@primmel/primmel 1.13.0 → 1.15.0

package/dist/src/check.js

@@ -486,6 +486,11 @@ function checkPackage(dir, options = {}) {
             else if (i.code === 'duplicate-id') {
                 err('C96', `${i.message} (duplicate-id)`);
             }
+            else if (i.code === 'orphan-overlay-entry') {
+                // The checklist overlay's orphan-entry guard (C141's
+                // composition leg — smart TODO.roadmap/40 batch 3).
+                err('C141', i.message);
+            }
         }
     }
     catch (e) {
@@ -1030,6 +1035,97 @@ function checkPackage(dir, options = {}) {
             }
         }
     }
+    // C42–C44 generalized to the promise_set register (smart
+    // TODO.roadmap/40 batch 3; the packages-as-SSOT epic): the rec promise
+    // registers carry the SAME sub-grammar as is.promises, so the same
+    // discipline fires. The set id binds the owning subject: when that
+    // subject composes, its characteristics resolve exactly as above; when
+    // it does not, the characteristic leg is gated off (per-register
+    // gating, the C58 doctrine) and attribute/behavior resolution stands.
+    for (const ps of standard.promiseSets ?? []) {
+        const owner = (standard.subjects ?? []).find(s => s.id === ps.id);
+        const characteristicSymbols = new Map();
+        for (const [k, c] of Object.entries(owner?.has.characteristics ?? {})) {
+            characteristicSymbols.set(k, c.symbol ?? '');
+        }
+        const bareValueTargets = new Set([
+            ...attrIds,
+            ...Object.keys(owner?.is.designParameters ?? {}),
+            ...Object.keys(owner?.has.attributes ?? {}),
+        ]);
+        for (const p of ps.promises ?? []) {
+            const label = p.id ||
+                (p.statement.length > 40
+                    ? p.statement.slice(0, 37) + '…'
+                    : p.statement);
+            const where = `promise_set ${ps.id}: promise "${label}"`;
+            // C2 — declared verified_by ids must resolve (same discipline as
+            // the subject promises).
+            for (const v of p.verifiedBy ?? []) {
+                if (!reqIds.has(v) && !testIds.has(v)) {
+                    err('C2', `${where} verified_by "${v}" is not a declared requirement or conformance test`);
+                }
+            }
+            if (!p.target) {
+                if ((p.verifiedBy ?? []).length === 0) {
+                    warn('C43', `${where} has no target and no verified_by — it is unverifiable; give it a characteristic/behavior target or declare the verifying requirement/test (promise-verifiable)`);
+                }
+                continue;
+            }
+            const isCharacteristic = characteristicSymbols.has(p.target);
+            const isBehavior = behaviorIds.has(p.target);
+            if (!isCharacteristic && !isBehavior) {
+                if (bareValueTargets.has(p.target)) {
+                    // C44 (narrowed) — same restatement leg as subject promises.
+                    const restatesBareValue = p.level?.kind === 'quantity' &&
+                        p.conditions === '' &&
+                        (p.verifiedBy ?? []).length === 0;
+                    if (restatesBareValue) {
+                        err('C44', `${where} only restates the declared attribute value "${p.target}" — a promise claims a characteristic or behavior (optionally conditioned); bare values stay origin: declared attributes (promise-not-bare-value)`);
+                    }
+                }
+                else if (owner) {
+                    // C42 — gated on the owning subject composing: without it the
+                    // characteristic register is out of scope and the target's
+                    // characteristic-ness is unknowable.
+                    err('C42', `${where} target "${p.target}" is not a declared characteristic or behavior (promise-target-resolves)`);
+                }
+                continue;
+            }
+            if ((p.verifiedBy ?? []).length > 0) {
+                continue; // verification declared — C43 silent
+            }
+            // C43 — derive the verifying requirements/tests from the target.
+            const names = new Set([p.target]);
+            if (isCharacteristic) {
+                const sym = characteristicSymbols.get(p.target);
+                if (sym) {
+                    names.add(sym);
+                }
+            }
+            const boundReqs = new Set();
+            for (const r of standard.requirements ?? []) {
+                if (requirementBindsPromiseTarget(r, names)) {
+                    boundReqs.add(r.id);
+                }
+            }
+            const boundTests = new Set();
+            for (const t of standard.conformanceTests ?? []) {
+                if (testBindsPromiseTarget(t, names, boundReqs)) {
+                    boundTests.add(t.id);
+                }
+            }
+            if (isBehavior) {
+                const b = (standard.behaviors ?? []).find(x => x.id === p.target);
+                for (const tid of b?.verifiedBy ?? []) {
+                    boundTests.add(tid);
+                }
+            }
+            if (boundReqs.size === 0 && boundTests.size === 0) {
+                warn('C43', `${where} declares no verified_by and no requirement/test binds its target "${p.target}" — declare the verifying requirement or test (promise-verifiable)`);
+            }
+        }
+    }
     // ── C45–C47: artifacts (TODO.roadmap/09 — gap audit G2) ──
     // An artifact is a required OUTPUT OF THE SUBJECT (the instrument) — not
     // a record of the test. artifact_definition (IS: content contract +
@@ -3520,6 +3616,715 @@ function checkPackage(dir, options = {}) {
             }
         }
     }
+    // ── C130: identity-and-aspect-references (smart TODO.roadmap/40 ─────
+    // batch 3; the packages-as-SSOT epic) ────────────────────────────────
+    // The documentary identity slots + the qualitative aspect register
+    // (smart TODO.roadmap/47). Legs: the slot shape leg (at least one
+    // presentation channel — the slot's content is presented somewhere);
+    // the aspect references — term_ref → the term register, component →
+    // an instrument component, attribute → an attribute_definition (a
+    // reference, never a redeclaration — INV-3), and the contains entries
+    // → EITHER a model.identity.<slot> path into the slot register OR a
+    // bare attribute/dimension id (the two namespaces coexist; each leg
+    // checked only when its target register composes — per-register
+    // gating, the C58 doctrine); and the R28 bind-path consumer leg — a
+    // requirement/test binds_to path of the model.identity.<slot> or
+    // model.aspects.<id> form names a declared slot/aspect when the
+    // register is in scope.
+    {
+        const slotIds = new Set((standard.identitySlots ?? []).map(s => s.id));
+        const aspectIds = new Set((standard.aspects ?? []).map(a => a.id));
+        const termIds = new Set((standard.terms ?? []).map(t => t.id));
+        const componentIds = new Set((standard.instruments ?? []).flatMap(i => (i.components ?? []).map(c => c.id)));
+        for (const s of standard.identitySlots ?? []) {
+            if (s.presentation.length === 0) {
+                err('C130', `identity_slot ${s.id}: at least one presentation channel is required — the slot's content is presented somewhere (identity-and-aspect-references)`);
+            }
+        }
+        // A contains entry resolves through the model.identity path into the
+        // slot register, or as a bare id into the attribute/dimension
+        // registers; null = no target register in scope (the gated skip).
+        const containsResolves = (entry) => {
+            if (entry.startsWith('model.identity.')) {
+                const slot = entry.slice('model.identity.'.length);
+                return slotIds.size > 0 ? slotIds.has(slot) : null;
+            }
+            if (attrIds.size > 0 || dimIds.size > 0) {
+                return attrIds.has(entry) || dimIds.has(entry);
+            }
+            return null;
+        };
+        for (const a of standard.aspects ?? []) {
+            const where = `aspect ${a.id}`;
+            if (a.termRef && termIds.size > 0 && !termIds.has(a.termRef)) {
+                err('C130', `${where}: term_ref "${a.termRef}" is not a declared term (identity-and-aspect-references)`);
+            }
+            if (a.component &&
+                componentIds.size > 0 &&
+                !componentIds.has(a.component)) {
+                err('C130', `${where}: component "${a.component}" is not a declared instrument component (identity-and-aspect-references)`);
+            }
+            if (a.attribute && attrIds.size > 0 && !attrIds.has(a.attribute)) {
+                err('C130', `${where}: attribute "${a.attribute}" is not a declared attribute_definition — an aspect points at a quantity, never redeclares it (identity-and-aspect-references)`);
+            }
+            for (const entry of a.contains ?? []) {
+                if (containsResolves(entry) === false) {
+                    err('C130', `${where}: contains entry "${entry}" resolves to neither a model.identity slot nor a declared attribute/dimension (identity-and-aspect-references)`);
+                }
+            }
+        }
+        // The R28 bind-path consumer leg (requirement + conformance-test
+        // binds_to), per-register gated.
+        const bindOwners = [
+            ...(standard.requirements ?? []).map(r => [`requirement ${r.id}`, r.bindsTo ?? []]),
+            ...(standard.conformanceTests ?? []).map(t => [`conformance_test ${t.id}`, t.bindsTo ?? []]),
+        ];
+        for (const [owner, paths] of bindOwners) {
+            for (const p of paths) {
+                const path = String(p);
+                if (path.startsWith('model.identity.') && slotIds.size > 0) {
+                    const slot = path.slice('model.identity.'.length);
+                    if (!slotIds.has(slot)) {
+                        err('C130', `${owner}: binds_to "${path}" — identity slot "${slot}" is not declared (identity-and-aspect-references)`);
+                    }
+                }
+                else if (path.startsWith('model.aspects.') && aspectIds.size > 0) {
+                    const aspect = path.slice('model.aspects.'.length);
+                    if (!aspectIds.has(aspect)) {
+                        err('C130', `${owner}: binds_to "${path}" — aspect "${aspect}" is not declared (identity-and-aspect-references)`);
+                    }
+                }
+            }
+        }
+    }
+    // ── C131: promise-certificate-projection (smart TODO.roadmap/40 ─────
+    // batch 3; the packages-as-SSOT epic) ────────────────────────────────
+    // The certificate print projection's shape, fired on subject promises
+    // AND promise_set entries alike: the content-binding XOR (at most one
+    // of attribute / attributes / dimension; none = a statement row); the
+    // bindings resolve (per-register gated, the C58 doctrine); the type is
+    // the renderer's closed vocabulary (string | integer | number |
+    // quantity | statement) — a check-time ERROR (the owner-settled
+    // renderer contract), kept parse-total against renderer growth; the
+    // label is required (the printed row carries its header). The
+    // obligation vocabulary is parse-enforced upstream (no check leg).
+    {
+        const CERTIFICATE_TYPES = [
+            'string',
+            'integer',
+            'number',
+            'quantity',
+            'statement',
+        ];
+        const certs = [];
+        for (const s of standard.subjects ?? []) {
+            for (const p of s.is.promises ?? []) {
+                if (p.certificate) {
+                    certs.push([`subject ${s.id}: promise "${p.id}"`, p.certificate]);
+                }
+            }
+        }
+        for (const ps of standard.promiseSets ?? []) {
+            for (const p of ps.promises ?? []) {
+                if (p.certificate) {
+                    certs.push([
+                        `promise_set ${ps.id}: promise "${p.id}"`,
+                        p.certificate,
+                    ]);
+                }
+            }
+        }
+        for (const [where, cert] of certs) {
+            const bindings = (cert.attribute ? 1 : 0) +
+                (cert.attributes.length > 0 ? 1 : 0) +
+                (cert.dimension ? 1 : 0);
+            if (bindings > 1) {
+                err('C131', `${where}: the certificate content binds by XOR — at most one of attribute / attributes / dimension (promise-certificate-projection)`);
+            }
+            if (cert.attribute && attrIds.size > 0 && !attrIds.has(cert.attribute)) {
+                err('C131', `${where}: certificate attribute "${cert.attribute}" is not a declared attribute_definition (promise-certificate-projection)`);
+            }
+            for (const a of cert.attributes ?? []) {
+                if (attrIds.size > 0 && !attrIds.has(a)) {
+                    err('C131', `${where}: certificate attributes entry "${a}" is not a declared attribute_definition (promise-certificate-projection)`);
+                }
+            }
+            if (cert.dimension && dimIds.size > 0 && !dimIds.has(cert.dimension)) {
+                err('C131', `${where}: certificate dimension "${cert.dimension}" is not a declared classification dimension (promise-certificate-projection)`);
+            }
+            if (!cert.type) {
+                err('C131', `${where}: the certificate type is required — the renderer's row kind (promise-certificate-projection)`);
+            }
+            else if (!CERTIFICATE_TYPES.includes(cert.type)) {
+                err('C131', `${where}: certificate type "${cert.type}" is outside the renderer's closed vocabulary (valid: ${CERTIFICATE_TYPES.join(', ')}) (promise-certificate-projection)`);
+            }
+            if (!cert.label) {
+                err('C131', `${where}: the certificate label is required — the printed row carries its header (promise-certificate-projection)`);
+            }
+        }
+    }
+    // ── C132: application-declaration-references (smart TODO.roadmap/40 ─
+    // batch 3; the packages-as-SSOT epic) ────────────────────────────────
+    // The applicant-facing documentation register: the declaration_form
+    // names a declared form WHEN the form register is in composition scope
+    // (per-register gating, the C58 doctrine), and the document ids are
+    // unique within the declaration. The obligation vocabulary is
+    // parse-enforced upstream (no check leg).
+    {
+        const formIds = new Set((standard.forms ?? []).map(f => f.id));
+        for (const d of standard.applicationDeclarations ?? []) {
+            const where = `application_declaration ${d.id}`;
+            if (d.declarationForm &&
+                formIds.size > 0 &&
+                !formIds.has(d.declarationForm)) {
+                err('C132', `${where}: declaration_form "${d.declarationForm}" is not a declared form (application-declaration-references)`);
+            }
+            const seen = new Set();
+            for (const doc of d.documents ?? []) {
+                if (seen.has(doc.id)) {
+                    err('C132', `${where}: document "${doc.id}" is declared twice (application-declaration-references)`);
+                }
+                seen.add(doc.id);
+            }
+        }
+    }
+    // ── C133: calculation-context-references (smart TODO.roadmap/40 ─────
+    // batch 3; the packages-as-SSOT epic) ────────────────────────────────
+    // The evaluation-side wiring: the source is `computed` (expression
+    // required) or a subject-chain source — classification.<dimension>
+    // (resolves, gated) or parameters.<attribute> (resolves, gated). The
+    // legacy schema tokens (dimensions, application, application.specs,
+    // lookup) and anything else ERROR — the modern subject-chain spelling
+    // is forced. The expression's free identifiers name the context's own
+    // fields — a WARNING leg: runtime-bound inputs (r60's `f`, r144's
+    // `measured_value`) are legitimate non-field references (function
+    // calls exempt — an identifier followed by `(` is a callee).
+    {
+        for (const cc of standard.calculationContexts ?? []) {
+            const fieldNames = new Set((cc.fields ?? []).map(f => f.id));
+            for (const f of cc.fields ?? []) {
+                const where = `calculation_context ${cc.id}: field ${f.id}`;
+                if (f.source === 'computed') {
+                    if (!f.expression) {
+                        err('C133', `${where}: source computed requires the expression facet (calculation-context-references)`);
+                    }
+                }
+                else if (f.source.startsWith('classification.') ||
+                    f.source.startsWith('parameters.')) {
+                    if (f.expression) {
+                        err('C133', `${where}: a non-computed source carries no expression (calculation-context-references)`);
+                    }
+                    if (f.source.startsWith('classification.')) {
+                        const dim = f.source.slice('classification.'.length);
+                        if (dimIds.size > 0 && !dimIds.has(dim)) {
+                            err('C133', `${where}: source "${f.source}" — "${dim}" is not a declared classification dimension (calculation-context-references)`);
+                        }
+                    }
+                    else {
+                        const attr = f.source.slice('parameters.'.length);
+                        if (attrIds.size > 0 && !attrIds.has(attr)) {
+                            err('C133', `${where}: source "${f.source}" — "${attr}" is not a declared attribute_definition (calculation-context-references)`);
+                        }
+                    }
+                }
+                else {
+                    err('C133', `${where}: source "${f.source}" is not a subject-chain source (classification.<dimension>, parameters.<attribute>, computed) (calculation-context-references)`);
+                }
+                if (f.expression) {
+                    const idents = new Set();
+                    const re = /[A-Za-z_][A-Za-z0-9_]*/g;
+                    let m;
+                    while ((m = re.exec(f.expression)) !== null) {
+                        if (!/^\s*\(/.test(f.expression.slice(re.lastIndex))) {
+                            idents.add(m[0]);
+                        }
+                    }
+                    for (const ident of idents) {
+                        if (!fieldNames.has(ident)) {
+                            warn('C133', `${where}: expression identifier "${ident}" is not a field of this context — a runtime-bound input (declare it as a field or bind it at runtime) (calculation-context-references)`);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    // ── C134: evaluation-dimension-references (smart TODO.roadmap/40 ────
+    // batch 3; the packages-as-SSOT epic) ────────────────────────────────
+    // The form-facing classification field schema: the enum facet resolves
+    // to a declared classification dimension (error, per-register gated),
+    // and the field NAME resolves to an is_dimension attribute_definition
+    // OR a dimension id — the two coexisting conventions (owner decision:
+    // r129's legacy camelCase names carry as-is), a WARNING when neither
+    // (gated on the registers composing). The type/setting vocabularies
+    // are parse-enforced upstream (no check legs).
+    {
+        const dimensionedAttrIds = new Set((standard.attributeDefinitions ?? [])
+            .filter(a => a.isDimension === true)
+            .map(a => a.id));
+        for (const ed of standard.evaluationDimensions ?? []) {
+            for (const f of ed.fields ?? []) {
+                const where = `evaluation_dimensions ${ed.id}: field ${f.id}`;
+                if (f.enumRef && dimIds.size > 0 && !dimIds.has(f.enumRef)) {
+                    err('C134', `${where}: enum "${f.enumRef}" is not a declared classification dimension (evaluation-dimension-references)`);
+                }
+                if ((dimensionedAttrIds.size > 0 || dimIds.size > 0) &&
+                    !dimensionedAttrIds.has(f.id) &&
+                    !dimIds.has(f.id)) {
+                    warn('C134', `${where}: the field name "${f.id}" resolves to neither an is_dimension attribute_definition nor a classification dimension — the legacy camelCase convention (evaluation-dimension-references)`);
+                }
+            }
+        }
+    }
+    // ── C135: evaluation-profile-coherence (smart TODO.roadmap/40 ───────
+    // batch 3; the packages-as-SSOT epic) ────────────────────────────────
+    // The named dimension-value presets: every dimensions key resolves to
+    // a declared classification dimension and every value to one of that
+    // dimension's declared values (per-register gated, the smart R4/R8
+    // applicability mirror; an OPEN dimension — no declared value set —
+    // accepts any value).
+    {
+        for (const p of standard.evaluationProfiles ?? []) {
+            const where = `evaluation_profile ${p.id}`;
+            for (const [dim, value] of Object.entries(p.dimensions ?? {})) {
+                if (dimIds.size > 0 && !dimIds.has(dim)) {
+                    err('C135', `${where}: dimensions key "${dim}" is not a declared classification dimension (evaluation-profile-coherence)`);
+                    continue;
+                }
+                const values = dimIds.get(dim);
+                if (values && values.size > 0 && !values.has(value)) {
+                    err('C135', `${where}: dimensions entry "${dim}" names value "${value}", which the dimension does not declare (evaluation-profile-coherence)`);
+                }
+            }
+        }
+    }
+    // ── C136: certificate-template-references (smart TODO.roadmap/40 ────
+    // batch 3; the packages-as-SSOT epic) ────────────────────────────────
+    // The certificate rendering contract: the dimension_labels pattern
+    // placeholders ({dim} / {dim:sep}) resolve to declared classification
+    // dimensions (error, per-register gated); the characteristic bindings
+    // resolve (attribute/attributes → attribute_definitions, dimension →
+    // classification dimensions, per-register gated) with the XOR shape
+    // leg (≤ 1 of attribute | attributes | dimension — none is the
+    // statement row); the characteristic type carries the renderer-driven
+    // closed vocabulary (string | integer | number | quantity |
+    // statement) at ERROR (the owner-settled decision — parse stays
+    // total against renderer growth); the number_format placeholders
+    // check against the known token vocabulary at WARNING (open for
+    // program-specific prefixes like twin-cert's literal TW-1).
+    {
+        const CERTIFICATE_NUMBER_TOKENS = new Set([
+            'shortName',
+            'edition',
+            'scheme',
+            'authority',
+            'year2',
+            'seq',
+        ]);
+        const CERTIFICATE_CHARACTERISTIC_TYPES = new Set([
+            'string',
+            'integer',
+            'number',
+            'quantity',
+            'statement',
+        ]);
+        const placeholderRe = /\{([^{}:/]+)(?::[^{}]*)?\}/g;
+        for (const t of standard.certificateTemplates ?? []) {
+            const where = `certificate_template ${t.id}`;
+            if (t.numberFormat) {
+                let m;
+                while ((m = placeholderRe.exec(t.numberFormat)) !== null) {
+                    if (!CERTIFICATE_NUMBER_TOKENS.has(m[1])) {
+                        warn('C136', `${where}: number_format placeholder "{${m[1]}}" is not a known token (${[...CERTIFICATE_NUMBER_TOKENS].join(', ')}) — a program-specific spelling (certificate-template-references)`);
+                    }
+                }
+            }
+            if (t.dimensionLabels && dimIds.size > 0) {
+                let m;
+                while ((m = placeholderRe.exec(t.dimensionLabels.pattern)) !== null) {
+                    if (!dimIds.has(m[1])) {
+                        err('C136', `${where}: dimension_labels placeholder "{${m[1]}}" is not a declared classification dimension (certificate-template-references)`);
+                    }
+                }
+            }
+            for (const c of t.characteristics ?? []) {
+                const cwhere = `${where}: characteristic ${c.id}`;
+                if (c.type && !CERTIFICATE_CHARACTERISTIC_TYPES.has(c.type)) {
+                    err('C136', `${cwhere}: type "${c.type}" is outside the renderer vocabulary (string, integer, number, quantity, statement) (certificate-template-references)`);
+                }
+                const bindings = (c.attribute ? 1 : 0) +
+                    (c.attributes.length > 0 ? 1 : 0) +
+                    (c.dimension ? 1 : 0);
+                if (bindings > 1) {
+                    err('C136', `${cwhere}: carries ${bindings} content bindings — the XOR is attribute | attributes | dimension | none (certificate-template-references)`);
+                }
+                if (c.attribute && attrIds.size > 0 && !attrIds.has(c.attribute)) {
+                    err('C136', `${cwhere}: attribute "${c.attribute}" is not a declared attribute_definition (certificate-template-references)`);
+                }
+                for (const a of c.attributes) {
+                    if (attrIds.size > 0 && !attrIds.has(a)) {
+                        err('C136', `${cwhere}: attributes entry "${a}" is not a declared attribute_definition (certificate-template-references)`);
+                    }
+                }
+                if (c.dimension && dimIds.size > 0 && !dimIds.has(c.dimension)) {
+                    err('C136', `${cwhere}: dimension "${c.dimension}" is not a declared classification dimension (certificate-template-references)`);
+                }
+            }
+        }
+    }
+    // ── C137: workflow-config-references (smart TODO.roadmap/40 ────────
+    // batch 3; the packages-as-SSOT epic) ────────────────────────────────
+    // The certification workflow step register: the actor resolves against
+    // the composed role register (per-register gated; role ids are
+    // snake_case — the YAML hyphenation is the emitter's); the inputs/
+    // outputs entries resolve against the data-class register ONLY when
+    // the entry is a single clean token (composite strings like
+    // "TestReport containing FormInstance" stay documentary — skipped,
+    // never errored); the gates are prose predicates — never resolved
+    // (the R26 field-resolution precedent). The phase vocabulary is
+    // parse-enforced upstream (no check leg).
+    {
+        const roleIds = new Set((standard.roles ?? []).map(r => r.id));
+        // Class ids may carry a namespace suffix (`Application#data`) while
+        // the workflow's inputs/outputs spell the bare entity name — index
+        // both spellings (the semantic-status leg's precedent).
+        const dataclassIds = new Set();
+        for (const c of standard.dataclasses ?? []) {
+            dataclassIds.add(c.id);
+            if (c.id.includes('#')) {
+                dataclassIds.add(c.id.slice(0, c.id.indexOf('#')));
+            }
+        }
+        const CLEAN_TOKEN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+        for (const w of standard.workflowConfigs ?? []) {
+            for (const s of w.steps ?? []) {
+                const where = `workflow_config ${w.id}: step ${s.id}`;
+                if (s.actor && roleIds.size > 0 && !roleIds.has(s.actor)) {
+                    err('C137', `${where}: actor "${s.actor}" is not a declared role (workflow-config-references)`);
+                }
+                for (const [facet, list] of [
+                    ['inputs', s.inputs],
+                    ['outputs', s.outputs],
+                ]) {
+                    for (const entry of list) {
+                        if (!CLEAN_TOKEN.test(entry)) {
+                            continue; // a composite documentary string — never resolved
+                        }
+                        if (dataclassIds.size > 0 && !dataclassIds.has(entry)) {
+                            err('C137', `${where}: ${facet} entry "${entry}" is not a declared data class (workflow-config-references)`);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    // ── C138: verification-pathway-references (smart TODO.roadmap/40 ───
+    // batch 3; the packages-as-SSOT epic) ────────────────────────────────
+    // The verification pathways beyond type evaluation: the tests resolve
+    // to conformance_tests and the assessment covers to requirements
+    // (per-register gated — the smart R22 mirror); the trigger action
+    // resolves to a transition action of an in-scope LIFECYCLE
+    // state_machine (gated); the trigger event is required iff kind
+    // signal; the validity window carries ≥ 1 of years/months. The kind /
+    // trigger-kind / limits-mode vocabularies are parse-enforced upstream
+    // (no check legs).
+    {
+        const lifecycleActions = new Set();
+        for (const sm of standard.stateMachines ?? []) {
+            if (sm.kind !== 'lifecycle') {
+                continue;
+            }
+            for (const t of sm.transitions ?? []) {
+                if (t.actionName) {
+                    lifecycleActions.add(t.actionName);
+                }
+            }
+        }
+        for (const p of standard.verificationPathways ?? []) {
+            const where = `verification_pathway ${p.id}`;
+            for (const t of p.tests ?? []) {
+                if (testIds.size > 0 && !testIds.has(t)) {
+                    err('C138', `${where}: tests entry "${t}" is not a declared conformance_test (verification-pathway-references)`);
+                }
+            }
+            for (const r of p.assessment?.covers ?? []) {
+                if (reqIds.size > 0 && !reqIds.has(r)) {
+                    err('C138', `${where}: assessment covers entry "${r}" is not a declared requirement (verification-pathway-references)`);
+                }
+            }
+            const window = p.validity?.window;
+            if (window && window.years <= 0 && window.months <= 0) {
+                err('C138', `${where}: the validity window carries neither years nor months (verification-pathway-references)`);
+            }
+            for (const t of p.validity?.triggers ?? []) {
+                const twhere = `${where}: trigger ${t.id}`;
+                if (t.kind === 'signal' && !t.event) {
+                    err('C138', `${twhere}: kind signal requires the event facet (verification-pathway-references)`);
+                }
+                if (t.kind === 'timer' && t.event) {
+                    err('C138', `${twhere}: kind timer carries no event facet — the period is the window's (verification-pathway-references)`);
+                }
+                if (t.action &&
+                    lifecycleActions.size > 0 &&
+                    !lifecycleActions.has(t.action)) {
+                    err('C138', `${twhere}: action "${t.action}" is not a transition action of an in-scope lifecycle state_machine (verification-pathway-references)`);
+                }
+            }
+        }
+    }
+    // ── C139: selection-rule-references (smart TODO.roadmap/40 ─────────
+    // batch 3; the packages-as-SSOT epic) ────────────────────────────────
+    // The selection rules: the lab criterion's applies_when/match
+    // model_field resolve against the attribute OR dimension registers
+    // (the two coexisting conventions — gated on either register
+    // composing); the match operator's conditional facets hold
+    // (has_capability ⇒ required_capability; capability_from_field /
+    // capability_covers_value / capability_prefix_match ⇒
+    // required_capability_prefix + model_field; always_pass ⇒ nothing
+    // else); the capability strings are free-form lab-side labels —
+    // never resolved. The sample/governance entries carry shape legs
+    // only (rule / rationale / applicability non-empty). The vocabularies
+    // are parse-enforced upstream (no check legs).
+    {
+        const fieldResolvable = (f) => attrIds.has(f) || dimIds.has(f);
+        const fieldRegistersCompose = attrIds.size > 0 || dimIds.size > 0;
+        for (const c of standard.labSelectionCriteria ?? []) {
+            const where = `lab_selection_criterion ${c.id}`;
+            if (c.appliesWhen?.modelField &&
+                fieldRegistersCompose &&
+                !fieldResolvable(c.appliesWhen.modelField)) {
+                err('C139', `${where}: applies_when model_field "${c.appliesWhen.modelField}" resolves to neither an attribute_definition nor a classification dimension (selection-rule-references)`);
+            }
+            const m = c.match;
+            if (m) {
+                if (m.modelField &&
+                    fieldRegistersCompose &&
+                    !fieldResolvable(m.modelField)) {
+                    err('C139', `${where}: match model_field "${m.modelField}" resolves to neither an attribute_definition nor a classification dimension (selection-rule-references)`);
+                }
+                if (m.operator === 'has_capability' && !m.requiredCapability) {
+                    err('C139', `${where}: operator has_capability requires the required_capability facet (selection-rule-references)`);
+                }
+                if ((m.operator === 'capability_from_field' ||
+                    m.operator === 'capability_covers_value' ||
+                    m.operator === 'capability_prefix_match') &&
+                    (!m.requiredCapabilityPrefix || !m.modelField)) {
+                    err('C139', `${where}: operator ${m.operator} requires required_capability_prefix and model_field (selection-rule-references)`);
+                }
+                if (m.operator === 'always_pass' &&
+                    (m.requiredCapability ||
+                        m.requiredCapabilityPrefix ||
+                        m.modelField ||
+                        m.labCapabilityPrefix)) {
+                    err('C139', `${where}: operator always_pass carries no other match facet (selection-rule-references)`);
+                }
+            }
+        }
+        for (const r of standard.sampleSelectionRules ?? []) {
+            const where = `sample_selection_rule ${r.id}`;
+            for (const [facet, v] of [
+                ['rule', r.rule],
+                ['rationale', r.rationale],
+                ['applicability', r.applicability],
+            ]) {
+                if (!v) {
+                    err('C139', `${where}: the ${facet} facet is required (selection-rule-references)`);
+                }
+            }
+        }
+        for (const r of standard.specimenGovernanceRules ?? []) {
+            const where = `specimen_governance_rule ${r.id}`;
+            for (const [facet, v] of [
+                ['rule', r.rule],
+                ['rationale', r.rationale],
+                ['applicability', r.applicability],
+            ]) {
+                if (!v) {
+                    err('C139', `${where}: the ${facet} facet is required (selection-rule-references)`);
+                }
+            }
+        }
+    }
+    // ── C140: test-report-skeleton-references (smart TODO.roadmap/40 ───
+    // batch 3; the packages-as-SSOT epic) ────────────────────────────────
+    // The evaluation-report structure: the form entry id resolves to a
+    // declared form, the conformance_test facet to a conformance_test, the
+    // requirements to requirements (all per-register gated — the smart
+    // R29/R35 mirrors); a conditional form carries its inclusion rule
+    // (applicability) or a documentary note (warning). The required
+    // vocabulary is parse-enforced upstream (no check leg).
+    {
+        const formIds = new Set((standard.forms ?? []).map(f => f.id));
+        const checkFormEntries = (where, entries) => {
+            for (const f of entries) {
+                const fwhere = `${where}: form ${f.id}`;
+                if (formIds.size > 0 && !formIds.has(f.id)) {
+                    err('C140', `${fwhere}: the entry id is not a declared form (test-report-skeleton-references)`);
+                }
+                if (f.conformanceTest &&
+                    testIds.size > 0 &&
+                    !testIds.has(f.conformanceTest)) {
+                    err('C140', `${fwhere}: conformance_test "${f.conformanceTest}" is not a declared conformance_test (test-report-skeleton-references)`);
+                }
+                for (const r of f.requirements) {
+                    if (reqIds.size > 0 && !reqIds.has(r)) {
+                        err('C140', `${fwhere}: requirements entry "${r}" is not a declared requirement (test-report-skeleton-references)`);
+                    }
+                }
+                if (f.required === 'conditional' &&
+                    f.applicability.length === 0 &&
+                    !f.notes) {
+                    warn('C140', `${fwhere}: required conditional carries neither applicability nor notes — the inclusion rule is undocumented (test-report-skeleton-references)`);
+                }
+            }
+        };
+        for (const s of standard.testReportSkeletons ?? []) {
+            for (const section of s.sections ?? []) {
+                const where = `test_report_skeleton ${s.id}: section ${section.id}`;
+                checkFormEntries(where, section.forms ?? []);
+                for (const sub of section.subsections ?? []) {
+                    checkFormEntries(`${where}: subsection "${sub.title}"`, sub.forms ?? []);
+                }
+            }
+        }
+    }
+    // ── C141: checklist-entry-shape (smart TODO.roadmap/40 batch 3; ────
+    // the packages-as-SSOT epic) ─────────────────────────────────────────
+    // The OIML-CS test-report checklist (PD-05 §4.4.3): the element
+    // letter rides the a–r vocabulary at WARNING (check-time, never
+    // parse-enforced — the element count can grow); the entry ids are
+    // unique per checklist; the overlay orphan-entry leg fires at
+    // COMPOSITION (the package.ts merge loop reports
+    // orphan-overlay-entry, surfaced under this rule above). The
+    // obligation vocabulary is parse-enforced upstream; the
+    // source/validation strings are engine expressions — documentary,
+    // never resolved.
+    {
+        for (const c of standard.testReportChecklists ?? []) {
+            const where = `test_report_checklist ${c.id}`;
+            const seen = new Set();
+            for (const e of c.entries ?? []) {
+                if (seen.has(e.id)) {
+                    err('C141', `${where}: entry "${e.id}" is declared twice (checklist-entry-shape)`);
+                }
+                seen.add(e.id);
+                if (e.element !== null && !/^[a-r]$/.test(e.element)) {
+                    warn('C141', `${where}: entry "${e.id}" element "${e.element}" is outside the PD-05 §4.4.3 vocabulary (a–r) — the element count can grow, confirm the extension (checklist-entry-shape)`);
+                }
+            }
+        }
+    }
+    // ── C142: gateway-edges-resolve (smart TODO.roadmap/40 batch 5; ────
+    // the packages-as-SSOT epic) ─────────────────────────────────────────
+    // The workflow routing cascade: every edge target resolves to a
+    // declared process (per-register gated — the smart R-rule mirrors);
+    // a gateway carrying edges declares exactly ONE default-conditioned
+    // edge (the first-match-wins cascade needs its catch-all), and the
+    // default edge is RECOMMENDED last (a mid-list default shadows the
+    // edges after it — WARNING, not error: the YAML lineage carries
+    // mid-list defaults). The conditions stay opaque strings — never
+    // resolved (the R26 field-resolution precedent). The edge-less
+    // gateway (a label-only declaration) carries no routing, so the
+    // default discipline skips it.
+    //
+    // The workflow_stage members-resolve legs ride this rule (step 5d):
+    // elements → the process register, approvals → the approval register,
+    // gateways → the gateway register — per-register gated. The stage's
+    // start_event / end_events are DOCUMENTARY tokens (dossier hazard 3,
+    // decision (b)) — the kernel's event register is the canvas start/end
+    // construct, a different sense — so they are never resolved.
+    {
+        const gwProcessIds = new Set((standard.processes ?? []).map(p => p.id));
+        for (const g of standard.gateways ?? []) {
+            if (g.gatewayType !== 'exclusive_gateway') {
+                continue;
+            }
+            const edges = g.edges ?? [];
+            const where = `exclusive_gateway ${g.id}`;
+            edges.forEach((e, i) => {
+                if (gwProcessIds.size > 0 && !gwProcessIds.has(e.target)) {
+                    err('C142', `${where}: edge ${i + 1} targets "${e.target}", which is not a declared process (gateway-edges-resolve)`);
+                }
+            });
+            if (edges.length > 0) {
+                const defaults = edges
+                    .map((e, i) => ({ e, i }))
+                    .filter(x => x.e.condition === 'default');
+                if (defaults.length === 0) {
+                    err('C142', `${where}: no default edge — the first-match-wins cascade needs its catch-all (gateway-edges-resolve)`);
+                }
+                else if (defaults.length > 1) {
+                    err('C142', `${where}: ${defaults.length} default edges — exactly one catch-all is allowed (gateway-edges-resolve)`);
+                }
+                else if (defaults[0].i !== edges.length - 1) {
+                    warn('C142', `${where}: the default edge is not last — it shadows the edges after it in the first-match-wins cascade (gateway-edges-resolve)`);
+                }
+            }
+        }
+        // The workflow_stage members-resolve legs (step 5d) — the events
+        // stay documentary, never resolved.
+        const stageApprovalIds = new Set((standard.approvals ?? []).map(a => a.id));
+        const stageGatewayIds = new Set((standard.gateways ?? []).map(g => g.id));
+        for (const s of standard.workflowStages ?? []) {
+            const where = `workflow_stage ${s.id}`;
+            for (const el of s.elements ?? []) {
+                if (gwProcessIds.size > 0 && !gwProcessIds.has(el)) {
+                    err('C142', `${where}: element "${el}" is not a declared process (gateway-edges-resolve)`);
+                }
+            }
+            for (const a of s.approvals ?? []) {
+                if (stageApprovalIds.size > 0 && !stageApprovalIds.has(a)) {
+                    err('C142', `${where}: approval "${a}" is not a declared approval (gateway-edges-resolve)`);
+                }
+            }
+            for (const g of s.gateways ?? []) {
+                if (stageGatewayIds.size > 0 && !stageGatewayIds.has(g)) {
+                    err('C142', `${where}: gateway "${g}" is not a declared gateway (gateway-edges-resolve)`);
+                }
+            }
+        }
+    }
+    // ── C143: approval-references-resolve (smart TODO.roadmap/40 batch ──
+    // 5; the packages-as-SSOT epic) ─────────────────────────────────────
+    // The first approval rule ever (the codec was dormant — no package
+    // declared an approval before batch 5): actor / approve_by resolve to
+    // declared roles, the approval_record entries to declared entity-class
+    // stores (the dataclass `store { … }` names — the workflow values are
+    // store names like `applications`, not data_registry ids). Per-register
+    // gated (the C58 doctrine): an empty register means the register is
+    // not in scope, not that every reference dangles. The rule reads the
+    // RAW reference ids (actorRef / approverRef / recordRefs) — the
+    // resolved fields silently drop unresolvable ids.
+    {
+        const approvalRoleIds = new Set((standard.roles ?? []).map(r => r.id));
+        const approvalStores = new Set();
+        for (const c of standard.dataclasses ?? []) {
+            if (c.store) {
+                for (const s of c.store.split(/\s+/)) {
+                    if (s) {
+                        approvalStores.add(s);
+                    }
+                }
+            }
+        }
+        for (const a of standard.approvals ?? []) {
+            const where = `approval ${a.id}`;
+            if (a.actorRef &&
+                approvalRoleIds.size > 0 &&
+                !approvalRoleIds.has(a.actorRef)) {
+                err('C143', `${where}: actor "${a.actorRef}" is not a declared role (approval-references-resolve)`);
+            }
+            if (a.approverRef &&
+                approvalRoleIds.size > 0 &&
+                !approvalRoleIds.has(a.approverRef)) {
+                err('C143', `${where}: approver "${a.approverRef}" is not a declared role (approval-references-resolve)`);
+            }
+            for (const store of a.recordRefs ?? []) {
+                if (approvalStores.size > 0 && !approvalStores.has(store)) {
+                    err('C143', `${where}: approval_record "${store}" is not a declared entity-class store (approval-references-resolve)`);
+                }
+            }
+        }
+    }
     // C34 — duality-coherence: one value structure, two roles.
     for (const d of standard.duals ?? []) {
         if (d.attribute && !attrIds.has(d.attribute)) {