !== undefined &&
+                        (a.frameId === undefined || b.frameId < a.frameId)
+                        ? b.frameId
+                        : a.frameId;
+                    violations.push(raise(rule, namedElements([a.id, b.id, a.sourceId, a.targetId]), frameId, endpoints.exclusive ?? rule));
+                }
+            }
+        }
+    }
+    return violations;
+}
+/**
+ * The cited zones of one instance, as model-space rectangles.
+ *
+ * Ratios are of the PLOT — the element box minus the declared margin — so this
+ * is the same resolution `backgroundBoundaryCoords` does for transitions, and
+ * the reason a rule never restates a coordinate the declaration already owns.
+ * In the rule's OWN citation order, so `boundaryId` names the first zone the
+ * rule itself mentions rather than the first one the declaration happens to
+ * list.
+ *
+ * ## Resolved against the INSTANCE, variants included
+ *
+ * A variant is a second reading of the same frame, and a zone that belongs to
+ * the other reading is not drawn on this instance at all: it is not a region of
+ * it either, and measuring against a quadrant nobody can see would indict an
+ * artefact for sitting where the chart shows nothing. Same gate the renderer and
+ * the label walk pass through, read off the same props.
+ *
+ * Silence, not {@link warnOnce}: a rule citing a zone the declaration does not
+ * declare is a broken RULE and says so, but a rule citing a zone this INSTANCE
+ * does not read is a perfectly good rule looking at a frame turned to its other
+ * page.
+ */
+function zoneRegions(def, zoneIds, frame) {
+    const bound = frame.bound;
+    const plot = backgroundPlot(def, bound.w, bound.h);
+    const regions = [];
+    for (const id of zoneIds) {
+        const zone = (def.zones ?? []).find(candidate => candidate.id === id);
+        if (zone === undefined)
+            continue;
+        if (!backgroundInVariant(def, zone.variants, frame.props))
+            continue;
+        regions.push({
+            id,
+            bound: new Bound(bound.x + plot.x0 + zone.rect.x * plot.width, bound.y + plot.y0 + zone.rect.y * plot.height, zone.rect.w * plot.width, zone.rect.h * plot.height),
+        });
+    }
+    return regions;
+}
+/**
+ * The instance a subject is judged against: the one that CONTAINS it.
+ *
+ * Not `attributeBackground`, and the difference is the point: "which zone is
+ * this in" only means something for an artefact that is ON the map. An element
+ * next to the card is outside every zone of it, which under `expect: 'inside'`
+ * would make it a finding of THIS rule — a second, worse-worded version of
+ * `element-in-background`, raised on artefacts the framework may perfectly well
+ * allow off the frame. Off every frame is silence here, and whether that is
+ * itself a mistake is a different rule's question.
+ *
+ * Ties go to the smaller id, never to the order a `Y.Map` was rebuilt in: the
+ * answer decides where a persisted arbitration is written.
+ */
+function containingBackground(bound, backgrounds) {
+    let found = null;
+    for (const background of backgrounds) {
+        if (!background.bound.contains(bound))
+            continue;
+        if (found === null || background.id < found.id)
+            found = background;
+    }
+    return found;
+}
+/**
+ * "Is this artefact in the region it belongs in?" — the zone half of
+ * `element-in-background`.
+ *
+ * The zones are the frame's own declared ones, named by id: a rule says
+ * `zoneIds: ['core'], expect: 'outside'` and the geometry comes from the
+ * declaration the renderer paints from. Nothing is restated, so a framework
+ * that redraws its quadrants moves its rules with them.
+ *
+ * ## Not gated on the tint
+ *
+ * A zone is SEMANTIC; its `fillVisibleProp` only decides whether it is
+ * coloured in. A user who switched the tints off to print a clean chart has not
+ * told the tool that the Core quadrant stopped being the Core quadrant — the
+ * labels, the axes and the whole point of the chart are still there.
+ *
+ * A deliberate contrast with `attachment`, which DOES read the instance's props
+ * before judging a transition, and the two are not in tension: a transition is a
+ * LINE, and a line the user has hidden is a line they cannot aim at, so the
+ * gesture the finding asks for would point at nothing. A quadrant is a REGION of
+ * a frame of reference that is still fully on screen. Judge the drawing that is
+ * on the canvas — and a hidden tint does not take a quadrant off it.
+ */
+function evaluateElementInZone(rule, elements) {
+    const subjectRole = rule.appliesTo;
+    const inZone = rule.inZone;
+    const def = rule.background;
+    if (subjectRole === undefined || inZone === undefined || def === undefined) {
+        return [];
+    }
+    if (inZone.zoneIds.length === 0)
+        return [];
+    const declared = new Set((def.zones ?? []).map(zone => zone.id));
+    const unknown = inZone.zoneIds.filter(id => !declared.has(id));
+    if (unknown.length > 0) {
+        // Measuring against the zones it happened to recognise would be a DIFFERENT
+        // rule — a narrower union, a shorter list of forbidden ground — and nothing
+        // on the canvas would show the difference.
+        warnOnce(`element-in-zone rule "${rule.id}" names zone(s) its background does ` +
+            `not declare (${unknown.join(', ')}) — the rule is not evaluated.`);
+        return [];
+    }
+    const backgrounds = backgroundsOf(rule, elements);
+    // No frame on the board, no zones to be in: an artefact on blank canvas is a
+    // sketch.
+    if (backgrounds.length === 0)
+        return [];
+    // Zones are a function of the frame's bounds AND of the reading it is turned
+    // to, and a board carries units of frames against hundreds of subjects:
+    // resolved once per frame, per variant. Both halves are in the key, so the
+    // entry can never outlive the reading it was built for — an id alone would be
+    // right only for as long as nobody moved this map out of one evaluation.
+    const regionsOf = new Map();
+    const extent = inZone.measure === 'extent';
+    const violations = [];
+    for (const el of elements) {
+        if (el.role === undefined)
+            continue;
+        if (!roleIsA(el.role, subjectRole, rule.roles))
+            continue;
+        const bound = el.elementBound;
+        const frame = containingBackground(bound, backgrounds);
+        if (frame === null)
+            continue;
+        // Keyed by the frame AND the reading it is turned to, joined by NUL — which
+        // no id and no variant name contains — so the two halves can never fold
+        // into one entry.
+        const variant = def.variantProp === undefined ? '' : String(frame.props[def.variantProp]);
+        const key = `${frame.id}\u0000${variant}`;
+        let regions = regionsOf.get(key);
+        if (regions === undefined) {
+            regions = zoneRegions(def, inZone.zoneIds, frame);
+            regionsOf.set(key, regions);
+        }
+        // Every cited zone belongs to the frame's OTHER reading: this instance has
+        // no such region, so there is nothing to be inside or outside of. Under
+        // `expect: 'inside'` the alternative would be indicting every subject on a
+        // frame that simply shows another page.
+        if (regions.length === 0)
+            continue;
+        const centre = centreOf(bound);
+        // `inside` asks for the subject to be WHOLLY in one zone; `outside` for it
+        // to share no area with any. The border belongs to the zone in both
+        // readings, so two neighbours never disagree about an artefact on their
+        // frontier.
+        const occupies = (region) => extent
+            ? region.bound.contains(bound)
+            : region.bound.containsPoint(centre);
+        const touches = (region) => extent
+            ? boundsOverlap(region.bound, bound)
+            : region.bound.containsPoint(centre);
+        if (inZone.expect === 'inside') {
+            if (regions.some(occupies))
+                continue;
+            // The zone the subject missed: the nearest one, which is the one the user
+            // was aiming at and the only one a suggestion can point back to.
+            let nearest;
+            let distance = Infinity;
+            for (const region of regions) {
+                const gap = gapSquared(region.bound, bound);
+                if (gap < distance) {
+                    distance = gap;
+                    nearest = region;
+                }
+            }
+            const violation = raise(rule, [el.id], frame.id);
+            if (nearest !== undefined)
+                violation.boundaryId = nearest.id;
+            violations.push(violation);
+            continue;
+        }
+        const trespassed = regions.find(touches);
+        if (trespassed === undefined)
+            continue;
+        const violation = raise(rule, [el.id], frame.id);
+        violation.boundaryId = trespassed.id;
+        violations.push(violation);
+    }
+    return violations;
+}
+/**
+ * "Does this artefact belong on THIS view?"
+ *
+ * The first family whose subject is the SHEET. Every other one starts from an
+ * artefact — a node, a relation, a pair — and asks something about where it is
+ * or what touches it. This one starts from a frame that has DECLARED what kind
+ * of view it is, and judges what has been drawn on it against that declaration.
+ *
+ * The level is read off the instance, from the prop the rule names
+ * ({@link ViewAdmissibilityDef.levelProp}) — the very idiom the background
+ * primitives already use for labels and variants — so the engine learns which
+ * views exist from the document rather than from a registry of its own.
+ *
+ * ## What it stays silent about, and why each one matters
+ *
+ * - **a frame that declares NO level** — the overwhelming majority, and every
+ *   frame in every document written before the prop existed. No fact, no rule
+ *   (PRD principle 8): a sheet whose author never said which view it is has
+ *   made no claim for anything to contradict, and a family that guessed would
+ *   light up every diagram already on disk.
+ * - **a level the rule's table does not name**, or names with an empty list —
+ *   the rule has nothing to say about that view. That is what lets a framework
+ *   ship the levels that forbid something and stay quiet on the one that
+ *   forbids nothing, instead of a rule that can never fire.
+ * - **an element carrying no role** — a rectangle somebody dropped on the sheet
+ *   to think with belongs to no notation, so no view can refuse it.
+ * - **an element off every declared view** — it is on the canvas beside the
+ *   sheet, not on it, and a view judges what is drawn ON it.
+ * - **the frame itself**, and any other frame of the same role: a view is not
+ *   an artefact drawn on itself.
+ *
+ * ## Which view judges an element
+ *
+ * The one whose plot contains its CENTRE ({@link plotContaining}) — membership,
+ * with the same tie-break every attribution in this file uses, and never the
+ * nearest-frame fallback: "this artefact is on that view" has to mean it, or a
+ * box floating beside a context diagram would be indicted by it.
+ *
+ * A subject on two nested views is judged by ONE of them, the smaller id, which
+ * is the same answer `role-count` and `edge-locality` give. Two views drawn on
+ * top of each other is not a case C4 has, and inventing a second verdict for it
+ * would mean inventing which of the two the author meant.
+ *
+ * ## Cost, and why it is realtime-safe
+ *
+ * One pass to collect the views (units per board), one plot resolved per view,
+ * then ONE pass over the elements with one containment walk and at most
+ * `forbidden.length` role tests each. Linear in the surface, no graph, no pair
+ * walk, nothing quadratic — the same budget `element-in-background` and
+ * `role-count` are measured on.
+ */
+function evaluateViewAdmissibility(rule, elements) {
+    const def = rule.admissibility;
+    if (def === undefined)
+        return [];
+    if (missingFrameRole(rule, 'view-admissibility'))
+        return [];
+    // The views that have both DECLARED a level and given this rule something to
+    // say about it. Resolved once, per frame — the plot arithmetic and the table
+    // lookup must not be paid per subject.
+    const views = [];
+    const forbiddenOf = new Map();
+    for (const frame of framePlots(rule, elements)) {
+        const stated = frame.instance.props[def.levelProp];
+        // A level is a non-empty string or it is nothing. The value comes off a
+        // Y.Map, so it is whatever a peer, an importer or an older client wrote.
+        if (typeof stated !== 'string' || stated === '')
+            continue;
+        // Own keys only: `forbidden` is an object literal shipped by a framework.
+        if (!Object.hasOwn(def.forbidden, stated))
+            continue;
+        const forbidden = def.forbidden[stated];
+        if (forbidden === undefined || forbidden.length === 0)
+            continue;
+        views.push(frame);
+        forbiddenOf.set(frame.instance.id, forbidden);
+    }
+    // No view on the board has stated a level this rule judges: not one element
+    // is walked.
+    if (views.length === 0)
+        return [];
+    const violations = [];
+    for (const el of elements) {
+        // Cheapest possible exit for a neutral element: no role, no evaluation.
+        const role = el.role;
+        if (role === undefined)
+            continue;
+        // A view is never an artefact drawn on ITSELF — its own centre is inside
+        // its own plot, so without this a rule forbidding the frame's own role
+        // would indict every frame that declared a level.
+        if (forbiddenOf.has(el.id))
+            continue;
+        const view = plotContaining(centreOf(el.elementBound), views);
+        if (view === null)
+            continue;
+        const forbidden = forbiddenOf.get(view.id);
+        if (forbidden === undefined)
+            continue;
+        // One finding per element, whichever forbidden role matched: the author has
+        // drawn one box on the wrong sheet, and telling them twice about it would
+        // be describing our table rather than their diagram.
+        if (forbidden.some(entry => roleIsA(role, entry, rule.roles))) {
+            violations.push(raise(rule, [el.id], view.id));
+        }
+    }
+    return violations;
+}
+/**
+ * "How many relations reach this node?" — the cardinality half of a grammar.
+ *
+ * One pass to count, one pass to judge. For every element carrying the declared
+ * edge role, the persisted `source → target` pair adds one OUT to its source and
+ * one IN to its target; then every subject node is confronted with the bounds
+ * its rule declares.
+ *
+ * ## What it stays silent about, and why each one matters
+ *
+ * - **an edge with a free end** — it relates nothing, so it is not evidence of a
+ *   node being connected. A link the user has grabbed and not yet dropped must
+ *   not make a start event legal for the length of the gesture;
+ * - **an end that is not a subject of this rule** — nothing to say about it;
+ * - **a rule declaring no bound at all** — it asks nothing. It warns once, since
+ *   data that can never fire and never says why is the worst thing declarative
+ *   data can do.
+ *
+ * ## An end whose element is GONE, and why this family keeps the other half
+ *
+ * A dangling id counts against nobody, but the edge is not dropped: the node at
+ * the surviving end really does have one relation leaving it, and no gesture the
+ * user makes on THAT node changes the fact. This family counts the ends, never
+ * the survivors.
+ *
+ * A deliberate divergence from the three families whose subject is the RELATION
+ * — `relative-order-along-axis`, `relation-endpoints`, `edge-locality` — which
+ * drop such an edge whole, because a sentence with a missing half is not a
+ * sentence anybody can be told about. A COUNT has no such problem, and neither
+ * does the traversal in {@link evaluateReachability}, which follows the arc to
+ * an element that is not there and simply never reaches anything by it. Two
+ * different questions, two different readings of the same broken pair.
+ *
+ * A SELF-LOOP counts on both sides: the node genuinely has one edge leaving and
+ * one arriving, and that is what the document says. Whether a loop is legitimate
+ * at all is `relation-endpoints`' question, asked with its own flag, and a
+ * count that quietly ignored loops would let one launder a node past a `maxOut`.
+ *
+ * ## One finding per node
+ *
+ * The bounds are tested in a fixed order — in, then out; fewest, then most; and
+ * {@link EdgeDegreeDef.eitherMin} LAST — and the first one that fails is the
+ * finding. Five badges on one symbol for one situation is pedantry the canvas
+ * cannot afford; the same argument `relation-endpoints` makes about not
+ * indicting an edge twice.
+ *
+ * The disjunction goes last on purpose. A per-direction bound names the side the
+ * user has to act on, and "nothing arrives here" is a more useful sentence than
+ * "neither side has enough"; the disjunction only speaks when the four
+ * conjunctive bounds have nothing to say. It is orthogonal to them, not a
+ * substitute: a rule may cap one side and still ask for two on either.
+ *
+ * ## Cost
+ *
+ * Linear in the elements plus linear in the EDGES, with one hash lookup per end.
+ * No pair-wise sweep and no closure: the rule is about the relations somebody
+ * drew, never about the ones they could have drawn.
+ */
+function evaluateEdgeDegree(rule, elements) {
+    const subjectRole = rule.appliesTo;
+    const degree = rule.degree;
+    if (subjectRole === undefined || degree === undefined)
+        return [];
+    const { minIn, maxIn, minOut, maxOut, eitherMin } = degree;
+    // A pattern satisfied by every node — one supplying no bound at all — would
+    // indict the whole board, which is the loudest possible way for a typo in the
+    // data to be wrong. Dropped rather than honoured, and said once.
+    const pattern = degree.forbidPattern;
+    const patternBounds = pattern === undefined
+        ? null
+        : [
+            ['in', '>=', pattern.minIn],
+            ['in', '<=', pattern.maxIn],
+            ['out', '>=', pattern.minOut],
+            ['out', '<=', pattern.maxOut],
+        ].filter(([, , value]) => value !== undefined);
+    if (patternBounds !== null && patternBounds.length === 0) {
+        warnOnce(`edge-degree rule "${rule.id}" declares a forbidden pattern with no ` +
+            `bound in it, which every node matches — the pattern is dropped.`);
+    }
+    const forbidden = patternBounds !== null && patternBounds.length > 0 ? patternBounds : null;
+    if (minIn === undefined &&
+        maxIn === undefined &&
+        minOut === undefined &&
+        maxOut === undefined &&
+        eitherMin === undefined &&
+        forbidden === null) {
+        warnOnce(`edge-degree rule "${rule.id}" declares no bound at all — the rule is ` +
+            `not evaluated.`);
+        return [];
+    }
+    // In the surface's own walk order, so a board reports its offending nodes the
+    // same way every other element-local family does.
+    const subjects = [];
+    const bySubjectId = new Map();
+    const edges = [];
+    for (const el of elements) {
+        // Cheapest possible exit for a neutral element: no role, no evaluation.
+        if (el.role === undefined)
+            continue;
+        if (roleIsA(el.role, subjectRole, rule.roles)) {
+            const subject = { el, in: 0, out: 0 };
+            subjects.push(subject);
+            bySubjectId.set(el.id, subject);
+        }
+        if (roleIsA(el.role, degree.edgeRole, rule.roles))
+            edges.push(el);
+    }
+    if (subjects.length === 0)
+        return [];
+    for (const edge of edges) {
+        const ends = rawEndpointIds(edge);
+        if (ends === null)
+            continue;
+        const source = bySubjectId.get(ends[0]);
+        if (source !== undefined)
+            source.out += 1;
+        const target = bySubjectId.get(ends[1]);
+        if (target !== undefined)
+            target.in += 1;
+    }
+    // Only resolved when something is actually wrong: a conformant board is the
+    // common case and must not pay for the frames it never names.
+    let backgrounds = null;
+    const violations = [];
+    for (const subject of subjects) {
+        const words = minIn !== undefined && subject.in < minIn
+            ? (degree.tooFewIn ?? rule)
+            : maxIn !== undefined && subject.in > maxIn
+                ? (degree.tooManyIn ?? rule)
+                : minOut !== undefined && subject.out < minOut
+                    ? (degree.tooFewOut ?? rule)
+                    : maxOut !== undefined && subject.out > maxOut
+                        ? (degree.tooManyOut ?? rule)
+                        : // LAST, and deliberately: a per-direction bound names the side
+                            // the user has to act on, which is a more useful sentence than
+                            // "neither side". The disjunction only speaks when the four
+                            // above have nothing to say.
+                            eitherMin !== undefined &&
+                                subject.in < eitherMin &&
+                                subject.out < eitherMin
+                                ? (degree.neither ?? rule)
+                                : // LAST of all, for the same reason: a bound that failed names
+                                    // what is missing, and a forbidden zone names a shape. When
+                                    // both have something to say, the missing thing is the more
+                                    // actionable half.
+                                    forbidden !== null &&
+                                        forbidden.every(([side, test, value]) => test === '>='
+                                            ? subject[side] >= value
+                                            : subject[side] <= value)
+                                        ? (pattern ?? rule)
+                                        : null;
+        if (words === null)
+            continue;
+        backgrounds ??= backgroundsOf(rule, elements);
+        const frameId = attributeBackground(subject.el.elementBound, backgrounds)?.id;
+        violations.push(raise(rule, [subject.el.id], frameId, words));
+    }
+    return violations;
+}
+/**
+ * "How many of these does one frame hold?" — existence and uniqueness.
+ *
+ * The tally is per INSTANCE and anchored ON it, exactly like
+ * {@link evaluateMajorityFact}: a board carrying three pools holds three
+ * independent answers, the bracket lands on the pool the answer is about, and
+ * the `map` exemption scope therefore covers that pool and no other.
+ *
+ * ## Containment, and only containment
+ *
+ * A subject belongs to the frame whose plot contains its CENTRE
+ * ({@link plotContaining}) — deliberately not `attributeBackground`'s
+ * nearest-fallback, which would let a start event floating beside a pool satisfy
+ * "this pool has a start event". A subject inside no frame at all is counted by
+ * nobody, and whether that is itself a mistake is `element-in-background`'s
+ * question.
+ *
+ * ## Silence
+ *
+ * - **no frame on the board** — nothing to count into. An artefact on blank
+ *   canvas is a sketch, and a process sketched before its pool was drawn must
+ *   not light up;
+ * - **a rule declaring neither bound** — it asks nothing, and warns once;
+ * - **a frame the GUARD has not armed** — see {@link RoleCountDef.ifPresent}.
+ *   Not judged, rather than judged and found compliant: a conditional
+ *   requirement says nothing at all about the case its condition excludes.
+ *
+ * An EMPTY frame is not silence: a pool holding no start event is precisely what
+ * `min` is for, so every instance gets an entry before the walk, not when a
+ * subject happens to land on it. The guard is what turns that back into silence
+ * for a notation where the artefact is optional on its own.
+ *
+ * ## Cost
+ *
+ * One pass over the elements, one plot per frame, one containment test per
+ * subject per frame — the frames are counted in units, so this is constant per
+ * element in practice, like every other attribution in this file.
+ */
+function evaluateRoleCount(rule, elements) {
+    const count = rule.roleCount;
+    if (count === undefined)
+        return [];
+    if (missingFrameRole(rule, 'role-count'))
+        return [];
+    const { min, max } = count;
+    if (min === undefined && max === undefined) {
+        warnOnce(`role-count rule "${rule.id}" declares neither a minimum nor a maximum ` +
+            `— the rule is not evaluated.`);
+        return [];
+    }
+    const frames = framePlots(rule, elements);
+    // No frame on the board: nothing for the count to be about.
+    if (frames.length === 0)
+        return [];
+    const tally = new Map();
+    for (const frame of frames)
+        tally.set(frame.instance.id, 0);
+    // The frames the GUARD has armed. Left null by a rule that declares none, so
+    // an unguarded rule allocates nothing and reads nothing extra per element.
+    const guard = count.ifPresent;
+    const armed = guard === undefined ? null : new Set();
+    for (const el of elements) {
+        // Cheapest possible exit for a neutral element: no role, no evaluation.
+        if (el.role === undefined)
+            continue;
+        const counts = count.exact === true
+            ? el.role === count.subject
+            : roleIsA(el.role, count.subject, rule.roles);
+        // Not `else if`: nothing forbids a vocabulary where the guard role and the
+        // counted role overlap, and an element that is both must arm the frame AND
+        // be counted in it. Two independent questions about one element.
+        const arms = guard !== undefined && roleIsA(el.role, guard, rule.roles);
+        if (!counts && !arms)
+            continue;
+        // Resolved once for both questions: the containment walk is the expensive
+        // half, and an element that is subject and guard at once must not pay twice.
+        const frame = plotContaining(centreOf(el.elementBound), frames);
+        // Off every frame: it neither counts towards a requirement nor arms one.
+        // An artefact floating beside a pool is a draft, on both readings.
+        if (frame === null)
+            continue;
+        if (counts)
+            tally.set(frame.id, (tally.get(frame.id) ?? 0) + 1);
+        if (arms)
+            armed.add(frame.id);
+    }
+    const violations = [];
+    // Sorted, so a board with several offending frames always reports them the
+    // same way whichever order the surface happened to be walked in.
+    for (const id of [...tally.keys()].sort()) {
+        // A frame the guard has not armed is not judged at all — not walked, not
+        // found compliant. That is the difference between "this notation requires
+        // one" and "this notation requires one WHEN the other is there".
+        if (armed !== null && !armed.has(id))
+            continue;
+        const held = tally.get(id);
+        const words = min !== undefined && held < min
+            ? (count.tooFew ?? rule)
+            : max !== undefined && held > max
+                ? (count.tooMany ?? rule)
+                : null;
+        if (words === null)
+            continue;
+        violations.push(raise(rule, [id], id, words));
+    }
+    return violations;
+}
+/**
+ * "Does this relation stay inside one frame, or cross between two?"
+ *
+ * The third family whose subject is a RELATION, and the only one that reads the
+ * frames rather than the roles: a sequence flow belongs to one pool, a message
+ * flow exists only between two. The two ends carry the same roles in the legal
+ * case and the illegal one, so nothing but the attribution can tell them apart.
+ *
+ * Each END is attributed on its own, by the centre of ITS element and never by
+ * the edge's box — the box of a link between two pools spans both of them and
+ * would answer whichever question was asked of it.
+ *
+ * ## What it stays silent about, and why each one matters
+ *
+ * - **no frame on the board** — a process sketched before anybody drew a pool is
+ *   a sketch, and this is the family a poolless board would otherwise light up
+ *   from end to end;
+ * - **an edge with a free end, or an end whose element is gone** — it relates
+ *   nothing;
+ * - **a self-loop** — one element compared with itself is always in its own
+ *   frame, so it says nothing about locality either way; whether a loop is legal
+ *   at all is `relation-endpoints`' question ({@link boundEnds});
+ * - **an end inside NO frame** — the decisive one, and it is the same
+ *   proportionality {@link RelationEndpointsDef.allowed}'s alphabet applies: a
+ *   task dropped beside the pool is a draft, and a tool that answered "that flow
+ *   leaves the pool" would be indicting the act of sketching.
+ *
+ * ## The finding names the edge AND its two ends
+ *
+ * The `relative-order-along-axis` and `relation-endpoints` precedent, for the
+ * same reason: the finding has two honest resolutions — move the artefact into
+ * the frame it belongs to, or re-point the link — and the second is only
+ * reachable from the edge. It is attributed to the SOURCE's frame, like every
+ * other relation finding in this file.
+ *
+ * ## Cost
+ *
+ * Linear in the elements plus linear in the edges, with the plots resolved once
+ * per frame.
+ */
+function evaluateEdgeLocality(rule, elements) {
+    const locality = rule.locality;
+    if (locality === undefined)
+        return [];
+    if (missingFrameRole(rule, 'edge-locality'))
+        return [];
+    const frames = framePlots(rule, elements);
+    // No frame on the board, no locality to be in or out of.
+    if (frames.length === 0)
+        return [];
+    const byId = new Map();
+    const edges = [];
+    for (const el of elements) {
+        byId.set(el.id, el);
+        // Cheapest possible exit for a neutral element: no role, no evaluation.
+        if (el.role === undefined)
+            continue;
+        if (roleIsA(el.role, locality.edgeRole, rule.roles))
+            edges.push(el);
+    }
+    if (edges.length === 0)
+        return [];
+    const same = locality.mode === 'same-background';
+    const violations = [];
+    for (const edge of edges) {
+        const ends = boundEnds(edge);
+        if (ends === null)
+            continue;
+        const [sourceId, targetId] = ends;
+        const source = byId.get(sourceId);
+        const target = byId.get(targetId);
+        if (source === undefined || target === undefined)
+            continue;
+        const sourceFrame = plotContaining(centreOf(source.elementBound), frames);
+        if (sourceFrame === null)
+            continue;
+        const targetFrame = plotContaining(centreOf(target.elementBound), frames);
+        if (targetFrame === null)
+            continue;
+        // Conformant when the two ends agree with the mode: one instance for
+        // `same-background`, two for `cross-background`.
+        const together = sourceFrame.id === targetFrame.id;
+        if (together === same)
+            continue;
+        violations.push(raise(rule, namedElements([edge.id, sourceId, targetId]), sourceFrame.id));
+    }
+    return violations;
+}
+/**
+ * "Can you get here from the start?" — the orphan question.
+ *
+ * The first family that builds a GRAPH. Every element carrying the declared edge
+ * role contributes one directed arc, `source → target`, read off the persisted
+ * pair and never off the geometry; a breadth-first walk leaves from every root
+ * at once; and every subject the walk never reached is a finding.
+ *
+ * ## Silence when there is no root
+ *
+ * TOTAL, and it is the load-bearing decision of this family. A process with no
+ * start event has every one of its tasks unreachable, so the rule would answer
+ * an empty board with one finding per artefact on it — a wall of brackets whose
+ * single real cause is a missing start event, which is `role-count`'s question
+ * and is already asked once, on the frame. One mistake, one sentence.
+ *
+ * A root is seeded into the visited set, which is also what makes "a root is
+ * never its own orphan" fall out rather than needing a second test.
+ *
+ * ## Two readings of "root"
+ *
+ * {@link ReachabilityDef.implicitRoots} adds the subjects nothing points at to
+ * the set the walk leaves from — the second, silent way a notation with an
+ * optional start marker says "the work begins here". Under it the gate above
+ * means "no root of EITHER kind", and what is left is every subject that has an
+ * incoming counted edge and that no root reaches: a ring entered from nowhere,
+ * and a subject fed only by an edge whose own source the walk never leaves from
+ * (a dangling id, or an element outside both roles). See that field for why the
+ * second one is reported here and fixed elsewhere.
+ *
+ * The two readings share every line but the seeding, deliberately: the answer to
+ * "can you get here" must not depend on which one a framework picked — including
+ * for that second shape, which behaves identically either way.
+ *
+ * ## Direction, and the arcs it does not add
+ *
+ * The walk follows arcs FORWARD only. "Reachable from the start" is a statement
+ * about the direction the process runs in; a task that only points BACK at the
+ * chain is exactly the mistake this exists to find, and an undirected walk would
+ * certify it. An edge with a free end, or an end whose element is gone, adds no
+ * arc — it connects nothing.
+ *
+ * ## Cost, and the incremental story
+ *
+ * O(V + E): one indexing pass, one adjacency build, one traversal that visits
+ * each node and each arc at most once.
+ *
+ * An {@link IncrementalContext} is deliberately NOT honoured, and could not
+ * usefully be: reachability is a GLOBAL property, so re-pointing a single edge
+ * can orphan or rescue an arbitrary number of nodes nowhere near it, and any
+ * dirty edge invalidates the whole answer. A framework that finds the traversal
+ * too expensive for the drawing path declares its rule `'on-demand'` — the
+ * moment is the rule's to choose ({@link ValidationMoment}), and this family
+ * stays agnostic about which one it is evaluated at.
+ */
+function evaluateReachability(rule, elements) {
+    const def = rule.reachability;
+    if (def === undefined)
+        return [];
+    const subjects = [];
+    const edges = [];
+    // Seeded with the roots, which is what makes a root that is also a subject
+    // reachable by definition rather than by a second test.
+    const visited = new Set();
+    const queue = [];
+    for (const el of elements) {
+        // Cheapest possible exit for a neutral element: no role, no evaluation.
+        if (el.role === undefined)
+            continue;
+        if (roleIsA(el.role, def.rootRole, rule.roles)) {
+            if (!visited.has(el.id)) {
+                visited.add(el.id);
+                queue.push(el.id);
+            }
+        }
+        if (roleIsA(el.role, def.subjectRole, rule.roles))
+            subjects.push(el);
+        if (roleIsA(el.role, def.edgeRole, rule.roles))
+            edges.push(el);
+    }
+    if (subjects.length === 0)
+        return [];
+    const implicit = def.implicitRoots === true;
+    // Under the declared-roots-only reading the gate is answerable before a
+    // single arc is built, which is the cheapest exit this family has. The
+    // implicit reading cannot take it: whether there is a root at all is a fact
+    // about the ARCS, so it has to wait for them.
+    if (!implicit && queue.length === 0)
+        return [];
+    const next = new Map();
+    // Every element some arc points AT — tracked only for the implicit reading,
+    // which is the only one that needs an in-degree. A board on the declared
+    // reading allocates nothing.
+    const pointedAt = implicit ? new Set() : null;
+    for (const edge of edges) {
+        const ends = rawEndpointIds(edge);
+        if (ends === null)
+            continue;
+        const outgoing = next.get(ends[0]);
+        if (outgoing === undefined)
+            next.set(ends[0], [ends[1]]);
+        else
+            outgoing.push(ends[1]);
+        pointedAt?.add(ends[1]);
+    }
+    if (pointedAt !== null) {
+        // A subject nothing points at IS a beginning — see
+        // {@link ReachabilityDef.implicitRoots}. In the surface's walk order, and
+        // through the same `visited` guard the declared roots use, so a subject
+        // that is also a declared root is seeded exactly once.
+        //
+        // A SELF-LOOP disqualifies its own node, and rightly: something does point
+        // at it. A ring of one is the smallest instance of the only defect this
+        // reading still reports.
+        for (const el of subjects) {
+            if (pointedAt.has(el.id) || visited.has(el.id))
+                continue;
+            visited.add(el.id);
+            queue.push(el.id);
+        }
+    }
+    // THE GATE: no root of EITHER kind on the board, so nothing is unreachable —
+    // see above. Under the implicit reading a board reaches this only when every
+    // one of its subjects is pointed at, i.e. when they all sit in rings entered
+    // from nowhere, and the question genuinely does not arise.
+    if (queue.length === 0)
+        return [];
+    // Breadth-first from every root at once. `head` walks the queue instead of
+    // `shift()`ing it: a shift is O(n) on a real array, which would turn an
+    // O(V + E) traversal quadratic on the one board big enough to notice.
+    for (let head = 0; head < queue.length; head++) {
+        const outgoing = next.get(queue[head]);
+        if (outgoing === undefined)
+            continue;
+        for (const id of outgoing) {
+            if (visited.has(id))
+                continue;
+            visited.add(id);
+            queue.push(id);
+        }
+    }
+    // Only resolved when something is actually wrong — the conformant board pays
+    // nothing for the frames it never names.
+    let backgrounds = null;
+    const violations = [];
+    for (const el of subjects) {
+        if (visited.has(el.id))
+            continue;
+        backgrounds ??= backgroundsOf(rule, elements);
+        const frameId = attributeBackground(el.elementBound, backgrounds)?.id;
+        violations.push(raise(rule, [el.id], frameId));
+    }
+    return violations;
+}
+/**
+ * Zero-width characters: present in the string, absent from the page.
+ *
+ * A name made of one of these is a name nobody can read, and a user who pasted
+ * one has an artefact that LOOKS unnamed and validates as named — the worst of
+ * both, and impossible to debug from the canvas. `trim()` does not remove them
+ * (they are not `WhiteSpace` in the spec), so they are stripped first.
+ *
+ * ESCAPED, never written as the characters themselves. A class holding the raw
+ * code points is invisible in every diff, review UI and editor — which makes it
+ * the one constant in this file that can be silently changed by a linter, a
+ * paste or a codemod that strips zero-width characters, with nothing on screen
+ * to show it happened. The escapes are: zero-width space, zero-width
+ * non-joiner, zero-width joiner, word joiner, and the byte-order mark.
+ */
+const INVISIBLE_CHARS = /[\u200B-\u200D\u2060\uFEFF]/g;
+/**
+ * Whether a non-string value knows how to render ITSELF as text, as opposed to
+ * inheriting `Object.prototype.toString` and answering `'[object Object]'`.
+ *
+ * The duck-typed test for "this is a text-bearing model": a `Y.Text` overrides
+ * `toString`, and so does every wrapper the canvas could plausibly store in that
+ * slot. A plain object does not, and neither does a number.
+ *
+ * An ARRAY is excluded even though it overrides `toString`, and that is the case
+ * worth spelling out: a raw delta list is the shape a text most plausibly
+ * degrades into, and `String([{ insert: 'x' }])` is `'[object Object]'` all over
+ * again. A list of runs is not a name; a model that can render one is.
+ */
+function rendersAsText(value) {
+    if (typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const own = value.toString;
+    return typeof own === 'function' && own !== Object.prototype.toString;
+}
+/**
+ * The words an element carries, or `''` — the EXTRACTION alone, with no opinion
+ * on whether having none is a mistake.
+ *
+ * Duck-typed on `text`, exactly like {@link elementPath} and
+ * {@link rawEndpointIds} are on their own properties, and for the same reason:
+ * the engine knows roles and geometry and must not import an element model. That
+ * one property is what a shape's `Y.Text`, a connector's label and a free text
+ * element all expose, and `String()` is what turns any of them into the content
+ * — the same conversion {@link textInkBound} has always relied on.
+ *
+ * NFC first, for the reason that function gives: the same name typed here and
+ * pasted from elsewhere can arrive as the same glyphs in a different number of
+ * code points. Then the invisibles, then the whitespace. What is left is what a
+ * reader would see.
+ *
+ * ## What is not a name
+ *
+ * A value that is neither a string nor something that knows how to render itself
+ * as one. `String({})` is `'[object Object]'` — eleven visible characters, which
+ * would make an artefact carrying a malformed `text` read as NAMED, and named
+ * with a word the user can neither see nor delete.
+ *
+ * `text` comes off a `Y.Map`, so it is whatever a peer or an importer wrote —
+ * the same threat model {@link elementExceptions} guards with its `Array.isArray`
+ * and {@link declaresRole} with its `Object.hasOwn`. The test is for an own
+ * `toString`, which a `Y.Text` has and a plain object does not: it accepts every
+ * shape the canvas actually stores without this file importing one of them.
+ */
+function elementLabel(el) {
+    const text = el.text;
+    if (text == null)
+        return '';
+    if (typeof text !== 'string' && !rendersAsText(text))
+        return '';
+    return String(text).normalize('NFC').replace(INVISIBLE_CHARS, '').trim();
+}
+/**
+ * "Does this artefact say what it is?"
+ *
+ * The first family that reads an element's WORDS. Every other one asks about
+ * geometry, roles or relations, all of which a reader can partly infer from the
+ * drawing; a box with nothing written in it is the one defect nothing recovers.
+ *
+ * ## What counts as absent
+ *
+ * No `text` at all, an empty one, one that is only whitespace, and one that is
+ * only invisible code points — see {@link elementLabel}. Anything a reader would
+ * see is a label, however short: judging the QUALITY of a name is not this
+ * family's business and probably nobody's.
+ *
+ * ## Silence
+ *
+ * The usual proportionality: an element with no role is not a subject, and a
+ * board carrying no subject raises nothing. There is no frame requirement —
+ * {@link ValidationRule.backgroundRole} buys attribution only, the `no-overlap`
+ * pattern, so a rule may name a frame to give its findings somewhere to be
+ * waived and need not.
+ *
+ * ## The moment, and why a framework should think about it
+ *
+ * Naming is the one property a user changes by TYPING, one character at a time.
+ * `text` is verdict-bearing only for a framework that registers a real-time rule
+ * of this family — {@link verdictPropsOf} adds it then and only then — so a rule
+ * declared `'on-demand'` costs the drawing path nothing at all, and a real-time
+ * one wakes the debounced evaluation on every keystroke in every shape on the
+ * board. Both are supported; the second is a choice a framework should make
+ * deliberately.
+ *
+ * ## Cost
+ *
+ * One pass, one `text` read per subject. Linear, and paid only by the elements
+ * carrying the subject role.
+ */
+function evaluateLabelPresence(rule, elements) {
+    const subjectRole = rule.appliesTo;
+    const label = rule.label;
+    if (subjectRole === undefined || label === undefined)
+        return [];
+    if (label.present !== true)
+        return [];
+    // Only resolved when something is actually wrong — a named board pays nothing
+    // for the frames it never has to name.
+    let backgrounds = null;
+    const violations = [];
+    for (const el of elements) {
+        // Cheapest possible exit for a neutral element: no role, no evaluation.
+        if (el.role === undefined)
+            continue;
+        if (!roleIsA(el.role, subjectRole, rule.roles))
+            continue;
+        if (elementLabel(el) !== '')
+            continue;
+        backgrounds ??= backgroundsOf(rule, elements);
+        const frameId = attributeBackground(el.elementBound, backgrounds)?.id;
+        violations.push(raise(rule, [el.id], frameId));
+    }
+    return violations;
+}
 const RULE_FAMILIES = {
     'element-in-background': evaluateElementInBackground,
     'orientation-against-axis': evaluateOrientationAgainstAxis,
@@ -1549,6 +3058,14 @@ const RULE_FAMILIES = {
     'tone-convention': evaluateToneConvention,
     'majority-fact': evaluateMajorityFact,
     'relative-order-along-axis': evaluateRelativeOrder,
+    'relation-endpoints': evaluateRelationEndpoints,
+    'element-in-zone': evaluateElementInZone,
+    'edge-degree': evaluateEdgeDegree,
+    'role-count': evaluateRoleCount,
+    'edge-locality': evaluateEdgeLocality,
+    reachability: evaluateReachability,
+    'label-presence': evaluateLabelPresence,
+    'view-admissibility': evaluateViewAdmissibility,
 };
 /** A rule the drawing path evaluates. `moment` absent means `'realtime'`. */
 function isRealtime(rule) {
@@ -1818,6 +3335,73 @@ export function ValidationProfileExtension(profiles) {
         },
     };
 }
+/** A framework declares its root instances here, when no rule already does. */
+export const ValidationFrameworkIdentifier = createIdentifier('ValidationFramework');
+/**
+ * Register a framework's root-instance declaration.
+ *
+ * ```ts
+ * context.register(
+ *   ValidationFrameworkExtension([
+ *     { framework: 'estuarine', backgroundRole: 'estuarine:map', roles: ESTUARINE_ROLES },
+ *   ])
+ * );
+ * ```
+ *
+ * Keyed by framework AND role, so a framework with two kinds of board declares
+ * both and neither silently replaces the other.
+ */
+export function ValidationFrameworkExtension(defs) {
+    return {
+        setup: di => {
+            for (const def of defs) {
+                di.addImpl(ValidationFrameworkIdentifier(`${def.framework}|${def.backgroundRole}`), () => def);
+            }
+        },
+    };
+}
+/** Shared answer for "this element is nobody's frame", allocated once. */
+const EMPTY_FRAMEWORKS = new Set();
+/**
+ * The frameworks `role` is a ROOT INSTANCE of — the one test that decides
+ * whether an element is somebody's frame, and the only one.
+ *
+ * TWO sources, and they answer the same question:
+ *
+ * - a registered RULE naming this role as the background it measures against.
+ *   A rule that frames against a role is a framework saying "this is my map",
+ *   with no second registry to keep in step;
+ * - a registered {@link ValidationFrameworkDef}, for the framework whose whole
+ *   contribution is nudges and which therefore has no rule to be derived from.
+ *
+ * Pure, and exported, because every per-instance surface downstream — the
+ * profile picker, the nudge checklist, the check-up — is built on this answer,
+ * and a function taking its inputs is testable without a DI container, a
+ * surface or an editor.
+ *
+ * Empty for a neutral element, and for a background authored before its role
+ * existed: no role, no framework, no tooling.
+ */
+export function frameworksOfRole(role, rules, frameworkDefs = []) {
+    if (role === undefined)
+        return EMPTY_FRAMEWORKS;
+    const frameworks = new Set();
+    for (const rule of rules) {
+        if (rule.backgroundRole === undefined)
+            continue;
+        if (roleIsA(role, rule.backgroundRole, rule.roles)) {
+            frameworks.add(rule.framework);
+        }
+    }
+    for (const def of frameworkDefs) {
+        if (roleIsA(role, def.backgroundRole, def.roles)) {
+            frameworks.add(def.framework);
+        }
+    }
+    // One shared answer for "this element is nobody's frame": the common case by
+    // far, on every element of every board that carries no framework.
+    return frameworks.size === 0 ? EMPTY_FRAMEWORKS : frameworks;
+}
 /** Recompute delay, so a drag re-evaluates once instead of once per frame. */
 const VALIDATION_DELAY_MS = 120;
 /**
@@ -1866,10 +3450,34 @@ export const VERDICT_PROPS = [
  * knows: `backgroundTransitionVisibleProps` reads the prop each framework
  * writes beside the line it gates. A framework whose background declares no
  * toggle contributes nothing and the set is the constant.
+ *
+ * ## `text`, and why it is not in the constant
+ *
+ * `label-presence` is the one family whose verdict turns on an element's words,
+ * and words are what a user changes by TYPING. Watched unconditionally, every
+ * keystroke in every shape on the board would wake the debounced evaluation —
+ * a cost paid by every document, for a question most of them never ask.
+ *
+ * So it is added exactly when a REAL-TIME rule of that family is registered.
+ * The moment filter is deliberate and mirrors {@link backgroundElementIds}: an
+ * on-demand rule is never evaluated on the gesture path, so waking that path for
+ * it would hand back precisely what declaring the second moment bought — and a
+ * framework that wants its naming checked while the user types says so by
+ * declaring the rule real-time, which is the one place that decision belongs.
  */
 export function verdictPropsOf(rules) {
     const props = new Set(VERDICT_PROPS);
     for (const rule of rules) {
+        if (rule.family === 'label-presence' && isRealtime(rule))
+            props.add('text');
+        // The level a VIEW declares decides which roles it admits, so changing it —
+        // or clearing it back to "free sketch", which DELETES the key, which is why
+        // `touchesVerdict` reads `oldValues` too — re-judges everything drawn on
+        // that frame. Derived from the rule's own declaration and never from a name
+        // the engine knows, exactly like the transition toggles below.
+        if (rule.admissibility !== undefined) {
+            props.add(rule.admissibility.levelProp);
+        }
         if (rule.background === undefined)
             continue;
         for (const prop of backgroundTransitionVisibleProps(rule.background)) {
@@ -1906,8 +3514,6 @@ export function touchesVerdict(payload, watched = VERDICT_PROPS) {
     }
     return false;
 }
-/** Shared answer for "this element is nobody's frame", allocated once. */
-const EMPTY_FRAMEWORKS = new Set();
 /**
  * Owns the evaluation and the reactive violation list. No-op until a framework
  * registers a rule.
@@ -2029,6 +3635,7 @@ export class ValidationManager extends InteractivityExtension {
         this._rules = null;
         this._verdictProps = null;
         this._nudges = null;
+        this._frameworks = null;
         this._profiles = null;
         this._subscriptions = [];
         this._disposeSurfaceEffect = null;
@@ -2066,6 +3673,15 @@ export class ValidationManager extends InteractivityExtension {
         this._nudges ??= Array.from(this.std.provider.getAll(QualityNudgeIdentifier).values());
         return this._nudges;
     }
+    /**
+     * Registered root-instance declarations, resolved once. Empty when every
+     * framework derives its frames from its rules, which is all of them but the
+     * ones that ship no rule at all — see {@link ValidationFrameworkDef}.
+     */
+    get _activeFrameworks() {
+        this._frameworks ??= Array.from(this.std.provider.getAll(ValidationFrameworkIdentifier).values());
+        return this._frameworks;
+    }
     /**
      * Registered profiles, resolved once. Empty when no framework ships one, in
      * which case every rule is judged by its own declared severity.
@@ -2078,9 +3694,18 @@ export class ValidationManager extends InteractivityExtension {
         return this.std.getOptional(OverlayIdentifier(ValidationOverlay.overlayName));
     }
     mounted() {
-        // Flag off (no rule registered) => never subscribe, never evaluate.
-        // The cost of validation on a board with no framework enabled is this
-        // single length check, once.
+        // No rule registered => never subscribe, never evaluate. The cost of
+        // validation on a board where nothing can be evaluated is this single
+        // length check, once.
+        //
+        // Deliberately about the RULES alone, and not about the root-instance
+        // declarations that also feed `frameworksOf`: what the subscriptions drive
+        // is the evaluation, and a framework that registers no rule has nothing to
+        // evaluate however many frames it declares. Its tooling reaches the user
+        // through getters nobody subscribes to — `nudgesFor` for the Map quality
+        // popup, `profilesFor` for the toolbar dropdown — which are called on the
+        // element in hand at the moment of the gesture, and answer the same thing
+        // whether or not this method ever ran.
         if (this._activeRules.length === 0)
             return;
         // The surface is a SIGNAL, not a fact: it can legitimately be null at
@@ -2199,15 +3824,13 @@ export class ValidationManager extends InteractivityExtension {
         return this._activeRules.find(rule => rule.id === ruleId);
     }
     /**
-     * The profiles selectable on `element`, i.e. those of every framework that
-     * measures against a background carrying this element's ROLE.
+     * The profiles selectable on `element`, i.e. those of every framework it is a
+     * ROOT INSTANCE of ({@link frameworksOf}).
      *
-     * Derived from the registered rules rather than from a second registry: a
-     * rule already names the role of the frame it measures against
-     * (`backgroundRole`), which is the only thing that makes an element a root
-     * instance in the engine's eyes. So the answer is gated for free — flag off,
-     * no rule, no profile offered — and a framework that ships profiles but no
-     * rule offers nothing to choose between, correctly.
+     * Gated for free: flag off, nothing registered, no framework, no profile
+     * offered. A framework that ships profiles and is a root instance of nothing —
+     * neither a rule framing against the role nor a declaration naming it —
+     * offers nothing to choose between, correctly.
      *
      * Empty for a neutral element, and for a background authored before its role
      * existed: no role, no framework, no profile.
@@ -2219,32 +3842,22 @@ export class ValidationManager extends InteractivityExtension {
         return this._activeProfiles.filter(profile => frameworks.has(profile.framework));
     }
     /**
-     * The frameworks `element` is a ROOT INSTANCE of, i.e. those with a registered
-     * rule measuring against a background carrying this element's role.
+     * The frameworks `element` is a ROOT INSTANCE of — those with a registered
+     * rule measuring against a background carrying this element's role, and those
+     * that declared the role outright ({@link ValidationFrameworkDef}).
      *
      * The one test that decides whether an element is a framework's frame, and the
-     * only one: it is derived from the registered rules rather than from a second
-     * registry, so it is gated for free — flag off, no rule, no framework — and
-     * every per-instance surface (the profile picker, the nudge checklist, the
-     * check-up) agrees about what a root instance is without any of them saying so
-     * twice.
+     * only one: every per-instance surface (the profile picker, the nudge
+     * checklist, the check-up) agrees about what a root instance is without any of
+     * them saying so twice. Both sources are registered from the flag-gated view
+     * extension, so it stays gated for free — flag off, nothing registered, no
+     * framework.
      *
      * Empty for a neutral element, and for a background authored before its role
      * existed.
      */
     frameworksOf(element) {
-        const role = element.role;
-        if (role === undefined)
-            return EMPTY_FRAMEWORKS;
-        const frameworks = new Set();
-        for (const rule of this._activeRules) {
-            if (rule.backgroundRole === undefined)
-                continue;
-            if (roleIsA(role, rule.backgroundRole, rule.roles)) {
-                frameworks.add(rule.framework);
-            }
-        }
-        return frameworks;
+        return frameworksOfRole(element.role, this._activeRules, this._activeFrameworks);
     }
     /**
      * The nudges offered on `element` (PF7.10), in declared order.
@@ -2419,9 +4032,7 @@ export class ValidationManager extends InteractivityExtension {
                 sliceStart = performance.now();
             }
         }
-        return generation === this._checkupGeneration
-            ? this.checkup$.peek()
-            : null;
+        return generation === this._checkupGeneration ? this.checkup$.peek() : null;
     }
     /**
      * The profile `element` is actually checked against — the one it names, or