@oimlsmart/primmel-packages 0.1.0

package/acme-cgm-system/package.primmel

@@ -0,0 +1,23 @@
+# ─────────────────────────────────────────────────────────────────────
+# ACME CGM-200 SYSTEM — the hierarchical SMART twin (TODO.v3/03):
+# a gas analytical SYSTEM as a graph of SMART twins — the analyzer
+# component (the acme-cgm-200 twin, pinned abstract import) + the
+# sampling-line component (model/sample-line.prl, inline), with the
+# projection decomposition declared in payload/composition.yaml (which
+# composite registers come from which component's projection).
+# ─────────────────────────────────────────────────────────────────────
+package {
+  id acme-cgm-system
+  kind product_reference
+  manufacturer "ACME Analytics GmbH (fictional demonstration manufacturer)"
+  product "CGM-200 gas analytical system (composite)"
+  title "ACME CGM-200 gas analytical system — the hierarchical SMART twin"
+  version "2026"
+  editions { 2026 }
+  status current
+  maps_to { oiml-r144 }
+  uses { acme-cgm-200@2026 }
+  validity { from 2026-01-01 }
+  default_spelling eng-Latn
+  description "The CGM-200 gas analytical SYSTEM as a hierarchical graph of SMART twins (TODO.v3/03): the analyzer component twin (the acme-cgm-200 product reference, pinned abstract import @2026) and the sampling-line component twin (inline, model/sample-line.prl) compose the system. The composite's twin interface mirrors the R 144 governed projection verbatim; the projection DECOMPOSITION (payload/composition.yaml) declares which composite register each component's projection supplies, the composite's operational-state rule (fault if any component faults), and the component certificate references the composition calculus reads (weakest-link: an uncertified or suspended component degrades the composite to the DECLARED partial state — a declared gap is a scope limitation, never a hidden one)."
+}

package/acme-lc500/model/lc500.prl

@@ -0,0 +1,218 @@
+# ─────────────────────────────────────────────────────────────────────
+# ACME LC-500 — the product model (TODO.roadmap/36; doctrine ch. 15
+# §15.2). A manufacturer authors their product model exactly as any
+# subject model — the full IS/HAS/DOES anatomy:
+#   IS   design parameters, promises, the endpoint declaration, metadata,
+#        provenance (the type-evaluation certificate — the promises-
+#        as-verified provenance, §15.2);
+#   HAS  exhibited attributes, the characteristics the standard's tests
+#        compute, the operational state, the serve bindings;
+#   DOES the response behaviors (creep) and the self-tests.
+#
+# The FULL TWIN (TODO.v2/16): the subject anatomy is the manufacturer's
+# complete representation — arbitrarily rich (internal temperature
+# telemetry, the overload event history, production/serial data below).
+# The Recommendation governs only a PROJECTION of it: the endpoint +
+# serve bindings of this subject are exactly the R 60 governed twin
+# interface (primmel-packages/oiml-r60/model/twin.prl), DERIVED — never
+# hand-mirrored — from the Recommendation's governed set + the
+# projection mapping (model/r60-map.prl) by the twin-projection
+# generator (browser/scripts/derive-twin-projection.ts). A rec-side
+# change surfaces here as a diff: npm run gen:twin-projection rewrites
+# the derived section; the drift guard runs in npm run validate.
+#
+# Quantity-typed design parameters carry their literal as the qualifier
+# string "<value> <unit>" — the design-time vocabulary a consumer's
+# abstract import validates against (the capacity-within-E_max check of
+# §15.3 mode 1, computed by the platform's product-coverage gate).
+# ─────────────────────────────────────────────────────────────────────
+
+quantity_register si {
+  kind mass { dimensions { M 1 } si_unit kg description "Mass." }
+  unit kg { symbol "kg" label "kilogram" kind mass factor 1 }
+  kind temperature { dimensions { Θ 1 } si_unit degC description "Thermodynamic temperature." }
+  unit degC { symbol "°C" label "degree Celsius" kind temperature factor 1 }
+  kind dimensionless { si_unit "1" }
+  unit dimensionless { label "dimensionless" kind dimensionless }
+}
+
+attribute_definition d_min {
+  symbol "d_min"
+  name "Minimum dead load"
+  definition "Minimum dead load of the load cell (R 60-1, 3.3.2), read from the twin's test context."
+  quantity_kind mass
+  unit kg
+  value_type QuantityValue
+  origin design-fixed
+  scope sample
+  category metrological
+}
+
+attribute_definition indication {
+  symbol "I"
+  name "Indication"
+  definition "The indication of the load cell — the served live reading (R 60-1, 3.4.1)."
+  quantity_kind mass
+  unit kg
+  value_type QuantityValue
+  origin measured
+  scope sample
+  category metrological
+}
+
+# ── Full-twin richness (TODO.v2/16) ─────────────────────────────────
+# Manufacturer diagnostics, telemetry, history, and production data the
+# Recommendation does NOT govern. These members are the full twin's
+# filtered richness: they live on the served subject but outside the
+# governed projection — deliberately unmapped in the twin-projection
+# coverage report (model/r60-map.prl), never gaps.
+
+attribute_definition internal_temperature {
+  symbol "T_int"
+  name "Internal electronics temperature"
+  definition "Temperature inside the LC-500 electronics housing, sampled on the manufacturer's diagnostics channel. Not governed by R 60 — full-twin telemetry the projection filters out (TODO.v2/16)."
+  quantity_kind temperature
+  unit degC
+  value_type QuantityValue
+  origin measured
+  scope sample
+  category electrical
+}
+
+attribute_definition overload_event_count {
+  name "Overload event count"
+  definition "Cumulative count of overload events (applied load above the safe load limit) held in the cell's event history. Not governed by R 60 — full-twin history the projection filters out (TODO.v2/16)."
+  quantity_kind dimensionless
+  unit dimensionless
+  value_type QuantityValue
+  origin measured
+  scope sample
+  category electrical
+}
+
+attribute_definition serial_number {
+  name "Serial number"
+  definition "Production serial number of the individual LC-500 unit, assigned at manufacture. Not governed by the R 60 twin interface — production data the projection filters out (TODO.v2/16)."
+  value_type string
+  origin declared
+  scope sample
+  category administrative
+}
+
+attribute_definition firmware_version {
+  name "Firmware version"
+  definition "Version string of the LC-500's embedded firmware image — the manufacturer's software inventory, richer than the legally-relevant software identification of R 60-1, 6.1. Not governed by R 60 — production data the projection filters out (TODO.v2/16)."
+  value_type string
+  origin declared
+  scope model
+  category administrative
+}
+
+state_machine lc_operational {
+  kind operational
+  initial off
+  states { off warming ready measuring fault }
+  transition off -> warming action power_on
+  transition warming -> ready action warmed
+  transition ready -> measuring action start_measurement
+  transition measuring -> ready action stop_measurement
+  transition [off, warming, ready, measuring] -> fault action fault_detected
+}
+
+behavior creep {
+  kind temporal
+  stimulus force
+  response "Change in load cell output with time under constant load (R 60-1, 3.4.4)."
+}
+
+behavior self_test {
+  kind procedural
+  stimulus invoke
+  response "The instrument runs its self-diagnostic and reports a diagnostic report (R 60-1, 6.3.4 software-controlled instruments); a significant fault drives the operational state machine to fault."
+}
+
+subject LC500 {
+  is {
+    metadata {
+      name "LC-500 load cell model"
+      designation "LC-500 class C6 compression load cell"
+    }
+    provenance {
+      manufacturer "ACME Weighing GmbH"
+      certificate "R60/2021-DE-24-071"
+      type_evaluation_report "ACME-TE-2024-118"
+      promises_as_verified "class C6 over −10…+40 °C (the certificate's content — the claims as verified, distinct from the claims as declared, §15.2)"
+    }
+    design_parameters {
+      e_max : "500 kg"
+      v_min : "0.02 kg"
+      n_lc : "6000 dimensionless"
+    }
+    promises {
+      mpe_within {
+        target error_hold
+        level symbolic C6
+        conditions ocl{self.temperature >= rated.t_min and self.temperature <= rated.t_max}
+        statement "Holds accuracy class C6 across the rated range −10…+40 °C."
+        verified_by { oiml-r60#/req/class-c/mpe }
+      }
+      creep_c6 {
+        target creep
+        statement "Creep stays within the class C apportionment envelope (p_lc = 0.7) over the 30-minute test."
+        verified_by { oiml-r60#/req/class-c/creep }
+      }
+      temp_envelope {
+        target error_hold
+        level range { min -10 max 40 unit degC }
+        conditions "over the rated temperature range"
+        statement "The rated temperature envelope spans −10…+40 °C."
+        verified_by { oiml-r60#/req/metrological/temperature-limits }
+      }
+      repeatability_c6 {
+        target error_hold
+        statement "Repeatability stays within the class C limit across the verification program."
+        verified_by { oiml-r60#/req/class-c/repeatability }
+      }
+      fault_annunciation {
+        target self_test
+        statement "Significant faults are detected and annunciated — the cell drives its operational state to fault and refuses measurement."
+        verified_by { oiml-r60#/req/electronic/no-significant-faults }
+      }
+    }
+    # DERIVED from oiml-r60 model/twin.prl (the governed projection,
+    # TODO.v2/16) — regenerate: npm run gen:twin-projection; never
+    # hand-edit. The R 60 twin interface served by this product,
+    # endpoint-for-endpoint; the full twin's richness stays above
+    # this surface.
+    endpoint lc500_api {
+      operation get_indication { kind query serves { indication } payload { quantity_kind mass unit kg timestamp true } }
+      operation watch_state { kind subscribe serves { state } payload { quantity_kind state unit dimensionless timestamp true } }
+      operation run_self_test { kind invoke does { self_test } payload { quantity_kind diagnostic_report unit dimensionless timestamp true } }
+      access { public { get_indication } registered { watch_state } authority { run_self_test } }
+      profile rest_json
+    }
+  }
+  has {
+    attributes {
+      indication : mass test_dependent
+      d_min : mass test_dependent
+      ref_load : mass test_dependent
+      internal_temperature : temperature measured
+      overload_event_count : dimensionless measured
+      serial_number : string declared
+      firmware_version : string declared
+    }
+    characteristics {
+      error_hold e = ocl{self.indication - self.ref_load}
+    }
+    state lc_operational
+    # DERIVED from oiml-r60 model/twin.prl (npm run gen:twin-projection)
+    # — the governed registers with the Recommendation's freshness.
+    serve sample.test_context.d_min via get_indication { fresh_within 5s }
+    serve sample.state via watch_state { fresh_within 1s }
+  }
+  does {
+    behavior creep
+    behavior self_test
+  }
+}

package/acme-lc500/model/passport.prl

@@ -0,0 +1,43 @@
+# ─────────────────────────────────────────────────────────────────────
+# ACME LC-500 — the model-native Digital Product Passport (TODO.roadmap/
+# 35; doctrine ch. 14 §14.6, ch. 15 §15.6, grammar sketch §15.8).
+#
+# The passport is the product model's named, access-classed PROJECTION —
+# "generated from the model, served by the endpoint, verified through the
+# engine. It cannot drift from the model because it *is* the model"
+# (§14.6). The declaration names WHAT the projection serves (content
+# classes), WHO may read each entry (access classes), the unique product
+# identifier (UPI — ESPR model level), and the data-carrier linkage (the
+# QR on the instrument; payload = the passport endpoint URL).
+#
+# The two service modes of §15.6 are NOT declared here: abstract
+# (point-in-time, as-certified) and live (continuous) are serving
+# decisions of the projection engine (browser/src/data/passport.ts); the
+# declaration already separates the live content via the
+# live_compliance_status class.
+#
+# Access classes (honest per the package's own content):
+#   public    — the abstract passport (what a buyer integrates; what the
+#               EU DPP registry looks up): identity, composition,
+#               promises-as-verified (the certificate the provenance
+#               declares is public record — the BIML register publishes).
+#   authority — adds the live view (what market surveillance actually
+#               wants when it scans the QR code): live compliance status
+#               computed by the engine from the verdict stream (task 34).
+# artifacts/sustainability are deliberately ABSENT: the package declares
+# no artifact ids and the ESPR delegated-act content models do not exist
+# yet (TODO.roadmap/35, "Out") — a declared class with nothing honest
+# behind it is brochure content, and the passport never carries that.
+#
+# The kernel lint proves the declaration: C86 (every content entry
+# resolves against the package's declared aspects/promises), C87
+# (nothing restricted/authority is reachable from the public class),
+# C88 (the UPI pattern declares its ESPR level).
+# ─────────────────────────────────────────────────────────────────────
+
+passport lc500_passport {
+  upi { pattern upi:acme:lc500 level model }
+  carrier { kind qr payload "https://passport.acme.example/passport/upi:acme:lc500.json" }
+  public { identity composition promises_as_verified }
+  authority { live_compliance_status }
+}

package/acme-lc500/model/r60-map.prl

@@ -0,0 +1,161 @@
+# ─────────────────────────────────────────────────────────────────────
+# ACME LC-500 → OIML R 60 — the conformance claim made computable
+# (TODO.roadmap/36; doctrine ch. 15 §15.2), and the TWIN PROJECTION
+# (TODO.v2/16): the full twin → governed projection relation, mapped.
+#
+# The decisive act of the product reference model: every conformance-
+# relevant aspect and promise is mapped to the Recommendation's — aspect
+# by aspect, node to node, promise to requirement. The map targets are
+# the package's own `oiml-r60#…` alias declarations (the implementation
+# declares local copies of the reference elements it maps to — C21); the
+# platform's product-coverage gate resolves the unqualified ids against
+# the real R 60 package, so no clause reference dangles.
+#
+# 100 % of the tested characteristics are covered: every block-form
+# promise is a mapping source (C82 product-unmapped-promises stays
+# silent), and every promise target (the error/creep characteristics and
+# the self-test behavior the standard's tests exercise) is reachable
+# through one.
+#
+# The projection half (TODO.v2/16): the `oiml-r60#/twin/…` alias forest
+# below is the Recommendation's GOVERNED TWIN INTERFACE (oiml-r60
+# model/twin.prl) — the endpoint and the governed registers — and the
+# mapping pairs prove every governed register is backed by a product
+# component (the endpoint that serves it, the attribute that backs it).
+# The coverage block pins the computed projection at full (C23: coverage
+# is computed, never authored); the full twin's richer anatomy
+# (internal_temperature, overload_event_count, serial_number,
+# firmware_version, ref_load) is deliberately NOT mapped here — it is
+# the filtered richness the projection leaves behind, reported by the
+# twin-projection gate, never a gap. The served twin section itself is
+# DERIVED from the Recommendation by browser/scripts/
+# derive-twin-projection.ts (the drift guard in npm run validate).
+# ─────────────────────────────────────────────────────────────────────
+
+requirement oiml-r60#/req/class-c/mpe {
+  name "alias: R 60 class C maximum permissible errors"
+  statement "Local alias of the Recommendation's class C MPE requirement (the product reference model declares local copies of the reference elements it maps to — C21)."
+  verification { method examination description "Verified in the Recommendation's own type evaluation program." }
+  source { doc "urn:oiml:pub:r:60-1:2021" clause "5.3.2" }
+}
+
+requirement oiml-r60#/req/class-c/creep {
+  name "alias: R 60 class C creep"
+  statement "Local alias of the Recommendation's class C creep requirement."
+  verification { method examination description "Verified in the Recommendation's own type evaluation program." }
+  source { doc "urn:oiml:pub:r:60-1:2021" clause "5.5.1" }
+}
+
+requirement oiml-r60#/req/class-c/repeatability {
+  name "alias: R 60 class C repeatability"
+  statement "Local alias of the Recommendation's class C repeatability requirement."
+  verification { method examination description "Verified in the Recommendation's own type evaluation program." }
+  source { doc "urn:oiml:pub:r:60-1:2021" clause "5.4" }
+}
+
+requirement oiml-r60#/req/metrological/temperature-limits {
+  name "alias: R 60 temperature limits"
+  statement "Local alias of the Recommendation's temperature-limits requirement."
+  verification { method examination description "Verified in the Recommendation's own type evaluation program." }
+  source { doc "urn:oiml:pub:r:60-1:2021" clause "5.6.1.1" }
+}
+
+requirement oiml-r60#/req/electronic/no-significant-faults {
+  name "alias: R 60 no significant faults"
+  statement "Local alias of the Recommendation's significant-fault requirement for electronic load cells."
+  verification { method examination description "Verified in the Recommendation's own type evaluation program." }
+  source { doc "urn:oiml:pub:r:60-1:2021" clause "5.7.1.1" }
+}
+
+requirement oiml-r60#/req/metrological/measuring-range-max {
+  name "alias: R 60 maximum load of the measuring range"
+  statement "Local alias of the Recommendation's measuring-range-max requirement (E_max)."
+  verification { method examination description "Verified in the Recommendation's own type evaluation program." }
+  source { doc "urn:oiml:pub:r:60-1:2021" clause "5.2.2" }
+}
+
+# ── The governed twin interface aliases (TODO.v2/16) ────────────────
+# Local copies (C21) of the R 60 governed twin interface — the
+# projection target — declared as a nested alias forest (the ims-demo
+# idiom) so the linter's C23 fallback tree is the real interface shape:
+# the interface decomposes into its endpoint and its governed registers
+# (oiml-r60 model/twin.prl: endpoint loadcell_api; serves
+# sample.test_context.d_min and sample.state). Composition `all`: every
+# governed element must be backed for the projection to be full.
+process oiml-r60#/twin/interface {
+  name "alias: the R 60 governed twin interface — the projection itself"
+  process oiml-r60#/twin/interface/endpoint/loadcell_api {
+    name "alias: the governed endpoint loadcell_api (rest_json: get_indication query, watch_state subscribe, run_self_test invoke)"
+  }
+  process oiml-r60#/twin/interface/serve/d_min {
+    name "alias: governed register sample.test_context.d_min (via get_indication, fresh_within 5s)"
+  }
+  process oiml-r60#/twin/interface/serve/state {
+    name "alias: governed register sample.state (via watch_state, fresh_within 1s)"
+  }
+}
+
+map_profile oiml-r60 {
+  description "LC-500 → R 60: the manufacturer's conformance claim, made computable — every conformance-relevant aspect and promise mapped to the Recommendation (doctrine ch. 15 §15.2)."
+  mapping {
+    mpe_within -> oiml-r60#/req/class-c/mpe {
+      description "The class-limited error promise answers the class C MPE requirement."
+      justification "Same quantity, same clause definition — our error-hold characteristic is the quantity the MPE test computes (§15.2)."
+    }
+    creep_c6 -> oiml-r60#/req/class-c/creep {
+      description "The creep promise answers the class C creep requirement."
+      justification "Our creep behavior is the behavior the standard's creep test exercises, at the same apportionment (p_lc = 0.7)."
+    }
+    temp_envelope -> oiml-r60#/req/metrological/temperature-limits {
+      description "The rated temperature envelope satisfies the Recommendation's temperature limits."
+      justification "The rated range −10…+40 °C is the condition tier the temperature requirement admits."
+    }
+    repeatability_c6 -> oiml-r60#/req/class-c/repeatability {
+      description "The repeatability promise answers the class C repeatability requirement."
+      justification "Same quantity, computed by the same test series."
+    }
+    fault_annunciation -> oiml-r60#/req/electronic/no-significant-faults {
+      description "The self-test promise answers the significant-fault requirement."
+      justification "The self-diagnostic detects significant faults and the state machine annunciates them — the behavior the requirement demands."
+    }
+    e_max -> oiml-r60#/req/metrological/measuring-range-max {
+      description "Our E_max is R 60's E_max."
+      justification "Same quantity, same clause definition (R 60-1, 5.2.2)."
+    }
+    v_min -> oiml-r60#/req/class-c/mpe {
+      description "The minimum verification interval enters the class C MPE apportionment."
+      justification "v_min = E_max/n_lc is the verification scale interval the class C MPE table is expressed in."
+    }
+    # ── the twin projection (TODO.v2/16): full twin → governed set ──
+    # Every governed element of the R 60 twin interface backed by a
+    # product component; the served section itself is derived from the
+    # Recommendation (the twin-projection drift guard), so these pairs
+    # name the BACKING components — endpoint and register-backing
+    # attribute — never the serve bindings (derived, not mapped).
+    lc500_api -> oiml-r60#/twin/interface/endpoint/loadcell_api {
+      description "The LC-500's twin endpoint IS the R 60 projection surface: the same governed operations (get_indication query, watch_state subscribe, run_self_test invoke), the same access scopes, the same rest_json profile — derived from the Recommendation's twin.prl, never hand-mirrored."
+      justification "The endpoint is part of the type definition (doctrine ch. 14 §14.3): the product serves exactly what the Recommendation governs; the full twin's richer anatomy is filtered out above this surface."
+      coverage full
+    }
+    d_min -> oiml-r60#/twin/interface/serve/d_min {
+      description "The exhibited d_min attribute backs the governed register sample.test_context.d_min, served via get_indication with the Recommendation's 5 s freshness."
+      justification "Same quantity, same sample test-context scope (R 60-1, 3.5.12): the product's d_min is the value the projection reads."
+      coverage full
+    }
+    lc500_api -> oiml-r60#/twin/interface/serve/state {
+      description "The endpoint's watch_state subscribe operation serves the governed register sample.state — the subject's has.state lc_operational machine — with the Recommendation's 1 s freshness."
+      justification "The operational state machine is the served aspect; at component granularity the endpoint is the serving surface (the serve binding itself is derived from the Recommendation's twin.prl — the mapping names its backing component)."
+      coverage full
+    }
+  }
+  coverage {
+    # C23 tripwires over the alias forest: the projection is computed
+    # full — every governed register backed, the interface aggregating
+    # (composition all). A dropped pair or a filtered register fails
+    # the calculus here, loudly.
+    oiml-r60#/twin/interface full
+    oiml-r60#/twin/interface/endpoint/loadcell_api full
+    oiml-r60#/twin/interface/serve/d_min full
+    oiml-r60#/twin/interface/serve/state full
+  }
+}

package/acme-lc500/model/twin-cert-map.prl

@@ -0,0 +1,114 @@
+# ─────────────────────────────────────────────────────────────────────
+# ACME LC-500 → OIML TWIN-CERT — the second projection, made explicit
+# (TODO.v3/01 multi-standard projection; doctrine ch. 15 §15.2).
+#
+# The LC-500 is governed by TWO standards: R 60 (the instrument
+# Recommendation — model/r60-map.prl) and the twin-fidelity
+# certification program (oiml-twin-cert — the twin certificate's own
+# requirement set). Until now the second projection was implicit (the
+# monitor's deployment binding wired the served indication against the
+# /req/twin-fidelity layer). This map makes it a FIRST-CLASS projection:
+# the product's twin surface mapped, node to node, to the program's
+# requirements — so an auditor can read the SAME implementation model
+# through either standard's lens, and the coverage calculus computes
+# each namespace independently.
+#
+# The honest boundary: the program's twin-fidelity requirements are
+# judged continuously by the twin-cert program's fleet monitor (the
+# served-vs-reference pairings); this map declares the product's side
+# of that judgment — which of its nodes answer which requirement.
+#
+# THE COLLISION DOCTRINE (TODO.v3/01 item 4 — declared here, in the
+# implementation model, never silent): the two governed sets this
+# product projects onto — R 60's twin interface (sample.test_context
+# .d_min, sample.state) and the twin-fidelity program's fidelity
+# registers (sample.test_context.indication, sample.test_context
+# .op_state) — share NO register today (computed: src/lenses/
+# collisions.ts, pinned by lens-collisions.test.ts). If a future
+# standard's governed set comes to name a register this product
+# already serves for another standard: (1) an auditor NEVER sees a
+# merged claim — each standard keeps its own lens, its own coverage,
+# its own verdicts, side by side in the composed fold; (2) for any
+# single-view merge the STRICTER limit wins, unless the standards'
+# own provisions say otherwise — and that resolution must be declared
+# HERE (a resolutions entry naming the register, the standards, and
+# the rule) before it is relied on, never assumed by the platform.
+# ─────────────────────────────────────────────────────────────────────
+
+requirement oiml-twin-cert#/req/twin-fidelity/static-conformance {
+  name "alias: twin-fidelity static conformance (admission)"
+  statement "Local alias of the program's static-conformance requirement — a certified twin serves exactly the interface its certified product package declares (endpoint id, operations with payloads and quantity kinds, access scopes); a mis-serving twin never enters value-fidelity probing."
+  verification { method inspection description "Admission-time contract check against the pinned product package's endpoint declaration (the abstract import's edition pin); re-verified at every surveillance cycle start." }
+  source { doc "urn:oiml:pub:cs:twin-1:2027" clause "5.1" }
+}
+
+requirement oiml-twin-cert#/req/twin-fidelity/indication-band {
+  name "alias: twin-fidelity indication band"
+  statement "Local alias of the program's indication-band requirement — the twin's served indication matches the physical instrument's indication within the declared tolerance δ_indication at every probe point (|served − reference| ≤ δ, paired within the pairing window)."
+  verification { method examination description "Verified by the twin-fidelity program's own probe schedule (/conf/twin-fidelity/probe-range, /conf/twin-fidelity/probe-envelope)." }
+  source { doc "urn:oiml:pub:cs:twin-1:2027" clause "5.2" }
+}
+
+requirement oiml-twin-cert#/req/twin-fidelity/freshness-declaration {
+  name "alias: twin-fidelity freshness declaration"
+  statement "Local alias of the program's freshness-declaration requirement — every fidelity register is served under a declared fresh_within; a stale value degrades the verdict to indeterminate, never a fail, never a silent pass; the window is inherited from the serve declaration, never re-declared on the binding."
+  verification { method definitional description "Satisfied by the serve declarations the program reuses; enforced continuously by the freshness gate." }
+  source { doc "urn:oiml:pub:cs:twin-1:2027" clause "5.3" }
+}
+
+requirement oiml-twin-cert#/req/twin-fidelity/timestamp-provenance {
+  name "alias: twin-fidelity timestamp provenance"
+  statement "Local alias of the program's timestamp-provenance requirement — a parseable served timestamp on every fidelity register, the served-timestamp field declared per operation at deployment, and every fidelity fact carrying provenance (endpoint id bound to the certified unit's serial, the serving operation, the definition version pin)."
+  verification { method definitional description "A declaration requirement gated at admission and enforced continuously — an absent served timestamp is unavailable, never invented." }
+  source { doc "urn:oiml:pub:cs:twin-1:2027" clause "5.4" }
+}
+
+requirement oiml-twin-cert#/req/twin-fidelity/state-fidelity {
+  name "alias: twin-fidelity state fidelity"
+  statement "Local alias of the program's state-fidelity requirement — the served operational state equals the physical state at every transition, fault annunciation included (a truthful fault serve passes fidelity and triggers service; a lying one fails)."
+  verification { method examination description "Verified by the twin-fidelity program's own probe schedule (/conf/twin-fidelity/probe-transitions)." }
+  source { doc "urn:oiml:pub:cs:twin-1:2027" clause "5.5" }
+}
+
+requirement oiml-twin-cert#/req/twin-fidelity/creep-envelope {
+  name "alias: twin-fidelity creep envelope (behavioral)"
+  statement "Local alias of the program's creep-envelope requirement — under a constant reference load held for the declared dwell, the twin's served indication drifts no more than the instrument's accuracy-class creep allowance (class-parameterized through the Recommendation's apportioned MPE); a reference drifting beyond one third of the allowance voids the setup — INVALID, never a fail."
+  verification { method examination description "Verified by the twin-fidelity program's own probe schedule (/conf/twin-fidelity/probe-creep)." }
+  source { doc "urn:oiml:pub:cs:twin-1:2027" clause "5.6" }
+}
+
+map_profile oiml-twin-cert {
+  description "LC-500 → twin-cert: the product's second projection (TODO.v3/01) — the twin surface that answers the fidelity program: the endpoint that statically conforms, the served registers whose fidelity is probed, the state machine whose truthfulness is watched, and the creep behavior whose dynamics the envelope bounds. Judged continuously by the program's fleet monitor; this map declares the product's side."
+  mapping {
+    lc500_api -> oiml-twin-cert#/req/twin-fidelity/static-conformance {
+      description "The LC-500's declared endpoint IS the contract the admission check pins: a certified LC-500 twin serves exactly these operations, payloads, and access scopes."
+      justification "Same declaration, one home (the product package's endpoint block — derived from the R 60 governed interface, TODO.v2/16): the admission check compares the served surface against THIS declaration, and the startup conformance check enforces it."
+      coverage full
+    }
+    indication -> oiml-twin-cert#/req/twin-fidelity/indication-band {
+      description "The exhibited indication attribute is the served register the fidelity band judges — |served − reference| ≤ δ_indication at every probe point."
+      justification "Same quantity (R 60-1, 3.4.1), same sample scope: the value the probes pair against the reference channel's reading."
+      coverage full
+    }
+    lc500_api -> oiml-twin-cert#/req/twin-fidelity/freshness-declaration {
+      description "The endpoint's serve bindings carry the freshness declarations the requirement demands — fresh_within 5 s on the indication, 1 s on the state."
+      justification "Declared once, on the serves (§14.12 — never re-declared on a binding): the program inherits exactly these windows."
+      coverage full
+    }
+    lc500_api -> oiml-twin-cert#/req/twin-fidelity/timestamp-provenance {
+      description "The endpoint's payload declarations carry timestamp: true on every operation — the served-timestamp provenance the requirement demands."
+      justification "The served timestamp rides every served value (the payload schema's timestamp facet); the deployment's timestamp_fields declaration binds it at runtime."
+      coverage full
+    }
+    lc500_api -> oiml-twin-cert#/req/twin-fidelity/state-fidelity {
+      description "The endpoint's watch_state subscribe operation serves the twin's op_state — the lc_operational machine's current node — compared with the reference state at every transition."
+      justification "The served aspect is the state machine, and at component granularity the endpoint is the serving surface; fault annunciation is the machine's fault node — a truthful fault serve passes fidelity and triggers service."
+      coverage full
+    }
+    creep -> oiml-twin-cert#/req/twin-fidelity/creep-envelope {
+      description "The LC-500's creep behavior is the dynamic the envelope bounds — the served drift over the dwell against the class-parameterized allowance."
+      justification "Same behavior the mapped Recommendation's creep test exercises (the r60-map's creep_c6 promise, verified_by oiml-r60#/req/class-c/creep): the program reuses the class's own apportioned-MPE allowance — dynamics judged, not merely points."
+      coverage full
+    }
+  }
+}

package/acme-lc500/package.primmel

@@ -0,0 +1,35 @@
+# ─────────────────────────────────────────────────────────────────────
+# ACME LC-500 — the product reference package (TODO.roadmap/36; doctrine
+# ch. 15, the model supply chain).
+#
+# The manufacturer side of the supply chain: ACME's LC-500 load cell
+# model as a SUBJECT model (the oiml-rec methodology applied by the
+# manufacturer — full IS/HAS/DOES anatomy), with every conformance-
+# relevant aspect and promise mapped aspect-by-aspect to R 60
+# (model/r60-map.prl). The mapping is the manufacturer's conformance
+# claim made computable: "our E_max is your E_max; our creep
+# characteristic answers your creep requirement" (§15.2).
+#
+# The package is a REFERENCE model — it states what the product is and
+# claims; it is not derived from the Recommendation and composes nothing
+# from it (no uses edge): the two are related by mapping only. Users
+# consume it in two modes (§15.3): abstract import (version-pinned
+# `uses { acme-lc500@2021 }` — C83) and live integration over the
+# declared endpoint. promises-as-verified come from the type evaluation
+# record (the certificate in is.provenance; the promises' verified_by
+# links are the verification chain — TODO.roadmap/08/16).
+# ─────────────────────────────────────────────────────────────────────
+package {
+  id acme-lc500
+  kind product_reference
+  manufacturer "ACME Weighing GmbH"
+  product "LC-500"
+  title "ACME LC-500 load cell — product reference model"
+  version "2021"
+  editions { 2021 }
+  status current
+  validity { from 2021-03-01 }
+  maps_to { oiml-r60 oiml-twin-cert }
+  default_spelling eng-Latn
+  description "ACME's LC-500 load cell (class C6, E_max 500 kg) as a product reference model: the full subject anatomy (the manufacturer's full twin, richer than the standard governs), the lc500_api twin endpoint serving exactly the R 60 governed projection (derived, TODO.v2/16), and the aspect-by-aspect mapping to OIML R 60 — the manufacturer's conformance claim made computable (TODO.roadmap/36, doctrine ch. 15)."
+}