@primmel/primmel 1.8.2 → 1.9.1

package/dist/src/check.js

@@ -291,6 +291,18 @@
 //      its initial state (the spec marks it required; the serializer
 //      omits the line rather than emitting the dangling keyword — the
 //      editor wave-03 finding, primmel/editor#19)
+//   C110 term-alias-shape (MN 114 v3.2 clause 13.10.1, TODO.primmel/11):
+//      the term alias family's shape — duplicates within one list
+//      (errors), the same string in two family fields of one term and
+//      label echoes (rollout warning legs; the cross-field leg tightens
+//      to the spec's error when 11d re-authors the estate's terms)
+//   C111 dimension-shape (MN 114 v3.2 clause 10.6, TODO.primmel/11):
+//      the applicability dimension namespace's declarations — unique
+//      value ids, implies resolving and acyclic, values vs values_of,
+//      one identifier once per namespace; and C3's resolution widens to
+//      the full namespace (clause 11.1.1: instrument dimensions +
+//      is_dimension attribute mirrors + the top-level declarations,
+//      values_of capabilities resolving from the capability register)
 //
 // Levels (TODO.roadmap/17): the DEFAULT level runs the normal-level
 // rules at their catalog severities. --audit additionally runs the
@@ -319,6 +331,10 @@ exports.checkPackage = checkPackage;
 exports.checkManifestResolution = checkManifestResolution;
 exports.checkSpellingCodes = checkSpellingCodes;
 exports.checkDeclaredPredicates = checkDeclaredPredicates;
+exports.checkTermAliases = checkTermAliases;
+exports.checkDimensions = checkDimensions;
+exports.checkReferences = checkReferences;
+exports.checkVerdictChains = checkVerdictChains;
 exports.checkEditionLifecycle = checkEditionLifecycle;
 const fs_1 = require("fs");
 const path_1 = require("path");
@@ -429,17 +445,27 @@ function checkPackage(dir, options = {}) {
             issues.push(...checkManifestResolution(dir));
         }
     }
-    // ── C77–C80: edition lifecycle (TODO.roadmap/28, doctrine §13.4/§13.7) ──
+    // ── C77–C80 + C113: edition lifecycle (TODO.roadmap/28, doctrine §13.4/§13.7;
+    // v3.2 clause 9.3.1) ──
     // Versioning relations live on the package manifest, never in subject
     // models: status/register coherence (C77), validity windows (C78),
-    // supersedes/replaces resolution + acyclicity across sibling manifests
-    // (C79), and the INV-8 pin — every instance's definition_versions
+    // supersedes/replaces/superseded_by resolution + acyclicity across
+    // sibling manifests (C79) and the forward-edge coherence (C113), and the
+    // INV-8 pin — every instance's definition_versions
     // resolves against the package's edition register (C80).
     issues.push(...checkEditionLifecycle(dir, standard));
     // ── C89: ISO 24229 spelling codes (TODO.roadmap/25, doctrine ch. 10) ──
     issues.push(...checkSpellingCodes(standard));
     // ── C103: declared-predicate (docs/primmel/18 §18.6) ───────────────
     issues.push(...checkDeclaredPredicates(standard));
+    // ── C110: term-alias-shape (MN 114 v3.2, clause 13.10.1) ───────────
+    issues.push(...checkTermAliases(standard));
+    // ── C111: dimension-shape (MN 114 v3.2, clause 10.6) ───────────────
+    issues.push(...checkDimensions(standard));
+    // ── C112: reference-identity (MN 114 v3.2, clause 14.7) ────────────
+    issues.push(...checkReferences(standard));
+    // ── C116/C117: the verdict chain (MN 114 v3.2, clause 11.3) ────────
+    issues.push(...checkVerdictChains(standard));
     const reqIds = new Set((standard.requirements ?? []).map((r) => r.id));
     const testIds = new Set((standard.conformanceTests ?? []).map((t) => t.id));
     const attrIds = new Set((standard.attributeDefinitions ?? []).map((a) => a.id));
@@ -449,8 +475,19 @@ function checkPackage(dir, options = {}) {
     // binds_to / limit.uses may reference them (e.g. sample.test_context
     // quantities that are measured test outputs).
     const symbolIds = new Set((standard.symbols ?? []).map((s) => s.id));
+    // The applicability dimension namespace (MN 114 v3.2, clause 11.1.1):
+    // the union of the instruments' classification dimensions, the
+    // attribute definitions declared is_dimension true (the bound enum or
+    // the inline enum_values supply the domain), and the top-level
+    // `dimension` declarations (clause 10.6; `values_of capabilities`
+    // resolves its domain from the merged capability register). A null
+    // domain means the axis is declared but its value set is open here
+    // (an undocumented values_of register — C111 warns there).
     const dimIds = new Map();
     const dimCardinality = new Map();
+    // Attribute-mirror dimensions carry no cardinality facet — the
+    // match-mode warning (C3) only fires on a KNOWN single cardinality.
+    const dimCardinalityOpen = new Set();
     for (const inst of standard.instruments ?? []) {
         for (const d of inst.dimensions ?? []) {
             dimIds.set(d.id, new Set(d.values.map(v => v.id)));
@@ -459,6 +496,35 @@ function checkPackage(dir, options = {}) {
             }
         }
     }
+    for (const a of standard.attributeDefinitions ?? []) {
+        if (a.isDimension !== true || dimIds.has(a.id)) {
+            continue;
+        }
+        const enumDef = (standard.enums ?? []).find(e => e.id === a.enumRef);
+        const domain = enumDef
+            ? new Set(enumDef.values.map(v => v.id))
+            : a.enumValues && a.enumValues.length > 0
+                ? new Set(a.enumValues)
+                : null;
+        dimIds.set(a.id, domain);
+        dimCardinalityOpen.add(a.id);
+    }
+    for (const d of standard.dimensions ?? []) {
+        if (dimIds.has(d.id)) {
+            continue; // the duplicate declaration is C111's finding
+        }
+        if (d.valuesOf) {
+            dimIds.set(d.id, d.valuesOf === 'capabilities'
+                ? new Set((standard.capabilities ?? []).map(c => c.id))
+                : null);
+        }
+        else {
+            dimIds.set(d.id, new Set(d.values.map(v => v.id)));
+        }
+        if (d.cardinality) {
+            dimCardinality.set(d.id, d.cardinality);
+        }
+    }
     // C1 — bind path scope vs attribute scope
     for (const form of standard.forms ?? []) {
         const checkField = (f) => {
@@ -577,7 +643,8 @@ function checkPackage(dir, options = {}) {
             if (!dimIds.has(dim)) {
                 err('C3', `conformance test ${t.id}: test_subject dimension "${dim}" not declared`);
             }
-            else if (!dimIds.get(dim).has(String(value))) {
+            else if (dimIds.get(dim) !== null &&
+                !dimIds.get(dim).has(String(value))) {
                 err('C3', `conformance test ${t.id}: test_subject ${dim}="${value}" not in the dimension's values`);
             }
         }
@@ -591,19 +658,30 @@ function checkPackage(dir, options = {}) {
                 err('C3', `requirement ${r.id}: applicability dimension "${a.dimension}" not declared`);
             }
             else {
+                const domain = dimIds.get(a.dimension) ?? null;
                 for (const v of a.values ?? []) {
-                    if (!dimIds.get(a.dimension).has(v)) {
+                    if (domain !== null && !domain.has(v)) {
                         err('C3', `requirement ${r.id}: applicability ${a.dimension}="${v}" not in the dimension's values`);
                     }
                 }
+                // The parameter-mapping form ({ A: 5, C: 3 }): the map's keys
+                // are listed values of the dimension (clause 11.1.1).
+                for (const k of Object.keys(a.mapping ?? {})) {
+                    if (domain !== null && !domain.has(k)) {
+                        err('C3', `requirement ${r.id}: applicability ${a.dimension} mapping key "${k}" not in the dimension's values`);
+                    }
+                }
                 // Universal/exact matching is the set-dimension semantics — on a
                 // single-cardinality dimension the selection holds at most one
                 // value, so `match all` and `match exact` both reduce to plain
                 // membership (equivalent to the default any). Flag the redundant
                 // mode so the data author either sets the dimension's cardinality
-                // or drops the mode.
+                // or drops the mode. An attribute-mirror dimension carries no
+                // cardinality facet: the warning only fires on a KNOWN single
+                // cardinality (clause 11.1.1).
                 if ((a.match === 'all' || a.match === 'exact') &&
-                    dimCardinality.get(a.dimension) !== 'set') {
+                    dimCardinality.get(a.dimension) !== 'set' &&
+                    !dimCardinalityOpen.has(a.dimension)) {
                     warn('C3', `requirement ${r.id}: applicability ${a.dimension} match ${a.match} on a single-cardinality dimension — only meaningful on set dimensions ('all' reduces to 'any'; a multi-value 'exact' is unsatisfiable on one value)`);
                 }
             }
@@ -2761,6 +2839,130 @@ function checkPackage(dir, options = {}) {
             err('C33', `${u.kind} ${u.id}: declared quantity_kind "${u.qk}" but unit "${u.unit}" measures kind ${uKind} — quantity kinds differ (quantity-coherence)`);
         }
     }
+    // ── C114/C115: the v3.2 units-typed quantities (MN 114 v3.2, clauses
+    // 11.1.2 and 13.7.1; TODO.primmel/11) ──
+    // C114 — limit-quantity-coherence: a limit that declares its derived
+    // quantity's typing AND binds a verdict must agree with the verdict's
+    // declared quantity, so a limit and its acceptance chain can never
+    // drift apart in units. Silent when either side leaves the facet
+    // undeclared (the block is the migration path); an unresolvable
+    // accepts.verdict is the resolution rule's leg, not this one's.
+    for (const r of standard.requirements ?? []) {
+        const q = r.limit?.quantity;
+        const accepts = r.limit?.accepts;
+        if (!q || !accepts) {
+            continue;
+        }
+        const verdict = (standard.verdicts ?? []).find(v => v.id === accepts.verdict);
+        if (!verdict) {
+            continue;
+        }
+        if (q.kind && verdict.quantityKind && q.kind !== verdict.quantityKind) {
+            err('C114', `requirement ${r.id}: limit declares quantity kind "${q.kind}" but accepts verdict ${verdict.id} derives kind "${verdict.quantityKind}" — a limit and its acceptance chain never drift apart in units (limit-quantity-coherence)`);
+        }
+        if (q.unit && verdict.unit && q.unit !== verdict.unit) {
+            err('C114', `requirement ${r.id}: limit declares quantity unit "${q.unit}" but accepts verdict ${verdict.id} derives unit "${verdict.unit}" (limit-quantity-coherence)`);
+        }
+    }
+    for (const c of standard.calculations ?? []) {
+        const entries = [
+            ...(c.inputs ?? []).map(inp => ({
+                owner: `calculation ${c.id}: input ${inp.name}`,
+                type: inp.type,
+                unit: inp.unit,
+                isInput: true,
+                quantityKind: inp.quantityKind,
+                rangeMin: inp.rangeMin,
+                rangeMax: inp.rangeMax,
+                hasRange: inp.hasRange,
+                enumValues: inp.enumValues,
+            })),
+            {
+                owner: `calculation ${c.id}: output`,
+                type: c.output.type,
+                unit: c.output.unit,
+                isInput: false,
+                quantityKind: c.output.quantityKind,
+                rangeMin: c.output.rangeMin,
+                rangeMax: c.output.rangeMax,
+                hasRange: c.output.hasRange,
+            },
+        ];
+        for (const e of entries) {
+            const declaredUnit = e.unit && e.unit !== '1' ? e.unit : '';
+            const unitKind = declaredUnit ? kindOfUnit(declaredUnit) : undefined;
+            if (declaredUnit && registersExist && unitKind === undefined) {
+                // Rollout warning leg (see the rule's catalog entry): the spec's
+                // error tightens when the estate's registers catch up.
+                warn('C115', `${e.owner}: unit "${declaredUnit}" resolves to no registered unit of the merged quantity register (calculation-signature-shape)`);
+            }
+            if (e.quantityKind) {
+                if (!kindDecl.has(e.quantityKind)) {
+                    err('C115', `${e.owner}: quantity_kind "${e.quantityKind}" resolves to no registered kind of the merged quantity register (calculation-signature-shape)`);
+                }
+                else if (unitKind !== undefined && unitKind !== e.quantityKind) {
+                    err('C115', `${e.owner}: declared quantity_kind "${e.quantityKind}" but unit "${declaredUnit}" measures kind ${unitKind} — the typed-unit pair must agree in kind (calculation-signature-shape)`);
+                }
+            }
+            if (e.hasRange && e.rangeMin && e.rangeMax) {
+                const lo = Number(e.rangeMin);
+                const hi = Number(e.rangeMax);
+                if (!Number.isNaN(lo) && !Number.isNaN(hi) && lo > hi) {
+                    err('C115', `${e.owner}: range min ${e.rangeMin} exceeds max ${e.rangeMax} (calculation-signature-shape)`);
+                }
+            }
+            if (e.isInput &&
+                e.type === 'enum' &&
+                (e.enumValues === undefined || e.enumValues.length === 0)) {
+                err('C115', `${e.owner}: an enum-typed input declares its values — enum_values is absent or empty (calculation-signature-shape)`);
+            }
+        }
+    }
+    // ── C118: requirement-parameter-shape (MN 114 v3.2, clause 11.1.3) ──
+    // The instance-parameter schema is the binding contract an execution
+    // environment reads: a parameter's bind path resolves against the
+    // subject's aspect catalog (the binds_to path discipline of C2), its
+    // unit resolves against the merged quantity register (the rollout
+    // WARNING leg — the C33 §6.8 precedent, shared with C115), and a
+    // range's min never exceeds its max.
+    for (const r of standard.requirements ?? []) {
+        for (const p of r.parameters ?? []) {
+            const where = `requirement ${r.id}: param ${p.name}`;
+            if (p.bind) {
+                const parts = String(p.bind).split('.');
+                const id = parts[2];
+                if (id) {
+                    if (parts[1] === 'classification') {
+                        const dim = DIM_ALIASES[id] ?? id;
+                        if (!dimIds.has(dim) && !attrIds.has(id) && !attrIds.has(dim)) {
+                            err('C118', `${where}: bind "${p.bind}" — dimension "${id}" not declared (requirement-parameter-shape)`);
+                        }
+                    }
+                    else if (parts[1] === 'behaviors') {
+                        if (!behaviorIds.has(id)) {
+                            err('C118', `${where}: bind "${p.bind}" — behavior "${id}" not declared (requirement-parameter-shape)`);
+                        }
+                    }
+                    else if (!isIdentityPath(String(p.bind)) &&
+                        !attrIds.has(id) &&
+                        !symbolIds.has(id)) {
+                        err('C118', `${where}: bind "${p.bind}" — attribute "${id}" not defined (requirement-parameter-shape)`);
+                    }
+                }
+            }
+            if (p.unit && registersExist && kindOfUnit(p.unit) === undefined) {
+                // Rollout warning leg (see the rule's catalog entry).
+                warn('C118', `${where}: unit "${p.unit}" resolves to no registered unit of the merged quantity register (requirement-parameter-shape)`);
+            }
+            if (p.hasRange && p.rangeMin && p.rangeMax) {
+                const lo = Number(p.rangeMin);
+                const hi = Number(p.rangeMax);
+                if (!Number.isNaN(lo) && !Number.isNaN(hi) && lo > hi) {
+                    err('C118', `${where}: range min ${p.rangeMin} exceeds max ${p.rangeMax} (requirement-parameter-shape)`);
+                }
+            }
+        }
+    }
     // C34 — duality-coherence: one value structure, two roles.
     for (const d of standard.duals ?? []) {
         if (d.attribute && !attrIds.has(d.attribute)) {
@@ -4272,7 +4474,266 @@ function checkDeclaredPredicates(standard) {
     return issues;
 }
 /**
- * C77–C80 + C85 — edition lifecycle (TODO.roadmap/28; doctrine ch. 13
+ * C110 — term-alias-shape (MN 114 v3.2, clause 13.10.1;
+ * TODO.primmel/11): the term alias family is the everyday-words →
+ * defined-term bridge, so its shape is checked. Duplicate entries within
+ * one list of one term are errors; an entry that merely echoes the
+ * term's label is a warning (it adds no bridge). The same string in two
+ * different family fields of one term — the spec's "one entry has one
+ * home" error — ships as a WARNING leg during the v3.2 rollout: v2
+ * content authored `alt` under the old admitted-forms semantics, where
+ * an entry doubling as the term's abbreviation was legal, and the
+ * shipped corpus carries exactly that debt (`alt { LC }` +
+ * `abbreviations { LC }` on R 60's load-cell and mpe terms); the leg
+ * tightens to the spec's error once the consumer wave re-authors the
+ * family (TODO.primmel/11d). Each spelling-tagged variant list is its
+ * own scope: the same string in two spellings is the variant mechanism
+ * working, never a duplicate.
+ */
+function checkTermAliases(standard) {
+    const issues = [];
+    const err = (message) => issues.push({ check: 'C110', severity: 'error', message });
+    const warn = (message) => issues.push({ check: 'C110', severity: 'warning', message });
+    const FACETS = ['aliases', 'colloquial', 'abbreviations', 'deprecated'];
+    for (const t of standard.terms ?? []) {
+        // The family scopes of the term: the default-spelling lists plus one
+        // scope per spelling-tagged variant.
+        const scopes = [
+            [
+                '',
+                {
+                    aliases: t.aliases ?? t.alt,
+                    colloquial: t.colloquial,
+                    abbreviations: t.abbreviations,
+                    deprecated: t.deprecated,
+                },
+            ],
+            ...Object.entries(t.aliasSpellings ?? {}).map(([code, v]) => [
+                ` ${code}`,
+                { ...v },
+            ]),
+        ];
+        for (const [tag, scope] of scopes) {
+            const where = (facet) => `term ${t.id}: ${facet}${tag ? ` ${tag}` : ''}`;
+            for (const facet of FACETS) {
+                const seen = new Set();
+                for (const entry of scope[facet] ?? []) {
+                    if (seen.has(entry)) {
+                        err(`${where(facet)}: duplicate entry "${entry}" — one entry has one home (term-alias-shape)`);
+                    }
+                    seen.add(entry);
+                }
+            }
+            const home = new Map();
+            for (const facet of FACETS) {
+                for (const entry of scope[facet] ?? []) {
+                    const prior = home.get(entry);
+                    if (prior !== undefined && prior !== facet) {
+                        // Rollout warning leg (see the rule's doc comment): the
+                        // spec's error tightens when the estate re-authors.
+                        warn(`${where(facet)}: "${entry}" already appears in ${prior} — one entry has one home (term-alias-shape)`);
+                    }
+                    else {
+                        home.set(entry, facet);
+                    }
+                }
+            }
+        }
+        // The label echo: any entry that restates the term's own label
+        // bridges nothing (checked across every scope).
+        if (t.label) {
+            for (const [tag, scope] of scopes) {
+                for (const facet of FACETS) {
+                    if ((scope[facet] ?? []).includes(t.label)) {
+                        warn(`term ${t.id}: ${facet}${tag ? ` ${tag}` : ''} entry "${t.label}" merely echoes the term's label — an alias adds a bridge or it does not belong (term-alias-shape)`);
+                    }
+                }
+            }
+        }
+    }
+    return issues;
+}
+/**
+ * C111 — dimension-shape (MN 114 v3.2, clause 10.6; TODO.primmel/11):
+ * the applicability dimension namespace is typed and shared, so its
+ * declarations are checked. Per dimension (the instruments' inline
+ * blocks AND the top-level declarations — one grammar, two placements):
+ * value identifiers are unique, every `implies` target resolves inside
+ * its own dimension, and the implication graph is acyclic (the
+ * applicability engine walks the closure). A top-level dimension carries
+ * `values` or `values_of`, never both; a `values_of` naming a register
+ * the kernel does not know (the documented register is `capabilities`)
+ * warns — the domain stays open, C3's value resolution skips it.
+ * Namespace uniqueness: a top-level declaration colliding with an
+ * instrument's inline dimension or an is_dimension attribute, or two
+ * instruments declaring the same dimension id in the merged package, is
+ * an error. The one tolerated overlap is the estate's mirror pattern: an
+ * attribute definition declared `is_dimension true` and an instrument's
+ * inline dimension carrying the SAME id are one axis declared at two
+ * layers (the attribute carries the typed aspect and the enum domain,
+ * the inline block the presentation) — R 144's power_supply axis is the
+ * shipped precedent.
+ */
+function checkDimensions(standard) {
+    const issues = [];
+    const err = (message) => issues.push({ check: 'C111', severity: 'error', message });
+    const warn = (message) => issues.push({ check: 'C111', severity: 'warning', message });
+    const checkShape = (owner, d) => {
+        const seen = new Set();
+        for (const v of d.values) {
+            if (seen.has(v.id)) {
+                err(`${owner} dimension ${d.id}: duplicate value id "${v.id}" (dimension-shape)`);
+            }
+            seen.add(v.id);
+        }
+        const valueIds = new Set(d.values.map(v => v.id));
+        const adj = new Map();
+        for (const v of d.values) {
+            for (const target of v.implies ?? []) {
+                if (!valueIds.has(target)) {
+                    err(`${owner} dimension ${d.id}: value ${v.id} implies "${target}", which is not a value of this dimension — implies targets resolve inside their own dimension (dimension-shape)`);
+                }
+            }
+            adj.set(v.id, (v.implies ?? []).filter(t => valueIds.has(t)));
+        }
+        const cycle = findCycle(adj);
+        if (cycle) {
+            err(`${owner} dimension ${d.id}: implies cycle ${cycle.join(' → ')} — the applicability engine walks the implication closure, so the graph must be acyclic (dimension-shape)`);
+        }
+        if (d.valuesOf && d.values.length > 0) {
+            err(`${owner} dimension ${d.id}: declares both values and values_of — a dimension carries one value domain (dimension-shape)`);
+        }
+        if (d.valuesOf && d.valuesOf !== 'capabilities') {
+            warn(`${owner} dimension ${d.id}: values_of "${d.valuesOf}" names a register the kernel does not document (the documented register is capabilities) — the value domain stays open (dimension-shape)`);
+        }
+    };
+    for (const inst of standard.instruments ?? []) {
+        for (const d of inst.dimensions ?? []) {
+            checkShape(`instrument ${inst.id}:`, d);
+        }
+    }
+    for (const d of standard.dimensions ?? []) {
+        checkShape('top-level', d);
+    }
+    // Namespace uniqueness. The inline-vs-attribute mirror is tolerated
+    // (see the rule's doc comment); every other double declaration is an
+    // error.
+    const inlineHome = new Map(); // dim id → instrument id
+    for (const inst of standard.instruments ?? []) {
+        for (const d of inst.dimensions ?? []) {
+            const prior = inlineHome.get(d.id);
+            if (prior !== undefined && prior !== inst.id) {
+                err(`dimension ${d.id}: declared inline on both instrument ${prior} and instrument ${inst.id} — one dimension identifier once per applicability namespace (dimension-shape)`);
+            }
+            else {
+                inlineHome.set(d.id, inst.id);
+            }
+        }
+    }
+    const attrDims = new Set((standard.attributeDefinitions ?? [])
+        .filter(a => a.isDimension === true)
+        .map(a => a.id));
+    for (const d of standard.dimensions ?? []) {
+        if (inlineHome.has(d.id)) {
+            err(`dimension ${d.id}: declared both top-level and inline on instrument ${inlineHome.get(d.id)} — one dimension identifier once per applicability namespace (dimension-shape)`);
+        }
+        if (attrDims.has(d.id)) {
+            err(`dimension ${d.id}: declared both top-level and as the is_dimension attribute definition of the same id — one dimension identifier once per applicability namespace (dimension-shape)`);
+        }
+    }
+    return issues;
+}
+/**
+ * C112 — reference-identity (MN 114 v3.2, clause 14.7; TODO.primmel/11):
+ * the reference construct is the registry of named citation targets, and
+ * v3.2 grows its facet set from display strings to a resolvable identity.
+ * A malformed `urn` is an error — the same well-formedness class as C85's
+ * baseUrn check (a scheme, then no whitespace or IRI delimiters). When
+ * `urn` is present it IS the document's identity; when it is absent the
+ * org/document/edition/clause quadruple is what a consumer's locator
+ * resolves, so a reference carrying neither `urn` nor the
+ * org-and-document pair is a warning — a display-string citation is
+ * visible debt, never silently citable.
+ */
+function checkReferences(standard) {
+    const issues = [];
+    for (const r of standard.references ?? []) {
+        if (r.urn !== undefined) {
+            if (!/^[A-Za-z][A-Za-z0-9+.-]*:[^\s<>"{}|^`\\]*$/.test(r.urn)) {
+                issues.push({
+                    check: 'C112',
+                    severity: 'error',
+                    message: `reference ${r.id}: urn "${r.urn}" is not a well-formed IRI (a scheme followed by no whitespace or IRI delimiters) (reference-identity)`,
+                });
+            }
+        }
+        else if (!(r.org && r.document)) {
+            issues.push({
+                check: 'C112',
+                severity: 'warning',
+                message: `reference ${r.id}: carries neither urn nor the org-and-document pair — a display-string citation is not machine-traversable (reference-identity)`,
+            });
+        }
+    }
+    return issues;
+}
+/**
+ * C116/C117 — the verdict chain (MN 114 v3.2, clause 11.3;
+ * TODO.primmel/11): a verdict's `inputs` name the free identifiers of
+ * its derivation, and an input may name another VERDICT — the
+ * acceptance chain is then an explicit graph: requirement →
+ * limit.accepts.verdict → the verdict's inputs (symbols and
+ * sub-verdicts) → each verdict's acceptance.
+ *   C116 verdict-inputs-resolve: every input resolves to a declared
+ *      symbol, a test variable or observable, or another verdict.
+ *   C117 verdict-chain-acyclic: the verdict→verdict graph never cycles
+ *      (a consumption system traverses the chain; a cycle never
+ *      terminates).
+ */
+function checkVerdictChains(standard) {
+    const issues = [];
+    const symbolIds = new Set((standard.symbols ?? []).map(s => s.id));
+    const testNames = new Set();
+    for (const t of standard.conformanceTests ?? []) {
+        for (const v of t.variables ?? []) {
+            testNames.add(v.name);
+        }
+        for (const o of t.observables ?? []) {
+            testNames.add(o.name);
+        }
+    }
+    const verdictIds = new Set((standard.verdicts ?? []).map(v => v.id));
+    // C116 — every input resolves.
+    for (const v of standard.verdicts ?? []) {
+        for (const inp of v.inputs ?? []) {
+            if (!symbolIds.has(inp) && !testNames.has(inp) && !verdictIds.has(inp)) {
+                issues.push({
+                    check: 'C116',
+                    severity: 'error',
+                    message: `verdict ${v.id}: input "${inp}" resolves to no declared symbol, test variable or observable, or verdict (verdict-inputs-resolve)`,
+                });
+            }
+        }
+    }
+    // C117 — the verdict→verdict subgraph never cycles. Self-derivation
+    // stays in the adjacency: a verdict deriving from itself is the
+    // length-1 cycle this rule exists for.
+    const adj = new Map();
+    for (const v of standard.verdicts ?? []) {
+        adj.set(v.id, (v.inputs ?? []).filter(i => verdictIds.has(i)));
+    }
+    const cycle = findCycle(adj);
+    if (cycle) {
+        issues.push({
+            check: 'C117',
+            severity: 'error',
+            message: `verdict chain cycle: ${cycle.join(' → ')} — the acceptance chain is a graph a consumer traverses, so it must be acyclic (verdict-chain-acyclic)`,
+        });
+    }
+    return issues;
+}
+/**
+ * C77–C80 + C85 + C113 — edition lifecycle (TODO.roadmap/28; doctrine ch. 13
  * §13.4/§13.7) and the manifest base URN (TODO.roadmap/27). Editions are
  * packagings: the relations live on the manifest, and the checks run
  * WITHOUT composing content (the checkManifestResolution sibling
@@ -4284,7 +4745,8 @@ function checkDeclaredPredicates(standard) {
  *      parser, like `kind` — an unknown token is a parse error.)
  *   C78 edition-validity-window: the window is well-formed ISO 8601 and
  *      `to` is not before `from`.
- *   C79 edition-supersedes-resolves: supersedes/replaces targets are
+ *   C79 edition-supersedes-resolves: supersedes/replaces/superseded_by
+ *      targets are
  *      well-formed URNs, never the package itself; a target naming an
  *      earlier edition OF THE SAME document resolves against the edition
  *      register (warning when the register omits it); the supersedes
@@ -4298,6 +4760,10 @@ function checkDeclaredPredicates(standard) {
  *      grounds every downstream IRI (the RDF projection, provenance
  *      comparisons), and the free-string field was the one manifest
  *      IRI surface nothing validated.
+ *   C113 edition-lineage-coherent (v3.2, clause 9.3.1): the forward
+ *      `superseded_by` edge, where declared, must agree with the
+ *      successor's backward edges across the composed closure; a missing
+ *      forward edge is never an error.
  */
 function checkEditionLifecycle(dir, standard) {
     const issues = [];
@@ -4353,12 +4819,15 @@ function checkEditionLifecycle(dir, standard) {
         !/^[A-Za-z][A-Za-z0-9+.-]*:[^\s<>"{}|^`\\]*$/.test(m.baseUrn)) {
         err('C85', `package "${m.id}": baseUrn "${m.baseUrn}" is not a well-formed IRI (a scheme followed by no whitespace or IRI delimiters) (baseurn-wellformed)`);
     }
-    // C79 — supersedes/replaces: well-formed URNs, never self, resolving
-    // against the register (same-document targets) and acyclic across the
-    // repo's manifests (§13.7).
+    // C79 — supersedes/replaces/superseded_by: well-formed URNs, never self,
+    // resolving against the register (same-document targets) and acyclic
+    // across the repo's manifests (§13.7). The v3.2 forward edge
+    // (superseded_by, clause 9.3.1) takes the same shape checks; coherence of
+    // the two directions is C113 below.
     const relations = [
         ...(m.supersedes ?? []).map(t => ['supersedes', t]),
         ...(m.replaces ?? []).map(t => ['replaces', t]),
+        ...(m.supersededBy ?? []).map(t => ['superseded_by', t]),
     ];
     const ownBasis = (0, model_diff_1.normalizeSourceRef)(m.baseUrn ?? '', '').basis;
     for (const [rel, target] of relations) {
@@ -4371,7 +4840,7 @@ function checkEditionLifecycle(dir, standard) {
             continue;
         }
         const tNorm = (0, model_diff_1.normalizeSourceRef)(target, '');
-        if (tNorm.basis === ownBasis && tNorm.edition) {
+        if (rel !== 'superseded_by' && tNorm.basis === ownBasis && tNorm.edition) {
             if (!register.has(tNorm.edition)) {
                 warn('C79', `package "${m.id}": ${rel} ${target}, but the edition register { ${[...register].join(' ')} } does not list ${tNorm.edition} (edition-supersedes-resolves)`);
             }
@@ -4381,8 +4850,12 @@ function checkEditionLifecycle(dir, standard) {
         // The supersedes graph over the repo's manifests (sibling dirs keyed
         // by baseUrn) must be acyclic — no superseding oneself through a
         // chain. Edges to URNs no sibling declares are external and cannot
-        // close a cycle here.
-        const nodes = new Map(); // baseUrn → relations
+        // close a cycle here. The walk also captures each node's forward edge
+        // (superseded_by) for C113; the cycle detector deliberately reads the
+        // backward edges ONLY — a matched supersedes/superseded_by pair is
+        // one lineage fact declared at both ends, never a 2-cycle.
+        const nodes = new Map(); // baseUrn → backward relations
+        const forwardByNode = new Map(); // baseUrn → superseded_by targets
         const parent = (0, path_1.dirname)((0, path_1.resolve)(dir));
         for (const entry of (0, fs_1.readdirSync)(parent).sort()) {
             const full = (0, path_1.join)(parent, entry);
@@ -4396,6 +4869,7 @@ function checkEditionLifecycle(dir, standard) {
                     ...(sib.supersedes ?? []).map(t => ['supersedes', t]),
                     ...(sib.replaces ?? []).map(t => ['replaces', t]),
                 ]);
+                forwardByNode.set(key, new Set(sib.supersededBy ?? []));
             }
             catch {
                 // Not a package dir — not a graph node.
@@ -4413,6 +4887,31 @@ function checkEditionLifecycle(dir, standard) {
         if (cycle) {
             err('C79', `supersedes cycle: ${cycle.join(' → ')} — the supersedes graph must be acyclic; a package cannot supersede itself through a chain (edition-supersedes-resolves)`);
         }
+        // C113 — edition-lineage-coherent (MN 114 v3.2, clause 9.3.1): the
+        // lineage graph is the union of the declared edges of both directions;
+        // when two composed packages declare opposite edges between the same
+        // pair, the declarations must agree. A MISSING forward edge is never
+        // an error — the backward edges remain the authored minimum — so each
+        // leg fires only when the opposite edge set is declared and omits this
+        // package. Edges to URNs no sibling declares are external: nothing to
+        // cohere with here.
+        const ownKey = m.baseUrn || m.id;
+        for (const target of [...(m.supersedes ?? []), ...(m.replaces ?? [])]) {
+            const fwd = forwardByNode.get(target);
+            if (fwd !== undefined && fwd.size > 0 && !fwd.has(ownKey)) {
+                err('C113', `package "${m.id}": supersedes/replaces ${target}, but that package declares superseded_by { ${[...fwd].join(' ')} } without ${ownKey} — opposite lineage edges between the same pair must agree (edition-lineage-coherent)`);
+            }
+        }
+        for (const target of m.supersededBy ?? []) {
+            const bwdRels = nodes.get(target);
+            if (bwdRels === undefined) {
+                continue;
+            }
+            const bwd = new Set(bwdRels.map(([, t]) => t));
+            if (bwd.size > 0 && !bwd.has(ownKey)) {
+                err('C113', `package "${m.id}": superseded_by ${target}, but that package declares supersedes/replaces { ${[...bwd].join(' ')} } without ${ownKey} — opposite lineage edges between the same pair must agree (edition-lineage-coherent)`);
+            }
+        }
     }
     // C80 — INV-8: definition version pins resolve against the edition
     // register. Silent on a register-less package (nothing to resolve