@formicoidea/labre-core 0.37.0 → 0.38.1

package/dist/_pkgs/affine-block-surface/extensions/validation.js

@@ -3,11 +3,22 @@ import { Bound, lineIntersects } from '../../global/gfx/index.js';
 import { GfxGroupLikeElementModel, GfxPrimitiveElementModel, InteractivityExtension, roleIsA, } from '../../std/gfx/index.js';
 import { effect, signal } from '@preact/signals-core';
 import { backgroundPlot } from '../framework-background/def.js';
-import { backgroundAxisFact, backgroundTransitionBands, backgroundTransitionVisibleProps, } from '../framework-background/facts.js';
+import { backgroundAxisFact, backgroundTransitionBands, backgroundTransitionVisibleProps, containingFrame, } from '../framework-background/facts.js';
 import { backgroundInVariant } from '../framework-background/labels.js';
 import { Overlay, OverlayIdentifier } from '../renderer/overlay.js';
 import { QualityNudgeIdentifier } from './map-quality.js';
 import { ViolationTimeline } from './violation-timeline.js';
+/**
+ * The four scopes from narrowest to widest — the ONLY place the order lives, so
+ * "widening only" is a `Math.max` over two indexes rather than a test somebody
+ * has to remember to write.
+ */
+const SCOPE_ORDER = [
+    'element',
+    'relations',
+    'frame',
+    'surface',
+];
 /**
  * Severity `profile` gives `rule` — the rule's own when the profile is silent
  * about it, or when there is no profile at all.
@@ -190,6 +201,49 @@ function isRuleSilent(rule, chosen, index) {
     }
     return true;
 }
+/**
+ * Whether a finding at `severity` is one the DRAWING user is shown. `'audit'`
+ * is collected and never drawn, `'off'` is not raised at all — a level that
+ * silences a rule is not a level that shows it.
+ */
+function isDrawn(severity) {
+    return severity !== 'audit' && severity !== 'off';
+}
+/**
+ * Whether `rule` is `'audit'` (or `'off'`) under EVERY profile in play on this
+ * surface — in which case no gesture can ever draw one of its findings, and it
+ * is evaluated on demand instead ({@link momentOf}).
+ *
+ * The exact walk {@link isRuleSilent} does, for the other severity that decides
+ * something before an element is read: the framework's default profile counts
+ * unconditionally, and then every profile a root instance on this surface has
+ * CHOSEN. A frame raised to a level that shows the finding therefore puts the
+ * rule back on the drawing path — for the whole pass, on the next gesture,
+ * because `validationProfile` is a {@link VERDICT_PROPS} and the choice wakes
+ * the evaluation that re-asks this question.
+ *
+ * No profile registered at all ({@link ProfileIndex} absent) means the rule's
+ * own declaration is the whole answer.
+ */
+function isRuleAuditOnly(rule, chosen, index) {
+    if (index === null)
+        return !isDrawn(rule.severity);
+    if (isDrawn(profileSeverity(rule, index.defaults.get(rule.framework)))) {
+        return false;
+    }
+    if (chosen === null)
+        return true;
+    for (const id of chosen.values()) {
+        const profile = index.byId.get(id);
+        // Unknown id, or another framework's: falls back to the default, already
+        // known to draw nothing.
+        if (profile === undefined || profile.framework !== rule.framework)
+            continue;
+        if (isDrawn(profileSeverity(rule, profile)))
+            return false;
+    }
+    return true;
+}
 /**
  * Re-judge what a rule raised, background by background: rewrite each finding's
  * severity to what its own profile says, and drop the ones the profile turned
@@ -273,6 +327,11 @@ function backgroundsOf(rule, elements) {
  * full sweep. An on-demand rule never takes part in that pass, so the frames it
  * measures against have nothing to invalidate — and a framework whose only rules
  * are on-demand has no incremental pass to protect in the first place.
+ *
+ * The DECLARED moment, deliberately, and not the one the levels in force decide
+ * ({@link momentOf}): this is a set of ids and not a verdict, so an audit rule
+ * whose frames it guards costs one extra id and can never make an answer wrong,
+ * where reading the levels here would mean re-reading the surface for it.
  */
 export function backgroundElementIds(rules, elements) {
     const ids = new Set();
@@ -469,15 +528,19 @@ function raise(rule, elementIds, backgroundId, words = rule) {
  * Cost: two linear passes, one `elementBound` per candidate. Backgrounds are
  * counted in units, so the per-element cost is constant in practice.
  */
-function evaluateElementInBackground(rule, elements) {
+function evaluateElementInBackground(rule, elements, incremental) {
     const subjectRole = rule.appliesTo;
     if (subjectRole === undefined)
         return [];
     const backgrounds = backgroundsOf(rule, elements);
     if (backgrounds.length === 0)
         return [];
+    // Subjects filter here; the `backgrounds` index above stays whole.
+    const judged = incremental?.subjects;
     const violations = [];
     for (const el of elements) {
+        if (judged !== undefined && !judged.has(el.id))
+            continue;
         // Cheapest possible exit for a neutral element: no role, no evaluation.
         if (el.role === undefined)
             continue;
@@ -702,7 +765,7 @@ function centreOf(bound) {
  * Cost: one `elementBound` and one path read per subject, plus the frame
  * attribution. Constant per element — the frames are counted in units.
  */
-function evaluateOrientationAgainstAxis(rule, elements) {
+function evaluateOrientationAgainstAxis(rule, elements, incremental) {
     const subjectRole = rule.appliesTo;
     const against = rule.against;
     const def = rule.background;
@@ -719,8 +782,12 @@ function evaluateOrientationAgainstAxis(rule, elements) {
     // Beyond this angle from the axis' forward sense, the subject runs against
     // it. Perpendicular (90°) plus the declared dead zone.
     const limit = Math.cos(((90 + against.toleranceDeg) * Math.PI) / 180);
+    // Subjects filter here; the `backgrounds` index above stays whole.
+    const judged = incremental?.subjects;
     const violations = [];
     for (const el of elements) {
+        if (judged !== undefined && !judged.has(el.id))
+            continue;
         if (el.role === undefined)
             continue;
         if (!roleIsA(el.role, subjectRole, rule.roles))
@@ -1198,10 +1265,12 @@ function pathsCross(a, b) {
  *
  * ## Cost, and the dirty set
  *
- * Naive it is O(p²) over the PARTICIPANTS — the elements carrying one of the
- * declared roles, never the whole surface — with every bound read exactly once
- * and a rectangle test as the inner loop. That is what the bench measures on
- * the reference map, and it fits.
+ * The full pass is a SWEEP-AND-PRUNE over the PARTICIPANTS — the elements
+ * carrying one of the declared roles, never the whole surface. Sorted by left
+ * edge, each subject is tested only against the ones that begin before it ends,
+ * so what used to be p²/2 rectangle tests is now p log p plus the couples that
+ * actually share an x band. That is what the bench measures on the reference
+ * map, and it fits with room to spare.
  *
  * With an {@link IncrementalContext} it is O(|dirty| × p): findings that name
  * only untouched elements are carried over from the previous evaluation, and
@@ -1269,11 +1338,76 @@ function evaluateNoOverlap(rule, elements, incremental) {
         const [first, second] = a.id < b.id ? [a, b] : [b, a];
         found.push(raise(rule, [first.id, second.id], attributeBackground(first.bound, backgrounds)?.id));
     };
+    /**
+     * The full pass: sweep-and-prune on x, not every couple.
+     *
+     * Sorted by left edge, a subject only has to be tested against the ones whose
+     * left edge is still inside its own right edge — past that, every remaining
+     * subject starts further right than this one ends, and the list is sorted, so
+     * the walk stops rather than skips.
+     *
+     * The prune is exactly conservative, and not by geometric luck:
+     * {@link subjectsCollide} opens with `boundsOverlap`, which needs
+     * `a.maxX - b.minX > OVERLAP_EPSILON`. A pair the walk stops at has
+     * `b.minX > a.maxX`, i.e. that difference NEGATIVE — a pair the naive sweep
+     * also answered `false` for, whatever geometry it carried. So an `edge`
+     * subject whose bound did not enclose its path would already be missed by the
+     * naive sweep for the same reason, and the prune cannot lose a crossing the
+     * old code found. (In production it does enclose it: a connector's `xywh` IS
+     * the bounding box of its path — `updatePath` in the connector manager — so
+     * nothing is lost either way.) The stop is `>` rather than `>=` so a
+     * zero-width box sitting exactly on another's right edge is still handed to
+     * `subjectsCollide`, which is the half that owns the touching-versus-
+     * overlapping question.
+     *
+     * Inside the band, the y gate is the same two comparisons `boundsOverlap`
+     * would make, on the same `Bound` fields, with the same epsilon and the same
+     * strict `>` — written out so the ~91 % of surviving couples that miss on y
+     * die before `declared` builds its closures. A pair it skips is a pair
+     * `subjectsCollide` returns `false` for on its first line.
+     *
+     * ponytail: one SORTED axis only — y is a filter inside the band, not an
+     * index. The remaining super-linear term is the DENSITY of subjects sharing
+     * an x band: a board where every subject spans the full width still walks
+     * p²/2 couples, and nothing here notices. It walks them at two subtractions
+     * each now rather than at a `declared` closure, which is a constant and not a
+     * class. The upgrade path when a real board does that is to make y an index
+     * too (sort on it as well and intersect the two candidate sets) or a uniform
+     * grid keyed on the bound; both cost memory per pass, which is why neither is
+     * here yet.
+     */
     const sweep = () => {
-        for (let i = 0; i < subjects.length; i++) {
-            for (let j = i + 1; j < subjects.length; j++)
-                test(subjects[i], subjects[j]);
+        const order = subjects.map((_, index) => index);
+        order.sort((a, b) => subjects[a].bound.x - subjects[b].bound.x);
+        for (let i = 0; i < order.length; i++) {
+            const a = subjects[order[i]];
+            const reach = a.bound.maxX;
+            const aMinY = a.bound.y;
+            const aMaxY = a.bound.y + a.bound.h;
+            for (let j = i + 1; j < order.length; j++) {
+                const b = subjects[order[j]];
+                if (b.bound.x > reach)
+                    break;
+                // the cheap axis first; `declared` allocates and runs after
+                const bMinY = b.bound.y;
+                if (bMinY + b.bound.h - aMinY <= OVERLAP_EPSILON ||
+                    aMaxY - bMinY <= OVERLAP_EPSILON)
+                    continue;
+                test(a, b);
+            }
         }
+        // Findings come out in x order now rather than in document order. Nothing
+        // reads them ordered — every consumer and every spec keys or sorts them —
+        // but a pass whose output depends on how its input happened to be sorted is
+        // a bad thing to leave lying around, so one line pins it. The ids of a pair
+        // are already sorted against each other by `test`.
+        found.sort((x, y) => x.elementIds[0] !== y.elementIds[0]
+            ? x.elementIds[0] < y.elementIds[0]
+                ? -1
+                : 1
+            : x.elementIds[1] < y.elementIds[1]
+                ? -1
+                : 1);
         return found;
     };
     if (incremental === undefined)
@@ -1299,11 +1433,17 @@ function evaluateNoOverlap(rule, elements, incremental) {
     /**
      * ...and so does a change big enough that the shortcut is no longer one.
      *
-     * The dirty path costs `dirtyParticipants × p`; the sweep costs `p²/2`. Past
-     * the crossover the "optimisation" is several times the price of the thing it
-     * replaces — measured at 8× and OUT of the 16 ms budget for a lasso drag over
-     * a third of a 500-element map, against 2.2 ms for the sweep it was avoiding.
-     * One comparison buys back the worst case entirely.
+     * The dirty path costs `dirtyParticipants × p`; the sweep costs `p²/2` at
+     * worst and much less than that since it prunes on x. Past the crossover the
+     * "optimisation" is several times the price of the thing it replaces —
+     * measured at 8× and OUT of the 16 ms budget for a lasso drag over a third of
+     * a 500-element map, against 2.2 ms for the sweep it was avoiding. One
+     * comparison buys back the worst case entirely, and the pruned sweep only
+     * makes the comparison more conservative: the branch it falls back to is
+     * cheaper than the one this half of the ratio was calibrated against, never
+     * dearer. The dirty loop itself is left NAIVE on purpose — it is the
+     * independent oracle the fuzz in `validation-incremental.unit.spec.ts`
+     * compares the pruned sweep against.
      */
     let dirtyParticipants = 0;
     const isDirty = subjects.map(subject => {
@@ -1523,7 +1663,7 @@ function departsFromTones(el, allowed) {
  * and indicting the whole board over a broken declaration is the one outcome
  * worse than silence.
  */
-function evaluateToneConvention(rule, elements) {
+function evaluateToneConvention(rule, elements, incremental) {
     const subjectRole = rule.appliesTo;
     const tone = rule.tone;
     const def = rule.background;
@@ -1548,8 +1688,12 @@ function evaluateToneConvention(rule, elements) {
         return [];
     }
     const backgrounds = backgroundsOf(rule, elements);
+    // Subjects filter here; the `backgrounds` index above stays whole.
+    const judged = incremental?.subjects;
     const violations = [];
     for (const el of elements) {
+        if (judged !== undefined && !judged.has(el.id))
+            continue;
         if (el.role === undefined)
             continue;
         if (!roleIsA(el.role, subjectRole, rule.roles))
@@ -1578,7 +1722,7 @@ function evaluateToneConvention(rule, elements) {
  * and the rule ships inert rather than waiting in a branch somewhere for
  * somebody to remember it.
  */
-function evaluateMajorityFact(rule, elements) {
+function evaluateMajorityFact(rule, elements, incremental) {
     const subjectRole = rule.appliesTo;
     const majority = rule.majority;
     if (subjectRole === undefined || majority === undefined)
@@ -1610,10 +1754,16 @@ function evaluateMajorityFact(rule, elements) {
         if (fact === majority.value)
             counts.matching += 1;
     }
+    // Subjects filter below; the TALLY above stays whole — a majority counted
+    // over a dirty subset is not a majority. The subject here is the FRAME, which
+    // is what the finding is raised on.
+    const judged = incremental?.subjects;
     const violations = [];
     // Sorted, so a board with two qualifying maps always reports them the same
     // way whichever order the surface happened to be walked in.
     for (const id of [...tally.keys()].sort()) {
+        if (judged !== undefined && !judged.has(id))
+            continue;
         const counts = tally.get(id);
         // THE GATE: nothing here carries the fact, so there is no majority to be in.
         if (counts.known === 0)
@@ -1698,7 +1848,7 @@ function boundEnds(el) {
  * two edges and is judged as two edges: at least one of them is against the
  * order, and that one is reported.
  */
-function evaluateRelativeOrder(rule, elements) {
+function evaluateRelativeOrder(rule, elements, incremental) {
     const order = rule.relativeOrder;
     const def = rule.background;
     if (order === undefined || def === undefined)
@@ -1732,8 +1882,13 @@ function evaluateRelativeOrder(rule, elements) {
         const centre = centreOf(bound);
         return centre[0] * axis.forward[0] + centre[1] * axis.forward[1];
     };
+    // Subjects filter here; the `byId` index above stays whole, or an end outside
+    // the subset would look like a deleted element.
+    const judged = incremental?.subjects;
     const violations = [];
     for (const edge of edges) {
+        if (judged !== undefined && !judged.has(edge.id))
+            continue;
         const ends = boundEnds(edge);
         if (ends === null)
             continue;
@@ -1875,12 +2030,13 @@ function namedElements(ids) {
  * pair-wise sweep over the nodes: the rule is about relations somebody drew,
  * never about every couple that could have had one.
  *
- * An {@link IncrementalContext} is deliberately NOT honoured, exactly like
- * `relative-order-along-axis`: a dirty set names the elements that moved, and
- * this family's verdict does not depend on where anything is. Re-reading every
- * edge is the cost of the linear pass it already was.
+ * Since PF5.4 an {@link IncrementalContext} filters the EDGES it judges, and
+ * the two-hop `'relations'` closure is what makes the pair walk below still
+ * right: a dirty edge puts its ends in the closure, and every SIBLING edge on
+ * those ends comes in with them — which is exactly what the duplicate and
+ * exclusivity verdicts read.
  */
-function evaluateRelationEndpoints(rule, elements) {
+function evaluateRelationEndpoints(rule, elements, incremental) {
     const endpoints = rule.endpoints;
     if (endpoints === undefined)
         return [];
@@ -1959,12 +2115,17 @@ function evaluateRelationEndpoints(rule, elements) {
     // would have allocated all three just to drop them. This runs on the gesture
     // path, inside the 16 ms the drawing has.
     const needsPairs = endpoints.forbidDuplicate === true || exclusivePairs.length > 0;
+    // Subjects filter here and on the neutral pass below; the `byId` index and
+    // the two role lists above stay whole.
+    const judged = incremental?.subjects;
     const violations = [];
     // Every relation drawn between one UNORDERED pair of elements, which is the
     // grain both the duplicate and the exclusivity questions are asked at. Filled
     // in the same pass that judges the sentences, walked once afterwards.
     const between = new Map();
     for (const { el: edge, role } of edges) {
+        if (judged !== undefined && !judged.has(edge.id))
+            continue;
         const ends = endpointIds(edge);
         if (ends === null)
             continue;
@@ -2039,6 +2200,8 @@ function evaluateRelationEndpoints(rule, elements) {
     // else — a link from an artefact to itself is not evidence that a typed
     // relation was meant.
     for (const el of neutral) {
+        if (judged !== undefined && !judged.has(el.id))
+            continue;
         const ends = boundEnds(el);
         if (ends === null)
             continue;
@@ -2171,14 +2334,7 @@ function zoneRegions(def, zoneIds, frame) {
  * answer decides where a persisted arbitration is written.
  */
 function containingBackground(bound, backgrounds) {
-    let found = null;
-    for (const background of backgrounds) {
-        if (!background.bound.contains(bound))
-            continue;
-        if (found === null || background.id < found.id)
-            found = background;
-    }
-    return found;
+    return containingFrame(bound, backgrounds, background => background.bound);
 }
 /**
  * "Is this artefact in the region it belongs in?" — the zone half of
@@ -2203,7 +2359,7 @@ function containingBackground(bound, backgrounds) {
  * a frame of reference that is still fully on screen. Judge the drawing that is
  * on the canvas — and a hidden tint does not take a quadrant off it.
  */
-function evaluateElementInZone(rule, elements) {
+function evaluateElementInZone(rule, elements, incremental) {
     const subjectRole = rule.appliesTo;
     const inZone = rule.inZone;
     const def = rule.background;
@@ -2234,8 +2390,12 @@ function evaluateElementInZone(rule, elements) {
     // right only for as long as nobody moved this map out of one evaluation.
     const regionsOf = new Map();
     const extent = inZone.measure === 'extent';
+    // Subjects filter here; the `backgrounds` index above stays whole.
+    const judged = incremental?.subjects;
     const violations = [];
     for (const el of elements) {
+        if (judged !== undefined && !judged.has(el.id))
+            continue;
         if (el.role === undefined)
             continue;
         if (!roleIsA(el.role, subjectRole, rule.roles))
@@ -2351,7 +2511,7 @@ function evaluateElementInZone(rule, elements) {
  * walk, nothing quadratic — the same budget `element-in-background` and
  * `role-count` are measured on.
  */
-function evaluateViewAdmissibility(rule, elements) {
+function evaluateViewAdmissibility(rule, elements, incremental) {
     const def = rule.admissibility;
     if (def === undefined)
         return [];
@@ -2381,8 +2541,12 @@ function evaluateViewAdmissibility(rule, elements) {
     // is walked.
     if (views.length === 0)
         return [];
+    // Subjects filter here; the `views` index above stays whole.
+    const judged = incremental?.subjects;
     const violations = [];
     for (const el of elements) {
+        if (judged !== undefined && !judged.has(el.id))
+            continue;
         // Cheapest possible exit for a neutral element: no role, no evaluation.
         const role = el.role;
         if (role === undefined)
@@ -2465,7 +2629,7 @@ function evaluateViewAdmissibility(rule, elements) {
  * No pair-wise sweep and no closure: the rule is about the relations somebody
  * drew, never about the ones they could have drawn.
  */
-function evaluateEdgeDegree(rule, elements) {
+function evaluateEdgeDegree(rule, elements, incremental) {
     const subjectRole = rule.appliesTo;
     const degree = rule.degree;
     if (subjectRole === undefined || degree === undefined)
@@ -2531,8 +2695,13 @@ function evaluateEdgeDegree(rule, elements) {
     // Only resolved when something is actually wrong: a conformant board is the
     // common case and must not pay for the frames it never names.
     let backgrounds = null;
+    // Subjects filter here; the DEGREE counts above are tallied over every edge
+    // on the surface, or a node's degree would be the degree of its neighbourhood.
+    const judged = incremental?.subjects;
     const violations = [];
     for (const subject of subjects) {
+        if (judged !== undefined && !judged.has(subject.el.id))
+            continue;
         const words = minIn !== undefined && subject.in < minIn
             ? (degree.tooFewIn ?? rule)
             : maxIn !== undefined && subject.in > maxIn
@@ -2605,7 +2774,7 @@ function evaluateEdgeDegree(rule, elements) {
  * subject per frame — the frames are counted in units, so this is constant per
  * element in practice, like every other attribution in this file.
  */
-function evaluateRoleCount(rule, elements) {
+function evaluateRoleCount(rule, elements, incremental) {
     const count = rule.roleCount;
     if (count === undefined)
         return [];
@@ -2653,10 +2822,16 @@ function evaluateRoleCount(rule, elements) {
         if (arms)
             armed.add(frame.id);
     }
+    // Subjects filter below; the TALLY above stays whole — a count over a dirty
+    // subset is not a count. The subject here is the FRAME, which is what the
+    // finding is raised on.
+    const judged = incremental?.subjects;
     const violations = [];
     // Sorted, so a board with several offending frames always reports them the
     // same way whichever order the surface happened to be walked in.
     for (const id of [...tally.keys()].sort()) {
+        if (judged !== undefined && !judged.has(id))
+            continue;
         // A frame the guard has not armed is not judged at all — not walked, not
         // found compliant. That is the difference between "this notation requires
         // one" and "this notation requires one WHEN the other is there".
@@ -2714,7 +2889,7 @@ function evaluateRoleCount(rule, elements) {
  * Linear in the elements plus linear in the edges, with the plots resolved once
  * per frame.
  */
-function evaluateEdgeLocality(rule, elements) {
+function evaluateEdgeLocality(rule, elements, incremental) {
     const locality = rule.locality;
     if (locality === undefined)
         return [];
@@ -2737,8 +2912,12 @@ function evaluateEdgeLocality(rule, elements) {
     if (edges.length === 0)
         return [];
     const same = locality.mode === 'same-background';
+    // Subjects filter here; the `byId` index and the frame plots above stay whole.
+    const judged = incremental?.subjects;
     const violations = [];
     for (const edge of edges) {
+        if (judged !== undefined && !judged.has(edge.id))
+            continue;
         const ends = boundEnds(edge);
         if (ends === null)
             continue;
@@ -3025,7 +3204,7 @@ function elementLabel(el) {
  * One pass, one `text` read per subject. Linear, and paid only by the elements
  * carrying the subject role.
  */
-function evaluateLabelPresence(rule, elements) {
+function evaluateLabelPresence(rule, elements, incremental) {
     const subjectRole = rule.appliesTo;
     const label = rule.label;
     if (subjectRole === undefined || label === undefined)
@@ -3035,8 +3214,12 @@ function evaluateLabelPresence(rule, elements) {
     // Only resolved when something is actually wrong — a named board pays nothing
     // for the frames it never has to name.
     let backgrounds = null;
+    // Subjects filter here; nothing above it is an index this family shares.
+    const judged = incremental?.subjects;
     const violations = [];
     for (const el of elements) {
+        if (judged !== undefined && !judged.has(el.id))
+            continue;
         // Cheapest possible exit for a neutral element: no role, no evaluation.
         if (el.role === undefined)
             continue;
@@ -3067,7 +3250,567 @@ const RULE_FAMILIES = {
     'label-presence': evaluateLabelPresence,
     'view-admissibility': evaluateViewAdmissibility,
 };
-/** A rule the drawing path evaluates. `moment` absent means `'realtime'`. */
+/**
+ * What a verdict of each family DEPENDS ON (PF5.3) — read off the evaluator
+ * beside it, one line of justification each.
+ *
+ * `Record<RuleFamily, RuleScope>`, so a family added without an entry is a
+ * BUILD error and never a silent `'surface'`. Nothing reads this table yet:
+ * PF5.4 will compute its dirty-set closure from it, and a family that changes
+ * what its evaluator reads has to change its line here on the same commit.
+ *
+ * Over-approximating is always SAFE — a wider scope re-evaluates more than it
+ * had to. Under-approximating is a stale verdict, so a family whose evidence is
+ * ambiguous is declared wider, not narrower.
+ */
+export const RULE_SCOPES = {
+    // Own bound against the frames; the frame it is nearest to is attribution only.
+    'element-in-background': 'element',
+    // Own direction against an axis the RULE declares; the frame is attribution only.
+    'orientation-against-axis': 'element',
+    // Widened from 'frame': the carriers it must be posed ON are collected from
+    // the WHOLE surface, bounded by a tolerance and by no frame at all, so a
+    // carrier moving anywhere can flip a subject's verdict.
+    attachment: 'surface',
+    // Pair-wise over every participant on the board; keeps its own dirty-set logic.
+    'no-overlap': 'surface',
+    // Element-local in fact — own colour props against the rule's declared palette
+    // — but kept at the wider level: no evaluator has ever been narrowed by guess.
+    'tone-convention': 'frame',
+    // Tallies the fact over every subject attributed to one frame.
+    'majority-fact': 'frame',
+    // The edge, the bounds of the two elements it binds, and their common frame.
+    'relative-order-along-axis': 'relations',
+    // The ends' roles, plus the sibling edges on the same pair (duplicate,
+    // exclusivity) — one hop through the two ends.
+    'relation-endpoints': 'relations',
+    // Own bound against the zones of the frame that contains it.
+    'element-in-zone': 'element',
+    // Counts every edge naming the node, wherever that edge is drawn.
+    'edge-degree': 'relations',
+    // Counts the subjects contained in one frame's plot, and reports ON the frame.
+    'role-count': 'frame',
+    // The edge and the frames containing its two ends.
+    'edge-locality': 'relations',
+    // Widened from 'frame': the traversal is over the WHOLE surface's arcs, and
+    // its own header says any dirty edge invalidates the answer — re-pointing one
+    // edge orphans or rescues nodes nowhere near it.
+    reachability: 'surface',
+    // Own words; the frame is attribution only.
+    'label-presence': 'element',
+    // Own role against the level the containing view declares; kept at the wider
+    // level for the same reason as `tone-convention`.
+    'view-admissibility': 'frame',
+};
+/**
+ * The dependency scope in force for `rule`: the WIDER of its family's and its
+ * own.
+ *
+ * Widening-only by construction rather than by a test — the answer is a
+ * `Math.max` over two positions in {@link SCOPE_ORDER}, so a rule declaring a
+ * narrower scope than its family simply does not get it.
+ *
+ * An unknown family — a serialized rule shipped by a host against a build that
+ * does not have it — resolves to `'surface'`, the safe answer.
+ */
+export function scopeOf(rule) {
+    const family = RULE_SCOPES[rule.family] ?? 'surface';
+    if (rule.scope === undefined)
+        return family;
+    const widest = Math.max(SCOPE_ORDER.indexOf(family), SCOPE_ORDER.indexOf(rule.scope));
+    // A `scope` that is not one of the four gives -1 on both sides only if the
+    // family is unknown too; either way the fallback is the widest answer.
+    return SCOPE_ORDER[widest] ?? 'surface';
+}
+/**
+ * The key a frame-role GROUP is memoised under: the framework and the role,
+ * never the rule.
+ *
+ * Two rules of one framework framing against the same role look at the same
+ * instances, and resolving them twice would pay a surface walk per rule for one
+ * answer. `null` for a rule that frames against nothing.
+ */
+function frameKey(rule) {
+    if (rule.backgroundRole === undefined)
+        return null;
+    // Joined by NUL, which no framework id and no role id contains.
+    return `${rule.framework}\u0000${rule.backgroundRole}`;
+}
+/**
+ * Every (element, frame) attribution, deliberately OVER-approximated: the frame
+ * {@link attributeBackground} names, plus every frame whose box holds the
+ * element's centre.
+ *
+ * The union of what the frame families actually ask — `attributeBackground`'s
+ * contains-or-nearest, `containingBackground`'s whole containment, and
+ * `plotContaining`'s centre-in-plot — read WITHOUT the plot arithmetic, so one
+ * answer serves every rule framing against the role whatever geometry each one
+ * declares. A plot is a sub-region of the box, so centre-in-plot implies
+ * centre-in-box; whole containment implies it too. Over-approximating widens a
+ * closure and can never lose a verdict.
+ *
+ * ponytail: the two halves are individually redundant on the SEVEN PACKS
+ * SHIPPED TODAY — the fuzz still passes with either one deleted, and fails the
+ * moment both go. They stop being redundant as soon as a framework declares a
+ * background margin big enough to push a contained element's centre out of its
+ * own plot while another frame's plot holds it, which is a geometry no pack has
+ * drawn yet and none is stopped from drawing. Two `Bound` tests per element,
+ * over frames counted in units; not worth trading for an argument that has to
+ * be re-derived every time a pack adds a margin.
+ */
+function attributeAll(elements, frames, add) {
+    if (frames.length === 0)
+        return;
+    for (const el of elements) {
+        const bound = el.elementBound;
+        const attributed = attributeBackground(bound, frames);
+        if (attributed !== null)
+            add(el.id, attributed.id);
+        const centre = centreOf(bound);
+        for (const frame of frames) {
+            if (frame.bound.containsPoint(centre))
+                add(el.id, frame.id);
+        }
+    }
+}
+/**
+ * The frames each element is attributed to, for the FRAME-scope rules
+ * registered — the manager's memory of a pass, handed to the next one as
+ * {@link IncrementalContext.wasIn}.
+ *
+ * The one fact the current surface cannot reconstruct: an element that has left
+ * a frame no longer says where it was, and the frame it left has one fewer
+ * subject to count. Without it a `'frame'`-scope rule has no honest incremental
+ * answer at all, which is exactly what {@link dirtyClosure} falls back to.
+ *
+ * ## Two depths, and why the shallow one is not optional
+ *
+ * The full attribution — which frame every element is on — is built for the
+ * `'frame'` scope only, since no other scope reads it. A framework like Wardley,
+ * whose rules are element, relations and surface, never pays for that walk.
+ *
+ * But every PIVOTAL element records itself under its own id — the same
+ * statement about a frame ("it is on itself"), asked at no cost beyond a role
+ * read and a prop read. Two kinds are pivotal:
+ *
+ * - a **frame** of any rule that frames against a background;
+ * - an element that **declares a level of requirement** (`validationProfile`),
+ *   because the levels in force decide the severity AND the moment of every
+ *   rule on the board, and they are INHERITED by containment
+ *   ({@link inheritChosenProfiles}) — so one of them is never a fact about one
+ *   subject.
+ *
+ * Those entries are what let {@link runRules} and {@link dirtyClosure} tell a
+ * dirty element that WAS one of the two from one that was never anything of the
+ * sort. That is the case a deletion makes unknowable, and that a role or a level
+ * changed AWAY makes invisible even while the element is still there. Without
+ * it, an incremental pass keeps verdicts measured against a map the user has
+ * just stopped calling a map, or judged at a level nobody holds any more.
+ *
+ * Real-time rules only, and the DECLARED moment, exactly like
+ * {@link backgroundElementIds} and for the same reason: an on-demand rule never
+ * takes part in an incremental pass, so it has nothing to invalidate.
+ */
+export function frameMembership(rules, elements) {
+    const membership = new Map();
+    const add = (id, frameId) => {
+        const held = membership.get(id);
+        if (held === undefined)
+            membership.set(id, [frameId]);
+        else if (!held.includes(frameId))
+            held.push(frameId);
+    };
+    const done = new Set();
+    let levelled = false;
+    for (const rule of rules) {
+        if (!isRealtime(rule))
+            continue;
+        levelled = true;
+        const key = frameKey(rule);
+        if (key === null || done.has(key))
+            continue;
+        done.add(key);
+        const frames = backgroundsOf(rule, elements);
+        // The shallow half: every frame, on itself.
+        for (const frame of frames)
+            add(frame.id, frame.id);
+        if (scopeOf(rule) !== 'frame')
+            continue;
+        attributeAll(elements, frames, add);
+    }
+    // The level-bearers, on themselves. One prop read per element, and only when
+    // there is a rule for a level to govern.
+    if (levelled) {
+        for (const el of elements) {
+            if (typeof el.validationProfile === 'string')
+                add(el.id, el.id);
+        }
+    }
+    return membership;
+}
+/**
+ * Whether the LEVELS IN FORCE may have moved since `previous` was computed — in
+ * which case nothing from it may be carried, because it is an answer to a
+ * different question.
+ *
+ * A level is not a fact about one subject: it decides each rule's severity and
+ * its MOMENT ({@link momentOf}), so a change to one can put a whole family on or
+ * off the drawing path at once, and it is inherited by containment, so moving
+ * the frame that carries one re-levels everything it holds. There is no closure
+ * of that; there is only "did anything about it change".
+ *
+ * Answered against the memory {@link frameMembership} keeps: a dirty element
+ * that declares a level NOW, or was pivotal at the last pass. A caller that
+ * keeps no memory gets the first half alone — which is the PF5.13 contract this
+ * slice inherited, unchanged, and never worse than it.
+ */
+function levelsMayHaveMoved(elements, incremental) {
+    const { dirty, wasIn } = incremental;
+    for (const el of elements) {
+        if (!dirty.has(el.id))
+            continue;
+        if (typeof el.validationProfile === 'string')
+            return true;
+    }
+    if (wasIn === undefined)
+        return false;
+    for (const id of dirty) {
+        if (wasIn.get(id)?.includes(id) === true)
+            return true;
+    }
+    return false;
+}
+/**
+ * The closure of a change (PF5.4): for each rule, which subjects a pass must
+ * re-judge for its answer to be the one a FULL pass would give.
+ *
+ * Framework-agnostic by construction — it reads roles only through
+ * {@link backgroundsOf}, ends only through {@link rawEndpointIds}, and geometry
+ * only through `elementBound`. It never asks what anything IS.
+ *
+ * ## The three closures
+ *
+ * - `'element'` — the dirty set itself. A verdict about an element's own props
+ *   changes when those props change and at no other time.
+ * - `'relations'` — the dirty set, plus the ends of every dirty edge, plus every
+ *   edge touching one of those ends. Two hops, on purpose: a dirty edge reaches
+ *   its ends, and its ends reach their SIBLING edges — which is precisely what
+ *   the duplicate and exclusivity verdicts of `relation-endpoints` read.
+ * - `'frame'` — the dirty set, plus every frame a dirty element is or WAS
+ *   attributed to, plus everything attributed to one of those frames. The frame
+ *   ids are in the set themselves, since `role-count` and `majority-fact` raise
+ *   their findings ON the frame.
+ *
+ * ## Where it refuses to answer
+ *
+ * Each of these returns `null`, i.e. a full pass for that rule, and each is a
+ * case where a narrower answer would be a GUESS:
+ *
+ * - **a frame of the rule is dirty** — moving, resizing or deleting one
+ *   re-attributes every finding measured against it. The deletion is the case a
+ *   "is a current background dirty" test cannot see on its own, so the previous
+ *   findings are asked too, exactly as {@link evaluateNoOverlap} asks them.
+ * - **a dirty element is GONE, for a `'relations'` rule** — a removal reports an
+ *   id and nothing else, so the ends of a deleted edge cannot be recovered, and
+ *   the nodes it used to bind would keep a degree nobody counts any more.
+ * - **no `wasIn`, for a `'frame'` rule** — see {@link frameMembership}.
+ *
+ * ## Cost
+ *
+ * Lazy throughout: a board of element-scope rules alone never walks an edge,
+ * and one whose frames nothing touched never builds a membership map. The
+ * relations closure is two passes over the elements, shared by every
+ * relations-scope rule; the frame membership is one pass per frame ROLE, shared
+ * by every rule framing against it.
+ */
+export function dirtyClosure(elements, dirty, previous, wasIn) {
+    const alive = new Set();
+    for (const el of elements)
+        alive.add(el.id);
+    // A dirty id that is no longer on the surface: whatever it was bound to went
+    // with it, and no walk of what is left can find out what that was.
+    let buried = false;
+    for (const id of dirty) {
+        if (!alive.has(id)) {
+            buried = true;
+            break;
+        }
+    }
+    const framesByKey = new Map();
+    const framesOf = (rule) => {
+        const key = frameKey(rule);
+        if (key === null)
+            return [];
+        let frames = framesByKey.get(key);
+        if (frames === undefined) {
+            frames = backgroundsOf(rule, elements);
+            framesByKey.set(key, frames);
+        }
+        return frames;
+    };
+    /**
+     * Whether anything dirty was a FRAME at the last pass — of any rule, which is
+     * the safe over-approximation and costs one walk of the dirty set.
+     *
+     * A frame records itself in {@link frameMembership}, so "it was a frame" is
+     * "its own id is among the frames it was attributed to". That is the one fact
+     * about a departed or re-typed frame the current surface cannot answer.
+     */
+    let wasFrame;
+    const dirtyWasFrame = () => {
+        if (wasFrame !== undefined)
+            return wasFrame;
+        wasFrame = false;
+        for (const id of dirty) {
+            if (wasIn?.get(id)?.includes(id) === true) {
+                wasFrame = true;
+                break;
+            }
+        }
+        return wasFrame;
+    };
+    const previousByRule = new Map();
+    for (const violation of previous) {
+        const held = previousByRule.get(violation.ruleId);
+        if (held === undefined)
+            previousByRule.set(violation.ruleId, [violation]);
+        else
+            held.push(violation);
+    }
+    let relations;
+    const relationsClosure = () => {
+        if (relations !== undefined)
+            return relations;
+        if (buried)
+            return (relations = null);
+        // One pass, two indexes: what each edge binds, and which edges name each
+        // element. Self-loops included — a loop IS a sentence about its node, and
+        // it counts on both sides of a degree.
+        const endsOf = new Map();
+        const incident = new Map();
+        for (const el of elements) {
+            const ends = rawEndpointIds(el);
+            if (ends === null)
+                continue;
+            endsOf.set(el.id, ends);
+            for (const end of ends) {
+                const held = incident.get(end);
+                if (held === undefined)
+                    incident.set(end, [el.id]);
+                else if (!held.includes(el.id))
+                    held.push(el.id);
+            }
+        }
+        /**
+         * The closure is exactly this: **every edge naming something in the set is
+         * in the set**.
+         *
+         * Not a fixed number of hops, and the difference is the whole correctness
+         * of the carry-over below. A finding of a relations family names its edge
+         * AND the two elements the edge binds, so it is dropped as soon as any one
+         * of the three is being re-judged — and it is only re-raised if the EDGE is
+         * too. A set that held an element without holding the edges that name it
+         * would therefore lose findings that nothing raises again, which is a
+         * verdict quietly disappearing from a live board.
+         *
+         * Seeded with the dirty set and the ends of every dirty edge, because those
+         * are the two ways a change reaches a relation: the edge itself moved, or
+         * one of the things it binds did.
+         *
+         * On any ordinary board this settles in exactly two hops — an artefact is
+         * not the endpoint of anything — and costs what "the dirty set plus the
+         * edges touching it" costs. It walks further only where an element is an
+         * edge AND an endpoint at once, which is the one shape the two-hop version
+         * got wrong.
+         */
+        const closure = new Set();
+        const queue = [];
+        const visit = (id) => {
+            if (closure.has(id))
+                return;
+            closure.add(id);
+            queue.push(id);
+        };
+        for (const id of dirty)
+            visit(id);
+        for (const id of dirty) {
+            const ends = endsOf.get(id);
+            if (ends === undefined)
+                continue;
+            visit(ends[0]);
+            visit(ends[1]);
+        }
+        // `head` walks the queue rather than shifting it: a shift is O(n) on a real
+        // array, which would turn this linear walk quadratic.
+        for (let head = 0; head < queue.length; head++) {
+            for (const edge of incident.get(queue[head]) ?? [])
+                visit(edge);
+        }
+        return (relations = closure);
+    };
+    const membershipByKey = new Map();
+    const membershipOf = (rule) => {
+        const key = frameKey(rule);
+        let map = membershipByKey.get(key);
+        if (map === undefined) {
+            const built = new Map();
+            attributeAll(elements, framesOf(rule), (id, frameId) => {
+                const held = built.get(id);
+                if (held === undefined)
+                    built.set(id, [frameId]);
+                else if (!held.includes(frameId))
+                    held.push(frameId);
+            });
+            map = built;
+            membershipByKey.set(key, map);
+        }
+        return map;
+    };
+    /**
+     * The frames whose CONTENT changed, per rule — the only reason a finding
+     * carried over from the last pass can be invalidated by something that is not
+     * one of its own elements.
+     *
+     * Empty for every scope but `'frame'`, and deliberately so: an `'element'` or
+     * `'relations'` verdict reads its frame for ATTRIBUTION only, and any change
+     * to the frame itself already took the rule through a full pass above.
+     */
+    const affectedByRule = new Map();
+    const frameClosure = (rule) => {
+        if (wasIn === undefined)
+            return null;
+        const frames = framesOf(rule);
+        // Nothing to be attributed to: the frame scope collapses to the element one.
+        if (frames.length === 0)
+            return dirty;
+        const mine = new Set(frames.map(frame => frame.id));
+        const membership = membershipOf(rule);
+        const affected = new Set();
+        for (const id of dirty) {
+            // Where it is now...
+            for (const frameId of membership.get(id) ?? []) {
+                if (mine.has(frameId))
+                    affected.add(frameId);
+            }
+            // ...and where it was, which is the half the surface cannot answer.
+            for (const frameId of wasIn.get(id) ?? []) {
+                if (mine.has(frameId))
+                    affected.add(frameId);
+            }
+        }
+        affectedByRule.set(rule.id, affected);
+        if (affected.size === 0)
+            return dirty;
+        const subjects = new Set(dirty);
+        for (const frameId of affected)
+            subjects.add(frameId);
+        for (const [id, held] of membership) {
+            if (held.some(frameId => affected.has(frameId)))
+                subjects.add(id);
+        }
+        return subjects;
+    };
+    return {
+        subjectsOf(rule) {
+            if (rule.backgroundRole !== undefined) {
+                // No memory of what the frames WERE: a dirty element may have stopped
+                // being one — deleted, or simply re-typed — and every attribution it
+                // held would silently keep the verdict it had. See
+                // {@link frameMembership}; the manager always hands this down.
+                if (wasIn === undefined)
+                    return null;
+                // A frame that IS dirty re-attributes everything measured against it...
+                if (framesOf(rule).some(frame => dirty.has(frame.id)))
+                    return null;
+                // ...and so does one that WAS, which is what the memory is for.
+                if (dirtyWasFrame())
+                    return null;
+                // ...and so does one whose findings are the only trace it left, for a
+                // pass that was handed no memory of the frame but does hold its
+                // findings ({@link evaluateNoOverlap} makes the same test).
+                const mine = previousByRule.get(rule.id);
+                if (mine?.some(violation => violation.backgroundId !== undefined &&
+                    dirty.has(violation.backgroundId))) {
+                    return null;
+                }
+            }
+            switch (scopeOf(rule)) {
+                case 'element':
+                    return dirty;
+                case 'relations':
+                    return relationsClosure();
+                case 'frame':
+                    return frameClosure(rule);
+                default:
+                    return null;
+            }
+        },
+        carried(rule, subjects) {
+            const mine = previousByRule.get(rule.id);
+            if (mine === undefined)
+                return [];
+            const affected = affectedByRule.get(rule.id);
+            return mine.filter(violation => {
+                // Judged again: the pass that judged it owns the answer, whatever it
+                // turns out to be. Keeping this one too would report the finding twice.
+                if (violation.elementIds.some(id => !alive.has(id) || subjects.has(id))) {
+                    return false;
+                }
+                const frameId = violation.backgroundId;
+                if (frameId === undefined)
+                    return true;
+                // The frame is tested against the AFFECTED set and never against
+                // `subjects`: the relations closure reaches a frame the moment a dirty
+                // edge is bound to one, and dropping every finding attributed to that
+                // frame would lose the ones nothing re-raises. Its ATTRIBUTION cannot
+                // have changed anyway — a dirty frame is a full pass, above.
+                //
+                // ponytail: for the FOUR FRAME-SCOPE FAMILIES SHIPPED TODAY this whole
+                // line is redundant, and the fuzz says so — it passes with the test
+                // reduced to `true`. It holds because each of them raises either ON the
+                // frame or on an element attributed to it, and both are already in
+                // `subjects` whenever the frame is affected. A frame-scope family whose
+                // finding named something attributed ELSEWHERE — the shape
+                // `edge-locality` already has, at a scope it does not yet claim — would
+                // carry a stale verdict without it. One set lookup per carried finding
+                // is the price of not having to re-check that argument per family.
+                return alive.has(frameId) && affected?.has(frameId) !== true;
+            });
+        },
+    };
+}
+/**
+ * The moment `rule` is evaluated at, GIVEN the levels of requirement in force
+ * on this surface — the one decision {@link runRules} takes before it reads a
+ * single element.
+ *
+ * A rule that declares the second moment keeps it, whatever any level says: an
+ * explicit `'on-demand'` is the stronger statement, and a framework that made
+ * it is not overruled by a table. Everything else turns on
+ * {@link isRuleAuditOnly}: an `audit` finding is dropped before anything draws
+ * it ({@link userFacingViolations}), so computing one inside the frame budget
+ * buys the user nothing.
+ *
+ * Mixed levels resolve towards EVALUATING, exactly as {@link isRuleSilent}
+ * needs `'off'` everywhere before it skips: one frame held to a level that
+ * shows the finding is enough to put the rule back on the drawing path for the
+ * whole pass, because the pass has one answer and a missed skip costs a linear
+ * walk where a wrong one costs a silent verdict.
+ */
+function momentOf(rule, chosen, index) {
+    if ((rule.moment ?? 'realtime') !== 'realtime')
+        return 'on-demand';
+    return isRuleAuditOnly(rule, chosen, index) ? 'on-demand' : 'realtime';
+}
+/**
+ * A rule the drawing path evaluates on its own DECLARATION alone — `moment`
+ * absent means `'realtime'`.
+ *
+ * The severity question is not asked here: this is the predicate for the two
+ * places that have no instance to read a level from ({@link verdictPropsOf},
+ * {@link backgroundElementIds}), and there the conservative answer is the right
+ * one. {@link momentOf} is what an evaluation asks.
+ */
 function isRealtime(rule) {
     return (rule.moment ?? 'realtime') === 'realtime';
 }
@@ -3133,6 +3876,18 @@ function applyExceptions(rule, raised, elements) {
  * whole surface is re-judged from scratch. Handed in, the pair-wise family
  * re-tests only the couples a change can have affected; the answer is the same,
  * it is just reached without walking the grid against itself.
+ *
+ * ## Two ways to hand one in, and two contracts
+ *
+ * - With a `previous` that IS the last verdict — the manager's debounced path —
+ *   the answer is exactly what a full pass would give, whole. That is PF5.4's
+ *   contract and the fuzz asserts it finding for finding.
+ * - With `previous: []` — a caller SEEDING the pass with its own dirty set, e.g.
+ *   the host's selection (PF7.9) — nothing is carried, so the answer is the
+ *   fresh verdicts on the closure of the seed and nothing else. For a seed `S`:
+ *   `seeded ⊆ full`, and `seeded ∩ touching(S) = full ∩ touching(S)` where
+ *   `touching(S)` is the findings naming an element or a frame of `S`. A partial
+ *   answer, never a wrong one.
  */
 export function evaluateRules(rules, elements, profiles = [], incremental) {
     return runRules(rules, elements, profiles, 'realtime', incremental);
@@ -3154,34 +3909,92 @@ function runRules(rules, elements, profiles, moment, incremental) {
     // No profile registered => not a single extra read on the whole surface.
     const index = profiles.length > 0 ? indexProfiles(profiles) : null;
     const chosen = index ? readChosenProfiles(elements) : null;
+    /**
+     * What this pass may build on, which is `incremental` unless the LEVELS in
+     * force may have moved under it.
+     *
+     * They are a property of the whole pass and not of any subject: a level
+     * decides each rule's severity and its MOMENT, so one change to one of them
+     * can put a whole family on or off the drawing path, and `previous` is then
+     * an answer to a different question — empty for a family that was on the
+     * other moment, which no carry-over and no dirty-set walk can reconstruct. So
+     * the answer is not "re-judge more", it is "there is nothing here to build
+     * on", and that applies to {@link evaluateNoOverlap} exactly as it does to
+     * the twelve families that filter on subjects.
+     *
+     * A board with no profile registered has no regime to change and pays nothing
+     * for the question.
+     */
+    const context = incremental !== undefined &&
+        index !== null &&
+        levelsMayHaveMoved(elements, incremental)
+        ? undefined
+        : incremental;
+    /**
+     * The closure of the change, built ONCE for the whole pass and lazily inside
+     * ({@link dirtyClosure}) — `null` when this pass has nothing to build it from.
+     *
+     * The crossover guard is {@link evaluateNoOverlap}'s, for the same reason and
+     * as one comparison: past half the surface, deriving what NOT to walk costs
+     * more than walking it. `no-overlap` keeps its own guard on its own
+     * participants, so it is not weakened by this one being coarser.
+     */
+    const closure = context === undefined || context.dirty.size * 2 >= elements.length
+        ? null
+        : dirtyClosure(elements, context.dirty, context.previous, context.wasIn);
     const violations = [];
     for (const rule of rules) {
         // The other moment's rules are not this pass's business — checked FIRST,
-        // so an on-demand rule never reaches a profile lookup, let alone an
-        // element (PF5.14).
-        if ((isRealtime(rule) ? 'realtime' : 'on-demand') !== moment)
+        // so an on-demand rule never reaches a family, let alone an element
+        // (PF5.14). The levels in force are already read, once, above: deciding the
+        // moment against them costs two map lookups and no walk (PF7.6).
+        if (momentOf(rule, chosen, index) !== moment)
             continue;
         // `'off'` everywhere means never walked: the cheapest exit there is, taken
         // before a single element is touched.
         if (index && chosen && isRuleSilent(rule, chosen, index))
             continue;
-        let raised = RULE_FAMILIES[rule.family](rule, elements, incremental);
+        // What this rule must JUDGE. `null` — a surface scope, a touched frame, no
+        // closure at all — is the full pass every caller had before PF5.4.
+        const subjects = closure?.subjectsOf(rule) ?? null;
+        let raised = RULE_FAMILIES[rule.family](rule, elements, subjects === null ? context : { ...context, subjects });
         if (index && chosen && raised.length > 0) {
             raised = applyProfiles(rule, raised, chosen, index);
         }
-        if (raised.length === 0)
-            continue;
         // Exceptions are read LAST, and independently of the profile: an
         // arbitration a user made is theirs, and changing the level of requirement
         // never revokes one (PF9.3).
-        applyExceptions(rule, raised, elements);
+        if (raised.length > 0)
+            applyExceptions(rule, raised, elements);
+        // What this rule did NOT judge keeps the verdict it already had — profile
+        // and exception included, since `previous` is a finished answer and both
+        // passes were applied to it when it was made. A change to either marks its
+        // element dirty ({@link VERDICT_PROPS}), so nothing carried can be stale.
+        if (subjects !== null) {
+            const carried = closure.carried(rule, subjects);
+            if (carried.length > 0)
+                violations.push(...carried);
+        }
         violations.push(...raised);
     }
     return violations;
 }
-/** The registered rules a check-up runs — and nothing else ever evaluates. */
-export function onDemandRules(rules) {
-    return rules.filter(rule => !isRealtime(rule));
+/**
+ * The registered rules a check-up runs on THIS surface — and nothing else ever
+ * evaluates.
+ *
+ * The same question {@link evaluateCheckup} answers by running them, asked
+ * without running anything: a host listing what a check-up would walk, and the
+ * manager sizing one ({@link ValidationManager.checkupRulesFor}), get exactly
+ * the set that pass will use — which means asking it the same way, against the
+ * levels the surface's own frames have CHOSEN ({@link momentOf}) and not
+ * against the registry in the abstract. Hand it no elements and the framework
+ * defaults govern, which is what an empty board is.
+ */
+export function checkupRules(rules, elements, profiles = []) {
+    const index = profiles.length > 0 ? indexProfiles(profiles) : null;
+    const chosen = index ? readChosenProfiles(elements) : null;
+    return rules.filter(rule => momentOf(rule, chosen, index) === 'on-demand');
 }
 /**
  * Run the ON-DEMAND rules over the surface (PF5.14). The exact mirror of
@@ -3198,9 +4011,33 @@ export function onDemandRules(rules) {
  * never reach the timeline, the bracket or the badge. A framework declares them
  * `audit` on top of that, which is the severity for "collected, invisible to the
  * drawing user" — belt and braces, and the braces are structural.
+ *
+ * ## A SEED, i.e. "audit this much of the board" (PF7.9)
+ *
+ * `seed` is a set of element ids the caller wants judged — the host's selection,
+ * typically. It reaches the same pipeline as any other incremental pass, with
+ * `previous` deliberately EMPTY: a seed is not a change to build on, it is a
+ * question about a part of the board, so nothing is carried over and the answer
+ * is exactly the fresh verdicts on the closure of the seed ({@link dirtyClosure}).
+ * `wasIn` is the CURRENT attribution, which is the honest memory here: nothing
+ * moved between the two, so where an element is and where it was are the same
+ * fact.
+ *
+ * The contract, for a seed `S` and against the same call without one:
+ *
+ * - `seeded ⊆ full` — a seeded run never invents a verdict; and
+ * - `seeded ∩ touching(S) = full ∩ touching(S)`, where `touching(S)` is the
+ *   findings naming an element or a frame of `S` — a seeded run never MISSES one
+ *   that is about the seed.
+ *
+ * Everything between the two is what the caller chose not to ask about. A seed
+ * containing a frame asks about that whole map: the frame guards in
+ * {@link dirtyClosure} send every rule measured against it through a full pass.
  */
-export function evaluateCheckup(rules, elements, profiles = []) {
-    return runRules(rules, elements, profiles, 'on-demand');
+export function evaluateCheckup(rules, elements, profiles = [], seed) {
+    return runRules(rules, elements, profiles, 'on-demand', seed === undefined
+        ? undefined
+        : { dirty: seed, previous: [], wasIn: frameMembership(rules, elements) });
 }
 /**
  * How long a check-up may hold the thread before yielding it back.
@@ -3464,6 +4301,11 @@ export const VERDICT_PROPS = [
  * it would hand back precisely what declaring the second moment bought — and a
  * framework that wants its naming checked while the user types says so by
  * declaring the rule real-time, which is the one place that decision belongs.
+ *
+ * The DECLARED moment, like {@link backgroundElementIds} and for the same
+ * reason: this set is computed ONCE per manager, before any surface exists to
+ * read a level from, and watching a prop nothing turns out to need costs a
+ * debounced pass that finds nothing — never a wrong verdict.
  */
 export function verdictPropsOf(rules) {
     const props = new Set(VERDICT_PROPS);
@@ -3632,6 +4474,17 @@ export class ValidationManager extends InteractivityExtension {
          * luck of no shipped profile using `'off'` yet.
          */
         this._backgrounds = new Set();
+        /**
+         * Where every element WAS, frame by frame, at the last evaluation — the other
+         * half of the memory {@link _backgrounds} is, and for the same kind of reason.
+         *
+         * A `'frame'`-scope verdict is about a frame's whole content, so an element
+         * that has just LEFT one changes the answer there as much as it does where it
+         * landed — and the surface, which only knows where things are now, cannot say
+         * where anything was. See {@link frameMembership}: empty, and free, unless a
+         * frame-scope rule is registered.
+         */
+        this._membership = new Map();
         this._rules = null;
         this._verdictProps = null;
         this._nudges = null;
@@ -3726,6 +4579,7 @@ export class ValidationManager extends InteractivityExtension {
         this._dirty.clear();
         this._evaluated = false;
         this._backgrounds = new Set();
+        this._membership = new Map();
         this.timeline.clear();
         // Supersede any check-up still yielding between two rules, and forget the
         // last one: both are session state, and a stale answer outliving the
@@ -3778,19 +4632,35 @@ export class ValidationManager extends InteractivityExtension {
     /**
      * Evaluate now. Exposed so a host (and the bench) can drive it directly.
      *
-     * `incremental` is the DEBOUNCED path's privilege and nobody else's: it is
-     * the only caller that knows exactly which elements moved since the last
-     * verdict. Everything else — a gesture that must land on the spot, a surface
-     * arriving, a host asking — pays for a full pass, because a full pass is
-     * always right and a wrong dirty set is a board that lies.
+     * An incremental pass is the privilege of WHOEVER KNOWS WHAT CHANGED — the
+     * debounced path by default, and since PF7.9 any caller willing to say so:
+     * `true` runs the debounced path's own accumulated dirty set, an object seeds
+     * the same pipeline with the caller's, `false` (the default) pays for a full
+     * pass. Nothing about the guarantee is relaxed by opening it: a full pass is
+     * always right, and a wrong seed is still a board that lies — so a caller that
+     * is not certain hands in nothing rather than a guess.
+     *
+     * The seed may contain FRAME ids, and that is a request rather than a mistake:
+     * a frame among the dirty ids means "re-judge this board", and it lands on the
+     * {@link _backgrounds} guard below, which is exactly a full pass.
+     *
+     * A pending debounce is never lost: what it had accumulated is folded INTO the
+     * seed and its timer cleared, so one pass answers both questions.
      */
-    evaluate(incremental = false) {
+    evaluate(seed = false) {
         const rules = this._activeRules;
         const surface = this.gfx.surface;
         // Whatever happens below, what accumulated is now accounted for: a dirty
         // set left behind would be replayed against a later, unrelated snapshot.
         const dirty = this._dirty;
         this._dirty = new Set();
+        if (typeof seed === 'object') {
+            for (const id of seed.dirty)
+                dirty.add(id);
+            if (this._pending)
+                clearTimeout(this._pending);
+            this._pending = null;
+        }
         if (rules.length === 0 || !surface)
             return;
         const previous = this.violations$.peek();
@@ -3798,11 +4668,12 @@ export class ValidationManager extends InteractivityExtension {
         // pair-wise re-test would reach — including, when its profile silenced the
         // rule, findings that were never recorded for the family to find.
         const frameTouched = [...dirty].some(id => this._backgrounds.has(id));
-        const violations = evaluateRules(rules, surface.elementModels, this._activeProfiles, incremental && this._evaluated && dirty.size > 0 && !frameTouched
-            ? { dirty, previous }
+        const violations = evaluateRules(rules, surface.elementModels, this._activeProfiles, seed !== false && this._evaluated && dirty.size > 0 && !frameTouched
+            ? { dirty, previous, wasIn: this._membership }
             : undefined);
         this._evaluated = true;
         this._backgrounds = backgroundElementIds(rules, surface.elementModels);
+        this._membership = frameMembership(rules, surface.elementModels);
         // Stay silent when nothing changed: `violations$` is the seam a host panel
         // subscribes to, and a clean board must not wake it on every debounce tick.
         if (violations.length === 0 && this.violations$.peek().length === 0)
@@ -3874,12 +4745,15 @@ export class ValidationManager extends InteractivityExtension {
             .filter(nudge => frameworks.has(nudge.framework))
             .sort((a, b) => (a.order ?? 0) - (b.order ?? 0));
     }
-    /** The on-demand rules a check-up on `element` would walk (PF5.14). */
+    /**
+     * The on-demand rules a check-up on `element` would walk (PF5.14) — under the
+     * levels the surface's frames are on right now (PF7.6).
+     */
     checkupRulesFor(element) {
         const frameworks = this.frameworksOf(element);
         if (frameworks.size === 0)
             return [];
-        return onDemandRules(this._activeRules).filter(rule => frameworks.has(rule.framework));
+        return checkupRules(this._activeRules, this.gfx.surface?.elementModels ?? [], this._activeProfiles).filter(rule => frameworks.has(rule.framework));
     }
     /**
      * Whether `element` has a Map quality panel to open at all: a framework of
@@ -3969,10 +4843,19 @@ export class ValidationManager extends InteractivityExtension {
      * remounted. So the run is finished with {@link CheckupRun.error} and whatever
      * it had managed to collect.
      *
+     * ## A SEED, i.e. "audit this much of it" (PF7.9)
+     *
+     * `seed` narrows the QUESTION, never the answer's honesty: the run judges the
+     * closure of those ids ({@link evaluateCheckup}) and carries nothing, so what
+     * comes back is `full ∩ about-the-seed` — the same verdicts a whole-board
+     * check-up would have produced there, and none of the ones it would have
+     * produced elsewhere. A host that has a selection can therefore ask about it;
+     * one that has not passes nothing and gets the whole map, as before.
+     *
      * @returns the finished run, or `null` if it was superseded or there was
      * nothing to run.
      */
-    async runCheckup(element) {
+    async runCheckup(element, seed) {
         const rules = this.checkupRulesFor(element);
         const generation = ++this._checkupGeneration;
         const backgroundId = element.id;
@@ -3993,7 +4876,7 @@ export class ValidationManager extends InteractivityExtension {
             if (!surface || generation !== this._checkupGeneration)
                 return null;
             try {
-                for (const remark of evaluateCheckup([rules[i]], surface.elementModels, this._activeProfiles)) {
+                for (const remark of evaluateCheckup([rules[i]], surface.elementModels, this._activeProfiles, seed)) {
                     // This map's remarks, and only this map's. A family that measures
                     // against no frame records no `backgroundId` and is dropped: it has
                     // said nothing about the instance the user is looking at.