@oimlsmart/primmel-packages 0.1.0

package/oiml-r60/entities/workflow.prl

@@ -0,0 +1,2079 @@
+class Application#data {
+  store { applications }
+  indexes { manufacturer_id status standard_id model_family_id }
+  id: string {
+    modality SHALL
+  }
+  standard_id: string {
+    modality SHALL
+  }
+  application_number: string {
+    modality SHALL
+  }
+  date_of_application: date {
+    modality SHALL
+  }
+  status: enum {
+    modality SHALL
+    definition "Includes sample-receipt steps per TODO.UPGRADE/01 and the ia_requests_changes/applicant_resubmits loop (CHANGES_REQUESTED) per state-machines.yaml; COMPLETED is the Evaluation Project's settled terminal (the demo-flows program's completion gate: the ia_marks_completed hop declares the completion_settled guard — the transition refuses while specification/constraints.prl's settling constraints stand violated)"
+    enum_values { DRAFT SUBMITTED SAMPLES_REQUESTED SAMPLES_RECEIVED UNDER_REVIEW CHANGES_REQUESTED ACCEPTED REJECTED WITHDRAWN COMPLETED }
+  }
+  model_family_id: reference(MeasuringInstrumentModelFamily) [0..1] {
+    modality MAY
+    definition "The instrument family this application covers (matrix model)"
+    on_delete restrict
+    required false
+  }
+  model_ids: reference(MeasuringInstrumentModel) [0..*] {
+    modality MAY
+    definition "In-scope matrix members the applicant declares"
+    on_delete nullify
+    required false
+  }
+  sample_ids: reference(MeasuringInstrumentSample) [0..*] {
+    modality MAY
+    definition "Physical samples logged against this application"
+    on_delete nullify
+    required false
+  }
+  applicant: reference(ApplicantInfo) {
+    modality SHALL
+  }
+  authorised_representative: reference(AuthorisedRep) [0..1] {
+    modality MAY
+  }
+  no_concurrent_application: boolean [0..1] {
+    modality MAY
+  }
+  instrument_id: reference(MeasuringInstrumentModel) [0..1] {
+    modality MAY
+    definition "DEPRECATED — legacy single-model link (was required pre-matrix). Use model_family_id + model_ids."
+    on_delete restrict
+    deprecated true
+    required false
+  }
+  manufacturer_id: reference(Manufacturer) {
+    modality SHALL
+    on_delete restrict
+    required true
+  }
+  model: string [0..1] {
+    modality MAY
+    definition "DEPRECATED — legacy model name string. Use model_ids / MeasuringInstrumentModel.model_designation."
+    deprecated true
+  }
+  type_designation: string [0..1] {
+    modality MAY
+  }
+  description: text [0..1] {
+    modality MAY
+  }
+  operation_description: text [0..1] {
+    modality MAY
+  }
+  dimensions: object [0..1] {
+    modality MAY
+    definition "DEPRECATED — legacy free-form dimension selections. Dimensions now live on the subject chain classification maps."
+    deprecated true
+  }
+  manufacturer_documentation: reference(DocumentRef) [0..*] {
+    modality MAY
+  }
+  agreement_evidence: reference(DocumentRef) [0..*] {
+    modality MAY
+    definition "The negotiation-evidence facility (the demo-flows program, DEMO_FLOWS/00): the IA↔applicant fee negotiation (and the IA↔TL negotiation) runs OUTSIDE the system, but the parties keep the EVIDENCE of agreement on the project's record — the contract/agreement document uploads to the document store against the project (the owning entity's visibility cone governs exactly the parties' read; ISO/IEC 17065:2012, 4.1.2 the legally enforceable agreement), marked as the agreement's evidence with the store's attested SHA-256, and every upload journals an audit event. The project anchor (this field) is the certification flow's record; the engagement's ConsultingAgreement documents stay the pre-application funnel's anchor (TODO.federation/02) — both cones honest."
+  }
+  sample_information: reference(SampleInfo) [0..1] {
+    modality MAY
+  }
+  sample_request: reference(SampleRequest) [0..1] {
+    modality MAY
+    definition "The IA's outstanding or answered sample request (PD-05 §4.3) — recorded when the application enters SAMPLES_REQUESTED; the applicant ships against it (manufacturer_ships per sample), receipt is logged by the receiver"
+  }
+  previous_test_reports: reference(PreviousTestReportRef) [0..*] {
+    modality MAY
+    definition "Previous evaluation reports for abbreviated testing (PD-05 §4.3.3)"
+  }
+  scheme: enum [0..1] {
+    modality MAY
+    enum_values { A B }
+  }
+  operated_scheme_id: string [0..1] {
+    modality MAY
+    definition "TODO.adoption/05: the certification scheme this application seeks certification under: the id of an OperatedScheme record; absent reads as the built-in OIML-CS scheme (oiml-cs). The TEP runs per scheme; the issued certificate carries the scheme forward"
+  }
+  issuing_authority_id: reference(IssuingAuthority) [0..1] {
+    modality MAY
+    on_delete nullify
+    required false
+  }
+  laboratory_id: reference(TestLaboratory) [0..1] {
+    modality MAY
+    on_delete nullify
+    required false
+  }
+  anr_countries: string[] [0..*] {
+    modality MAY
+  }
+  applied_anrs: reference(AppliedAnr) [0..*] {
+    modality MAY
+    definition "Scheme A (PD-05 §5.1.4): the additional national requirement tests the applicant applies for, on the basis of the ANRs listed in a Utilizer/Associate OIML-CS Declaration; discharged at evaluation (§5.3.2/§5.4.2) and validated by the IA's letter to the BIML (§5.6.3)."
+  }
+  fee_acceptance: reference(FeeAcceptance) [0..1] {
+    modality MAY
+  }
+  ia_review_result: reference(IAReviewResult) [0..1] {
+    modality MAY
+    definition "IA review outcome per PD-05 §4.2"
+  }
+  documentation: reference(ApplicationDocument) [1..*] {
+    modality SHALL
+  }
+  submitted_date: datetime [0..1] {
+    modality MAY
+  }
+  reviewed_date: datetime [0..1] {
+    modality MAY
+  }
+  completed_date: datetime [0..1] {
+    modality MAY
+    definition "When the Evaluation Project was marked COMPLETED (the ia_marks_completed hop — the completion gate's settling conditions all held: every fee marked paid, every sample's custody closed, every review thread resolved, the reports finalized, the certificate issued and registered)"
+  }
+  reviewer: string [0..1] {
+    modality MAY
+  }
+  review_notes: text [0..1] {
+    modality MAY
+  }
+  rejection_reason: text [0..1] {
+    modality MAY
+    definition "Required if status is REJECTED (PD-05 §4.2.2)"
+  }
+  engagement_id: reference(Engagement) [0..1] {
+    modality MAY
+    definition "The pre-application engagement this application converted from (TODO.federation/02 — the NMI profile's white-gloves phase); absent on direct portal applications"
+    on_delete nullify
+    required false
+  }
+  entered_by: string [0..1] {
+    modality MAY
+    definition "The officer who entered the application on the applicant's behalf (TODO.federation/03 — the NMI profile's white-gloves path; ISO/IEC 17065:2012, 7.2 — the body obtains the application information from the client). Absent on a self-served portal application; the audit events carry the full actor record."
+  }
+  on_behalf_of: reference(Manufacturer) [0..1] {
+    modality MAY
+    definition "The applicant organization the application was entered on behalf of (TODO.federation/03) — equals manufacturer_id on a white-gloves entry; absent on a self-served one. The entered_by + on_behalf_of pair is the white-gloves provenance marker."
+    on_delete nullify
+    required false
+  }
+  applicant_org_id: string [0..1] {
+    modality MAY
+    definition "The applicant ACCOUNT's organization id (TODO.register/02): the OP-minted org id the application belongs to, bound at creation — the self-served portal entry stamps the session's active org (the server stamps it again at the write, never trusting the client), the white-gloves entry carries the picked applicant org. The certificate issued from this application carries the same org id as its holder-org descriptor (json_data.holder_org), the federation registration package transports it, and the hub's register attributes the registered certificate to it. Absent on pre-program and records-mode rows — the hub's one-time claim act attributes those by holder-name match with estate-admin confirmation."
+  }
+  test_report_id: reference(TestReport) [0..1] {
+    modality MAY
+    on_delete nullify
+    required false
+  }
+  evaluation_report_id: reference(EvaluationReport) [0..1] {
+    modality MAY
+    on_delete nullify
+    required false
+  }
+  certificate_id: reference(Certificate) [0..1] {
+    modality MAY
+    on_delete nullify
+    required false
+  }
+  origin: enum [0..1] {
+    modality MAY
+    definition "How this record came to exist: platform_workflow (the DEFAULT — an absent origin reads as platform_workflow) or registered_offline (TODO.adoption/02 — records mode: the underlying act was performed offline, in the files-and-folders practice the conformity map's section 5 names (docs/adoption/cspd-conformity-map.md, gaps G1/G7/G8/G10), and is registered after the fact by a named officer; a registered_offline record never masquerades as platform-tested and claims no test-run evidence it does not hold)"
+    enum_values { platform_workflow registered_offline }
+  }
+  created: datetime {
+    modality SHALL
+  }
+  modified: datetime {
+    modality SHALL
+  }
+}
+
+class RunEvaluation#data {
+  description { "The IA's per-test-run evaluation mark (TODO.deploying/08 — finer grain than the TR determination): one run of one test report marked approve/reject with the evaluator's provenance. A rejected run's form instance is excluded from the TR determination's pass basis — the rejection is recorded with its reason, never silently dropped. Embedded on EvaluationReport.run_evaluations." }
+  helper { true }
+  test_run_id: reference(TestRun) {
+    modality SHALL
+    on_delete cascade
+    required true
+  }
+  test_report_id: reference(TestReport) {
+    modality SHALL
+    definition "The TestReport the run belongs to (denormalized for query)"
+    on_delete cascade
+    required true
+  }
+  mark: enum {
+    modality SHALL
+    enum_values { approve reject }
+  }
+  comment: text [0..1] {
+    modality MAY
+    definition "The rejection reason (required on reject); an optional note on approve"
+  }
+  evaluated_by: string {
+    modality SHALL
+    definition "The IA evaluator (audit provenance)"
+  }
+  evaluated_at: datetime {
+    modality SHALL
+  }
+}
+
+class FieldVerdict#data {
+  description { "The IA's per-field verdict inside a reviewed test-report section (TODO.cs-e2e/08): only the fields the form schema marks with requirement references (targets) carry one. Embedded on SectionVerdict.field_verdicts." }
+  helper { true }
+  field: string {
+    modality SHALL
+    definition "The field name within the section's form schema"
+  }
+  requirement_refs: string[] [0..*] {
+    modality MAY
+    definition "The field's requirement targets (denormalized from the form schema at verdict time)"
+  }
+  verdict: enum {
+    modality SHALL
+    enum_values { pass fail not_evaluated }
+  }
+  remarks: text [0..1] {
+    modality MAY
+  }
+}
+
+class SectionVerdict#data {
+  description { "The IA's verdict on one section of a reviewed TestReport (TODO.cs-e2e/08): one form instance (one report-format section filled for one sample) marked pass/fail/not_evaluated with remarks and the reviewer's provenance. Maps into the evaluation report's verdict summary (R 60-3 §4.3): the examination sections (R 60-3 §5) roll to §4.3.1, the performance sections (R 60-3 §6) to §4.3.2 per temperature point (from the run context). Embedded on TestReportReview.sections." }
+  helper { true }
+  form_id: string {
+    modality SHALL
+    definition "The form (the report's section) this verdict covers"
+  }
+  form_instance_id: reference(FormInstance) [0..1] {
+    modality MAY
+    definition "The evidence instance under review (one per form × sample)"
+    on_delete cascade
+    required false
+  }
+  sample_id: reference(MeasuringInstrumentSample) [0..1] {
+    modality MAY
+    definition "The sample the section's evidence belongs to (denormalized from the instance)"
+    on_delete nullify
+    required false
+  }
+  section_ref: string [0..1] {
+    modality MAY
+    definition "The report-format clause of the section (the form schema's section, e.g. 'R 60-3, 5.4')"
+  }
+  verdict: enum {
+    modality SHALL
+    enum_values { pass fail not_evaluated }
+  }
+  remarks: text [0..1] {
+    modality MAY
+    definition "The reviewer's remarks (expected with a fail, optional otherwise)"
+  }
+  field_verdicts: reference(FieldVerdict) [0..*] {
+    modality MAY
+    definition "The per-field verdicts on the schema's requirement-referenced fields (targets)"
+    on_delete cascade
+  }
+  reviewed_by: string {
+    modality SHALL
+    definition "The IA reviewer (audit provenance)"
+  }
+  reviewed_at: datetime {
+    modality SHALL
+  }
+}
+
+class TestReportReview#data {
+  description { "The IA's section-by-section review of one submitted TestReport (TODO.cs-e2e/08): the per-section verdicts (with per-field verdicts on requirement-referenced fields), the TR decision with its reason once every section carries a verdict, and the reviewer's provenance. Embedded on EvaluationReport.test_report_reviews — the same store as the per-run marks (one store, no fork). The decision walks the test_report machine (ia_accepts / ia_rejects) and sets the Level-1 admissibility determination; the section verdicts map into the evaluation report's verdict summary (R 60-3 §4.3)." }
+  helper { true }
+  test_report_id: reference(TestReport) {
+    modality SHALL
+    on_delete cascade
+    required true
+  }
+  sections: reference(SectionVerdict) [0..*] {
+    modality MAY
+    definition "One verdict per reviewed section (form instance); the TR decision opens only when every section of the report carries one"
+    on_delete cascade
+  }
+  decision: enum [0..1] {
+    modality MAY
+    definition "The TR decision — absent while the review is open"
+    enum_values { ACCEPTED REJECTED }
+  }
+  reason: text [0..1] {
+    modality MAY
+    definition "The decision's reason (mandatory on reject)"
+  }
+  started_by: string {
+    modality SHALL
+    definition "The IA reviewer who opened the review (the ia_starts_review walk)"
+  }
+  started_at: datetime {
+    modality SHALL
+  }
+  decided_by: string [0..1] {
+    modality MAY
+  }
+  decided_at: datetime [0..1] {
+    modality MAY
+  }
+}
+
+class TestRequest#data {
+  store { testRequests }
+  description { "IA-issued request to a test laboratory. The atomic unit of test work is the TestAssignment (one per form × sample pair). The IA explicitly chooses which (form, sample) tuples each lab performs — different labs may be assigned different tests on the same model, or the same test on different samples. One Application typically produces multiple TestRequests (one per lab)." }
+  indexes { application_id assigned_laboratory_id requesting_authority_id status test_report_id standard_id }
+  id: string {
+    modality SHALL
+  }
+  standard_id: string {
+    modality SHALL
+  }
+  request_number: string {
+    modality SHALL
+    definition "Unique within the parent Application (e.g. 'TR-ACME-2024-001-01')"
+  }
+  application_id: reference(Application) {
+    modality SHALL
+    on_delete cascade
+    required true
+  }
+  requesting_authority_id: reference(IssuingAuthority) {
+    modality SHALL
+    on_delete restrict
+    required true
+  }
+  assigned_laboratory_id: reference(TestLaboratory) {
+    modality SHALL
+    on_delete restrict
+    required true
+  }
+  assignments: reference(TestAssignment) [1..*] {
+    modality SHALL
+    definition "Explicit (form_id, sample_id) tuples this lab must perform. Replaces the cross-product of required_forms × sample_ids — the IA chooses precisely which tests on which samples go to this lab. Different labs can be assigned different subsets."
+    on_delete cascade
+  }
+  sample_ids: reference(MeasuringInstrumentSample) [0..*] {
+    modality MAY
+    definition "Derived from assignments[].sample_id (denormalized for query)"
+    on_delete nullify
+    required false
+  }
+  required_forms: string[] [0..*] {
+    modality MAY
+    definition "Derived from assignments[].form_id (denormalized for query)"
+  }
+  model_ids: reference(MeasuringInstrumentModel) [0..*] {
+    modality MAY
+    definition "Derived from assignments[].model_id (denormalized)"
+    on_delete nullify
+    required false
+  }
+  test_conditions: object {
+    modality SHALL
+    definition "Ambient conditions, schedule, special instructions"
+  }
+  test_program_id: string [0..1] {
+    modality MAY
+    definition "Reference to a pre-defined test program (e.g. 'R60-full-class-C')"
+  }
+  special_instructions: text [0..1] {
+    modality MAY
+  }
+  anr_countries: string[] [0..*] {
+    modality MAY
+    definition "ANR countries (PD-05 §5.1.4) this request applies to"
+  }
+  scheme: enum {
+    modality SHALL
+    definition "PD-05 §5.3 scheme (A = with MTL, B = independent lab only)"
+    enum_values { A B }
+  }
+  includes_mtl: boolean [0..1] {
+    modality MAY
+    definition "Scheme A: lab is the manufacturer's own lab (MTL)"
+  }
+  status: enum {
+    modality SHALL
+    definition "The dispatch lifecycle (the `test_request` state machine): DRAFT → ISSUED → ACCEPTED_BY_LAB → IN_PROGRESS → COMPLETED, with the optional commercial leg ISSUED → QUOTED → ACCEPTED_BY_LAB (TODO.adoption/07: a laboratory that quotes responds with a quotation; the Issuing Authority accepts or declines; laboratories that do not quote accept directly, the quote step is never forced)"
+    enum_values { DRAFT ISSUED QUOTED ACCEPTED_BY_LAB IN_PROGRESS COMPLETED WITHDRAWN REJECTED_BY_LAB }
+  }
+  issued_date: datetime [0..1] {
+    modality MAY
+  }
+  quotation_id: reference(Quotation) [0..1] {
+    modality MAY
+    definition "The laboratory's current quotation against this request (TODO.adoption/07's quote leg); a re-quotation supersedes the previous one, never edits it in place"
+    on_delete nullify
+    required false
+  }
+  quoted_date: datetime [0..1] {
+    modality MAY
+    definition "When the laboratory issued its quotation (the ISSUED → QUOTED hop)"
+  }
+  accepted_date: datetime [0..1] {
+    modality MAY
+  }
+  started_date: datetime [0..1] {
+    modality MAY
+  }
+  completed_date: datetime [0..1] {
+    modality MAY
+  }
+  withdrawn_date: datetime [0..1] {
+    modality MAY
+  }
+  withdrawn_reason: text [0..1] {
+    modality MAY
+  }
+  test_report_id: reference(TestReport) [0..1] {
+    modality MAY
+    definition "Primary TestReport issued by the lab against this request"
+    on_delete nullify
+    required false
+  }
+  parent_request_ids: reference(TestRequest) [0..*] {
+    modality MAY
+    definition "For re-tests or amended requests, the prior request(s)"
+    on_delete nullify
+    required false
+  }
+  issued_by: string {
+    modality SHALL
+    definition "IA staff member who issued the request"
+  }
+  accepted_by: string [0..1] {
+    modality MAY
+    definition "Lab staff member who accepted the request"
+  }
+  created: datetime {
+    modality SHALL
+  }
+  modified: datetime {
+    modality SHALL
+  }
+}
+
+class TestAssignment#data {
+  store { testAssignments }
+  description { "The atomic unit of test work: one R 60-3 form performed on one sample (which belongs to one model). The IA explicitly creates these tuples when dispatching a TestRequest — different labs may receive different subsets of (form, sample) pairs even for the same Application. Each assignment produces zero or one FormInstance when the lab completes the work." }
+  indexes { test_request_id sample_id model_id laboratory_id form_id status application_id }
+  id: string {
+    modality SHALL
+  }
+  test_request_id: reference(TestRequest) {
+    modality SHALL
+    on_delete cascade
+    required true
+  }
+  application_id: reference(Application) {
+    modality SHALL
+    definition "Denormalized from TestRequest for query efficiency"
+    on_delete restrict
+    required true
+  }
+  form_id: string {
+    modality SHALL
+    definition "R 60-3 form identifier (e.g. 'load-test')"
+  }
+  sample_id: reference(MeasuringInstrumentSample) {
+    modality SHALL
+    definition "Specific physical sample this test is performed on"
+    on_delete restrict
+    required true
+  }
+  model_id: reference(MeasuringInstrumentModel) {
+    modality SHALL
+    definition "Denormalized from sample_id.model_id for query efficiency"
+    on_delete restrict
+    required true
+  }
+  laboratory_id: reference(TestLaboratory) {
+    modality SHALL
+    definition "Denormalized from TestRequest.assigned_laboratory_id"
+    on_delete restrict
+    required true
+  }
+  origin: enum [0..1] {
+    modality MAY
+    definition "Who put this test on the lab's bench: ia_assigned (the IA's dispatch — the DEFAULT; absent reads as ia_assigned) or lab_added (the laboratory performs an additional test of its own initiative, TODO.deploying/06); lab-added work is flagged, never silently merged with the IA-assigned set"
+    enum_values { ia_assigned lab_added }
+  }
+  status: enum {
+    modality SHALL
+    definition "Lifecycle: PENDING (lab not yet started) → ACCEPTED (lab acknowledged) → IN_PROGRESS → COMPLETED (FormInstance submitted) | OMITTED (lab cannot perform, with reason) | FAILED (attempted but could not complete)"
+    enum_values { PENDING ACCEPTED IN_PROGRESS COMPLETED OMITTED FAILED }
+  }
+  form_instance_id: reference(FormInstance) [0..1] {
+    modality MAY
+    definition "Filled in when the lab completes this assignment"
+    on_delete nullify
+    required false
+  }
+  omit_reason: text [0..1] {
+    modality MAY
+    definition "Required when status=OMITTED (e.g. equipment unavailable)"
+  }
+  assigned_date: datetime {
+    modality SHALL
+  }
+  accepted_date: datetime [0..1] {
+    modality MAY
+  }
+  started_date: datetime [0..1] {
+    modality MAY
+  }
+  completed_date: datetime [0..1] {
+    modality MAY
+  }
+  notes: text [0..1] {
+    modality MAY
+  }
+}
+
+class TestReport#data {
+  store { testReports }
+  description { "Test lab's submission. Per user correction (2026-07-02): one TestReport per model family/group being tested. If a lab tests multiple groups, they produce multiple TestReports. The TestReport declares which MeasuringInstrumentModelGroup(s) and MeasuringInstrumentSample(s) it covers. Within each report, the lab fills in R 60-3 Test Report Forms. If a particular TRF doesn't apply to the group being tested, the lab marks it as omitted with a justification (form_omissions)." }
+  indexes { laboratory_id status standard_id test_request_id application_id model_family_id model_group_id }
+  id: string {
+    modality SHALL
+  }
+  standard_id: string {
+    modality SHALL
+  }
+  application_id: reference(Application) [0..1] {
+    modality MAY
+    definition "Denormalized for query. Authoritative lineage: TestRequest → Application."
+    on_delete restrict
+    required false
+  }
+  test_request_id: reference(TestRequest) [0..1] {
+    modality MAY
+    definition "Originating TestRequest (the IA dispatch that produced this report)"
+    on_delete nullify
+    required false
+  }
+  model_family_id: reference(MeasuringInstrumentModelFamily) [0..1] {
+    modality MAY
+    definition "Which family this report covers"
+    on_delete restrict
+    required false
+  }
+  model_group_id: reference(MeasuringInstrumentModelGroup) [0..1] {
+    modality MAY
+    definition "Which MeasuringInstrumentModelGroup this report covers. Per user: \"1 test report for each model family/group that needs to be tested.\" When null, the report covers the entire family."
+    on_delete restrict
+    required false
+  }
+  instrument_id: reference(MeasuringInstrumentModel) {
+    modality SHALL
+    definition "Primary model under test (kept from the legacy declaration; matrix coverage is via sample_ids)"
+    on_delete restrict
+    required true
+  }
+  laboratory_id: reference(TestLaboratory) {
+    modality SHALL
+    on_delete restrict
+    required true
+  }
+  sample_ids: reference(MeasuringInstrumentSample) [0..*] {
+    modality SHALL
+    definition "Physical samples covered by this report. Each sample belongs to a specific model within the group. The same sample can appear in multiple FormInstances (one per test/TRF)."
+    on_delete restrict
+    required true
+  }
+  dimensions: object {
+    modality SHALL
+    definition "Dimension snapshot of the tested group at report time (classification context for calculations)"
+  }
+  definition_versions: object [0..1] {
+    modality MAY
+    definition "INV-8 pin (version pinning — every definition executed in D2 is version-pinned in the TestReport): the definition versions this report's D2 execution used, captured at issuance before the report goes immutable. Shape: { standard: the standard edition URN whose definition corpus (requirements, verdict quantities, constraints, form schemas) was in force; forms: { <form_id>: the executed form-schema identifier, propagated from the completing TestRuns' method_version pins } }. D3 re-evaluation records these pins into its verdict snapshots so the chain stays auditable. Absent when no run-backed evidence pins anything (an assumed edition is never written); a form executed under two different schema versions drops its key — honest absence beats a false pin."
+  }
+  required_forms: string[] [1..*] {
+    modality SHALL
+    definition "R 60-3 form identifiers the lab should complete for this group"
+  }
+  form_instances: reference(FormInstance) [0..*] {
+    modality SHALL
+    definition "FormInstances bundled by this report (was string[] of ids; re-typed per the FK graph, one-to-many cascade)"
+    on_delete cascade
+  }
+  form_omissions: reference(FormOmission) [0..*] {
+    modality MAY
+    definition "Forms that don't apply to the group being tested, with justification. Per user: \"If the IA or test lab decides that a particular TRF doesn't need to be filled for a model family/group, then they should have a way to specify that.\""
+    on_delete cascade
+  }
+  forms: reference(TestReportFormRef) [0..*] {
+    modality MAY
+  }
+  artifact_instances: reference(ArtifactInstance) [0..*] {
+    modality MAY
+    definition "Artifact instances linked as evidence (TODO.roadmap/09) — produced outputs OF THE INSTRUMENT conforming to the standard's model/artifacts.yaml definitions (e.g. R 91's enforcement evidence file). Seeded from sample-data.yaml test_report.artifact_instances; captured at runtime in the lab report composer. A report covering an artifact-producing test must link ≥1 instance of each produced definition (linker rule artifact-presence)."
+  }
+  anr_countries: string[] [0..*] {
+    modality MAY
+  }
+  status: enum {
+    modality SHALL
+    definition "DRAFT → SUBMITTED → UNDER_REVIEW → ACCEPTED | REJECTED; CONSULTATION is the review period (the demo-flows program's flow 04, step 4): the IA opens it from UNDER_REVIEW, the project's participants comment (entities/comments.prl's threads), and the terminal decisions gate on consultation_resolved — the threads resolve before the finalization completes"
+    enum_values { DRAFT SUBMITTED UNDER_REVIEW CONSULTATION ACCEPTED REJECTED }
+  }
+  evaluator: string {
+    modality SHALL
+  }
+  signature_date: date [0..1] {
+    modality MAY
+    definition "Date of signature by authorizing person (PD-05 §4.4.3 r)"
+  }
+  test_location: string [0..1] {
+    modality MAY
+    definition "Place of testing (PD-05 §4.4.3 j)"
+  }
+  includes_mtl_results: boolean [0..1] {
+    modality MAY
+    definition "Whether this report includes results from a Manufacturer Test Lab (Scheme A, PD-05 §5.3.1 b) — the MTL flag the §5.5.4 prominent-statement and §5.5.5 own-Declaration checks key on"
+  }
+  supervising_ia_id: reference(IssuingAuthority) [0..1] {
+    modality MAY
+    definition "MTL reports only — the Issuing Authority exercising controlled supervision over the Manufacturer Test Laboratory (PD-04, 7.1); must equal the IA utilising the report (PD-05 §5.5.5)"
+    on_delete nullify
+    required false
+  }
+  test_period_start: date [0..1] {
+    modality MAY
+    definition "First day of the reported testing (the test dates of the PD-05 §4.4.3 report content) — records mode (TODO.adoption/02) carries the offline report's test period; platform-run reports pin their evidence dates per test run"
+  }
+  test_period_end: date [0..1] {
+    modality MAY
+    definition "Last day of the reported testing (TODO.adoption/02)"
+  }
+  origin: enum [0..1] {
+    modality MAY
+    definition "How this record came to exist: platform_workflow (the DEFAULT — an absent origin reads as platform_workflow) or registered_offline (TODO.adoption/02 — records mode: the laboratory performed and issued this report offline and registered it after the fact; a registered_offline report never masquerades as platform-run and claims no test-run evidence it does not hold)"
+    enum_values { platform_workflow registered_offline }
+  }
+  created: datetime {
+    modality SHALL
+  }
+  modified: datetime {
+    modality SHALL
+  }
+  submitted_date: datetime [0..1] {
+    modality MAY
+  }
+  attachments: reference(DocumentRef) [0..*] {
+    modality MAY
+    definition "Files attached to the report (the signed report PDF, raw data exports, instrument photographs) — blob-backed when the document store is bound, file-name references otherwise (TODO.adoption/03)"
+  }
+}
+
+class FormInstance#data {
+  store { formInstances }
+  indexes { form_id standard_id test_report_id sample_id laboratory_id }
+  id: string {
+    modality SHALL
+  }
+  standard_id: string {
+    modality SHALL
+  }
+  form_id: string {
+    modality SHALL
+  }
+  test_report_id: reference(TestReport) {
+    modality SHALL
+    definition "Owning TestReport — form is one row in this report"
+    on_delete cascade
+    required true
+  }
+  test_request_id: reference(TestRequest) [0..1] {
+    modality MAY
+    definition "Originating TestRequest (denormalized from TestReport)"
+    on_delete nullify
+    required false
+  }
+  application_id: reference(Application) [0..1] {
+    modality MAY
+    definition "Originating Application (denormalized for query)"
+    on_delete nullify
+    required false
+  }
+  sample_id: reference(MeasuringInstrumentSample) {
+    modality SHALL
+    definition "Which sample this form was filled in for"
+    on_delete restrict
+    required true
+  }
+  laboratory_id: reference(TestLaboratory) {
+    modality SHALL
+    definition "Lab that authored this form (PD-05 §4.4.3 b)"
+    on_delete restrict
+    required true
+  }
+  values: object {
+    modality SHALL
+    definition "Typed record validated against form schema data class"
+  }
+  computed_values: object {
+    modality SHALL
+    definition "DERIVED measurement results from OCL evaluation"
+  }
+  result: enum {
+    modality SHALL
+    enum_values { PASS FAIL NA PENDING }
+  }
+  status: enum {
+    modality SHALL
+    definition "Authoring + IA review state — see state machine"
+    enum_values { DRAFT IN_PROGRESS SUBMITTED LOCKED ACCEPTED REJECTED }
+  }
+  source: string [0..1] {
+    modality MAY
+  }
+  country: string [0..1] {
+    modality MAY
+  }
+  entity_type: string [0..1] {
+    modality MAY
+    definition "DEPRECATED — use test_report_id. Polymorphic link retained for migration."
+    deprecated true
+  }
+  entity_id: string [0..1] {
+    modality MAY
+    definition "DEPRECATED — use test_report_id. Polymorphic link retained for migration."
+    deprecated true
+  }
+  abbreviated: boolean [0..1] {
+    modality MAY
+    definition "Whether this test was abbreviated per PD-05 §4.3.3"
+  }
+  abbreviation_justification: text [0..1] {
+    modality MAY
+    definition "Justification for abbreviated/omitted test (PD-05 §4.3.3)"
+  }
+  previous_report_ref: reference(PreviousTestReportRef) [0..1] {
+    modality MAY
+    definition "Reference to previous test report for abbreviated testing"
+  }
+  created: datetime {
+    modality SHALL
+  }
+  modified: datetime {
+    modality SHALL
+  }
+  evaluator: string {
+    modality SHALL
+    definition "Test lab evaluator name (PD-05 §4.4.3)"
+  }
+  supervisor: string [0..1] {
+    modality MAY
+    definition "Test lab supervisor name"
+  }
+  ia_reviewer: string [0..1] {
+    modality MAY
+    definition "IA reviewer who recorded the per-form determination"
+  }
+  submitted_at: datetime [0..1] {
+    modality MAY
+  }
+  locked_at: datetime [0..1] {
+    modality MAY
+    definition "When the parent TestReport was issued (form became immutable)"
+  }
+}
+
+class EvaluationReport#data {
+  store { evaluationReports }
+  indexes { authority_id standard_id application_id }
+  id: string {
+    modality SHALL
+  }
+  standard_id: string {
+    modality SHALL
+  }
+  application_id: reference(Application) {
+    modality SHALL
+    definition "Originating Application (declared by the FK graph; denormalized for query)"
+    on_delete restrict
+    required true
+  }
+  test_report_id: reference(TestReport) [0..1] {
+    modality MAY
+    definition "DEPRECATED — primary test report kept for backward compatibility. Use test_report_ids."
+    on_delete nullify
+    deprecated true
+    required false
+  }
+  test_report_ids: reference(TestReport) [1..*] {
+    modality SHALL
+    definition "All OIML test reports included (PD-05 §4.5.1 k)"
+    on_delete restrict
+    required true
+  }
+  instrument_id: reference(MeasuringInstrumentModel) {
+    modality SHALL
+    definition "Primary model evaluated (kept from the legacy declaration; per-model verdicts live in model_evaluations)"
+    on_delete restrict
+    required true
+  }
+  authority_id: reference(IssuingAuthority) {
+    modality SHALL
+    on_delete restrict
+    required true
+  }
+  form_determinations: reference(FormDetermination) [0..*] {
+    modality SHALL
+  }
+  run_evaluations: reference(RunEvaluation) [0..*] {
+    modality MAY
+    definition "The IA's per-test-run marks (TODO.deploying/08) — a rejected run's form instance is excluded from the pass basis; the ER finalize gate requires every run of every included TR marked"
+    on_delete cascade
+  }
+  test_report_reviews: reference(TestReportReview) [0..*] {
+    modality MAY
+    definition "The IA's section-by-section reviews of the included TestReports (TODO.cs-e2e/08) — the section verdicts roll up to the per-report decision and map into the evaluation report's verdict summary (R 60-3 §4.3)"
+    on_delete cascade
+  }
+  test_report_determinations: reference(TestReportDetermination) [0..*] {
+    modality SHALL
+    definition "Admissibility gate. One per TestReport in test_report_ids[]."
+    on_delete cascade
+  }
+  model_evaluations: reference(ModelEvaluation) [0..*] {
+    modality SHALL
+    definition "Per-model technical synthesis across accepted TestReports. Required for finalization — family-level decision derives from these. Per TODO.UPGRADE/13."
+    on_delete cascade
+  }
+  status: enum [0..1] {
+    modality MAY
+    definition "Workflow position on the declared evaluation_report machine (evaluation/state-machines.prl): DRAFT → IN_REVIEW → ALL_TR_REVIEWED → APPROVED | REJECTED | CONDITIONALLY_APPROVED, with the CONSULTATION review period between ALL_TR_REVIEWED and the terminal decision (the demo-flows program's flow 04: the project's participants comment on the report, the consultation_resolved guard gates the terminal hops), and ia_reopens back to IN_REVIEW. Owned by the walker (walkTransition) — services route every lifecycle move through the machine, never assign it (gap D8, the task-61 punt closed). DISTINCT from overall_decision, the JUDGMENT axis: the terminal transitions SET the matching decision via their declared cascades, never the reverse. Optional for pre-D8 instances — an absent status reads as the machine's initial DRAFT (the task-61 walker idiom)."
+    enum_values { DRAFT IN_REVIEW ALL_TR_REVIEWED CONSULTATION APPROVED REJECTED CONDITIONALLY_APPROVED }
+  }
+  overall_decision: enum {
+    modality SHALL
+    enum_values { PENDING APPROVED REJECTED CONDITIONALLY_APPROVED }
+  }
+  conditions: string[] [0..*] {
+    modality SHALL
+  }
+  review_notes: text {
+    modality SHALL
+  }
+  reviewer_name: string {
+    modality SHALL
+  }
+  supervisor_name: string [0..1] {
+    modality MAY
+    definition "Supervising evaluator per PD-05 §4.5"
+  }
+  review_date: date {
+    modality SHALL
+  }
+  finalized_at: datetime [0..1] {
+    modality MAY
+  }
+  finalized_by: string [0..1] {
+    modality MAY
+  }
+  certificate_id: reference(Certificate) [0..1] {
+    modality MAY
+    on_delete nullify
+    required false
+  }
+  anr_compliance: reference(ANRCompliance) [0..*] {
+    modality MAY
+  }
+  mtl_use_statement: text [0..1] {
+    modality MAY
+    definition "Scheme A (PD-05 §5.5.4): where OIML test reports from a Manufacturer Test Laboratory are utilised, the prominent statement at the beginning of the evaluation report identifying the respective tests and the MTL designation. Mandatory when any included test report carries includes_mtl_results."
+  }
+  test_period_start: date [0..1] {
+    modality MAY
+    definition "First day of the evaluated testing — records mode (TODO.adoption/02) registers the offline evaluation's test period; platform-run evaluations pin their evidence per included test report"
+  }
+  test_period_end: date [0..1] {
+    modality MAY
+    definition "Last day of the evaluated testing (TODO.adoption/02)"
+  }
+  origin: enum [0..1] {
+    modality MAY
+    definition "How this record came to exist: platform_workflow (the DEFAULT — an absent origin reads as platform_workflow) or registered_offline (TODO.adoption/02 — records mode: the type evaluation was performed offline and is registered after the fact by a named IA officer; a registered_offline report never masquerades as platform-evaluated and claims no test-run evidence it does not hold)"
+    enum_values { platform_workflow registered_offline }
+  }
+  created: datetime {
+    modality SHALL
+  }
+  modified: datetime {
+    modality SHALL
+  }
+}
+
+class TestReportDetermination#data {
+  store { testReportDeterminations }
+  description { "IA's per-TestReport decision within an EvaluationReport. One EvaluationReport contains one TestReportDetermination per entry in test_report_ids[] (PD-05 §4.5). The aggregate of these determines overall_decision." }
+  indexes { evaluation_report_id test_report_id }
+  id: string {
+    modality SHALL
+  }
+  evaluation_report_id: reference(EvaluationReport) {
+    modality SHALL
+    on_delete cascade
+    required true
+  }
+  test_report_id: reference(TestReport) {
+    modality SHALL
+    on_delete restrict
+    required true
+  }
+  decision: enum {
+    modality SHALL
+    enum_values { ACCEPTED REJECTED CONDITIONALLY_ACCEPTED }
+  }
+  reviewer_name: string {
+    modality SHALL
+  }
+  supervisor_name: string [0..1] {
+    modality MAY
+  }
+  review_date: date {
+    modality SHALL
+  }
+  notes: text [0..1] {
+    modality MAY
+  }
+  conditions: string[] [0..*] {
+    modality MAY
+  }
+  verdicts: reference(Verdict) [0..*] {
+    modality MAY
+    definition "Per-requirement verdict re-execution results (metamodel D3, TODO.new-paradigm/08): one Verdict per applicable requirement × sample in scope, computed by the verdict service from the report's bound facts and form computed values (embedded)."
+    on_delete cascade
+  }
+}
+
+class ModelEvaluation#data {
+  store { modelEvaluations }
+  description { "Per-model synthesis of accepted TestReports. Aggregates FormInstances across labs to determine if the model is fully tested (every required form has passing evidence from at least one lab). Lives on the parent EvaluationReport. Three-level synthesis per TODO.UPGRADE/13: TestReport → TestReportDetermination (admissibility gate) ModelEvaluation (per-model technical evaluation across labs) EvaluationReport (family-level aggregate)" }
+  indexes { evaluation_report_id model_id decision }
+  id: string {
+    modality SHALL
+  }
+  evaluation_report_id: reference(EvaluationReport) {
+    modality SHALL
+    on_delete cascade
+    required true
+  }
+  model_id: reference(MeasuringInstrumentModel) {
+    modality SHALL
+    on_delete restrict
+    required true
+  }
+  group_id: reference(MeasuringInstrumentModelGroup) [0..1] {
+    modality MAY
+    definition "Denormalized from model_id.group_id for filtering"
+    on_delete nullify
+    required false
+  }
+  required_form_ids: string[] [1..*] {
+    modality SHALL
+    definition "From the test program (e.g. R60-full-class-C: 11 forms)"
+  }
+  covered_form_ids: string[] [0..*] {
+    modality SHALL
+    definition "Forms with at least one passing FormInstance (derived)"
+  }
+  missing_form_ids: string[] [0..*] {
+    modality SHALL
+    definition "required_form_ids - covered_form_ids (derived)"
+  }
+  contributor_test_report_ids: string[] [0..*] {
+    modality SHALL
+    definition "TestReports that provided evidence for this model (derived)"
+  }
+  contributor_lab_ids: string[] [0..*] {
+    modality SHALL
+    definition "Labs that contributed (derived from TestReports)"
+  }
+  decision: enum {
+    modality SHALL
+    definition "PASS: all required forms covered with no failures. FAIL: any FormInstance.result == FAIL. CONDITIONAL: covered but with non-passing evidence (e.g. ANR cases). INCOMPLETE: missing_form_ids is non-empty."
+    enum_values { PASS FAIL CONDITIONAL INCOMPLETE }
+  }
+  reviewer_name: string {
+    modality SHALL
+  }
+  review_date: date {
+    modality SHALL
+  }
+  notes: text [0..1] {
+    modality MAY
+  }
+  conditions: string[] [0..*] {
+    modality MAY
+  }
+}
+
+class Certificate#data {
+  store { certificates }
+  indexes { standard_id }
+  id: string {
+    modality SHALL
+  }
+  standard_id: string {
+    modality SHALL
+  }
+  certificate_number: string {
+    modality SHALL
+  }
+  scheme: enum {
+    modality SHALL
+    enum_values { A B }
+  }
+  operated_scheme_id: string [0..1] {
+    modality MAY
+    definition "TODO.adoption/05: the certification scheme this certificate is issued under: the id of an OperatedScheme record; absent reads as the built-in OIML-CS scheme (oiml-cs). Under any other scheme this is NOT an OIML-CS certificate: no Annex B number, no BIML registration, no OIML marking, no OIML-CS Declaration gate (the honest boundary)"
+  }
+  scheme_numbering: reference(SchemeNumbering) [0..1] {
+    modality MAY
+    definition "TODO.adoption/05: the mint context of a template-numbered certificate: the sequence, the issue year and the category code the number was minted from, so a revision re-renders the number with the revision token and the ORIGINAL issue year (the guide practice: the year in the number is the year of initial certification). Absent on an Annex-B-numbered (OIML-CS) certificate"
+    required false
+  }
+  replaces_certificate_number: string [0..1] {
+    modality MAY
+    definition "TODO.adoption/05: the replacement lineage: a replacement certificate carries the replaced certificate's number, printed directly under its own number ('Replaces certificate no. ...' directly under the number, the conformity body's guide practice)"
+  }
+  edition_year: integer {
+    modality SHALL
+  }
+  issuing_authority_id: reference(IssuingAuthority) {
+    modality SHALL
+    on_delete restrict
+    required true
+  }
+  oiml_member_state: string {
+    modality SHALL
+  }
+  applicant: reference(ApplicantInfo) {
+    modality SHALL
+  }
+  manufacturer: reference(ManufacturerInfo) {
+    modality SHALL
+  }
+  model_family_id: reference(MeasuringInstrumentModelFamily) {
+    modality SHALL
+    definition "Certified scope: the model family (renamed from instrumentModelFamilyId in the old FK graph)"
+    on_delete restrict
+    required true
+  }
+  type_designation: string {
+    modality SHALL
+  }
+  type_description: text [0..1] {
+    modality MAY
+  }
+  module_designation: string [0..1] {
+    modality MAY
+  }
+  responsible_person: string [0..1] {
+    modality MAY
+  }
+  evaluation_report_id: reference(EvaluationReport) [0..1] {
+    modality MAY
+    on_delete nullify
+    required false
+  }
+  evaluation_report_ref: reference(TestEvaluationReportRef) [0..1] {
+    modality MAY
+  }
+  documentation_file: reference(DocumentationFileRef) [0..1] {
+    modality MAY
+  }
+  test_reports: reference(TestEvaluationReportRef) [1..*] {
+    modality SHALL
+  }
+  classifications: reference(CertificateClassification) [1..*] {
+    modality SHALL
+  }
+  result: enum {
+    modality SHALL
+    enum_values { APPROVED REJECTED REVOKED SUSPENDED }
+  }
+  status: enum [0..1] {
+    modality MAY
+    definition "DRAFT is the machine's initial (evaluation/state-machines.prl) — an issued certificate pre-registration-submission; the issuance gate walks initial → submit (task 61 reconciliation: the machine declared DRAFT, the enum did not — the service's tested behavior kept the machine)."
+    enum_values { DRAFT PENDING_REGISTRATION ACTIVE EXPIRED WITHDRAWN SUSPENDED UNDER_INVESTIGATION }
+  }
+  issue_date: date {
+    modality SHALL
+  }
+  expiry_date: date {
+    modality SHALL
+  }
+  periodicity_years: integer {
+    modality SHALL
+  }
+  conditions: string[] [0..*] {
+    modality SHALL
+  }
+  anr_coverage: reference(ANRCompliance) [0..*] {
+    modality MAY
+    definition "TODO.adoption/11 — the Additional National Requirements coverage recorded on the certificate's content, per targeted country: covered (with the evidence forms) or not evaluated (the tier-0 bypass with its recorded reason) — never a silent gap. Snapshotted from the evaluation report's anr_compliance at issuance."
+  }
+  remarks: text [0..1] {
+    modality MAY
+    definition "Free-text remarks printed on the certificate (the OIML certificate format's optional remarks block), recorded at issuance"
+  }
+  biml_registration: reference(BIMLRegistration) [0..1] {
+    modality MAY
+  }
+  fees: reference(Fees) [0..1] {
+    modality MAY
+  }
+  withdrawal: reference(Withdrawal) [0..1] {
+    modality MAY
+  }
+  suspension: reference(Suspension) [0..1] {
+    modality MAY
+  }
+  investigation: reference(Investigation) [0..1] {
+    modality MAY
+  }
+  edition_change: reference(EditionChange) [0..1] {
+    modality MAY
+    definition "Edition-change workflow per PD-05 §8.3"
+  }
+  parallel_to: string [0..1] {
+    modality MAY
+  }
+  original_applicant: reference(ApplicantInfo) [0..1] {
+    modality MAY
+  }
+  parallel_documentation_possessed: boolean [0..1] {
+    modality MAY
+    definition "Parallel issuance only (PD-05 §8.2.1): the new applicant possesses all the §4.1.2 technical documentation and the existing OIML type evaluation report — verified by the IA"
+  }
+  parallel_inquiry: text [0..1] {
+    modality MAY
+    definition "Parallel issuance only (PD-05 §8.2.2): the IA's validity inquiry (e.g. the original applicant's permission)"
+  }
+  ownership_transferred: reference(OwnershipTransfer) [0..1] {
+    modality MAY
+  }
+  revisions: reference(CertificateRevision) [0..*] {
+    modality SHALL
+  }
+  json_data: object {
+    modality SHALL
+  }
+  origin: enum [0..1] {
+    modality MAY
+    definition "How this record came to exist: platform_workflow (the DEFAULT — an absent origin reads as platform_workflow) or registered_offline (TODO.adoption/02 — records mode: the certificate was issued offline and is registered for the record by a named IA officer; a registered_offline certificate is visually marked on every detail, print and register view and never claims platform test-run evidence)"
+    enum_values { platform_workflow registered_offline }
+  }
+  created: datetime {
+    modality SHALL
+  }
+  modified: datetime {
+    modality SHALL
+  }
+}
+
+class CertificateAnnex#data {
+  store { certificateAnnexes }
+  indexes { certificate_id }
+  id: string {
+    modality SHALL
+  }
+  certificate_id: reference(Certificate) {
+    modality SHALL
+    on_delete cascade
+    required true
+  }
+  certificate_number: string {
+    modality SHALL
+  }
+  member_state: string {
+    modality SHALL
+  }
+  scheme: enum {
+    modality SHALL
+    enum_values { A B }
+  }
+  issuing_authority: reference(IASignatory) {
+    modality SHALL
+  }
+  applicant: reference(ApplicantInfo) {
+    modality SHALL
+  }
+  manufacturer: reference(ManufacturerInfo) {
+    modality SHALL
+  }
+  correction: text {
+    modality SHALL
+  }
+  signatory: reference(Signatory) {
+    modality SHALL
+  }
+  created: datetime {
+    modality SHALL
+  }
+  modified: datetime {
+    modality SHALL
+  }
+  document: reference(DocumentRef) [0..1] {
+    modality MAY
+    definition "The signed annex document — blob-backed when the document store is bound, the reference alone otherwise (TODO.adoption/03)"
+  }
+}
+
+class AuditEvent#data {
+  store { auditEvents }
+  indexes { entity_type timestamp standard_id }
+  id: string {
+    modality SHALL
+  }
+  timestamp: datetime {
+    modality SHALL
+  }
+  standard_id: string {
+    modality SHALL
+  }
+  entity_type: string {
+    modality SHALL
+  }
+  entity_id: string {
+    modality SHALL
+  }
+  action: string {
+    modality SHALL
+  }
+  user_id: string [0..1] {
+    modality MAY
+  }
+  user_name: string [0..1] {
+    modality MAY
+  }
+  basis: string [0..1] {
+    modality MAY
+    definition "Why the event happened — the normative or operational ground (TODO.roadmap/55, BUG.R60-SSOT gap 11: every audit-relevant record carries actor + timestamp + basis; service-emitted events may ride metadata.basis, the declared record audit_event cascade carries this first-class field)"
+  }
+  changes: reference(FieldChange) [0..*] {
+    modality MAY
+  }
+  metadata: object [0..1] {
+    modality MAY
+  }
+}
+
+class VerdictFact#data {
+  description { "The observed fact a requirement's machine limit was evaluated against (metamodel D3, TODO.new-paradigm/08): the value resolved from the requirement's primary binds_to path (entity graph) or from the form computed values realising an observable symbol." }
+  helper { true }
+  name: string {
+    modality SHALL
+    definition "binds_to path (e.g. 'sample.test_context.d_max') or observable symbol id (e.g. 'e_l')"
+  }
+  value: reference(QuantityValue) {
+    modality SHALL
+    definition "Observed value — QuantityValue { value, unit? }, never a bare number (INV-1)"
+  }
+  source: string [0..1] {
+    modality MAY
+    definition "Evidence source: the entity path the value resolved from, or the form id/field path of the computed value"
+  }
+}
+
+class Verdict#data {
+  description { "One per-requirement re-execution judgment (metamodel D3 Verdict, TODO.new-paradigm/08), embedded on TestReportDetermination.verdicts: the requirement's machine limit (OCL) evaluated against the bound facts (entity attributes + form computed values) → pass | fail | invalid | indeterminate. 'invalid' comes from a violated declaration-level CONSTRAINT (TODO.roadmap/51 — the subject's own validity rules, voiding the MEASUREMENT) or a violated test-validity precondition (TODO.refactor/08): both void, never count as an instrument failure. 'indeterminate' means missing evidence or an unevaluable expression (the reason is recorded in notes). An evaluator may override the computed outcome; the override is recorded, never silent." }
+  helper { true }
+  requirement_id: string {
+    modality SHALL
+    definition "Full requirement identifier (e.g. '/req/metrological/measuring-range-max')"
+  }
+  sample_id: reference(MeasuringInstrumentSample) {
+    modality SHALL
+    definition "The sample the bound facts belong to"
+  }
+  fact: reference(VerdictFact) {
+    modality SHALL
+    definition "The observed fact the limit was evaluated against"
+  }
+  limit: object {
+    modality SHALL
+    definition "Limit snapshot { expression, uses, inputs } — the OCL expression and every input value it was evaluated with"
+  }
+  outcome: enum {
+    modality SHALL
+    enum_values { pass fail invalid indeterminate }
+  }
+  modality: enum [0..1] {
+    modality MAY
+    definition "Modality of the requirement limit that produced this verdict (TODO.refactor/08, default shall): a failed should-verdict is an OBSERVATION in the evaluation report, never a pass/fail blocker"
+    enum_values { shall should }
+  }
+  precondition_violations: string[] [0..1] {
+    modality MAY
+    definition "Ids of the violated conformance-test preconditions when outcome = invalid (ConformanceTest.preconditions, evaluated before the limit; a violated precondition voids the run)"
+  }
+  constraint_violations: string[] [0..1] {
+    modality MAY
+    definition "Ids of the violated subject-intrinsic constraints when outcome = invalid (specification/constraints.yaml, TODO.roadmap/51 — declaration-level validity rules evaluated BEFORE preconditions; a violated constraint voids the MEASUREMENT, never a fail)"
+  }
+  overridden: boolean [0..1] {
+    modality MAY
+    definition "True when an evaluator replaced the computed outcome"
+  }
+  override_note: text [0..1] {
+    modality MAY
+    definition "Mandatory justification for an override"
+  }
+  override_by: string [0..1] {
+    modality MAY
+    definition "Evaluator who applied the override"
+  }
+  override_at: datetime [0..1] {
+    modality MAY
+    definition "When the override was applied (ISO timestamp) — with override_by + override_note the override's audit carriers (TODO.roadmap/55, BUG.R60-SSOT gap 11: actor + timestamp + basis, the override is recorded, never silent)"
+  }
+  notes: text [0..1] {
+    modality MAY
+    definition "Why indeterminate (missing evidence, unevaluable expression), or other remarks"
+  }
+  channel_values: string[] [0..1] {
+    modality MAY
+    definition "Channel values (e.g. measurand components co/no/no2) this verdict's evidence covers, from the evidence form instances' component_under_test; per-channel requirements (TODO.refactor/06) need a passing verdict per value"
+  }
+  criterion: enum [0..1] {
+    modality MAY
+    definition "Verdict criterion (TODO.refactor/10; R 91-2, 6.1, OIML D 11-based): I/MPE — limit during the influence factor; D/NSFa — no significant fault AFTER the disturbance (manual intervention allowed, recorded); D/NSFd — no significant fault DURING the disturbance; n/a — observational. Stamped so evaluation reports distinguish fault-during from fault-after"
+    enum_values { I/MPE D/NSFa D/NSFd n/a }
+  }
+  verdict_id: string [0..1] {
+    modality MAY
+    definition "Canonical VerdictQuantity id (TODO.refactor/04) when the requirement judges via limit.accepts — the per-observable key of the canonical verdict chain"
+  }
+}
+
+class ApplicantInfo#data {
+  helper { true }
+  company: string {
+    modality SHALL
+  }
+  address: string {
+    modality SHALL
+  }
+  contact_person: string [0..1] {
+    modality MAY
+  }
+  email: string [0..1] {
+    modality MAY
+  }
+  phone: string [0..1] {
+    modality MAY
+  }
+}
+
+class AuthorisedRep#data {
+  helper { true }
+  name: string {
+    modality SHALL
+  }
+  address: string {
+    modality SHALL
+  }
+}
+
+class ApplicationDocument#data {
+  helper { true }
+  name: string {
+    modality SHALL
+  }
+  description: string {
+    modality SHALL
+  }
+  submitted: boolean {
+    modality SHALL
+  }
+  reference: string [0..1] {
+    modality MAY
+  }
+  size: integer [0..1] {
+    modality MAY
+    definition "Blob slot (TODO.adoption/03): the stored file's size in bytes — set with blob_key, absent in the file-name-only posture"
+  }
+  type: string [0..1] {
+    modality MAY
+    definition "Blob slot: the stored file's MIME content type"
+  }
+  blob_key: string [0..1] {
+    modality MAY
+    definition "Blob slot: the document-store key (<owner store>/<owner entity id>/<blob id>) — absent when no blob store is bound (the honest file-name-only fallback: reference carries the name, the bytes stay with the sender)"
+  }
+  sha256: string [0..1] {
+    modality MAY
+    definition "Blob slot: the SHA-256 hex digest of the stored bytes — the download path re-verifies it"
+  }
+  uploaded_by: string [0..1] {
+    modality MAY
+    definition "Blob slot provenance: who uploaded the file (the display name)"
+  }
+  uploaded_at: datetime [0..1] {
+    modality MAY
+    definition "Blob slot provenance: when the file was uploaded"
+  }
+}
+
+class DocumentRef#data {
+  helper { true }
+  document_type: string {
+    modality SHALL
+  }
+  reference: string [0..1] {
+    modality MAY
+  }
+  description: string [0..1] {
+    modality MAY
+  }
+  size: integer [0..1] {
+    modality MAY
+    definition "Blob slot (TODO.adoption/03): the stored file's size in bytes — set with blob_key, absent in the file-name-only posture"
+  }
+  type: string [0..1] {
+    modality MAY
+    definition "Blob slot: the stored file's MIME content type"
+  }
+  blob_key: string [0..1] {
+    modality MAY
+    definition "Blob slot: the document-store key (<owner store>/<owner entity id>/<blob id>) — absent when no blob store is bound (the honest file-name-only fallback: reference carries the name, the bytes stay with the sender)"
+  }
+  sha256: string [0..1] {
+    modality MAY
+    definition "Blob slot: the SHA-256 hex digest of the stored bytes — the download path re-verifies it"
+  }
+  uploaded_by: string [0..1] {
+    modality MAY
+    definition "Blob slot provenance: who uploaded the file (the display name)"
+  }
+  uploaded_at: datetime [0..1] {
+    modality MAY
+    definition "Blob slot provenance: when the file was uploaded"
+  }
+}
+
+class SampleInfo#data {
+  helper { true }
+  sample_count: integer [0..1] {
+    modality MAY
+  }
+  sample_details: text [0..1] {
+    modality MAY
+  }
+}
+
+class SampleRequest#data {
+  description { "The IA's request for physical samples against a submitted application (PD-05 §4.3): which models, how many samples of each, the routing (to the IA for onward dispatch, or directly to each named test laboratory), and free-text particulars (deadline, conditions, shipping instructions). Recorded on Application.sample_request when the IA fires ia_requests_samples; the stub samples it spawns carry the request through the custody chain (REQUESTED → IN_TRANSIT → RECEIVED)." }
+  helper { true }
+  routing: enum {
+    modality SHALL
+    definition "The sample-routing decision (PD-05 §4.3 — the IA's sample request carries it): send the samples to the IA (which dispatches them to its laboratories after receipt) or directly to each named test laboratory"
+    enum_values { to_ia to_each_tl }
+  }
+  count: integer {
+    modality SHALL
+    definition "Samples requested per in-scope model"
+  }
+  model_ids: reference(MeasuringInstrumentModel) [0..*] {
+    modality MAY
+    definition "The models the requested samples must cover; absent = the application's whole declared scope"
+    on_delete nullify
+    required false
+  }
+  laboratory_ids: reference(TestLaboratory) [0..*] {
+    modality MAY
+    definition "The receiving laboratories when routing is to_each_tl"
+    on_delete nullify
+    required false
+  }
+  particulars: text [0..1] {
+    modality MAY
+    definition "Deadline, conditions, shipping instructions for the applicant"
+  }
+  requested_by: string [0..1] {
+    modality MAY
+    definition "The IA officer who issued the request (audit provenance)"
+  }
+  requested_at: datetime [0..1] {
+    modality MAY
+  }
+}
+
+class PreviousTestReportRef#data {
+  helper { true }
+  report_number: string {
+    modality SHALL
+  }
+  issuing_authority: string [0..1] {
+    modality MAY
+  }
+  date: date [0..1] {
+    modality MAY
+  }
+  relevant_scope: text [0..1] {
+    modality MAY
+  }
+}
+
+class FeeAcceptance#data {
+  helper { true }
+  application_fee_accepted: boolean [0..1] {
+    modality MAY
+  }
+  evaluation_fee_accepted: boolean [0..1] {
+    modality MAY
+  }
+}
+
+class IAReviewResult#data {
+  description { "IA review outcome per PD-05 §4.2" }
+  helper { true }
+  fee_estimate: reference(FeeEstimate) [0..1] {
+    modality MAY
+  }
+  sample_count_required: integer [0..1] {
+    modality MAY
+    definition "Number of samples required (PD-05 §4.2)"
+  }
+  estimated_timeline: string [0..1] {
+    modality MAY
+  }
+  decision_date: date [0..1] {
+    modality MAY
+  }
+  decision_letter: text [0..1] {
+    modality MAY
+    definition "Written decision (acceptance or refusal)"
+  }
+  refusal_reason: text [0..1] {
+    modality MAY
+    definition "Required if decision is REJECTED (PD-05 §4.2.2)"
+  }
+}
+
+class FeeEstimate#data {
+  helper { true }
+  application_fee: number [0..1] {
+    modality MAY
+    unit "EUR"
+  }
+  evaluation_fee_estimate: number [0..1] {
+    modality MAY
+    unit "EUR"
+  }
+  currency: string [0..1] {
+    modality MAY
+  }
+}
+
+class TestReportFormRef#data {
+  helper { true }
+  form_id: string {
+    modality SHALL
+  }
+  instance_id: string [0..1] {
+    modality MAY
+  }
+  source: string {
+    modality SHALL
+    default "base"
+  }
+  country: string [0..1] {
+    modality MAY
+  }
+  required: boolean {
+    modality SHALL
+  }
+}
+
+class FormOmission#data {
+  description { "Declares that a specific R 60-3 Test Report Form does not apply to the model group being tested in this TestReport, with justification. Per user (2026-07-02): \"If the IA or test lab decides that a particular TRF doesn't need to be filled for a model family/group, then they should have a way to specify that.\"" }
+  helper { true }
+  id: string {
+    modality SHALL
+  }
+  test_report_id: reference(TestReport) {
+    modality SHALL
+    on_delete cascade
+    required true
+  }
+  form_id: string {
+    modality SHALL
+    definition "R 60-3 form identifier being omitted (e.g. 'humidity-sh')"
+  }
+  reason: text {
+    modality SHALL
+    definition "Justification, e.g. 'Not applicable — CH humidity class, SH test not required'"
+  }
+  decided_by: enum {
+    modality SHALL
+    definition "Who decided the form doesn't apply"
+    enum_values { ia test_lab }
+  }
+  decided_at: datetime {
+    modality SHALL
+  }
+}
+
+class ArtifactInstance#data {
+  description { "One produced artifact (TODO.roadmap/09, gap audit G2) — a HAS-level output OF THE INSTRUMENT conforming to an artifact definition of the standard's model/artifacts.yaml (the IS-level contract; e.g. R 91's enforcement evidence file, R 91-1 6.6/7.2.2/7.3), embedded in the TestReport it evidences. Distinct from an EvidenceRecord: the artifact is the instrument's own output, not the lab's record of the test (linker rule artifact-evidence-separation keeps the vocabularies apart). Content entries key on the definition's content-contract field ids; required (non-optional) fields must be populated (linker rule artifact-presence)." }
+  helper { true }
+  id: string {
+    modality SHALL
+  }
+  of: string {
+    modality SHALL
+    definition "Artifact definition id (model/artifacts.yaml artifact_definitions[].id)"
+  }
+  produced_at: datetime [0..1] {
+    modality MAY
+    definition "When the instrument produced the artifact"
+  }
+  by: string [0..1] {
+    modality MAY
+    definition "Producer id — the sample/instrument that produced the artifact"
+  }
+  content: map<field_id, QuantityValue> {
+    modality SHALL
+    definition "Contract field id → value entry ({ value, unit? }); a numeric value populating a quantity-kind-typed field carries a unit of that kind"
+  }
+  links: string[] [0..*] {
+    modality MAY
+    definition "Run/assignment/report ids the instance is linked to; per_measurement definitions must link ≥1 (linker rule artifact-presence)"
+  }
+}
+
+class FormDetermination#data {
+  helper { true }
+  form_id: string {
+    modality SHALL
+  }
+  decision: enum {
+    modality SHALL
+    enum_values { PASS FAIL CONDITIONAL NOT_REVIEWED }
+  }
+  notes: text {
+    modality SHALL
+  }
+  reviewed_date: date {
+    modality SHALL
+  }
+  field_determinations: reference(FieldDetermination) [0..*] {
+    modality MAY
+  }
+}
+
+class FieldDetermination#data {
+  helper { true }
+  decision: enum {
+    modality SHALL
+    enum_values { PASS FAIL CONDITIONAL NOT_REVIEWED }
+  }
+  notes: text {
+    modality SHALL
+  }
+}
+
+class TestEvaluationReportRef#data {
+  helper { true }
+  report_number: string {
+    modality SHALL
+  }
+  date: date {
+    modality SHALL
+  }
+  pages: integer [0..1] {
+    modality MAY
+  }
+}
+
+class CertificateClassification#data {
+  helper { true }
+  label: string {
+    modality SHALL
+  }
+  characteristics: object {
+    modality SHALL
+  }
+}
+
+class CertificateRevision#data {
+  helper { true }
+  revision: integer {
+    modality SHALL
+  }
+  date: date {
+    modality SHALL
+  }
+  description: text {
+    modality SHALL
+  }
+  changes: reference(RevisionChange) [0..*] {
+    modality MAY
+  }
+  modifies_type: boolean [0..1] {
+    modality MAY
+    definition "The revision modifies the certified type (PD-05 §8.1.3) — triggers the §8.1.4 retest-list obligation"
+  }
+  corrects_error: boolean [0..1] {
+    modality MAY
+    definition "The revision corrects an error (PD-05 §8.1.5) — the previous registered copy is marked SUPERSEDED on registration"
+  }
+  retest_list: reference(RetestItem) [0..*] {
+    modality MAY
+    definition "The IA-determined list of tests and examinations performed on the modified instrument (PD-05 §8.1.4) — mandatory when modifies_type"
+  }
+}
+
+class RetestItem#data {
+  description { "One entry of the §8.1.4 retest list: a test or examination the Issuing Authority determined must be performed on the modified instrument, with the reason it is required." }
+  helper { true }
+  test_id: string {
+    modality SHALL
+    definition "Conformance-test id (or free identification of the examination)"
+  }
+  reason: text {
+    modality SHALL
+  }
+  report_ref: string [0..1] {
+    modality MAY
+    definition "The test report evidencing the performed retest (PD-05 §8.1.3 references)"
+  }
+}
+
+class AppliedAnr#data {
+  description { "One additional national requirement test applied for under Scheme A (PD-05 §5.1.4): the ANR as listed in a Utilizer/Associate OIML-CS Declaration, with the results placement (§5.4.2 — a separate test report or the OIML test reports) recorded at discharge. TODO.adoption/11: populated at application time from the targeted countries' APPROVED AnrDeclaration records, snapshotting country/tier for provenance (a later tier promotion never rewrites the history); the tier-0 honest bypass marks coverage = not_evaluated with its reason — the certificate's ANR section reports it per country, never a silent gap." }
+  helper { true }
+  anr: text {
+    modality SHALL
+    definition "The additional national requirement (verbatim from the Declaration's additional_national_requirements)"
+  }
+  for_participant_id: string {
+    modality SHALL
+    definition "The Utilizer/Associate whose Declaration lists the ANR"
+  }
+  declaration_id: string [0..1] {
+    modality MAY
+    definition "The Declaration record the ANR was taken from"
+  }
+  country: string [0..1] {
+    modality MAY
+    definition "TODO.adoption/11 — the targeted market (Application.anr_countries token) this ANR belongs to, snapshotted at application time"
+  }
+  tier: enum [0..1] {
+    modality MAY
+    definition "TODO.adoption/11 — the declaring AnrDeclaration's content tier at application time (the coverage history keeps both forms' provenance across a later promotion)"
+    enum_values { tier_1 tier_2 }
+  }
+  coverage: enum [0..1] {
+    modality MAY
+    definition "TODO.adoption/11 — the tier-0 honest bypass: not_evaluated marks the ANR as deliberately not evaluated in this evaluation (not_evaluated_reason is then mandatory); absent or evaluated = covered by the evaluation"
+    enum_values { evaluated not_evaluated }
+  }
+  not_evaluated_reason: text [0..1] {
+    modality MAY
+    definition "Mandatory when coverage = not_evaluated — the recorded reason the ANR is not evaluated in this evaluation"
+  }
+  results_in: enum [0..1] {
+    modality MAY
+    definition "Where the ANR results are reported (PD-05 §5.4.2) — set at discharge"
+    enum_values { separate_report oiml_test_report }
+  }
+  discharged: boolean [0..1] {
+    modality MAY
+    definition "The ANR tests were conducted and reported (§5.3.2/§5.4.2) — the §5.6.3 letter validates discharged ANRs"
+  }
+}
+
+class RevisionChange#data {
+  helper { true }
+  field: string {
+    modality SHALL
+  }
+  old_value: any {
+    modality MAY
+  }
+  new_value: any {
+    modality MAY
+  }
+}
+
+class BIMLRegistration#data {
+  helper { true }
+  submitted_date: date [0..1] {
+    modality MAY
+  }
+  registered_date: date [0..1] {
+    modality MAY
+  }
+  registration_number: string [0..1] {
+    modality MAY
+  }
+}
+
+class Fees#data {
+  helper { true }
+  application_fee: number [0..1] {
+    modality MAY
+  }
+  evaluation_fee: number [0..1] {
+    modality MAY
+  }
+  registration_fee: number [0..1] {
+    modality MAY
+  }
+  currency: string [0..1] {
+    modality MAY
+  }
+  paid_date: date [0..1] {
+    modality MAY
+  }
+  invoice_number: string [0..1] {
+    modality MAY
+  }
+}
+
+class Withdrawal#data {
+  helper { true }
+  date: date {
+    modality SHALL
+  }
+  reason: text {
+    modality SHALL
+  }
+  requested_by: enum {
+    modality SHALL
+    enum_values { ia manufacturer biml }
+  }
+  reported_to_biml: boolean {
+    modality SHALL
+  }
+}
+
+class Suspension#data {
+  helper { true }
+  date: date {
+    modality SHALL
+  }
+  reason: text {
+    modality SHALL
+  }
+  lift_date: date [0..1] {
+    modality MAY
+  }
+}
+
+class Investigation#data {
+  helper { true }
+  date: date {
+    modality SHALL
+  }
+  evidence: text {
+    modality SHALL
+  }
+  status: enum {
+    modality SHALL
+    enum_values { open resolved deregistered }
+  }
+  outcome: text [0..1] {
+    modality MAY
+  }
+  resolved_date: date [0..1] {
+    modality MAY
+    definition "The date the investigation closed (status resolved/deregistered) — the closure hook the surveillance wiring reads to judge a certificate flag stale (an open escalation record never rewrites; the resolution event closes it, TODO.v2/13 item 7)"
+  }
+  reported_to_biml: boolean {
+    modality SHALL
+  }
+}
+
+class EditionChange#data {
+  description { "Edition-change workflow per PD-05 §8.3" }
+  helper { true }
+  previous_edition: integer {
+    modality SHALL
+    definition "Year of the previous edition"
+  }
+  new_edition: integer {
+    modality SHALL
+  }
+  additional_tests_required: boolean {
+    modality SHALL
+  }
+  additional_tests_description: text [0..1] {
+    modality MAY
+  }
+  new_evaluation_report_id: reference(EvaluationReport) [0..1] {
+    modality MAY
+    on_delete nullify
+    required false
+  }
+}
+
+class OwnershipTransfer#data {
+  helper { true }
+  from: reference(ApplicantInfo) {
+    modality SHALL
+  }
+  to: reference(ApplicantInfo) {
+    modality SHALL
+  }
+  transfer_date: date {
+    modality SHALL
+  }
+  verified_by: string {
+    modality SHALL
+  }
+}
+
+class ManufacturerInfo#data {
+  helper { true }
+  company: string {
+    modality SHALL
+  }
+  address: string {
+    modality SHALL
+  }
+}
+
+class DocumentationFileRef#data {
+  helper { true }
+  reference_number: string {
+    modality SHALL
+  }
+  date: date {
+    modality SHALL
+  }
+  pages: integer {
+    modality SHALL
+  }
+}
+
+class ANRCompliance#data {
+  helper { true }
+  country: string {
+    modality SHALL
+  }
+  decision: enum {
+    modality SHALL
+    definition "TODO.adoption/11 — PENDING: targeted, the evaluation has not concluded the coverage yet; NOT_EVALUATED is the tier-0 honest bypass: every ANR of the country was marked not evaluated in this evaluation (the per-ANR reasons ride items); never a silent gap"
+    enum_values { APPROVED REJECTED CONDITIONALLY_APPROVED NOT_EVALUATED PENDING }
+  }
+  forms: string[] [0..*] {
+    modality MAY
+  }
+  notes: text [0..1] {
+    modality MAY
+  }
+  items: reference(ANRComplianceItem) [0..*] {
+    modality MAY
+    definition "TODO.adoption/11 — the per-ANR coverage detail (evaluated with its evidence forms / not_evaluated with its reason)"
+  }
+}
+
+class ANRComplianceItem#data {
+  description { "TODO.adoption/11 — one applied ANR's coverage inside a country's ANRCompliance entry: the requirement snapshot, its declaration provenance and tier at application time, whether the evaluation covered it (with the evidence form ids) or bypassed it (with the recorded reason)." }
+  helper { true }
+  anr: text {
+    modality SHALL
+    definition "The applied requirement (snapshot at application time)"
+  }
+  declaration_id: string [0..1] {
+    modality MAY
+    definition "The AnrDeclaration the ANR was resolved from"
+  }
+  tier: enum [0..1] {
+    modality MAY
+    enum_values { tier_1 tier_2 }
+  }
+  coverage: enum {
+    modality SHALL
+    enum_values { evaluated not_evaluated }
+  }
+  reason: text [0..1] {
+    modality MAY
+    definition "The recorded bypass reason (mandatory on not_evaluated)"
+  }
+  forms: string[] [0..*] {
+    modality MAY
+    definition "The evidence form ids the coverage was evaluated through (the ANR test forms on the application's test reports)"
+  }
+}
+
+class IASignatory#data {
+  helper { true }
+  name: string {
+    modality SHALL
+  }
+  address: string {
+    modality SHALL
+  }
+  responsible_person: string {
+    modality SHALL
+  }
+}
+
+class Signatory#data {
+  helper { true }
+  name: string {
+    modality SHALL
+  }
+  position: string {
+    modality SHALL
+  }
+  date: date {
+    modality SHALL
+  }
+}
+
+class FieldChange#data {
+  helper { true }
+  field: string {
+    modality SHALL
+  }
+  old_value: any {
+    modality MAY
+  }
+  new_value: any {
+    modality MAY
+  }
+}
+
+class ApprovalRecord#data {
+  helper { true }
+  approver_role: string {
+    modality SHALL
+  }
+  approver_name: string {
+    modality SHALL
+  }
+  decision: enum {
+    modality SHALL
+    enum_values { APPROVED REJECTED CONDITIONALLY_APPROVED }
+  }
+  decision_date: datetime {
+    modality SHALL
+  }
+  notes: string [0..1] {
+    modality MAY
+  }
+}
+