@primmel/primmel 1.19.0 → 1.21.0

package/dist/src/check.js

@@ -360,17 +360,6 @@
 //      part_annex register's declaration shape — letters unique per
 //      package, the source provenance required; the obligation
 //      vocabulary is parse-enforced upstream
-//   C129 storyline-shape (smart TODO.roadmap/40 batch 4): the demo-seed
-//      shapes — the id_prefix pattern (register-free), party →
-//      demo_world participant seeds (gated), record stores → entity-
-//      class stores (gated), in-construct record cross-references
-//      (ungated); field-level discipline stays app-side
-//   C144–C146 the license facets (smart TODO.external-refs/04; the
-//      entitlement facet + catalog): the catalog-key shape
-//      (^std:[a-z0-9-]+$), at most one license_key per package (the
-//      parser's earlier declarations surface here), and the
-//      license_holder required with the key — a package without a key
-//      is public content and every leg keys on the key's presence
 //
 // Levels (TODO.roadmap/17): the DEFAULT level runs the normal-level
 // rules at their catalog severities. --audit additionally runs the
@@ -397,6 +386,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkPackage = checkPackage;
 exports.checkManifestResolution = checkManifestResolution;
+exports.checkArtifactContracts = checkArtifactContracts;
+exports.checkTypedPayloads = checkTypedPayloads;
+exports.checkAttestations = checkAttestations;
+exports.checkClosedDerivations = checkClosedDerivations;
 exports.checkSpellingCodes = checkSpellingCodes;
 exports.checkDeclaredPredicates = checkDeclaredPredicates;
 exports.checkTermAliases = checkTermAliases;
@@ -421,6 +414,7 @@ const FormulasUsed_1 = require("./types/FormulasUsed");
 const tokenize_1 = require("./ser-des/tokenize");
 const operational_state_1 = require("./operational-state");
 const check_rules_1 = require("./check-rules");
+const instance_resolution_1 = require("./instance-resolution");
 const check_allowlist_1 = require("./check-allowlist");
 const text_coverage_1 = require("./text-coverage");
 const spelling_1 = require("./spelling");
@@ -485,7 +479,12 @@ function checkPackage(dir, options = {}) {
         });
         standard = loaded.standard;
         for (const i of loaded.issues) {
-            if (i.code === 'provides-unconsumed') {
+            // The deprecation report (phase 2): the parse-time issue maps to
+            // its rule.
+            if (i.code === 'construct-deprecated') {
+                warn('C154', i.message);
+            }
+            else if (i.code === 'provides-unconsumed') {
                 warn('C30', i.message);
             }
             else if (i.code === 'extends-deprecated') {
@@ -540,11 +539,20 @@ function checkPackage(dir, options = {}) {
     issues.push(...checkReferences(standard));
     // ── C116/C117: the verdict chain (MN 114 v3.2, clause 11.3) ────────
     issues.push(...checkVerdictChains(standard));
+    // ── C149: the closed-derivation rule (the typed kernel, R3) ────────
+    issues.push(...checkClosedDerivations(standard));
+    // ── C150/C151: the attestation's references and claim lineage ──────
+    issues.push(...checkAttestations(standard));
+    // ── C152: the typed payload rule (the typed kernel, R2) ────────────
+    issues.push(...checkTypedPayloads(standard));
+    // ── C153: the contract-derivation facet (the typed kernel, clause 10)
+    issues.push(...checkArtifactContracts(standard));
     const reqIds = new Set((standard.requirements ?? []).map((r) => r.id));
     const testIds = new Set((standard.conformanceTests ?? []).map((t) => t.id));
     const attrIds = new Set((standard.attributeDefinitions ?? []).map((a) => a.id));
+    const roleIds = new Set((standard.roles ?? []).map(r => r.id));
     const behaviorIds = new Set((standard.behaviors ?? []).map((b) => b.id));
-    const subjectIds = new Set((standard.subjects ?? []).map((s) => s.id));
+    const subjectIds = new Set((standard.subjects ?? []).map(s => s.id));
     // Observables live in the symbols registry, not the attribute layer —
     // binds_to / limit.uses may reference them (e.g. sample.test_context
     // quantities that are measured test outputs).
@@ -1157,7 +1165,9 @@ function checkPackage(dir, options = {}) {
     // C45 — artifact-def-contract: the content contract is well-formed.
     for (const d of standard.artifactDefinitions ?? []) {
         const c = d.contentContract;
-        if (c.fields.length === 0) {
+        // A derived contract (contract_from, C153) is the referenced
+        // promise set's projection — its fields are the set's.
+        if (!d.contractFrom && c.fields.length === 0) {
             err('C45', `artifact definition ${d.id}: content contract declares no fields — a definition must contract SOME content (artifact-def-contract)`);
         }
         const seenFields = new Set();
@@ -1692,15 +1702,6 @@ function checkPackage(dir, options = {}) {
                 }
             }
         }
-        for (const m of standard.processModels ?? []) {
-            const where = `process_model ${m.id}`;
-            for (const s of m.sequence ?? []) {
-                resolveProcessRef(where, 'sequence', s);
-            }
-            for (const r of m.registers ?? []) {
-                resolveOrganAp(`${where} register ${r.id}`, 'maintainer', r.maintainer);
-            }
-        }
     }
     // ── C84: constraint-shape (TODO.roadmap/51 — BUG.R60-SSOT gap 7) ─────
     // The subject-intrinsic constraint's DECLARATION shape — the kernel
@@ -2034,7 +2035,6 @@ function checkPackage(dir, options = {}) {
     // escalation ACTIONS are runtime — the smart app's monitor service owns
     // them; these rules guarantee the declarations the runtime needs.
     {
-        const roleIds = new Set((standard.roles ?? []).map(r => r.id));
         const KNOWN_OUTCOMES = new Set(Monitor_1.MONITOR_OUTCOMES);
         const KNOWN_ACTIONS = new Set(Monitor_1.MONITOR_ESCALATION_ACTIONS);
         const KNOWN_STREAMS = new Set(Monitor_1.MONITOR_STREAMS);
@@ -2338,6 +2338,7 @@ function checkPackage(dir, options = {}) {
     };
     const instrumentIds = new Set((standard.instruments ?? []).map(i => i.id));
     const instanceIds = new Set((standard.instances ?? []).map(i => i.id));
+    const dataclassIds = new Set((standard.dataclasses ?? []).map(c => c.id));
     const attrScopes = new Map((standard.attributeDefinitions ?? []).map(a => [a.id, a.scope]));
     // Classification-dimension scopes, by every spelling a classification
     // map may use: the instrument dimension id, the is_dimension attribute
@@ -2431,9 +2432,53 @@ function checkPackage(dir, options = {}) {
             }
         }
         // C20 — instance-of-resolves: the `of` reference names a declared
-        // subject (v3) or instrument (v2) definition.
-        if (!subjectIds.has(inst.of) && !instrumentIds.has(inst.of)) {
-            err('C20', `instance ${inst.id}: of "${inst.of}" is not a declared subject or instrument (instance-of-resolves)`);
+        // subject (v3), instrument (v2), or ANOTHER INSTANCE (the power-type
+        // discipline — every instance can serve as the definition of further
+        // instantiation).
+        if (!subjectIds.has(inst.of) &&
+            !instrumentIds.has(inst.of) &&
+            !instanceIds.has(inst.of) &&
+            !dataclassIds.has(inst.of)) {
+            err('C20', `instance ${inst.id}: of "${inst.of}" is not a declared subject, instrument, class, or instance (instance-of-resolves)`);
+        }
+        // C155 — power-type-chain (coherence leg): an instance whose `of`
+        // names another instance carries NO upward subject-chain link — the
+        // two are one pattern's two spellings, and mixing them makes the
+        // delegation walk ambiguous.
+        if (instanceIds.has(inst.of)) {
+            const links = ['model', 'group', 'family'].filter(k => inst[k]);
+            if (links.length > 0) {
+                err('C155', `instance ${inst.id}: of "${inst.of}" names an instance and the instance carries an upward ${links.join('/')} link — the power-type chain and the subject-chain profile do not mix (power-type-chain)`);
+            }
+        }
+    }
+    // C155 — power-type-chain (acyclicity leg): the MIXED delegation
+    // graph — of-chains to instances AND the prototype hop (an `of` to a
+    // class whose extends names an instance) — is acyclic: a cycle over
+    // these edges would make the delegation walk non-terminating, and a
+    // class instantiating its own prototype (`instance x of C` while
+    // `C extends { x }`) is the shapes' own mutual recursion.
+    const delegation = (0, instance_resolution_1.delegationSuccessors)(standard);
+    const ofAdj = new Map();
+    for (const [from, to] of delegation) {
+        if (instanceIds.has(to)) {
+            ofAdj.set(from, [to]);
+        }
+    }
+    const ofCycle = findCycle(ofAdj);
+    if (ofCycle) {
+        err('C155', `the power-type of-chain is cyclic: ${ofCycle.join(' → ')} (power-type-chain)`);
+    }
+    // C156 — class-extends-resolves: a class's extends names a declared
+    // class or a declared INSTANCE (the definition side of the power-type
+    // discipline — a class extending an instance specializes that
+    // individual). Successfully merged links clear at resolve time, so a
+    // surviving link is exactly an unresolved one.
+    for (const c of standard.dataclasses ?? []) {
+        if (c.extends &&
+            !dataclassIds.has(c.extends) &&
+            !instanceIds.has(c.extends)) {
+            warn('C156', `class ${c.id}: extends "${c.extends}" is not a declared class or instance (class-extends-resolves)`);
         }
     }
     // C19 — chain-acyclic (integrity part 2): the resolved link graph is
@@ -3171,6 +3216,97 @@ function checkPackage(dir, options = {}) {
             }
         }
     }
+    // ── C147–C148: the executable test programs (smart TODO.twin-demo/03 —
+    // the model-drive bindings) ──
+    // The conformance test's `preparation { … }` / `stimulus { … }` facets
+    // are the machine-executable half of the test declaration: the
+    // preparation program (warm-up, preload discipline, zero check) and the
+    // ordered measurement program (drive, argument expressions over the
+    // subject's declared parameters, hold, the read's freshness bound, the
+    // per-point acceptance reference). C147 test-program-shape: every
+    // program entry's order is a positive integer unique in the program; a
+    // preparation step carries a prose action AND/OR a drive reference; a
+    // step's verify block carries read AND tolerance; a stimulus point
+    // carries a drive and an acceptance reference. C148
+    // test-program-duration: a hold / fresh_within value parses as a
+    // duration window (the serve contract's vocabulary — shorthand 30min or
+    // ISO 8601 fixed-length PT30M), and a stimulus point declares
+    // fresh_within (§14.12's no-stale-semantics doctrine: a measurement
+    // point's read carries its freshness bound, like C63's live bindings).
+    // Drive/acceptance/tolerance REFERENCE RESOLUTION (the world-vocabulary
+    // operation names, the requirement nodes) is the consumer-side
+    // conformance leg's job — the kernel checks syntax/shape only (the
+    // C92/C93 vs R39 split). Packages without test programs are untouched —
+    // the loops are empty.
+    {
+        for (const ct of standard.conformanceTests ?? []) {
+            const prep = ct.preparation;
+            if (prep) {
+                const orders = new Set();
+                for (const step of prep.entries) {
+                    const at = step.order !== null
+                        ? `preparation step ${step.order}`
+                        : 'a preparation step';
+                    if (step.order === null ||
+                        !Number.isInteger(step.order) ||
+                        step.order < 1) {
+                        err('C147', `conformance_test ${ct.id}: ${at} declares no positive-integer order (got ${step.order === null ? 'none' : step.order}) — the step order is a positive integer (test-program-shape)`);
+                    }
+                    else if (orders.has(step.order)) {
+                        err('C147', `conformance_test ${ct.id}: preparation step order ${step.order} is declared twice — the order is unique within the program (test-program-shape)`);
+                    }
+                    else {
+                        orders.add(step.order);
+                    }
+                    if (step.action === '' && step.drive === '') {
+                        err('C147', `conformance_test ${ct.id}: ${at} declares neither action nor drive — a preparation step carries a prose action AND/OR a drive reference (test-program-shape)`);
+                    }
+                    if (step.verify &&
+                        (step.verify.read === '' || step.verify.tolerance === '')) {
+                        err('C147', `conformance_test ${ct.id}: ${at} declares a verify block without ${step.verify.read === '' ? 'read' : 'tolerance'} — the verification names what to read AND the tolerance reference (test-program-shape)`);
+                    }
+                    if (step.hold !== '' && (0, time_1.parseFreshnessWindow)(step.hold) === null) {
+                        err('C148', `conformance_test ${ct.id}: ${at} hold "${step.hold}" is not a parseable duration (shorthand 500ms/5s/1min/1h/1d or ISO 8601 with fixed-length components, e.g. PT30M) (test-program-duration)`);
+                    }
+                }
+            }
+            const stim = ct.stimulus;
+            if (stim) {
+                const orders = new Set();
+                for (const point of stim.entries) {
+                    const at = point.order !== null
+                        ? `stimulus point ${point.order}`
+                        : 'a stimulus point';
+                    if (point.order === null ||
+                        !Number.isInteger(point.order) ||
+                        point.order < 1) {
+                        err('C147', `conformance_test ${ct.id}: ${at} declares no positive-integer order (got ${point.order === null ? 'none' : point.order}) — the point order is a positive integer (test-program-shape)`);
+                    }
+                    else if (orders.has(point.order)) {
+                        err('C147', `conformance_test ${ct.id}: stimulus point order ${point.order} is declared twice — the order is unique within the program (test-program-shape)`);
+                    }
+                    else {
+                        orders.add(point.order);
+                    }
+                    if (point.drive === '') {
+                        err('C147', `conformance_test ${ct.id}: ${at} declares no drive — a stimulus point names the drive operation (test-program-shape)`);
+                    }
+                    if (point.acceptance === '') {
+                        err('C147', `conformance_test ${ct.id}: ${at} declares no acceptance — a stimulus point names the MPE/requirement node it is judged against (test-program-shape)`);
+                    }
+                    if (point.hold !== '' && (0, time_1.parseFreshnessWindow)(point.hold) === null) {
+                        err('C148', `conformance_test ${ct.id}: ${at} hold "${point.hold}" is not a parseable duration (shorthand 500ms/5s/1min/1h/1d or ISO 8601 with fixed-length components, e.g. PT30M) (test-program-duration)`);
+                    }
+                    if (point.freshWithin === '') {
+                        err('C148', `conformance_test ${ct.id}: ${at} declares no fresh_within — a measurement point's read carries its freshness bound (§14.12: no stale semantics) (test-program-duration)`);
+                    }
+                    else if ((0, time_1.parseFreshnessWindow)(point.freshWithin) === null) {
+                        err('C148', `conformance_test ${ct.id}: ${at} fresh_within "${point.freshWithin}" is not a parseable freshness window (shorthand 500ms/5s/1min/1h/1d or ISO 8601 with fixed-length components, e.g. PT5S) (test-program-duration)`);
+                    }
+                }
+            }
+        }
+    }
     // ── C94: the per-test evaluation-formula traces (smart gap-close E11,
     // analysis/architecture-gaps-2026-07.md; the smart contract
     // data/schemas/formulas-used.yaml) ──
@@ -3598,68 +3734,6 @@ function checkPackage(dir, options = {}) {
             }
         }
     }
-    // ── C129: storyline-shape (smart TODO.roadmap/40 batch 4; the ──────
-    // packages-as-SSOT epic) ────────────────────────────────────────────
-    // The demo-seed shapes: the id_prefix pattern (the register-free shape
-    // leg); the party laboratory/authority resolve against the package's
-    // participant seeds WHEN a demo_world with participants is in scope
-    // (per-register gating, the C58 doctrine); the record stores resolve
-    // against the declared entity-class stores WHEN that register is in
-    // scope; and the in-construct cross-references resolve — a record
-    // field keyed by a sibling record's store names a sibling record of
-    // that store (in-construct, ungated). The field-level discipline (the
-    // schema's per-slot required fields) stays app-side.
-    {
-        const participantSeeds = new Set();
-        for (const w of standard.demoWorlds ?? []) {
-            for (const section of w.participants ?? []) {
-                for (const e of section.entries ?? []) {
-                    participantSeeds.add(e.id);
-                }
-            }
-        }
-        const entityStores = new Set((standard.dataclasses ?? [])
-            .map(c => c.store)
-            .filter((s) => !!s));
-        for (const s of standard.storylines ?? []) {
-            const where = `storyline ${s.id}`;
-            if (s.idPrefix && !/^[a-z0-9-]+$/.test(s.idPrefix)) {
-                err('C129', `${where}: id_prefix "${s.idPrefix}" does not match ^[a-z0-9-]+$ — the id-minting prefix is a lowercase slug (storyline-shape)`);
-            }
-            if (participantSeeds.size > 0) {
-                for (const [slot, ref] of [
-                    ['laboratory', s.party.laboratory],
-                    ['authority', s.party.authority],
-                ]) {
-                    if (ref && !participantSeeds.has(ref)) {
-                        err('C129', `${where}: party ${slot} "${ref}" is not a declared participant seed (storyline-shape)`);
-                    }
-                }
-            }
-            const siblingStores = new Map();
-            for (const r of s.records ?? []) {
-                if (entityStores.size > 0 && !entityStores.has(r.store)) {
-                    err('C129', `${where}: record store "${r.store}" is not a declared entity-class store (storyline-shape)`);
-                }
-                let ids = siblingStores.get(r.store);
-                if (!ids) {
-                    ids = new Set();
-                    siblingStores.set(r.store, ids);
-                }
-                ids.add(r.id);
-            }
-            for (const r of s.records ?? []) {
-                for (const [key, value] of Object.entries(r.fields)) {
-                    const targets = siblingStores.get(key);
-                    if (targets !== undefined &&
-                        !Array.isArray(value) &&
-                        !targets.has(String(value))) {
-                        err('C129', `${where}: record ${r.store} ${r.id}: ${key} "${String(value)}" is not a sibling ${key} record of this storyline (storyline-shape)`);
-                    }
-                }
-            }
-        }
-    }
     // ── C130: identity-and-aspect-references (smart TODO.roadmap/40 ─────
     // batch 3; the packages-as-SSOT epic) ────────────────────────────────
     // The documentary identity slots + the qualitative aspect register
@@ -4030,7 +4104,6 @@ function checkPackage(dir, options = {}) {
     // (the R26 field-resolution precedent). The phase vocabulary is
     // parse-enforced upstream (no check leg).
     {
-        const roleIds = new Set((standard.roles ?? []).map(r => r.id));
         // Class ids may carry a namespace suffix (`Application#data`) while
         // the workflow's inputs/outputs spell the bare entity name — index
         // both spellings (the semantic-status leg's precedent).
@@ -4041,28 +4114,6 @@ function checkPackage(dir, options = {}) {
                 dataclassIds.add(c.id.slice(0, c.id.indexOf('#')));
             }
         }
-        const CLEAN_TOKEN = /^[A-Za-z_][A-Za-z0-9_]*$/;
-        for (const w of standard.workflowConfigs ?? []) {
-            for (const s of w.steps ?? []) {
-                const where = `workflow_config ${w.id}: step ${s.id}`;
-                if (s.actor && roleIds.size > 0 && !roleIds.has(s.actor)) {
-                    err('C137', `${where}: actor "${s.actor}" is not a declared role (workflow-config-references)`);
-                }
-                for (const [facet, list] of [
-                    ['inputs', s.inputs],
-                    ['outputs', s.outputs],
-                ]) {
-                    for (const entry of list) {
-                        if (!CLEAN_TOKEN.test(entry)) {
-                            continue; // a composite documentary string — never resolved
-                        }
-                        if (dataclassIds.size > 0 && !dataclassIds.has(entry)) {
-                            err('C137', `${where}: ${facet} entry "${entry}" is not a declared data class (workflow-config-references)`);
-                        }
-                    }
-                }
-            }
-        }
     }
     // ── C138: verification-pathway-references (smart TODO.roadmap/40 ───
     // batch 3; the packages-as-SSOT epic) ────────────────────────────────
@@ -4309,26 +4360,6 @@ function checkPackage(dir, options = {}) {
         }
         // The workflow_stage members-resolve legs (step 5d) — the events
         // stay documentary, never resolved.
-        const stageApprovalIds = new Set((standard.approvals ?? []).map(a => a.id));
-        const stageGatewayIds = new Set((standard.gateways ?? []).map(g => g.id));
-        for (const s of standard.workflowStages ?? []) {
-            const where = `workflow_stage ${s.id}`;
-            for (const el of s.elements ?? []) {
-                if (gwProcessIds.size > 0 && !gwProcessIds.has(el)) {
-                    err('C142', `${where}: element "${el}" is not a declared process (gateway-edges-resolve)`);
-                }
-            }
-            for (const a of s.approvals ?? []) {
-                if (stageApprovalIds.size > 0 && !stageApprovalIds.has(a)) {
-                    err('C142', `${where}: approval "${a}" is not a declared approval (gateway-edges-resolve)`);
-                }
-            }
-            for (const g of s.gateways ?? []) {
-                if (stageGatewayIds.size > 0 && !stageGatewayIds.has(g)) {
-                    err('C142', `${where}: gateway "${g}" is not a declared gateway (gateway-edges-resolve)`);
-                }
-            }
-        }
     }
     // ── C143: approval-references-resolve (smart TODO.roadmap/40 batch ──
     // 5; the packages-as-SSOT epic) ─────────────────────────────────────
@@ -5582,6 +5613,362 @@ function textAddressKey(item, segment) {
  *     (titular:source:target:identifying); a `zz-` user-assigned code
  *     validates with a warning (user-assigned codes are not portable).
  */
+// ── C153: artifact-contract-derivation (the typed kernel, clause 10) ─
+// An artifact definition whose content is the projection of declared
+// claims declares contract_from; the referenced set resolves, and a
+// definition that restates inline fields while deriving its contract
+// is the restatement the rule exists to prevent.
+function checkArtifactContracts(standard) {
+    const issues = [];
+    const err = (check, message) => issues.push({ check, severity: 'error', message });
+    const setIds = new Set();
+    for (const ps of standard.promiseSets ?? []) {
+        setIds.add(ps.id);
+        setIds.add(`${ps.id}.promise_set`);
+    }
+    for (const s of standard.subjects ?? []) {
+        if ((s.is?.promises ?? []).length > 0) {
+            setIds.add(s.id);
+            setIds.add(`${s.id}.promise_set`);
+        }
+    }
+    for (const d of standard.artifactDefinitions ?? []) {
+        if (!d.contractFrom) {
+            continue;
+        }
+        if (!setIds.has(d.contractFrom)) {
+            err('C153', `artifact_definition ${d.id}: contract_from "${d.contractFrom}" does not resolve to a declared promise set (artifact-contract-derivation)`);
+        }
+        const c = d.contentContract;
+        if (c.fields.length > 0 || c.structure || c.media.length > 0) {
+            err('C153', `artifact_definition ${d.id}: declares both contract_from and inline contract fields — the derived contract is the referenced set's projection, never a restatement (artifact-contract-derivation)`);
+        }
+    }
+    return issues;
+}
+// ── C152: payload-typed-by-class (the typed kernel R2, clause 10) ────
+// A dimension that declares payload_class types every value's
+// definition: the class resolves, every payload field is a field of
+// that class, and every value carries its definition — a value IS its
+// definition, not a symbol pointing at a table. The attribute-side
+// bridge resolves too: an attribute_definition's class reference names
+// a declared class.
+function checkTypedPayloads(standard) {
+    const issues = [];
+    const err = (check, message) => issues.push({ check, severity: 'error', message });
+    const classFields = new Map();
+    for (const c of standard.dataclasses ?? []) {
+        classFields.set(c.id, new Set(c.attributes.map(a => a.id)));
+    }
+    // The power-type discipline reaches the typing bridge: an INSTANCE
+    // is a class, and its shape is the fields of the class its `of`
+    // chain terminates at (the prototype hop's mirror — an individual
+    // typed by its definition's fields).
+    const instanceShape = (id) => {
+        const inst = (standard.instances ?? []).find(i => i.id === id);
+        if (!inst) {
+            return undefined;
+        }
+        let cur = inst;
+        const seen = new Set([cur.id]);
+        while (cur.of) {
+            const next = (standard.instances ?? []).find(i => i.id === cur.of);
+            if (!next || seen.has(next.id)) {
+                break;
+            }
+            seen.add(next.id);
+            cur = next;
+        }
+        return cur.of !== '' ? classFields.get(cur.of) : undefined;
+    };
+    const typedFields = (id) => classFields.get(id) ?? instanceShape(id);
+    const checkDim = (owner, d) => {
+        if (!d.payloadClass) {
+            return;
+        }
+        const fields = typedFields(d.payloadClass);
+        if (!fields) {
+            err('C152', `${owner} dimension ${d.id}: payload_class "${d.payloadClass}" is not a declared class (payload-typed-by-class)`);
+            return;
+        }
+        for (const v of d.values) {
+            const keys = Object.keys(v.payload ?? {});
+            if (keys.length === 0) {
+                err('C152', `${owner} dimension ${d.id}: value ${v.id} carries no payload — a value of a payload_class dimension IS its definition (payload-typed-by-class)`);
+                continue;
+            }
+            for (const key of keys) {
+                if (!fields.has(key)) {
+                    err('C152', `${owner} dimension ${d.id}: value ${v.id} payload field "${key}" is not a field of class "${d.payloadClass}" (payload-typed-by-class)`);
+                }
+            }
+        }
+    };
+    for (const inst of standard.instruments ?? []) {
+        for (const d of inst.dimensions ?? []) {
+            checkDim(`instrument ${inst.id}`, d);
+        }
+    }
+    for (const d of standard.dimensions ?? []) {
+        checkDim('top-level', d);
+    }
+    for (const a of standard.attributeDefinitions ?? []) {
+        if (a.classRef && !typedFields(a.classRef)) {
+            err('C152', `attribute_definition ${a.id}: class "${a.classRef}" is not a declared class (payload-typed-by-class)`);
+        }
+    }
+    return issues;
+}
+// ── C150/C151: the attestation's references and claim lineage ───────
+// C150 attestation-references-resolve: the subject is a declared
+// instance, the promise set resolves in `Subject.promise_set_id` form,
+// every basis entry carries kind and id, and every claim's declaration
+// and verdict references are stated. C151
+// attestation-claim-lineage: every promise the certificate prints as
+// mandatory must be carried by a claim — a mandatory characteristic is
+// carried by lineage, never restated (clause 19).
+function checkAttestations(standard) {
+    const issues = [];
+    const err = (check, message) => issues.push({ check, severity: 'error', message });
+    const roleIds = new Set((standard.roles ?? []).map(r => r.id));
+    const instanceIds = new Set((standard.instances ?? []).map(i => i.id));
+    const verdictIds = new Set((standard.verdicts ?? []).map(v => v.id));
+    const setViews = new Map();
+    for (const ps of standard.promiseSets ?? []) {
+        setViews.set(ps.id, { promises: ps.promises });
+        setViews.set(`${ps.id}.promise_set`, { promises: ps.promises });
+    }
+    for (const s of standard.subjects ?? []) {
+        if ((s.is?.promises ?? []).length > 0) {
+            setViews.set(s.id, { promises: s.is.promises });
+        }
+    }
+    const resolveSet = (ref) => setViews.get(ref) ??
+        setViews.get(ref.split('.').slice(1).join('.')) ??
+        null;
+    const mandatoryOf = (view) => {
+        const out = new Set();
+        for (const p of view.promises) {
+            if (p.certificate?.obligation === 'mandatory') {
+                out.add(p.id);
+            }
+        }
+        return out;
+    };
+    for (const a of standard.attestations ?? []) {
+        if (!a.subject) {
+            err('C150', `attestation ${a.id}: no subject facet (attestation-references-resolve)`);
+        }
+        else if (!instanceIds.has(a.subject)) {
+            err('C150', `attestation ${a.id}: subject "${a.subject}" is not a declared instance (attestation-references-resolve)`);
+        }
+        if (!a.promises) {
+            err('C150', `attestation ${a.id}: no promises facet (attestation-references-resolve)`);
+        }
+        const set = a.promises ? resolveSet(a.promises) : null;
+        if (a.promises && !set) {
+            err('C150', `attestation ${a.id}: promises "${a.promises}" does not resolve to a declared promise set (attestation-references-resolve)`);
+        }
+        for (const b of a.basis) {
+            if (!b.kind || !b.id) {
+                err('C150', `attestation ${a.id}: a basis entry needs an evidence kind and an id (attestation-references-resolve)`);
+            }
+        }
+        if (a.authority.role &&
+            roleIds.size > 0 &&
+            !roleIds.has(a.authority.role)) {
+            err('C150', `attestation ${a.id}: authority role "${a.authority.role}" is not a declared role (attestation-references-resolve)`);
+        }
+        const carried = new Set(a.claims.map(c => c.promise));
+        for (const c of a.claims) {
+            if (set && !set.promises.some(p => p.id === c.promise)) {
+                err('C150', `attestation ${a.id}: claim "${c.promise}" is not a promise of "${a.promises}" (attestation-references-resolve)`);
+            }
+            if (!c.declared) {
+                err('C151', `attestation ${a.id}: claim "${c.promise}" carries no declaration reference (attestation-claim-lineage)`);
+            }
+            if (!c.validatedBy) {
+                err('C151', `attestation ${a.id}: claim "${c.promise}" carries no verdict reference (attestation-claim-lineage)`);
+            }
+            else if (verdictIds.size > 0 &&
+                !c.validatedBy.startsWith('/') &&
+                !verdictIds.has(c.validatedBy)) {
+                // Bare ids resolve inside the package; slash ids are the
+                // requirement-anatomy path form and resolve in the linker.
+                err('C150', `attestation ${a.id}: claim "${c.promise}" names verdict "${c.validatedBy}", which is not declared (attestation-references-resolve)`);
+            }
+        }
+        if (set) {
+            for (const pid of mandatoryOf(set)) {
+                if (!carried.has(pid)) {
+                    err('C151', `attestation ${a.id}: the mandatory promise "${pid}" of "${a.promises}" is carried by no claim — a mandatory characteristic is carried by lineage, never restated (attestation-claim-lineage)`);
+                }
+            }
+        }
+    }
+    return issues;
+}
+// ── C149: closed-derivation-references-declared ─────────────────────
+// The typed kernel's rule R3: a derivation expression names only
+// declared definitions — declared calculations, tables, symbols,
+// measurements/variables, data classes, enums, and attributes of the
+// model. The checker rejects an expression that references anything
+// else and names the missing declaration, so the undefined-reference
+// defect class cannot be authored.
+const CLOSED_DERIVATION_STOP = new Set([
+    'self',
+    'p',
+    'ocl',
+    'true',
+    'false',
+    'null',
+    'undefined',
+    // OCL navigation and collection operators
+    'and',
+    'or',
+    'not',
+    'implies',
+    'if',
+    'then',
+    'else',
+    'endif',
+    'xor',
+    'let',
+    'in',
+    'exists',
+    'forAll',
+    'select',
+    'reject',
+    'collect',
+    'isEmpty',
+    'size',
+    'sum',
+    'min',
+    'max',
+    'abs',
+    'round',
+    'floor',
+    'sqrt',
+    'includes',
+    'excludes',
+    'includesAll',
+    'excludesAll',
+    'count',
+    'first',
+    'last',
+    'asSet',
+    'asOrderedSet',
+    'asSequence',
+    'asBag',
+    'sortedBy',
+    'iterate',
+    'oclIsUndefined',
+    'oclIsKindOf',
+    'oclIsTypeOf',
+    'allInstances',
+    // table-lookup engine vocabulary (the lookup facet names these)
+    'lookup',
+    'profile',
+    // OCL collection statistics and arithmetic
+    'average',
+    'mean',
+    'size',
+    'div',
+    'mod',
+    'collect',
+]);
+// Attribute navigation: `head.field…` resolves when the HEAD is a
+// declared name (an input, a calculation, an attribute, a class-typed
+// value); the tail is navigation over that head's type, judged by the
+// class layer (C152), not by the closed-derivation rule.
+const CLOSED_DERIVATION_PATH_RE = /\b[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)+/g;
+const CLOSED_DERIVATION_IDENT_RE = /[A-Za-z_][A-Za-z0-9_]*/g;
+function checkClosedDerivations(standard) {
+    const issues = [];
+    const err = (check, message) => issues.push({ check, severity: 'error', message });
+    // The declared universe every derivation may reference.
+    const declared = new Set();
+    for (const c of standard.calculations ?? []) {
+        declared.add(c.id);
+        declared.add(c.name);
+    }
+    for (const tb of standard.tables ?? []) {
+        declared.add(tb.id);
+    }
+    for (const s of standard.symbols ?? []) {
+        declared.add(s.id);
+    }
+    for (const v of standard.variables ?? []) {
+        declared.add(v.id);
+    }
+    for (const a of standard.attributeDefinitions ?? []) {
+        declared.add(a.id);
+    }
+    for (const e of standard.enums ?? []) {
+        declared.add(e.id);
+    }
+    for (const d of standard.dataclasses ?? []) {
+        declared.add(d.id);
+    }
+    for (const inst of standard.instruments ?? []) {
+        for (const d of inst.dimensions ?? []) {
+            declared.add(d.id);
+        }
+    }
+    for (const d of standard.dimensions ?? []) {
+        declared.add(d.id);
+    }
+    // A calculation's own output name is declared too (requirements bind
+    // it), and so is every input of every calculation.
+    for (const c of standard.calculations ?? []) {
+        if (c.output?.name) {
+            declared.add(c.output.name);
+        }
+        for (const i of c.inputs ?? []) {
+            declared.add(i.name);
+        }
+    }
+    const localsOf = (extra) => new Set([...declared, ...extra]);
+    const checkExpression = (expr, locals, where) => {
+        if (!expr) {
+            return;
+        }
+        // Values and lambdas are not references: single-quoted literals are
+        // values; an identifier before `|` is a lambda parameter.
+        const noLiterals = expr.replace(/'[^']*'/g, ' ');
+        const noLambdas = noLiterals.replace(/\b([A-Za-z_][A-Za-z0-9_]*)\s*\|/g, ' ');
+        const stripped = noLambdas.replace(CLOSED_DERIVATION_PATH_RE, ' ');
+        const seen = new Set();
+        for (const raw of stripped.match(CLOSED_DERIVATION_IDENT_RE) ?? []) {
+            if (CLOSED_DERIVATION_STOP.has(raw) ||
+                locals.has(raw) ||
+                seen.has(raw) ||
+                /^[a-z][0-9]?$/.test(raw)) {
+                continue;
+            }
+            seen.add(raw);
+            err('C149', `${where}: expression references "${raw}", which no declared calculation, table, symbol, measurement, or attribute defines (closed-derivation-references-declared)`);
+        }
+    };
+    for (const a of standard.attributeDefinitions ?? []) {
+        checkExpression(a.derived, localsOf([]), `attribute_definition ${a.id}`);
+    }
+    for (const c of standard.calculations ?? []) {
+        // The normative body is the declared expression; engine variants
+        // are consumer code and outside the language's semantics.
+        const inputs = (c.inputs ?? []).map(i => i.name);
+        checkExpression(c.expression, localsOf(inputs), `calculation ${c.id}`);
+    }
+    for (const s of standard.symbols ?? []) {
+        if (s.formula?.expression) {
+            checkExpression(s.formula.expression, localsOf(s.formula.inputs ?? []), `symbol ${s.id}`);
+        }
+    }
+    for (const v of standard.verdicts ?? []) {
+        checkExpression(v.derive, localsOf(v.inputs ?? []), `verdict ${v.id}`);
+    }
+    return issues;
+}
 function checkSpellingCodes(standard) {
     const issues = [];
     const err = (check, message) => issues.push({ check, severity: 'error', message });