@primmel/primmel 1.11.1 → 1.13.0

package/dist/src/check.js

@@ -152,7 +152,10 @@
 //      (TODO.roadmap/39b — ISO/IEC 17065 role segregation) are
 //      well-formed: pair members resolve to declared processes (or the
 //      reserved case_personnel token), are distinct, and include the
-//      owning process
+//      owning process; the kind-conditional XOR (smart TODO.roadmap/40
+//      batch 2): a disjoint constraint is ONLY a pair, a consultancy
+//      bar carries barred relations (required) + an optional period and
+//      never a pair
 //   C74 process-io-type-coherence (TODO.roadmap/38): typed transition
 //      boundaries — one name (signature in/out, registers) carries ONE
 //      type; two declarations of the same name whose quantity
@@ -311,6 +314,55 @@
 //      document approving organs, decision_rule edges. Per-register
 //      gating (the C58 doctrine): an edge is checked only when its
 //      target register is in composition scope
+//   C121 abstract-process-references-resolve (smart TODO.roadmap/40
+//      batch 2): the abstract-process model's framework bindings resolve
+//      — roles/organs/participant_kinds lists, decision.rule, the
+//      declaration kind + sign|update action vocabulary,
+//      discharges_gate, realized_by → process, approved_by → approval,
+//      the calendar windows' shape (kind vocabulary; exactly one of
+//      years/months), and the process_model's sequence + register
+//      maintainer edges. Per-register gating (the C58 doctrine)
+//   C122 scheme-type-resolves (smart TODO.roadmap/40 batch 2): the
+//      ISO/IEC 17067 register is composable — a manifest's scheme_type
+//      token resolves against the composed scheme_type register when one
+//      is in scope; a scheme_type's determination / attestation /
+//      surveillance.activities entries resolve against the composed
+//      scheme_activity_kind menus. C98's no-surveillance set defers to
+//      the register's surveillance.required (register-free fallback
+//      stays)
+//   C123 document-module-references-resolve (smart TODO.roadmap/40 batch
+//      2): the document module's edges resolve — sequence → process,
+//      register maintainer → governance_organ (per-register gated), the
+//      declared namespace is an absolute requirement-namespace path (the
+//      pin C119 prefers over the requirement_class-id derivation), and
+//      the informative annex's applies_to names a known package
+//      (locator-gated)
+//   C124 pair-list-shape (smart TODO.roadmap/40 batch 4): the
+//      attribute_definition pair_list block's declaration shape — key +
+//      value slots required, component ids unique, key_dimension →
+//      applicability dimension (per-register gated); the closed-registry-
+//      over-values leg stays app-side
+//   C125 formula-variant-shape (smart TODO.roadmap/40 batch 4): the
+//      calculation variant block's declaration shape — variant ids
+//      unique, the type-conditional facets present (expression /
+//      table_lookup / profile_lookup); the params are engine call-site
+//      names and carry no resolution leg
+//   C126 formula-note-targets-resolve (smart TODO.roadmap/40 batch 4):
+//      the formula_note register's reverse applicability resolves —
+//      applies_to → symbol (per-register gated)
+//   C127 common-test-condition-shape (smart TODO.roadmap/40 batch 4):
+//      the common_test_condition register's declaration shape — the
+//      description is required; the title stays optional (the r91 map
+//      entries carry none) and the reference a free citation string
+//   C128 part-annex-shape (smart TODO.roadmap/40 batch 4): the
+//      part_annex register's declaration shape — letters unique per
+//      package, the source provenance required; the obligation
+//      vocabulary is parse-enforced upstream
+//   C129 storyline-shape (smart TODO.roadmap/40 batch 4): the demo-seed
+//      shapes — the id_prefix pattern (register-free), party →
+//      demo_world participant seeds (gated), record stores → entity-
+//      class stores (gated), in-construct record cross-references
+//      (ungated); field-level discipline stays app-side
 //
 // Levels (TODO.roadmap/17): the DEFAULT level runs the normal-level
 // rules at their catalog severities. --audit additionally runs the
@@ -1365,6 +1417,11 @@ function checkPackage(dir, options = {}) {
     // never roles — a scheme may bind one role to evaluation, review AND
     // decision, so the norms quantify over process involvement. Per-
     // assignment runtime enforcement is the platform's business (task 44).
+    // The kind-conditional shape (smart TODO.roadmap/40 batch 2 — the YAML
+    // schema's allOf discipline, data/schemas/abstract-processes.yaml): a
+    // case_personnel_disjoint constraint is ONLY a pair (no period, no
+    // barred relations); a consultancy_bar is ONLY a barred-relations list
+    // with an optional period (never a pair).
     // Mirror of the OIML SMART linker's R24 abstract-process-segregation.
     {
         const SEGREGATION_CASE_PERSONNEL = 'case_personnel';
@@ -1381,6 +1438,9 @@ function checkPackage(dir, options = {}) {
                         err('C59', `process ${p.id}: segregation constraint "${s.id}" is case_personnel_disjoint but declares ${s.pair.length} pair members — exactly two are required (segregation-members-resolve)`);
                         continue;
                     }
+                    if (s.period !== '' || s.barred.length > 0) {
+                        err('C59', `process ${p.id}: segregation constraint "${s.id}" is case_personnel_disjoint but declares ${s.period !== '' ? `period "${s.period}"` : 'barred relations'} — a disjoint constraint is ONLY a pair; the period/barred facets belong to consultancy_bar (segregation-members-resolve)`);
+                    }
                     const [a, b] = s.pair;
                     if (a === b) {
                         err('C59', `process ${p.id}: segregation constraint "${s.id}" declares "${a}" disjoint from itself — the two personnel sets must be distinct (segregation-members-resolve)`);
@@ -1395,6 +1455,134 @@ function checkPackage(dir, options = {}) {
                         err('C59', `process ${p.id}: segregation constraint "${s.id}" is declared on process "${p.id}" but neither pair member is "${p.id}" — the constrained process owns its segregation constraints (segregation-members-resolve)`);
                     }
                 }
+                else {
+                    // consultancy_bar — the barred client relations are REQUIRED
+                    // (a bar that bars nothing is no bar); the pair is the disjoint
+                    // kind's shape and never appears here; the period is optional
+                    // (4.2.10 body-specified vs 7.13.6 fixed P2Y).
+                    if (s.barred.length === 0) {
+                        err('C59', `process ${p.id}: segregation constraint "${s.id}" is consultancy_bar but bars no client relation — the barred list is required (segregation-members-resolve)`);
+                    }
+                    if (s.pair.length > 0) {
+                        err('C59', `process ${p.id}: segregation constraint "${s.id}" is consultancy_bar but declares a pair — the pair is the case_personnel_disjoint shape; a bar carries barred relations and an optional period only (segregation-members-resolve)`);
+                    }
+                }
+            }
+        }
+    }
+    // ── C121: abstract-process-references-resolve (smart TODO.roadmap/40 ──
+    // batch 2; the packages-as-SSOT epic) ───────────────────────────────
+    // The abstract-process model's framework bindings resolve against the
+    // composed registers: the role binding list, the organ and participant
+    // kind facets, the decision rule, the declaration kind (plus the sign |
+    // update action vocabulary), the discharged declaration gate, the
+    // realizing processes and the authorizing approvals; the calendar
+    // windows' shape legs (the max_elapsed | min_elapsed kind vocabulary;
+    // exactly one of years/months — the scheme_lifecycle duration
+    // sub-grammar) are register-free. The process_model's sequence members
+    // (→ process) and register maintainers (→ governance_organ) ride the
+    // same rule. Per-register gating (the C58 doctrine): an edge is checked
+    // only when its target register is in composition scope. The windows'
+    // anchor/applies_to FIELD resolution stays consumer-side (the R26
+    // precedent). Mirror of the OIML SMART linker's abstract-process
+    // reference legs.
+    {
+        const apRoleIds = new Set((standard.roles ?? []).map(r => r.id));
+        const apGateIds = new Set((standard.declarationGates ?? []).map(g => g.id));
+        const apRuleIds = new Set((standard.decisionRules ?? []).map(r => r.id));
+        const apApprovalIds = new Set((standard.approvals ?? []).map(a => a.id));
+        // The C120 organ/kind/declaration resolvers report under C120 — the
+        // abstract-process edges are C121's, so the rule carries its own
+        // per-register-gated resolvers over the same composed registers.
+        const resolveOrganAp = (where, facet, id) => {
+            if (organIds.size > 0 && id !== '' && !organIds.has(id)) {
+                err('C121', `${where}: ${facet} "${id}" is not a declared governance organ (abstract-process-references-resolve)`);
+            }
+        };
+        const resolveKindAp = (where, facet, id) => {
+            if (kindIds.size > 0 && id !== '' && !kindIds.has(id)) {
+                err('C121', `${where}: ${facet} "${id}" is not a declared participant kind (abstract-process-references-resolve)`);
+            }
+        };
+        const resolveDeclarationAp = (where, facet, id) => {
+            if (declIds.size > 0 && id !== '' && !declIds.has(id)) {
+                err('C121', `${where}: ${facet} "${id}" is not a declared declaration kind (abstract-process-references-resolve)`);
+            }
+        };
+        const resolveProcessRef = (where, facet, id) => {
+            if (frameworkProcessIds.size > 0 && !frameworkProcessIds.has(id)) {
+                err('C121', `${where}: ${facet} "${id}" is not a declared process (abstract-process-references-resolve)`);
+            }
+        };
+        for (const p of standard.processes ?? []) {
+            const where = `process ${p.id}`;
+            if (apRoleIds.size > 0) {
+                for (const r of p.roles ?? []) {
+                    if (!apRoleIds.has(r)) {
+                        err('C121', `${where}: roles "${r}" is not a declared role (abstract-process-references-resolve)`);
+                    }
+                }
+            }
+            for (const o of p.organs ?? []) {
+                resolveOrganAp(where, 'organs', o);
+            }
+            for (const k of p.participantKinds ?? []) {
+                resolveKindAp(where, 'participant_kinds', k);
+            }
+            if (p.decision) {
+                if (p.decision.rule === '') {
+                    err('C121', `${where}: the decision facet declares no rule — a decision names the decision_rule it applies (abstract-process-references-resolve)`);
+                }
+                else if (apRuleIds.size > 0 && !apRuleIds.has(p.decision.rule)) {
+                    err('C121', `${where}: decision.rule "${p.decision.rule}" is not a declared decision rule (abstract-process-references-resolve)`);
+                }
+            }
+            if (p.declaration) {
+                if (p.declaration.kind === '') {
+                    err('C121', `${where}: the declaration facet declares no kind — a declaration names the declaration_kind it signs or updates (abstract-process-references-resolve)`);
+                }
+                else {
+                    resolveDeclarationAp(where, 'declaration.kind', p.declaration.kind);
+                }
+                if (p.declaration.action !== 'sign' &&
+                    p.declaration.action !== 'update') {
+                    err('C121', `${where}: declaration action "${p.declaration.action || '(none)'}" — a declaration is signed or updated (valid: sign, update) (abstract-process-references-resolve)`);
+                }
+            }
+            if (p.dischargesGate !== '' &&
+                apGateIds.size > 0 &&
+                !apGateIds.has(p.dischargesGate)) {
+                err('C121', `${where}: discharges_gate "${p.dischargesGate}" is not a declared declaration gate (abstract-process-references-resolve)`);
+            }
+            for (const r of p.realizedBy ?? []) {
+                resolveProcessRef(where, 'realized_by', r);
+            }
+            if (apApprovalIds.size > 0) {
+                for (const a of p.approvedBy ?? []) {
+                    if (!apApprovalIds.has(a)) {
+                        err('C121', `${where}: approved_by "${a}" is not a declared approval (abstract-process-references-resolve)`);
+                    }
+                }
+            }
+            for (const w of p.windows ?? []) {
+                const wwhere = `${where} window ${w.id}`;
+                if (w.kind !== 'max_elapsed' && w.kind !== 'min_elapsed') {
+                    err('C121', `${wwhere}: kind "${w.kind || '(none)'}" — a calendar window is a deadline or a cooling-off (valid: max_elapsed, min_elapsed) (abstract-process-references-resolve)`);
+                }
+                if (w.windowYears > 0 === w.windowMonths > 0) {
+                    err('C121', `${wwhere}: the window duration declares ${w.windowYears > 0
+                        ? 'both years and months'
+                        : 'neither years nor months'} — exactly one is required (the scheme_lifecycle window sub-grammar) (abstract-process-references-resolve)`);
+                }
+            }
+        }
+        for (const m of standard.processModels ?? []) {
+            const where = `process_model ${m.id}`;
+            for (const s of m.sequence ?? []) {
+                resolveProcessRef(where, 'sequence', s);
+            }
+            for (const r of m.registers ?? []) {
+                resolveOrganAp(`${where} register ${r.id}`, 'maintainer', r.maintainer);
             }
         }
     }
@@ -2427,6 +2615,88 @@ function checkPackage(dir, options = {}) {
             }
         }
     }
+    // ── C122: scheme-type-resolves (smart TODO.roadmap/40 batch 2; the ──
+    // packages-as-SSOT epic) ────────────────────────────────────────────
+    // The ISO/IEC 17067 register is composable: a manifest's `scheme_type`
+    // token resolves against the composed scheme_type register WHEN one is
+    // in scope (per-register gating, the C58 doctrine — a register-less
+    // package keeps the register-free fallback, the C89 spelling
+    // precedent); and a scheme_type's determination / attestation /
+    // surveillance.activities entries resolve against the composed
+    // scheme_activity_kind menus when THAT register is in scope. C98's
+    // hard-coded no-surveillance set defers to the register's
+    // surveillance.required (below, in the C97–C98 block).
+    {
+        const schemeTypeIds = new Set((standard.schemeTypes ?? []).map(t => t.id));
+        const menuIds = new Set((standard.schemeActivityKinds ?? []).map(k => k.id));
+        const manifestSchemeType = standard.packageManifest?.schemeType;
+        if (schemeTypeIds.size > 0 &&
+            manifestSchemeType &&
+            !schemeTypeIds.has(manifestSchemeType)) {
+            err('C122', `package "${standard.packageManifest.id}": scheme_type "${manifestSchemeType}" is not a declared scheme type of the in-scope ISO/IEC 17067 register (scheme-type-resolves)`);
+        }
+        if (menuIds.size > 0) {
+            const resolveMenuEntry = (where, facet, id) => {
+                if (!menuIds.has(id)) {
+                    err('C122', `${where}: ${facet} "${id}" is not a declared scheme activity kind (scheme-type-resolves)`);
+                }
+            };
+            for (const t of standard.schemeTypes ?? []) {
+                const where = `scheme_type ${t.id}`;
+                for (const d of t.determination) {
+                    resolveMenuEntry(where, 'determination', d);
+                }
+                for (const a of t.attestation) {
+                    resolveMenuEntry(where, 'attestation', a);
+                }
+                for (const s of t.surveillance?.activities ?? []) {
+                    resolveMenuEntry(where, 'surveillance.activities', s);
+                }
+            }
+        }
+    }
+    // ── C123: document-module-references-resolve (smart TODO.roadmap/40 ──
+    // batch 2; the packages-as-SSOT epic) ───────────────────────────────
+    // The document module's edges resolve: the sequence members against
+    // the composed processes, the register maintainers against the
+    // governance_organ register (per-register gating, the C58 doctrine),
+    // and the declared namespace is an absolute requirement-namespace path
+    // (the register-free shape leg). The informative annex's applies_to
+    // names a known package — checked through the dependency-manifest
+    // locator, so the leg is gated on a locator being supplied (the
+    // C97-class resolution discipline; without a locator the sibling scan
+    // cannot adjudicate non-sibling ids and the leg stays silent).
+    {
+        const dmOrganIds = new Set((standard.governanceOrgans ?? []).map(o => o.id));
+        const dmProcessIds = new Set((standard.processes ?? []).map(p => p.id));
+        for (const m of standard.documentModules ?? []) {
+            const where = `document_module ${m.id}`;
+            if (m.namespace !== '' && !m.namespace.startsWith('/')) {
+                err('C123', `${where}: namespace "${m.namespace}" is not an absolute requirement-namespace path (e.g. /req/cs/${m.id}) — the declared pin C119 guards must be a path (document-module-references-resolve)`);
+            }
+            if (dmProcessIds.size > 0) {
+                for (const s of m.sequence ?? []) {
+                    if (!dmProcessIds.has(s)) {
+                        err('C123', `${where}: sequence "${s}" is not a declared process (document-module-references-resolve)`);
+                    }
+                }
+            }
+            if (dmOrganIds.size > 0) {
+                for (const r of m.registers ?? []) {
+                    if (r.maintainer !== '' && !dmOrganIds.has(r.maintainer)) {
+                        err('C123', `${where} register ${r.id}: maintainer "${r.maintainer}" is not a declared governance organ (document-module-references-resolve)`);
+                    }
+                }
+            }
+        }
+        if (options.resolvePackage) {
+            for (const a of standard.informativeAnnexes ?? []) {
+                if (a.appliesTo !== '' && !resolveDepManifest(a.appliesTo)) {
+                    err('C123', `informative_annex ${a.id}: applies_to "${a.appliesTo}" does not resolve to a known package — the CASCO layer the annex applies to must resolve (document-module-references-resolve)`);
+                }
+            }
+        }
+    }
     // ── C97–C98: the certification program (TODO.v2/01;
     // analysis/twin-certification-design.md Q4) ──
     // A fourth publisher with the product_reference shape: the scheme
@@ -2464,9 +2734,16 @@ function checkPackage(dir, options = {}) {
         // surveillance machinery. A monitor IS a continuous claim ("without
         // triggers, 'continuous' has no clock" — types/Monitor.ts); an
         // activity_kind { surveillance } process is a surveillance claim.
+        // When the scheme-type register is in scope (smart TODO.roadmap/40
+        // batch 2 — composed via uses), the register's own
+        // surveillance.required adjudicates; the hard-coded type_1a/1b set
+        // is the register-free fallback (the C89 spelling precedent).
         const SCHEME_TYPES_WITHOUT_SURVEILLANCE = new Set(['type_1a', 'type_1b']);
-        if (productManifest.schemeType &&
-            SCHEME_TYPES_WITHOUT_SURVEILLANCE.has(productManifest.schemeType)) {
+        const registerEntry = (standard.schemeTypes ?? []).find(t => t.id === productManifest.schemeType);
+        const noSurveillance = registerEntry
+            ? !registerEntry.surveillance?.required
+            : SCHEME_TYPES_WITHOUT_SURVEILLANCE.has(productManifest.schemeType ?? '');
+        if (productManifest.schemeType && noSurveillance) {
             const claims = [];
             if ((standard.monitors ?? []).length > 0) {
                 claims.push(`${standard.monitors.length} monitor(s): ${standard.monitors.map(m => m.id).join(', ')}`);
@@ -3066,6 +3343,183 @@ function checkPackage(dir, options = {}) {
             }
         }
     }
+    // ── C124: pair-list-shape (smart TODO.roadmap/40 batch 4; the ──────
+    // packages-as-SSOT epic) ────────────────────────────────────────────
+    // The pair_list block's declaration shape: the key and value slots are
+    // required, the component ids are unique within the block, and the
+    // key_dimension names a declared applicability dimension WHEN the
+    // dimension register is in composition scope (per-register gating, the
+    // C58 doctrine). The closed-registry-over-VALUES leg (pair keys drawn
+    // from the dimension's values ∪ the declared components) quantifies
+    // over app-side records, so it stays app-side — the kernel checks the
+    // declaration shape only.
+    for (const a of standard.attributeDefinitions ?? []) {
+        const pl = a.pairList;
+        if (!pl) {
+            continue;
+        }
+        const where = `attribute_definition ${a.id}: pair_list`;
+        if (!pl.key) {
+            err('C124', `${where}: the key slot is required (pair-list-shape)`);
+        }
+        if (!pl.value) {
+            err('C124', `${where}: the value slot is required (pair-list-shape)`);
+        }
+        const seen = new Set();
+        for (const c of pl.components) {
+            if (seen.has(c.id)) {
+                err('C124', `${where}: component "${c.id}" is declared twice (pair-list-shape)`);
+            }
+            seen.add(c.id);
+        }
+        if (pl.keyDimension && dimIds.size > 0 && !dimIds.has(pl.keyDimension)) {
+            err('C124', `${where}: key_dimension "${pl.keyDimension}" is not a declared applicability dimension (pair-list-shape)`);
+        }
+    }
+    // ── C125: formula-variant-shape (smart TODO.roadmap/40 batch 4; the ─
+    // packages-as-SSOT epic) ────────────────────────────────────────────
+    // The variant block's declaration shape (the top-level calculation
+    // shape discipline mirrored onto the realization): variant ids are
+    // unique within the owning calculation, and the type-conditional
+    // facets are present — an expression variant carries its expression,
+    // a table_lookup variant its lookup block, a profile_lookup variant
+    // its profile path. The variant's params are engine call-site names
+    // and deliberately do NOT resolve against the calculation's inputs —
+    // there is no params-resolve leg (the block stays documentary/
+    // engine-facing).
+    for (const c of standard.calculations ?? []) {
+        const seen = new Set();
+        for (const v of c.variants ?? []) {
+            const where = `calculation ${c.id}: variant ${v.id}`;
+            if (seen.has(v.id)) {
+                err('C125', `${where}: the variant id is declared twice (formula-variant-shape)`);
+            }
+            seen.add(v.id);
+            if (v.type === 'expression' && !v.expression) {
+                err('C125', `${where}: type expression requires the expression facet (formula-variant-shape)`);
+            }
+            if (v.type === 'table_lookup' && !v.lookup) {
+                err('C125', `${where}: type table_lookup requires the lookup block (formula-variant-shape)`);
+            }
+            if (v.type === 'profile_lookup' && !v.profile) {
+                err('C125', `${where}: type profile_lookup requires the profile facet (formula-variant-shape)`);
+            }
+        }
+    }
+    // ── C126: formula-note-targets-resolve (smart TODO.roadmap/40 ──────
+    // batch 4; the packages-as-SSOT epic) ────────────────────────────────
+    // The formula_note register's reverse applicability resolves: every
+    // applies_to entry names a declared symbol WHEN the symbol register
+    // is in composition scope (per-register gating, the C58 doctrine).
+    if (symbolIds.size > 0) {
+        for (const n of standard.formulaNotes ?? []) {
+            for (const s of n.appliesTo ?? []) {
+                if (!symbolIds.has(s)) {
+                    err('C126', `formula_note ${n.id}: applies_to "${s}" is not a declared symbol (formula-note-targets-resolve)`);
+                }
+            }
+        }
+    }
+    // ── C127: common-test-condition-shape (smart TODO.roadmap/40 ───────
+    // batch 4; the packages-as-SSOT epic) ────────────────────────────────
+    // The register's declaration shape: the description is the one facet
+    // BOTH YAML shapes carry (the r60/r144/r129 array entries and the r91
+    // keyed-map entries alike) — a condition without its text is a
+    // carrier with no content. The title stays OPTIONAL (the r91 map
+    // entries carry none; requiring it would force content invention at
+    // migration) and the reference stays a free citation string (the
+    // linker owns the citation semantics — no kernel leg).
+    for (const c of standard.commonTestConditions ?? []) {
+        if (!c.description) {
+            err('C127', `common_test_condition ${c.id}: the description is required — a condition entry carries its normative text (common-test-condition-shape)`);
+        }
+    }
+    // ── C128: part-annex-shape (smart TODO.roadmap/40 batch 4; the ─────
+    // packages-as-SSOT epic) ────────────────────────────────────────────
+    // The annex-volume register's declaration shape: letters are unique
+    // per package (the index keys on the printed letter) and every entry
+    // carries its clause-URN provenance. The obligation vocabulary is
+    // parse-enforced upstream (the fail-closed precedent), so it carries
+    // no check leg.
+    {
+        const seenLetters = new Map();
+        for (const a of standard.partAnnexes ?? []) {
+            if (a.letter) {
+                const prior = seenLetters.get(a.letter);
+                if (prior !== undefined) {
+                    err('C128', `part_annex ${a.id}: letter "${a.letter}" is already declared by ${prior} — the annex-volume index keys on the printed letter (part-annex-shape)`);
+                }
+                else {
+                    seenLetters.set(a.letter, a.id);
+                }
+            }
+            if (!a.source?.doc) {
+                err('C128', `part_annex ${a.id}: the source provenance is required — a documentary register entry cites its part (part-annex-shape)`);
+            }
+        }
+    }
+    // ── C129: storyline-shape (smart TODO.roadmap/40 batch 4; the ──────
+    // packages-as-SSOT epic) ────────────────────────────────────────────
+    // The demo-seed shapes: the id_prefix pattern (the register-free shape
+    // leg); the party laboratory/authority resolve against the package's
+    // participant seeds WHEN a demo_world with participants is in scope
+    // (per-register gating, the C58 doctrine); the record stores resolve
+    // against the declared entity-class stores WHEN that register is in
+    // scope; and the in-construct cross-references resolve — a record
+    // field keyed by a sibling record's store names a sibling record of
+    // that store (in-construct, ungated). The field-level discipline (the
+    // schema's per-slot required fields) stays app-side.
+    {
+        const participantSeeds = new Set();
+        for (const w of standard.demoWorlds ?? []) {
+            for (const section of w.participants ?? []) {
+                for (const e of section.entries ?? []) {
+                    participantSeeds.add(e.id);
+                }
+            }
+        }
+        const entityStores = new Set((standard.dataclasses ?? [])
+            .map(c => c.store)
+            .filter((s) => !!s));
+        for (const s of standard.storylines ?? []) {
+            const where = `storyline ${s.id}`;
+            if (s.idPrefix && !/^[a-z0-9-]+$/.test(s.idPrefix)) {
+                err('C129', `${where}: id_prefix "${s.idPrefix}" does not match ^[a-z0-9-]+$ — the id-minting prefix is a lowercase slug (storyline-shape)`);
+            }
+            if (participantSeeds.size > 0) {
+                for (const [slot, ref] of [
+                    ['laboratory', s.party.laboratory],
+                    ['authority', s.party.authority],
+                ]) {
+                    if (ref && !participantSeeds.has(ref)) {
+                        err('C129', `${where}: party ${slot} "${ref}" is not a declared participant seed (storyline-shape)`);
+                    }
+                }
+            }
+            const siblingStores = new Map();
+            for (const r of s.records ?? []) {
+                if (entityStores.size > 0 && !entityStores.has(r.store)) {
+                    err('C129', `${where}: record store "${r.store}" is not a declared entity-class store (storyline-shape)`);
+                }
+                let ids = siblingStores.get(r.store);
+                if (!ids) {
+                    ids = new Set();
+                    siblingStores.set(r.store, ids);
+                }
+                ids.add(r.id);
+            }
+            for (const r of s.records ?? []) {
+                for (const [key, value] of Object.entries(r.fields)) {
+                    const targets = siblingStores.get(key);
+                    if (targets !== undefined &&
+                        !Array.isArray(value) &&
+                        !targets.has(String(value))) {
+                        err('C129', `${where}: record ${r.store} ${r.id}: ${key} "${String(value)}" is not a sibling ${key} record of this storyline (storyline-shape)`);
+                    }
+                }
+            }
+        }
+    }
     // C34 — duality-coherence: one value structure, two roles.
     for (const d of standard.duals ?? []) {
         if (d.attribute && !attrIds.has(d.attribute)) {