@primmel/primmel 1.21.12 → 1.21.14

package/dist/src/check.js

@@ -396,12 +396,14 @@ exports.checkTermAliases = checkTermAliases;
 exports.checkDimensions = checkDimensions;
 exports.checkReferences = checkReferences;
 exports.checkVerdictChains = checkVerdictChains;
+exports.checkLmlAligned = checkLmlAligned;
 exports.checkEditionLifecycle = checkEditionLifecycle;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const package_1 = require("./ser-des/package");
 const prm_1 = require("./ser-des/prm");
 const mapping_coverage_1 = require("./mapping-coverage");
+const expressions_1 = require("./expressions");
 const time_1 = require("./time");
 const type_expr_1 = require("./type-expr");
 const model_diff_1 = require("./model-diff");
@@ -412,6 +414,7 @@ const Passport_1 = require("./types/Passport");
 const TestSequence_1 = require("./types/TestSequence");
 const FormulasUsed_1 = require("./types/FormulasUsed");
 const tokenize_1 = require("./ser-des/tokenize");
+const lmlAligned_1 = require("./ser-des/config/lmlAligned");
 const operational_state_1 = require("./operational-state");
 const check_rules_1 = require("./check-rules");
 const instance_resolution_1 = require("./instance-resolution");
@@ -541,6 +544,9 @@ function checkPackage(dir, options = {}) {
     issues.push(...checkReferences(standard));
     // ── C116/C117: the verdict chain (MN 114 v3.2, clause 11.3) ────────
     issues.push(...checkVerdictChains(standard));
+    // ── C158–C162 + C164 + C167: the LML-aligned substrate (the spec's
+    // validation contract, language-v3 §16) ─────────────────────────────
+    issues.push(...checkLmlAligned(standard));
     // ── C149: the closed-derivation rule (the typed kernel, R3) ────────
     issues.push(...checkClosedDerivations(standard));
     // ── C150/C151: the attestation's references and claim lineage ──────
@@ -636,10 +642,12 @@ function checkPackage(dir, options = {}) {
         };
         (form.fields ?? []).forEach(checkField);
     }
-    // C2 — reference targets resolve
+    // C2 — reference targets resolve (a requirement class is a legitimate
+    // verification target: a test may verify a whole regime)
+    const classIds = new Set((standard.requirementClasses ?? []).map(rc => rc.id));
     for (const t of standard.conformanceTests ?? []) {
         for (const target of t.targets ?? []) {
-            if (!reqIds.has(target)) {
+            if (!reqIds.has(target) && !classIds.has(target)) {
                 err('C2', `conformance test ${t.id}: target "${target}" is not a declared requirement`);
             }
         }
@@ -796,9 +804,19 @@ function checkPackage(dir, options = {}) {
     // targeting test AND no recorded non-test verification warns. The
     // reverse leg is unchanged: a test targeting nothing warns.
     const covered = new Set();
+    const classMembers = new Map();
+    for (const rc of standard.requirementClasses ?? []) {
+        classMembers.set(rc.id, rc.members ?? []);
+    }
+    const coverWithMembers = (id) => {
+        covered.add(id);
+        for (const m of classMembers.get(id) ?? []) {
+            covered.add(m);
+        }
+    };
     for (const t of standard.conformanceTests ?? []) {
         for (const target of t.targets ?? []) {
-            covered.add(target);
+            coverWithMembers(target);
         }
     }
     const provisioned = new Set();
@@ -834,6 +852,1021 @@ function checkPackage(dir, options = {}) {
             warn('C5', `conformance test ${t.id}: targets no requirement`);
         }
     }
+    // ── C171 expression-identifiers-resolve ─────────────────────────────
+    // The machine-executable expressions are the executable core: every
+    // identifier inside a limit expression, a derivation, or a derive
+    // must resolve to a declared name in scope — the expression's own
+    // uses list, the test's declared variables, or the package's
+    // symbols/datums/verdicts. An identifier naming nothing is air inside
+    // the formula. Dotted paths (the subject-chain binds) and the OCL
+    // keywords are not identifiers for this purpose.
+    const OCL_WORDS = new Set([
+        'and',
+        'or',
+        'not',
+        'xor',
+        'implies',
+        'if',
+        'then',
+        'else',
+        'endif',
+        'true',
+        'false',
+        'null',
+        'invalid',
+        'abs',
+        'max',
+        'min',
+        'floor',
+        'ceil',
+        'mod',
+        'div',
+        'round',
+        'sqrt',
+        'exp',
+        'ln',
+        'log',
+        'sum',
+        'count',
+        'exists',
+        'forall',
+        'oclIsUndefined',
+        'oclIsKindOf',
+        'oclIsTypeOf',
+        'String',
+        'Integer',
+        'Real',
+        'Boolean',
+        'Set',
+        'Bag',
+        'Sequence',
+        'Collection',
+        // the subject-chain roots: every expression reads the dispatch
+        // context through them — context, never air
+        'sample',
+        'family',
+        'group',
+        'model',
+        'instrument',
+        'specimen',
+        'max_of',
+        'min_of',
+        'mean_of',
+        'stddev_of',
+        'count_of',
+    ]);
+    const globalExprNames = new Set([
+        ...(standard.symbols ?? []).map(s => s.id),
+        ...(standard.symbols ?? []).map(s => s.id.split('/').pop() ?? ''),
+        ...(standard.datums ?? []).map(d => d.id),
+        ...(standard.verdicts ?? []).map(v => v.id),
+        // the lookup tables: a dotted helper call's OBJECT is declared here —
+        // the method name rides the declared object
+        ...(standard.tables ?? []).map(v => v.id),
+        // the subject anatomy: a declared attribute is a declaration
+        ...(standard.attributeDefinitions ?? []).map(a => a.id),
+        ...(standard.attributeDefinitions ?? []).map(a => a.id.split('/').pop() ?? ''),
+        // the calculations: a derivation may call a declared calculation
+        // (twin-cert's lookupMPE) — the callable registry
+        ...(standard.calculations ?? []).map(c => c.id),
+        ...(standard.calculations ?? []).map(c => c.id.split('/').pop() ?? ''),
+    ].filter(x => x !== ''));
+    // The declared quantity kinds (C177 kind-coherence): only the
+    // declarations that STATE a kind participate; everything else is
+    // unknown and never conflicts.
+    const symbolKinds = new Map();
+    for (const s of standard.symbols ?? []) {
+        if (s.quantityKind) {
+            symbolKinds.set(s.id, s.quantityKind);
+            symbolKinds.set(s.id.split('/').pop() ?? '', s.quantityKind);
+        }
+    }
+    const attributeKinds = new Map();
+    for (const a of standard.attributeDefinitions ?? []) {
+        if (a.quantityKind) {
+            attributeKinds.set(a.id, a.quantityKind);
+            attributeKinds.set(a.id.split('/').pop() ?? '', a.quantityKind);
+        }
+    }
+    const verdictKinds = new Map();
+    for (const v of standard.verdicts ?? []) {
+        if (v.quantityKind) {
+            verdictKinds.set(v.id, v.quantityKind);
+        }
+    }
+    const tableColumnTypes = new Map();
+    for (const t of standard.tables ?? []) {
+        const cols = new Map();
+        for (const c of t.columnDefs ?? []) {
+            cols.set(c.name, (c.type || '').toLowerCase());
+        }
+        if (cols.size > 0) {
+            tableColumnTypes.set(t.id, cols);
+        }
+    }
+    const bare = (q) => q.split(':').pop() ?? q;
+    const usesCovers = (uses, id) => uses.some(u => {
+        const tail = bare(u.replace(/\./g, ':'));
+        return u === id || tail === id || u.endsWith('.' + id);
+    });
+    const exprIds = (expr) => {
+        // dotted paths are WHOLE references: the interior segments are the
+        // chain's structure — only the final segment names the datum, and
+        // usesCovers judges the path against the uses entries.
+        const paths = expr.match(/[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*/g) ?? [];
+        const out = [];
+        const seen = new Set();
+        for (const p of paths) {
+            if (p.includes('.')) {
+                const segs = p.split('.');
+                // a method call on a declared object (table.permits(...)) rides
+                // the declared object — the final segment is its method
+                if (globalExprNames.has(segs[0])) {
+                    continue;
+                }
+                const finalSeg = segs[segs.length - 1];
+                if (!seen.has(p)) {
+                    seen.add(p);
+                    if (!OCL_WORDS.has(finalSeg)) {
+                        out.push(finalSeg);
+                    }
+                }
+                continue;
+            }
+            if (!OCL_WORDS.has(p) && !seen.has(p)) {
+                seen.add(p);
+                out.push(p);
+            }
+        }
+        return out;
+    };
+    const unresolvedIn = (expr, scope, uses) => {
+        const scopeSet = new Set([...scope, ...globalExprNames]);
+        const seen = new Set();
+        const out = [];
+        for (const id of exprIds(expr)) {
+            if (seen.has(id)) {
+                continue;
+            }
+            seen.add(id);
+            if (OCL_WORDS.has(id) || scopeSet.has(id) || usesCovers(uses, id)) {
+                continue;
+            }
+            out.push(id);
+        }
+        return out;
+    };
+    // The mapped computations (register: the mapped-callee plane): a
+    // certification program maps to its Recommendations (`maps_to`), and
+    // its derivations invoke the mapped Recommendation's declared
+    // computations — by reference, never restated. The ids join the
+    // callable registry, locator-gated like C168's scoped leg.
+    const mappedCalcIds = new Set();
+    {
+        const mapsTo = standard.packageManifest?.mapsTo ?? [];
+        for (const target of mapsTo) {
+            if (!options.resolvePackage) {
+                continue;
+            }
+            try {
+                const depDir = options.resolvePackage(target);
+                if (!depDir) {
+                    continue;
+                }
+                const dep = (0, package_1.loadPackageWithIssues)(depDir);
+                for (const c of dep.standard?.calculations ?? []) {
+                    mappedCalcIds.add(c.id);
+                    mappedCalcIds.add(c.id.split('/').pop() ?? '');
+                }
+            }
+            catch {
+                // Unreadable mapped package — C27 reports the resolution
+                // failure; this registry stays silent rather than
+                // double-reporting.
+            }
+        }
+        for (const x of mappedCalcIds) {
+            if (x !== '') {
+                globalExprNames.add(x);
+            }
+        }
+    }
+    // The v3.3 inline limit: the AST walked against the args scope. The
+    // body's identifiers are the args and nothing else (plus `self`-rooted
+    // paths — the dispatch context — and the closed function vocabulary);
+    // `memberScope` (a class law) adds the containment to the scope.
+    const INLINE_FUNCTION_WORDS = new Set([
+        'abs',
+        'max',
+        'min',
+        'floor',
+        'ceil',
+        'round',
+        'sqrt',
+        'exp',
+        'ln',
+        'log',
+        'mod',
+        'sum',
+        'count',
+        'exists',
+        'forall',
+        // the series aggregations (register W4): the GUM type A vocabulary —
+        // the statistics of a captured series; the evaluation is plurimath's
+        'max_of',
+        'min_of',
+        'mean_of',
+        'stddev_of',
+        'count_of',
+    ]);
+    const DECLARATION_KINDS = new Set([
+        'symbol',
+        'table',
+        'datum',
+        'verdict',
+        'attribute',
+        'process',
+    ]);
+    // the dispatch-context roots: the chain the expression reads the
+    // subject through — allowed as PATH roots, never as bare scalars
+    const CONTEXT_ROOTS = new Set([
+        'sample',
+        'family',
+        'group',
+        'model',
+        'instrument',
+        'specimen',
+    ]);
+    const checkInlineLimit = (ownerKind, ownerId, limit, memberScope) => {
+        let ast;
+        try {
+            ast = (0, expressions_1.parseExpression)(limit.expression);
+        }
+        catch (e) {
+            err('C171', `${ownerKind} ${ownerId}: the inline limit expression does not parse — ${String(e.message ?? e)} (expression-identifiers-resolve)`);
+            return;
+        }
+        const ids = (0, expressions_1.freeIdentifiers)(ast);
+        const args = limit.args ?? [];
+        const argNames = new Set(args.map(a => a.name));
+        if (memberScope === null &&
+            args.length === 0 &&
+            ids.names.some(n => !n.includes('.'))) {
+            // a body over pure dispatch-context paths (`sample.test_context.*`)
+            // binds nothing and is legal; any bare identifier is ambient air
+            err('C171', `${ownerKind} ${ownerId}: the inline limit declares no arguments — every identifier must bind explicitly, args { name <- <declaration> } (expression-identifiers-resolve)`);
+        }
+        for (const call of new Set(ids.calls)) {
+            if (INLINE_FUNCTION_WORDS.has(call)) {
+                continue;
+            }
+            if (globalExprNames.has(call)) {
+                // a declared callable — the calculation registry (twin-cert's
+                // mpe(…), R 49's relative_error(…))
+                continue;
+            }
+            if (call.includes('.')) {
+                const root = call.split('.')[0];
+                if (argNames.has(root) ||
+                    globalExprNames.has(root) ||
+                    root === 'self' ||
+                    CONTEXT_ROOTS.has(root)) {
+                    // the method rides its declared object — the root is the check
+                    continue;
+                }
+            }
+            if (argNames.has(call)) {
+                // an arg-bound callable — the table lookup the args declare
+                continue;
+            }
+            err('C171', `${ownerKind} ${ownerId}: the limit calls "${call}(…)", which no argument binds and which is not in the expression function vocabulary (abs max min floor ceil round sqrt exp ln log mod sum count exists forall) — air inside the formula (expression-identifiers-resolve)`);
+        }
+        for (const id of new Set(ids.names)) {
+            const root = id.split('.')[0];
+            if (id.includes('.') &&
+                (root === 'self' || argNames.has(root) || CONTEXT_ROOTS.has(root))) {
+                continue;
+            }
+            if (argNames.has(id)) {
+                continue;
+            }
+            if (memberScope !== null && memberScope.has(id)) {
+                continue;
+            }
+            const lawScoped = memberScope !== null;
+            const fix = lawScoped
+                ? 'the law composes the containment only — its identifiers are the members'
+                : 'add args { ' + id + ' <- <declaration> } or remove it';
+            err(lawScoped ? 'C172' : 'C171', `${ownerKind} ${ownerId}: the limit expression names "${id}", which no argument binds — ${fix} (${lawScoped ? 'requirement-algebra-resolves' : 'expression-identifiers-resolve'})`);
+        }
+        for (const a of args) {
+            if (a.source.includes(':')) {
+                const segs = a.source.split(':');
+                if (segs.some(s => s.length === 0)) {
+                    err('C171', `${ownerKind} ${ownerId}: argument "${a.name}" binds to "${a.source}" — a binding is <kind>:<id> in this package or <package>:<kind>:<id> across a uses edge (expression-identifiers-resolve)`);
+                    continue;
+                }
+                if (segs.length === 2) {
+                    const [kind, id] = segs;
+                    if (kind === 'process') {
+                        // register 19: `process:<p>[.<step>[.<io>]]` — the dot
+                        // descends the declared structure, the leaf names a
+                        // declared io
+                        const segs2 = id.split('.');
+                        const proc = (standard.processes ?? []).find(pp => pp.id === segs2[0]);
+                        if (!proc) {
+                            err('C171', `${ownerKind} ${ownerId}: argument "${a.name}" binds to "${a.source}", which no declared process names — air inside the formula (expression-identifiers-resolve)`);
+                        }
+                        else if (segs2.length >= 2) {
+                            const stp = (proc.steps ?? []).find(ss => ss.id === segs2[1]);
+                            if (!stp) {
+                                err('C171', `${ownerKind} ${ownerId}: argument "${a.name}" binds to "${a.source}" — the process declares no step "${segs2[1]}" (expression-identifiers-resolve)`);
+                            }
+                            else if (segs2.length >= 3) {
+                                const io = segs2.slice(2).join('.');
+                                if (!(stp.sigInputs ?? []).includes(io) &&
+                                    !(stp.sigOutputs ?? []).includes(io)) {
+                                    err('C171', `${ownerKind} ${ownerId}: argument "${a.name}" binds to "${a.source}" — the step declares no io "${io}" (expression-identifiers-resolve)`);
+                                }
+                            }
+                        }
+                        continue;
+                    }
+                    if (kind !== 'observable') {
+                        if (!DECLARATION_KINDS.has(kind)) {
+                            err('C171', `${ownerKind} ${ownerId}: argument "${a.name}" binds to "${a.source}" — "${kind}" is not a declaration kind (symbol table datum verdict attribute observable) (expression-identifiers-resolve)`);
+                            continue;
+                        }
+                        const idRoot = id.split('.')[0];
+                        const idTail = id.split('.').pop() ?? id;
+                        if (!globalExprNames.has(id) &&
+                            !globalExprNames.has(idRoot) &&
+                            !globalExprNames.has(idTail)) {
+                            err('C171', `${ownerKind} ${ownerId}: argument "${a.name}" binds to "${a.source}", which no declared ${kind} names — air inside the formula (expression-identifiers-resolve)`);
+                        }
+                    }
+                    continue;
+                }
+                // <package>:<kind>:<id> across a uses edge — the composed gate
+                // resolves it against the closure.
+                continue;
+            }
+            if (a.source === 'self' || a.source.startsWith('self.')) {
+                continue;
+            }
+            const bare = (q) => q.split(':').pop() ?? q;
+            const sourceBare = bare(a.source.replace(/\./g, ':'));
+            if (memberScope !== null) {
+                if (!memberScope.has(a.source) && !memberScope.has(sourceBare)) {
+                    err('C172', `requirement class ${ownerId}: the law binds "${a.name}" to "${a.source}", which is not a contained member (requirement-algebra-resolves)`);
+                }
+                continue;
+            }
+            if (!globalExprNames.has(a.source) &&
+                !globalExprNames.has(sourceBare) &&
+                !usesCovers(limit.uses, sourceBare)) {
+                err('C171', `${ownerKind} ${ownerId}: argument "${a.name}" binds to "${a.source}", which no symbol, datum, verdict, attribute, or uses entry declares — air inside the formula (expression-identifiers-resolve)`);
+            }
+        }
+        // ── C177 kind-coherence ──────────────────────────────────────────
+        // The comparisons compare operands of the same declared quantity
+        // kind. The kinds come from the args' declared sources; an operand
+        // of unknown kind or a bare number never conflicts — the check is
+        // exact where the declarations are, silent everywhere else.
+        const kindLabel = (k) => k === undefined
+            ? 'an operand of unknown kind'
+            : k === 'TEXT'
+                ? 'text'
+                : k === null
+                    ? 'a bare number'
+                    : `the "${k}" quantity`;
+        const argKindOf = (source) => {
+            if (source.includes(':')) {
+                const segs = source.split(':');
+                if (segs.length !== 2) {
+                    return undefined;
+                }
+                const [kind, id] = segs;
+                if (kind === 'symbol') {
+                    return symbolKinds.get(id.split('.').pop() ?? id);
+                }
+                if (kind === 'attribute') {
+                    return attributeKinds.get(id.split('.').pop() ?? id);
+                }
+                if (kind === 'verdict') {
+                    return verdictKinds.get(id.split('.')[0]);
+                }
+                if (kind === 'table') {
+                    const segs2 = id.split('.');
+                    const colType = segs2.length === 2
+                        ? tableColumnTypes.get(segs2[0])?.get(segs2[1])
+                        : undefined;
+                    return colType === 'string' ? 'TEXT' : undefined;
+                }
+                return undefined;
+            }
+            if (source === 'self' || source.startsWith('self.')) {
+                return undefined;
+            }
+            return symbolKinds.get(source) ?? attributeKinds.get(source) ?? undefined;
+        };
+        const kindConflicts = new Set();
+        const kindMixErr = (node, l, r) => {
+            const key = (0, expressions_1.renderExpression)(node);
+            if (kindConflicts.has(key)) {
+                return;
+            }
+            kindConflicts.add(key);
+            err('C177', `${ownerKind} ${ownerId}: ${kindLabel(l)} is set against ${kindLabel(r)} in "${(0, expressions_1.renderExpression)(node)}" — the operands must share the quantity kind (kind-coherence)`);
+        };
+        const kindOf = (node) => {
+            switch (node.type) {
+                case 'num':
+                    return null;
+                case 'str':
+                    return null;
+                case 'bool':
+                    return null;
+                case 'ifelse': {
+                    kindOf(node.cond);
+                    const l = kindOf(node.then);
+                    const r = kindOf(node.else);
+                    if (l !== undefined &&
+                        r !== undefined &&
+                        l !== null &&
+                        r !== null &&
+                        l !== r) {
+                        kindMixErr(node, l, r);
+                    }
+                    return l !== undefined && l !== null ? l : r;
+                }
+                case 'name': {
+                    const root = node.path[0];
+                    if (node.path.length > 1 &&
+                        (root === 'self' || CONTEXT_ROOTS.has(root))) {
+                        return undefined;
+                    }
+                    const arg = args.find(a => a.name === root);
+                    return arg ? argKindOf(arg.source) : undefined;
+                }
+                case 'call': {
+                    if (node.callee.includes('.')) {
+                        return undefined;
+                    }
+                    const kinded = [
+                        'abs',
+                        'max',
+                        'min',
+                        'floor',
+                        'ceil',
+                        'round',
+                        'sqrt',
+                        'exp',
+                        'ln',
+                        'log',
+                        'mod',
+                    ];
+                    if (!kinded.includes(node.callee)) {
+                        return null;
+                    }
+                    let acc = undefined;
+                    for (const a of node.args) {
+                        const k = kindOf(a);
+                        if (k === undefined) {
+                            continue;
+                        }
+                        if (acc === undefined || acc === null) {
+                            acc = k;
+                            continue;
+                        }
+                        if (k !== undefined && k !== null && k !== acc) {
+                            kindMixErr(node, acc, k);
+                        }
+                    }
+                    return acc;
+                }
+                case 'unop':
+                    return node.op === 'not' ? null : kindOf(node.operand);
+                case 'nav':
+                    // the iteration predicate's truth over the collection: the
+                    // boolean iterators; select keeps the source's kind — its
+                    // element kind is the collection's, unknown here; collect
+                    // projects to a collection of the body's element kind
+                    return node.op === 'select'
+                        ? undefined
+                        : node.op === 'collect'
+                            ? kindOf(node.body)
+                            : null;
+                case 'binop': {
+                    if (['<=', '>=', '<', '>', '=', '!=', '≠'].includes(node.op)) {
+                        const l = kindOf(node.left);
+                        const r = kindOf(node.right);
+                        if (l !== undefined &&
+                            r !== undefined &&
+                            l !== null &&
+                            r !== null &&
+                            l !== r) {
+                            kindMixErr(node, l, r);
+                        }
+                        return null;
+                    }
+                    if (['and', 'or', 'xor', 'implies'].includes(node.op)) {
+                        kindOf(node.left);
+                        kindOf(node.right);
+                        return null;
+                    }
+                    const l = kindOf(node.left);
+                    const r = kindOf(node.right);
+                    if (l !== undefined &&
+                        r !== undefined &&
+                        l !== null &&
+                        r !== null &&
+                        l !== r) {
+                        kindMixErr(node, l, r);
+                    }
+                    return l !== undefined && l !== null ? l : r;
+                }
+            }
+        };
+        kindOf(ast);
+    };
+    for (const r of standard.requirements ?? []) {
+        if (r.limit?.argsBound) {
+            checkInlineLimit('requirement', r.id, r.limit, null);
+            continue;
+        }
+        const expr = r.limit?.expression;
+        if (!expr) {
+            continue;
+        }
+        const ocl = expr.replace(/^ocl\{/, '').replace(/\}$/, '');
+        const uses = r.limit?.uses ?? [];
+        for (const id of unresolvedIn(ocl, [], uses)) {
+            err('C171', `requirement ${r.id}: the limit expression names "${id}", which no uses entry, symbol, datum, or verdict declares — air inside the formula (expression-identifiers-resolve)`);
+        }
+    }
+    // The inline carriers (derive / derivation / check blocks): the
+    // AST-exact resolution — the free names against the carrier's declared
+    // scope plus the package's declared registries; the calls against the
+    // function vocabulary and the declared callables.
+    const resolveInlineCarrier = (ownerKind, ownerId, what, src, scope) => {
+        let ast;
+        try {
+            ast = (0, expressions_1.parseExpression)(src);
+        }
+        catch (e) {
+            err('C171', `${ownerKind} ${ownerId}: the ${what} does not parse — ${String(e.message ?? e)} (expression-identifiers-resolve)`);
+            return;
+        }
+        const ids = (0, expressions_1.freeIdentifiers)(ast);
+        for (const call of new Set(ids.calls)) {
+            if (INLINE_FUNCTION_WORDS.has(call)) {
+                continue;
+            }
+            if (call.includes('.')) {
+                const root = call.split('.')[0];
+                if (scope.has(root) ||
+                    globalExprNames.has(root) ||
+                    root === 'self' ||
+                    CONTEXT_ROOTS.has(root)) {
+                    continue;
+                }
+            }
+            if (scope.has(call) || globalExprNames.has(call)) {
+                continue;
+            }
+            err('C171', `${ownerKind} ${ownerId}: the ${what} calls "${call}(…)", which nothing declares and which is not in the expression function vocabulary — air inside the formula (expression-identifiers-resolve)`);
+        }
+        for (const id of new Set(ids.names)) {
+            const root = id.split('.')[0];
+            if (id.includes('.') &&
+                (scope.has(root) || root === 'self' || CONTEXT_ROOTS.has(root))) {
+                continue;
+            }
+            if (scope.has(id)) {
+                continue;
+            }
+            if (globalExprNames.has(id) ||
+                globalExprNames.has(id.split('.').pop() ?? id)) {
+                continue;
+            }
+            err('C171', `${ownerKind} ${ownerId}: the ${what} names "${id}", which nothing in scope declares — air inside the formula (expression-identifiers-resolve)`);
+        }
+    };
+    for (const v of standard.verdicts ?? []) {
+        const expr = v.derive;
+        if (!expr) {
+            continue;
+        }
+        const inputs = v.inputs ?? [];
+        if (v.deriveBound) {
+            resolveInlineCarrier('verdict', v.id, 'derive', expr, new Set(inputs));
+            continue;
+        }
+        // the legacy leg: the ocl{…} wrapper strips before the regex walk
+        const ocl = expr.replace(/^ocl\{/, '').replace(/\}$/, '');
+        for (const id of unresolvedIn(ocl, inputs, [])) {
+            err('C171', `verdict ${v.id}: the derive expression names "${id}", which no input declares — air inside the formula (expression-identifiers-resolve)`);
+        }
+    }
+    for (const t of standard.conformanceTests ?? []) {
+        const scope = (t.variables ?? []).map(v => v.name);
+        for (const v of t.variables ?? []) {
+            if (!v.derivation) {
+                continue;
+            }
+            if (v.derivationBound) {
+                resolveInlineCarrier('conformance test', t.id, `variable ${v.name}'s derivation`, v.derivation, new Set(scope));
+                continue;
+            }
+            const ocl = v.derivation.replace(/^ocl\{/, '').replace(/\}$/, '');
+            for (const id of unresolvedIn(ocl, scope, [])) {
+                err('C171', `conformance test ${t.id}: variable ${v.name}'s derivation names "${id}", which no sibling variable, symbol, datum, or verdict declares — air inside the formula (expression-identifiers-resolve)`);
+            }
+        }
+    }
+    for (const c of standard.constraints ?? []) {
+        if (!c.checkBound || !c.check) {
+            continue;
+        }
+        const cArgs = c.args ?? [];
+        const cScope = new Set(cArgs.map(a => a.name));
+        for (const a of cArgs) {
+            if (a.source.includes(':')) {
+                const segs = a.source.split(':');
+                if (segs.length === 2 && segs[0] !== 'observable') {
+                    const [kind, id] = segs;
+                    if (!DECLARATION_KINDS.has(kind)) {
+                        err('C171', `constraint ${c.id}: argument "${a.name}" binds to "${a.source}" — "${kind}" is not a declaration kind (expression-identifiers-resolve)`);
+                    }
+                    else {
+                        const idRoot = id.split('.')[0];
+                        const idTail = id.split('.').pop() ?? id;
+                        if (!globalExprNames.has(id) &&
+                            !globalExprNames.has(idRoot) &&
+                            !globalExprNames.has(idTail)) {
+                            err('C171', `constraint ${c.id}: argument "${a.name}" binds to "${a.source}", which no declared ${kind} names — air inside the formula (expression-identifiers-resolve)`);
+                        }
+                    }
+                }
+                continue;
+            }
+            if (a.source === 'self' || a.source.startsWith('self.')) {
+                continue;
+            }
+            const bare = a.source.split(':').pop() ?? a.source;
+            if (!globalExprNames.has(a.source) && !globalExprNames.has(bare)) {
+                err('C171', `constraint ${c.id}: argument "${a.name}" binds to "${a.source}", which nothing declares — air inside the formula (expression-identifiers-resolve)`);
+            }
+        }
+        resolveInlineCarrier('constraint', c.id, 'check', c.check, cScope);
+        // C84's inline restatement: the check is one BOOLEAN expression
+        try {
+            const ast = (0, expressions_1.parseExpression)(c.check);
+            const booleanTop = (ast.type === 'binop' &&
+                [
+                    '<=',
+                    '>=',
+                    '<',
+                    '>',
+                    '=',
+                    '!=',
+                    '≠',
+                    'and',
+                    'or',
+                    'xor',
+                    'implies',
+                ].includes(ast.op)) ||
+                (ast.type === 'nav' && ['forAll', 'exists'].includes(ast.op));
+            if (!booleanTop) {
+                err('C84', `constraint ${c.id}: the check does not evaluate to a boolean — an invariant is one comparison or logical composition (constraint-shape)`);
+            }
+        }
+        catch {
+            // already reported by resolveInlineCarrier
+        }
+    }
+    // ── C172 requirement-algebra-resolves ───────────────────────────────
+    // Containment is conjunction: a requirement class's members are its
+    // body, and the class's limit expression (the LAW) names its members —
+    // and/or/xor/implies, the OCL booleans. The law's identifiers resolve
+    // to members only; every member appears in the law or the class
+    // carries no law (pure conjunction); a child's modality is never
+    // weaker than the class's.
+    const memberSet = new Map();
+    for (const rc of standard.requirementClasses ?? []) {
+        memberSet.set(rc.id, new Set((rc.members ?? []).map(String)));
+    }
+    for (const rc of standard.requirementClasses ?? []) {
+        const law = rc.limit?.expression;
+        const members = memberSet.get(rc.id) ?? new Set();
+        if (!law) {
+            continue;
+        }
+        if (rc.limit?.argsBound) {
+            checkInlineLimit('requirement class', rc.id, rc.limit, members);
+            const covered = new Set();
+            try {
+                for (const n of (0, expressions_1.freeIdentifiers)((0, expressions_1.parseExpression)(law)).names) {
+                    covered.add(n);
+                }
+            }
+            catch {
+                // already reported inside checkInlineLimit
+            }
+            for (const a of rc.limit.args ?? []) {
+                covered.add(a.name);
+                covered.add(a.source);
+            }
+            for (const m of members) {
+                if (!covered.has(m)) {
+                    warn('C172', `requirement class ${rc.id}: member ${m} does not appear in the law — either it is always-required (add it with \`and\`) or it is orphaned (requirement-algebra-resolves)`);
+                }
+            }
+            continue;
+        }
+        const ocl = law.replace(/^ocl\{/, '').replace(/\}$/, '');
+        const ids = (ocl.match(/[A-Za-z_][A-Za-z0-9_]*/g) ?? []).filter(x => !OCL_WORDS.has(x));
+        const lawIds = new Set();
+        for (const id of ids) {
+            lawIds.add(id);
+            if (!members.has(id)) {
+                err('C172', `requirement class ${rc.id}: the law names "${id}", which is not a contained member — the algebra composes the containment only (requirement-algebra-resolves)`);
+            }
+        }
+        for (const m of members) {
+            if (!lawIds.has(m)) {
+                warn('C172', `requirement class ${rc.id}: member ${m} does not appear in the law — either it is always-required (add it with \`and\`) or it is orphaned (requirement-algebra-resolves)`);
+            }
+        }
+    }
+    // ── C176 language-declared-wellformed ───────────────────────────────
+    // A declared language generation must be well-formed (v<digit>[.digit])
+    // — the strict-parse contract's key. The unknown-keyword errors come
+    // from the parse itself (the strict mode); this rule only checks the
+    // declaration's shape.
+    // ── C178 legacy-carrier-deprecated ──────────────────────────────────
+    // The deprecation mechanism (register W6): the legacy quoted
+    // expression carriers (`expression "ocl{…}"`, the quoted derive /
+    // derivation / check) warn once a package declares the generation
+    // that deprecates them. The generation constant is INERT until the
+    // owner's release bump — no package declares it today, so nothing
+    // warns; flipping the constant (or packages declaring the newer
+    // generation) activates the ratchet. The inline blocks are the only
+    // forward form.
+    const DEPRECATION_GENERATION = 'v3.4';
+    const generationRank = (g) => {
+        const m = g.match(/^v(\d+)(?:\.(\d+))?$/);
+        if (!m) {
+            return -1;
+        }
+        return Number(m[1]) * 1000 + Number(m[2] ?? '0');
+    };
+    try {
+        const mf = (0, package_1.readPackageManifest)(dir);
+        if (mf.language !== undefined) {
+            if (!/^v\d+(\.\d+)?$/.test(mf.language)) {
+                err('C176', `the declared language "${mf.language}" is not a generation (v<major>[.<minor>]) (language-declared-wellformed)`);
+            }
+            else if (generationRank(mf.language) >= generationRank(DEPRECATION_GENERATION)) {
+                let legacy = 0;
+                for (const r of standard.requirements ?? []) {
+                    if (r.limit && !r.limit.argsBound && r.limit.expression) {
+                        legacy += 1;
+                    }
+                }
+                for (const v of standard.verdicts ?? []) {
+                    if (v.derive &&
+                        !v.deriveBound) {
+                        legacy += 1;
+                    }
+                }
+                for (const t of standard.conformanceTests ?? []) {
+                    for (const v of t.variables ?? []) {
+                        if (v.derivation && !v.derivationBound) {
+                            legacy += 1;
+                        }
+                    }
+                    for (const p of t.preconditions ?? []) {
+                        if (p.check && !p.checkBound) {
+                            legacy += 1;
+                        }
+                    }
+                }
+                for (const c of standard.constraints ?? []) {
+                    if (c.check && !c.checkBound) {
+                        legacy += 1;
+                    }
+                }
+                if (legacy > 0) {
+                    warn('C178', `${legacy} quoted expression carrier${legacy === 1 ? '' : 's'} — the ocl{…} string form is deprecated as of ${DEPRECATION_GENERATION}; migrate to the inline blocks (expression { … }, derive { … }, derivation { … }, check { … }) (legacy-carrier-deprecated)`);
+                }
+            }
+        }
+    }
+    catch {
+        // the manifest unreadable — the load errors own that
+    }
+    // ── C179 uncertainty-budget-resolves ────────────────────────────────
+    // The budget is a declaration, never arithmetic: its target is a
+    // declared verdict (the measured quantity it backs), a Type A
+    // component names a declared test variable that holds a captured
+    // series, a Type B component states its distribution and half-width,
+    // and the coverage factor is a positive number. The propagation law
+    // is the GUM's — the evaluation plane's, never restated here.
+    {
+        const seriesVariables = new Map();
+        for (const t of standard.conformanceTests ?? []) {
+            for (const v of t.variables ?? []) {
+                seriesVariables.set(v.name, v.series !== null);
+            }
+        }
+        for (const b of standard.uncertaintyBudgets ?? []) {
+            if (!b.target) {
+                err('C179', `uncertainty_budget ${b.id}: declares no target — the budget backs a declared verdict's measured quantity (uncertainty-budget-resolves)`);
+            }
+            else if (!(standard.verdicts ?? []).some(v => v.id === b.target)) {
+                err('C179', `uncertainty_budget ${b.id}: target "${b.target}" is not a declared verdict — the budget backs a measured quantity the verdicts own (uncertainty-budget-resolves)`);
+            }
+            if (b.components.length === 0) {
+                warn('C179', `uncertainty_budget ${b.id}: declares no components — an empty budget states no uncertainty (uncertainty-budget-resolves)`);
+            }
+            if (b.coverageK && !(Number(b.coverageK) > 0)) {
+                err('C179', `uncertainty_budget ${b.id}: coverage k "${b.coverageK}" is not a positive number (uncertainty-budget-resolves)`);
+            }
+            for (const c of b.components) {
+                if (c.type === 'A') {
+                    if (!c.series) {
+                        err('C179', `uncertainty_budget ${b.id}: component ${c.id} is Type A but names no series — the statistics compute from a declared captured series (uncertainty-budget-resolves)`);
+                    }
+                    else if (!seriesVariables.has(c.series)) {
+                        err('C179', `uncertainty_budget ${b.id}: component ${c.id}'s series "${c.series}" is not a declared test variable (uncertainty-budget-resolves)`);
+                    }
+                    else if (!seriesVariables.get(c.series)) {
+                        err('C179', `uncertainty_budget ${b.id}: component ${c.id}'s series "${c.series}" declares no series shape — a Type A evaluation needs the captured series' axes and cell (uncertainty-budget-resolves)`);
+                    }
+                }
+                else {
+                    if (!c.distribution) {
+                        err('C179', `uncertainty_budget ${b.id}: component ${c.id} is Type B but states no distribution (uncertainty-budget-resolves)`);
+                    }
+                    if (!c.halfWidth) {
+                        err('C179', `uncertainty_budget ${b.id}: component ${c.id} is Type B but states no half_width — the distribution spans a half-width (uncertainty-budget-resolves)`);
+                    }
+                }
+            }
+        }
+    }
+    // ── C173 step-plane-refs-resolve (register 19) ──────────────────────
+    // A signature step's completion is one expression over the step's own
+    // declared ios: the identifiers resolve to `inputs`/`outputs`, the
+    // calls stay in the closed vocabulary, and nothing in the completion
+    // is air. The calls bindings ride C76's machinery (the typed pass-1
+    // fills the same fields the flow dialect uses).
+    for (const p of standard.processes ?? []) {
+        for (const st of p.steps ?? []) {
+            if (!st.completion) {
+                continue;
+            }
+            const ios = new Set([...st.sigInputs, ...st.sigOutputs]);
+            let ids;
+            try {
+                ids = (0, expressions_1.freeIdentifiers)((0, expressions_1.parseExpression)(st.completion.replace(/^ocl\{/, '').replace(/\}$/, '')));
+            }
+            catch (e) {
+                err('C173', `process ${p.id}: step "${st.id}" completion does not parse — ${String(e.message ?? e)} — the completion is one expression over the step's ios (step-plane-refs-resolve)`);
+                continue;
+            }
+            for (const call of new Set(ids.calls)) {
+                if (!INLINE_FUNCTION_WORDS.has(call)) {
+                    err('C173', `process ${p.id}: step "${st.id}" completion calls "${call}(…)", which is not in the expression function vocabulary (step-plane-refs-resolve)`);
+                }
+            }
+            for (const id of new Set(ids.names)) {
+                const root = id.split('.')[0];
+                if (id.includes('.') && (root === 'self' || CONTEXT_ROOTS.has(root))) {
+                    continue;
+                }
+                if (ios.has(id) || ios.has(root)) {
+                    continue;
+                }
+                err('C173', `process ${p.id}: step "${st.id}" completion names "${id}", which is not a declared io of the step — the completion reads the step's own inputs and outputs (step-plane-refs-resolve)`);
+            }
+        }
+    }
+    // ── C170 edition-lineage-declared ───────────────────────────────────
+    // A package declaring more than one edition carries a declarative
+    // edition mapping (edition-mapping.json, primmel-edition-mapping/1)
+    // naming both edition states — the cross-edition linkage is an
+    // artifact, never implicit. Born-at-edition packages map the prior
+    // edition with model_state: null and the reason.
+    try {
+        const mf = (0, package_1.readPackageManifest)(dir);
+        const eds = (mf.editions ?? []).map(String);
+        if (eds.length > 1) {
+            const map = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(dir, 'edition-mapping.json'), 'utf8'));
+            if (map.kind !== 'primmel-edition-mapping/1') {
+                err('C170', `edition-mapping.json: kind "${String(map.kind)}" is not primmel-edition-mapping/1 (edition-lineage-declared)`);
+            }
+            else {
+                const fromEd = map.from?.edition === undefined
+                    ? undefined
+                    : String(map.from.edition);
+                const toEd = map.to?.edition === undefined ? undefined : String(map.to.edition);
+                for (const [side, ed] of [
+                    ['from', fromEd],
+                    ['to', toEd],
+                ]) {
+                    if (!ed || !eds.includes(ed)) {
+                        err('C170', `edition-mapping.json: the ${side} edition ${String(ed)} is not among the manifest's declared editions [${eds.join(', ')}] (edition-lineage-declared)`);
+                    }
+                }
+            }
+        }
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === 'ENOENT') {
+            const eds = (() => {
+                try {
+                    return ((0, package_1.readPackageManifest)(dir).editions ?? []).map(String);
+                }
+                catch {
+                    return [];
+                }
+            })();
+            if (eds.length > 1) {
+                err('C170', `the package declares ${eds.length} editions [${eds.join(', ')}] but ships no edition-mapping.json — the cross-edition linkage is an artifact, never implicit (edition-lineage-declared)`);
+            }
+        }
+        else if (e instanceof SyntaxError) {
+            err('C170', `edition-mapping.json is not valid JSON: ${e.message} (edition-lineage-declared)`);
+        }
+    }
+    // ── C168 method-ref-resolves ────────────────────────────────────────
+    // A conformance test's method_ref names THE PROCESS the test realizes:
+    // a bare id resolved in this package, or a scoped <package>:<id>
+    // reference resolved read-only through the locator (the target's own
+    // content validates the id; nothing merges — the C31 doctrine). A
+    // bibliographic standard id is not a resolution target: the method is
+    // a process to be realized, not a document to cite. Locator-gated
+    // like C27-C31 — without a locator the scoped leg stays silent.
+    const methodTargetIds = (s) => new Set([
+        ...(s.processes ?? []).map(p => p.id),
+        ...(s.conformanceTests ?? []).map(x => x.id),
+    ]);
+    const localMethodIds = methodTargetIds(standard);
+    const scopedMethodIds = new Map();
+    const resolveCitation = (elemId, ref) => {
+        const colon = ref.indexOf(':');
+        if (colon <= 0) {
+            if (!localMethodIds.has(ref)) {
+                err('C168', `${elemId}: the reference "${ref}" names no process or conformance test declared in this package (method-ref-resolves)`);
+            }
+            return;
+        }
+        if (!options.resolvePackage) {
+            return;
+        }
+        const pkgId = ref.slice(0, colon);
+        const localId = ref.slice(colon + 1);
+        let ids = scopedMethodIds.get(pkgId);
+        if (!ids) {
+            ids = new Set();
+            try {
+                const depDir = options.resolvePackage(pkgId);
+                if (depDir) {
+                    const dep = (0, package_1.loadPackageWithIssues)(depDir);
+                    ids = methodTargetIds(dep.standard);
+                }
+            }
+            catch {
+                // Unreadable dependency — C27 reports the resolution failure;
+                // this rule stays silent rather than double-reporting.
+            }
+            scopedMethodIds.set(pkgId, ids);
+        }
+        if (!ids.has(localId)) {
+            err('C168', `${elemId}: the reference "${ref}" names no process or conformance test declared in package "${pkgId}" (method-ref-resolves)`);
+        }
+    };
+    for (const t of standard.conformanceTests ?? []) {
+        const ref = t.methodRef;
+        if (ref) {
+            resolveCitation(t.id, ref);
+        }
+    }
+    // The process bodies' call edges ride the same resolution: a step's
+    // `calls <p>` (typed or raw-plane) names a process to be realized.
+    for (const pr of standard.processes ?? []) {
+        const raw = pr;
+        for (const st of raw.steps ?? []) {
+            const call = st.calls || st.signatureBlock?.match(/\bcalls +([\w:/.-]+)/)?.[1];
+            if (call) {
+                resolveCitation(`${pr.id}/step/${st.id ?? ''}`, call);
+            }
+        }
+    }
     // C6 — subject anatomy: every aspect declared under exactly one family
     // (anatomy-family). The parser records wrong-family and undeclared
     // aspect keys on Subject.misplacedAspects; value-level markers catch
@@ -1724,7 +2757,7 @@ function checkPackage(dir, options = {}) {
             if (c.stereotype !== 'inv') {
                 err('C84', `constraint ${c.id}: stereotype "${c.stereotype || '(none)'}" — a constraint is always «inv», the subject's declaration-level invariant (constraint-shape)`);
             }
-            if (!OCL_CHECK.test(c.check)) {
+            if (!c.checkBound && !OCL_CHECK.test(c.check)) {
                 err('C84', `constraint ${c.id}: check is not one OCL boolean expression ocl{…} over the subject's declared anatomy (constraint-shape)`);
             }
             if (!c.violationMeaning || c.violationMeaning.trim() === '') {
@@ -6571,6 +7604,124 @@ function checkVerdictChains(standard) {
     }
     return issues;
 }
+/**
+ * C158–C162 + C164 + C167 — the LML-aligned substrate (TODO.lang-gaps;
+ * the spec's validation contract, language-v3 §16). The five constructs
+ * (wireMappings / stringFormats / namespaces / datums / checks) carry
+ * their declared data; the checker does the discipline:
+ *
+ *   C158 prose-quarantine: free text stays in the description block — a
+ *      clause citation inside a datum's description is a reference in
+ *      prose, and the reference belongs in a urn (the deletion test's
+ *      kernel-side proxy: the citation patterns are exactly the prose a
+ *      re-locator would trip over). An unfinished-prose TODO.roadmap
+ *      marker warns.
+ *   C159 urn-only-refs: a wire mapping's namespace names a declared
+ *      namespace block (the serializer emits the prefix/uri pair).
+ *   C160 signature-closure: every name a check consumes (its inputs) is
+ *      a declared datum or symbol — a check over an undeclared input is
+ *      uncomputable.
+ *   C161 check-surface: a datum's render hints name their notation, and
+ *      the notation vocabulary is closed. (The parser silently drops an
+ *      unknown notation token, so parsed models never carry one — this
+ *      leg guards programmatically built Standards and pins the closed
+ *      vocabulary against renderer growth.)
+ *   C162 namespace-coherence: the metadata namespace string names a
+ *      declared namespace block when one is declared at all.
+ *   C164 wire-mapping-coverage: a mapping's format is in the wire
+ *      vocabulary and its class names a declared dataclass when
+ *      dataclasses are declared.
+ *   C167 qualified-unit-reference: a datum's unit and quantity kind use
+ *      the closed qualified `<namespace>:<id>` form (si:…, unitsdb:…) —
+ *      a bare unit token is exactly the ambiguity the registries exist
+ *      to close.
+ *
+ * C163 change-levels runs over `primmel diff --exit-code` (the existing
+ * diff classifier — model-diff.ts); C165/C166 await the calculation
+ * math plane. All three are catalog-only entries (check-rules.ts) with
+ * no kernel leg here — deliberately, not by omission.
+ */
+function checkLmlAligned(standard) {
+    const issues = [];
+    const err = (check, message) => issues.push({ check, severity: 'error', message });
+    const warn = (check, message) => issues.push({ check, severity: 'warning', message });
+    const namespaceIds = new Set((standard.namespaces ?? []).map(n => n.id));
+    // The mapping targets the LML class name as authored (`mapping xml
+    // Ceramic`); a registerable class declares `Ceramic#data`, so the
+    // target matches the id or the id with its `#data` register suffix
+    // stripped (spec §Serialization's authored shape).
+    const dataclassIds = new Set();
+    for (const c of standard.dataclasses ?? []) {
+        dataclassIds.add(c.id);
+        dataclassIds.add(c.id.replace(/#data$/, ''));
+    }
+    const symbolIds = new Set((standard.symbols ?? []).map(s => s.id));
+    const datumIds = new Set((standard.datums ?? []).map(d => d.id));
+    // ── C158 prose-quarantine ──────────────────────────────────────────
+    // A datum with a label and an empty description is the FINE form; the
+    // quarantine breaks only when the description smuggles a citation.
+    const CLAUSE_CITATION = /clause-\d|§\d/i;
+    for (const d of standard.datums ?? []) {
+        if (!d.description) {
+            continue;
+        }
+        if (CLAUSE_CITATION.test(d.description)) {
+            err('C158', `datum ${d.id}: the description cites a clause — a reference in prose belongs in a urn reference, not the quarantined free text (prose-quarantine)`);
+        }
+        else if (d.description.includes('TODO.roadmap')) {
+            warn('C158', `datum ${d.id}: the description carries the unfinished-prose marker TODO.roadmap (prose-quarantine)`);
+        }
+    }
+    // ── C159 urn-only-refs ─────────────────────────────────────────────
+    for (const w of standard.wireMappings ?? []) {
+        if (w.namespaceRef && !namespaceIds.has(w.namespaceRef)) {
+            err('C159', `mapping ${w.id}: namespace "${w.namespaceRef}" names no declared namespace block (urn-only-refs)`);
+        }
+    }
+    // ── C160 signature-closure ─────────────────────────────────────────
+    for (const c of standard.checks ?? []) {
+        for (const inp of c.inputs ?? []) {
+            if (!(datumIds.has(inp) || symbolIds.has(inp))) {
+                err('C160', `check ${c.id}: input "${inp}" resolves to no declared datum or symbol — the check consumes an undeclared name (signature-closure)`);
+            }
+        }
+    }
+    // ── C161 check-surface ─────────────────────────────────────────────
+    for (const d of standard.datums ?? []) {
+        for (const r of d.renders ?? []) {
+            if (!lmlAligned_1.MATH_NOTATIONS.includes(r.notation)) {
+                err('C161', `datum ${d.id}: render notation "${r.notation}" is outside the closed vocabulary (${lmlAligned_1.MATH_NOTATIONS.join('|')}) (check-surface)`);
+            }
+        }
+    }
+    // ── C162 namespace-coherence ───────────────────────────────────────
+    const metaNamespace = standard.meta?.namespace ?? '';
+    if (metaNamespace &&
+        namespaceIds.size > 0 &&
+        !namespaceIds.has(metaNamespace)) {
+        err('C162', `metadata namespace "${metaNamespace}" names no declared namespace block (namespace-coherence)`);
+    }
+    // ── C164 wire-mapping-coverage ─────────────────────────────────────
+    for (const w of standard.wireMappings ?? []) {
+        if (!lmlAligned_1.MAPPING_FORMATS.includes(w.format)) {
+            err('C164', `mapping ${w.id}: format "${w.format}" is outside the wire vocabulary (${lmlAligned_1.MAPPING_FORMATS.join('|')}) (wire-mapping-coverage)`);
+        }
+        if (dataclassIds.size > 0 && !dataclassIds.has(w.target)) {
+            err('C164', `mapping ${w.id}: the class "${w.target}" is no declared dataclass — a class serialized to a format carries the declared mapping (wire-mapping-coverage)`);
+        }
+    }
+    // ── C167 qualified-unit-reference ──────────────────────────────────
+    const QUALIFIED_REF = /^[a-z]+:[A-Za-z0-9_-]+$/;
+    for (const d of standard.datums ?? []) {
+        if (d.unit && !QUALIFIED_REF.test(d.unit)) {
+            err('C167', `datum ${d.id}: unit "${d.unit}" is bare — a unit reference uses the qualified <namespace>:<id> form (si:…, unitsdb:…) (qualified-unit-reference)`);
+        }
+        if (d.quantityKind && !QUALIFIED_REF.test(d.quantityKind)) {
+            err('C167', `datum ${d.id}: quantity_kind "${d.quantityKind}" is bare — a quantity-kind reference uses the qualified <namespace>:<id> form (si:…, unitsdb:…) (qualified-unit-reference)`);
+        }
+    }
+    return issues;
+}
 /**
  * C77–C80 + C85 + C113 — edition lifecycle (TODO.roadmap/28; doctrine ch. 13
  * §13.4/§13.7) and the manifest base URN (TODO.roadmap/27). Editions are