@sigloch/contracts 10.10.0 → 10.13.0

package/dist/se/conformance-rules.d.ts

@@ -24,6 +24,7 @@ export declare const FileFactsSchema: z.ZodObject<{
     testCases: z.ZodDefault<z.ZodArray<z.ZodString>>;
     importedSymbols: z.ZodDefault<z.ZodArray<z.ZodString>>;
     parsedSymbols: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    zodSymbols: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 export type FileFacts = z.infer<typeof FileFactsSchema>;
 /** One file→file import edge (repo-relative paths) — the module-drift evidence (CR-212). */
@@ -44,6 +45,7 @@ export declare const CodeFactsSchema: z.ZodObject<{
         testCases: z.ZodDefault<z.ZodArray<z.ZodString>>;
         importedSymbols: z.ZodDefault<z.ZodArray<z.ZodString>>;
         parsedSymbols: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        zodSymbols: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
     importEdges: z.ZodOptional<z.ZodArray<z.ZodObject<{
         from: z.ZodString;
@@ -54,6 +56,10 @@ export declare const CodeFactsSchema: z.ZodObject<{
         open: "open";
         done: "done";
     }>>>;
+    fileScope: z.ZodOptional<z.ZodEnum<{
+        all: "all";
+        referenced: "referenced";
+    }>>;
 }, z.core.$strip>;
 export type CodeFacts = z.infer<typeof CodeFactsSchema>;
 /** A conformance rule: pure over (graph, facts) — never touches I/O itself. */
@@ -103,7 +109,6 @@ export interface ImportCoverage {
     unassigned: string[];
 }
 export declare function importCoverage(graph: OntologyGraph, facts: CodeFacts): ImportCoverage;
-/** All RC conformance rules — evaluated by executors that can supply CodeFacts. */
 export declare const CODE_CONFORMANCE_RULES: ConformanceRuleDefinition[];
 /** Run all RC rules against a graph + extracted code facts. */
 export declare function evaluateConformanceRules(graph: OntologyGraph, facts: CodeFacts): RuleViolation[];

package/dist/se/conformance-rules.js

@@ -15,7 +15,7 @@
  * @sigloch/contracts/se — single source of truth for SE validation rules.
  */
 import { z } from 'zod/v4';
-import { RealRefSchema, TestRefsSchema } from './ontology.js';
+import { readTestRefs, readRealRef } from './ontology.js';
 import { CLOSED_STATUS } from './cr-quality-rules.js';
 /** Parser facts about one source file (extracted by the executor). */
 export const FileFactsSchema = z.object({
@@ -29,6 +29,12 @@ export const FileFactsSchema = z.object({
     importedSymbols: z.array(z.string()).default([]),
     /** Symbols X invoked as `X.parse(` / `X.safeParse(` — the schema is actually used (CR-211). */
     parsedSymbols: z.array(z.string()).default([]),
+    /**
+     * Exported consts whose initializer is a Zod schema (`export const X = z.…`) — for RC-08
+     * (CR-SM-358). Optional, ABSENT = silence: the extractor did not look, which is not the
+     * same as "this file declares no schema" (same asymmetry as `declaredDependencies`).
+     */
+    zodSymbols: z.array(z.string()).optional(),
 });
 /** One file→file import edge (repo-relative paths) — the module-drift evidence (CR-212). */
 export const ImportEdgeSchema = z.object({
@@ -67,6 +73,13 @@ export const CodeFactsSchema = z.object({
      * `docs/cr/` was never looked at, it does not "have no CRs".
      */
     crFiles: z.record(z.string(), z.enum(['open', 'done'])).optional(),
+    /**
+     * Which files `files` covers (CR-SM-358): `referenced` = only files a realRef/testRefs
+     * entry names (the contract above), `all` = every source file of the repo. RC-09 asks
+     * "who ELSE parses this contract" and can only answer it over `all` — a partial scan
+     * would report the absence of what it never looked at. ABSENT = `referenced`.
+     */
+    fileScope: z.enum(['referenced', 'all']).optional(),
 });
 const missingFile = (facts, file) => facts.files[file]?.exists !== true;
 // RC-01: every valid FUNC realRef must resolve — file on disk, symbol declared in
@@ -81,17 +94,17 @@ function codeRefMustResolve(graph, facts) {
             continue;
         if (el.attributes?.concept === true || el.attributes?.external === true)
             continue;
-        const parsed = RealRefSchema.safeParse(el.attributes?.realRef);
-        if (!parsed.success)
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound')
             continue; // no/invalid binding → R-20 territory
-        const ref = parsed.data;
+        const ref = parsed.value;
         if (missingFile(facts, ref.file)) {
             violations.push({
                 rule_id: 'RC-01',
                 severity: 'warning',
                 element_id: el.id,
                 message: `${el.id} realRef.file '${ref.file}' does not exist on disk`,
-                fix_hint: 'Re-realize the FUNC (graph_realize) against the current source tree, or fix the moved/renamed file path',
+                fix_hint: `Re-bind the FUNC to the current source tree via graph_mutate Format-E \`~ ${el.id} @realRef {"file":…,"symbol":…}\` — or restore the moved/renamed file`,
                 context: { element_type: el.type, element_name: el.name },
             });
             continue;
@@ -125,17 +138,17 @@ function testRefMustResolve(graph, facts) {
             continue;
         if (el.attributes?.concept === true)
             continue;
-        const parsed = TestRefsSchema.safeParse(el.attributes?.testRefs);
-        if (!parsed.success)
+        const parsed = readTestRefs(el.attributes);
+        if (parsed.state !== 'bound')
             continue; // no/invalid binding → R-19 territory
-        for (const ref of parsed.data) {
+        for (const ref of parsed.value) {
             if (missingFile(facts, ref.file)) {
                 violations.push({
                     rule_id: 'RC-02',
                     severity: 'warning',
                     element_id: el.id,
                     message: `${el.id} testRefs entry file '${ref.file}' does not exist on disk`,
-                    fix_hint: 'The test file was moved or deleted — rebind the TEST (graph_realize) to the current file, or drop the entry',
+                    fix_hint: `The test file was moved or deleted — rebind the TEST via graph_mutate Format-E \`~ ${el.id} @testRefs [{"file":…,"tool":…}]\` (the patch replaces the whole list — carry the other entries), or drop the entry`,
                     context: { element_type: el.type, element_name: el.name },
                 });
                 continue;
@@ -169,17 +182,17 @@ function schemaRefMustResolve(graph, facts) {
             continue;
         if (el.attributes?.concept === true || el.attributes?.external === true)
             continue;
-        const parsed = RealRefSchema.safeParse(el.attributes?.realRef);
-        if (!parsed.success)
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound')
             continue; // no/invalid binding → R-26 territory
-        const ref = parsed.data;
+        const ref = parsed.value;
         if (missingFile(facts, ref.file)) {
             violations.push({
                 rule_id: 'RC-03',
                 severity: 'warning',
                 element_id: el.id,
                 message: `${el.id} realRef.file '${ref.file}' does not exist on disk`,
-                fix_hint: 'Re-bind the SCHEMA (graph_realize) to the current source tree, or fix the moved/renamed file path',
+                fix_hint: `Re-bind the SCHEMA to the current source tree via graph_mutate Format-E \`~ ${el.id} @realRef {"file":…,"symbol":…}\` — or restore the moved/renamed file`,
                 context: { element_type: el.type, element_name: el.name },
             });
             continue;
@@ -199,6 +212,61 @@ function schemaRefMustResolve(graph, facts) {
     }
     return violations;
 }
+// The files the MODEL names as a SCHEMA's interface: realRef files of the FUNCs io-connected
+// (producer or consumer) to a FLOW whose data format is this SCHEMA (FUNC ─io→ FLOW
+// ─relation→ SCHEMA), restricted to files that exist. RC-04 asks whether one of them parses
+// the schema, RC-09 whether anyone ELSE does — one derivation, so both ask the same question.
+function interfaceFiles(graph, schemaId, facts, typeOf) {
+    const flowIds = new Set(graph.traces
+        .filter(t => t.type === 'relation' && t.target === schemaId && typeOf.get(t.source) === 'FLOW')
+        .map(t => t.source));
+    if (flowIds.size === 0)
+        return [];
+    const funcIds = new Set(graph.traces
+        .filter(t => t.type === 'io' &&
+        ((flowIds.has(t.target) && typeOf.get(t.source) === 'FUNC') ||
+            (flowIds.has(t.source) && typeOf.get(t.target) === 'FUNC')))
+        .map(t => (flowIds.has(t.target) ? t.source : t.target)));
+    const files = [];
+    for (const fnId of funcIds) {
+        const fn = graph.elements.find(e => e.id === fnId);
+        const cr = readRealRef(fn?.attributes);
+        if (cr.state === 'bound' && !missingFile(facts, cr.value.file))
+            files.push(cr.value.file);
+    }
+    return files;
+}
+// Does `file` parse the schema? It must call `.parse`/`.safeParse` on the symbol AND have it in
+// scope — imported, or declared right there: the definition file does not import its own schema
+// (CR-SM-358, found by the positive control on graphcode's Format-E door, where the modelled
+// translator lives in the schema's own file).
+function parsesAt(facts, file, ref) {
+    const f = facts.files[file];
+    if (f?.exists !== true || !f.parsedSymbols.includes(ref.symbol))
+        return false;
+    return f.importedSymbols.includes(ref.symbol) || file === ref.file;
+}
+// Files outside `allowed` that import AND parse the symbol — the parsers the model does not
+// name. Test files (testCases present) are exempt; consumer ratchets cover them. Empty unless
+// the extractor saw every file (`fileScope: 'all'`): a partial scan cannot name who else parses.
+function foreignParsers(facts, symbol, allowed) {
+    if (facts.fileScope !== 'all')
+        return [];
+    return Object.entries(facts.files)
+        .filter(([file, f]) => f.exists && !allowed.has(file) && f.testCases.length === 0 &&
+        f.importedSymbols.includes(symbol) && f.parsedSymbols.includes(symbol))
+        .map(([file]) => file)
+        .sort();
+}
+// A SCHEMA whose realRef symbol is declared but, by the extractor's own account, not a Zod
+// schema. False when the extractor did not report `zodSymbols` (silence, not a verdict) or
+// when the symbol is not declared at all (RC-03's finding, not this one).
+function boundToNonZod(facts, ref) {
+    const f = facts.files[ref.file];
+    if (f?.exists !== true || f.zodSymbols === undefined)
+        return false;
+    return f.declaredSymbols.includes(ref.symbol) && !f.zodSymbols.includes(ref.symbol);
+}
 // RC-04: a bound SCHEMA that the graph says is realized at an interface must
 // actually be parsed there (CR-211). The graph gives the check LOCATIONS: FUNCs
 // io-connected to a FLOW whose data format IS this SCHEMA (FUNC ─io→ FLOW
@@ -218,43 +286,29 @@ function schemaRefMustBeUsed(graph, facts) {
             continue;
         if (el.attributes?.concept === true)
             continue;
-        const parsed = RealRefSchema.safeParse(el.attributes?.realRef);
-        if (!parsed.success || parsed.data.symbol === undefined)
-            continue;
-        const ref = parsed.data;
-        // The FLOWs whose data format is this SCHEMA (FLOW ─relation→ SCHEMA).
-        const flowIds = new Set(graph.traces
-            .filter(t => t.type === 'relation' && t.target === el.id && typeOf.get(t.source) === 'FLOW')
-            .map(t => t.source));
-        if (flowIds.size === 0)
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound' || parsed.value.symbol === undefined)
             continue;
-        // FUNCs io-connected to those FLOWs (producer or consumer).
-        const funcIds = new Set(graph.traces
-            .filter(t => t.type === 'io' &&
-            ((flowIds.has(t.target) && typeOf.get(t.source) === 'FUNC') ||
-                (flowIds.has(t.source) && typeOf.get(t.target) === 'FUNC')))
-            .map(t => (flowIds.has(t.target) ? t.source : t.target)));
-        // Realized FUNCs among them: a resolvable realRef whose file exists.
-        const realizedFiles = [];
-        for (const fnId of funcIds) {
-            const fn = graph.elements.find(e => e.id === fnId);
-            const cr = RealRefSchema.safeParse(fn?.attributes?.realRef);
-            if (cr.success && !missingFile(facts, cr.data.file))
-                realizedFiles.push(cr.data.file);
-        }
+        const ref = parsed.value;
+        if (boundToNonZod(facts, ref))
+            continue; // RC-08 owns this cause (CR-SM-358)
+        const realizedFiles = interfaceFiles(graph, el.id, facts, typeOf);
         if (realizedFiles.length === 0)
             continue; // nothing realized to check against
-        const usedSomewhere = realizedFiles.some(file => {
-            const f = facts.files[file];
-            return f.importedSymbols.includes(ref.symbol) && f.parsedSymbols.includes(ref.symbol);
-        });
+        const usedSomewhere = realizedFiles.some(file => parsesAt(facts, file, ref));
         if (!usedSomewhere) {
+            // CR-SM-358: where it IS parsed, if the extractor saw every file — then the finding says
+            // where the binding has to point, and RC-09 stays quiet about the same cause.
+            const actual = foreignParsers(facts, ref.symbol, new Set([ref.file, ...realizedFiles]));
             violations.push({
                 rule_id: 'RC-04',
                 severity: 'warning',
                 element_id: el.id,
-                message: `${el.id} schema '${ref.symbol}' is not parsed in any realized FUNC at its modelled interface`,
-                fix_hint: `Import and call ${ref.symbol}.parse()/.safeParse() in one of the io-connected FUNC's code files — or mark the SCHEMA concept:true if no code realizes it yet`,
+                message: `${el.id} schema '${ref.symbol}' is not parsed in any realized FUNC at its modelled interface` +
+                    (actual.length > 0 ? ` — it is parsed in: ${actual.join(', ')}` : ''),
+                fix_hint: actual.length > 0
+                    ? `The parse sits in ${actual.join(', ')}: point the FUNC realRef at that file, or move the parse into the modelled FUNC`
+                    : `Import and call ${ref.symbol}.parse()/.safeParse() in one of the io-connected FUNC's code files — or mark the SCHEMA concept:true if no code realizes it yet`,
                 context: { element_type: el.type, element_name: el.name },
             });
         }
@@ -295,12 +349,12 @@ function buildModResolver(graph) {
     for (const el of graph.elements) {
         if (el.type !== 'FUNC')
             continue;
-        const cr = RealRefSchema.safeParse(el.attributes?.realRef);
-        if (!cr.success)
+        const cr = readRealRef(el.attributes);
+        if (cr.state !== 'bound')
             continue;
         const modTrace = graph.traces.find(t => t.source === el.id && t.type === 'allocate' && typeOf.get(t.target) === 'MOD');
         if (modTrace)
-            fileToMod.set(cr.data.file, modTrace.target);
+            fileToMod.set(cr.value.file, modTrace.target);
     }
     // MOD.path longest-prefix fallback for files with no direct binding.
     const modPaths = graph.elements
@@ -439,10 +493,10 @@ function externalRefMustNameDependency(graph, facts) {
         // `concept: true` has no binding that could rot — a concept node claims nothing about code.
         if (el.attributes?.external !== true || el.attributes?.concept === true)
             continue;
-        const parsed = RealRefSchema.safeParse(el.attributes?.realRef);
-        if (!parsed.success)
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound')
             continue;
-        const match = WORKSPACE_PATH.exec(parsed.data.file);
+        const match = WORKSPACE_PATH.exec(parsed.value.file);
         if (!match)
             continue; // not the shape this rule can decide
         const pkg = `${WORKSPACE_SCOPE}/${match[1]}`;
@@ -452,7 +506,7 @@ function externalRefMustNameDependency(graph, facts) {
             rule_id: 'RC-06',
             severity: 'warning',
             element_id: el.id,
-            message: `${el.id} binds to '${parsed.data.file}', but '${pkg}' is not a declared dependency`,
+            message: `${el.id} binds to '${parsed.value.file}', but '${pkg}' is not a declared dependency`,
             fix_hint: `Add '${pkg}' to dependencies, or re-point the realRef at the package that now owns the symbol`,
             context: { element_type: el.type, element_name: el.name },
         });
@@ -514,6 +568,127 @@ function crNodeMatchesFile(graph, facts) {
     return violations;
 }
 /** All RC conformance rules — evaluated by executors that can supply CodeFacts. */
+// ---------------------------------------------------------------------------
+// RC-08 / RC-09 (CR-SM-358) — the contract has a checker, and only the modelled places use it.
+//
+// Why these two replace ND-01 in substance: parallel paths are not similar to each other
+// (spike CR-GC-637: name similarity 0.000 in 7 of 7 documented pairs); they share a CONTRACT.
+// A second translator of the same contract is found by asking who parses it, not what it
+// looks like. RC-01..RC-07 ask model → code ("does the binding resolve?"); RC-09 is the
+// first rule that asks code → model ("does the model know everyone who reads this?").
+// ---------------------------------------------------------------------------
+// RC-08: a bound SCHEMA must bind a Zod schema, not a type. A type is checked by the
+// compiler and gone at runtime: whatever produces the data cannot prove it, and whoever
+// reads it cannot check it. Data that nobody parses yet only has a reader nobody knows yet.
+function schemaRefMustBeZod(graph, facts) {
+    const violations = [];
+    for (const el of graph.elements) {
+        if (el.type !== 'SCHEMA')
+            continue;
+        if (el.attributes?.concept === true)
+            continue;
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound' || parsed.value.symbol === undefined)
+            continue;
+        const ref = parsed.value;
+        if (!boundToNonZod(facts, ref))
+            continue;
+        violations.push({
+            rule_id: 'RC-08',
+            severity: 'warning',
+            element_id: el.id,
+            message: `${el.id} realRef '${ref.symbol}' in '${ref.file}' is not a Zod schema — the contract cannot be checked at runtime`,
+            fix_hint: `Declare the contract as a Zod schema (export const ${ref.symbol}Schema = z.…) and bind the SCHEMA to it — a producer needs a checkable schema even while no reader is known`,
+            context: { element_type: el.type, element_name: el.name },
+        });
+    }
+    return violations;
+}
+// RC-09: a Zod-bound SCHEMA may be parsed only where the model says — in the realRef files
+// of its producers/translators (the same set RC-04 checks) or in its own definition file.
+// Any other file that imports AND parses the symbol is a translator the model does not
+// know: a second path. The definition may live in another package (no facts entry) — only a
+// proven type binding (RC-08) silences the rule. One finding per SCHEMA, listing the files — the count must not grow
+// with usage (Gate 7, class CR-GC-315). Test files (testCases present) are exempt; ratchets
+// in the consumer cover them. Runs only when the extractor saw every file (`fileScope:'all'`).
+function schemaParsedOnlyAtInterface(graph, facts) {
+    if (facts.fileScope !== 'all')
+        return [];
+    // (foreignParsers repeats this guard; checking here skips the graph walk entirely.)
+    const typeOf = new Map(graph.elements.map(e => [e.id, e.type]));
+    const violations = [];
+    for (const el of graph.elements) {
+        if (el.type !== 'SCHEMA')
+            continue;
+        if (el.attributes?.concept === true)
+            continue;
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound' || parsed.value.symbol === undefined)
+            continue;
+        const ref = parsed.value;
+        // Only a PROVEN type binding silences RC-09 (RC-08 owns it). A definition outside this
+        // repo — the family's shared contracts live in @sigloch/contracts — has no facts entry,
+        // and those are exactly the contracts reused most; a `.parse()` on the symbol is already
+        // the evidence that it is a runtime checker.
+        if (boundToNonZod(facts, ref))
+            continue;
+        const iface = interfaceFiles(graph, el.id, facts, typeOf);
+        // One cause, one finding (Gate 4): if the model names an interface and NONE of it parses,
+        // the parse merely sits elsewhere — that is RC-04's finding (which names the file), not a
+        // second path. A second path needs a first one: a modelled parser AND a foreign one.
+        const ifaceParses = iface.some(file => parsesAt(facts, file, ref));
+        if (iface.length > 0 && !ifaceParses)
+            continue;
+        const foreign = foreignParsers(facts, ref.symbol, new Set([ref.file, ...iface]));
+        if (foreign.length === 0)
+            continue;
+        violations.push({
+            rule_id: 'RC-09',
+            severity: 'warning',
+            element_id: el.id,
+            message: `${el.id} schema '${ref.symbol}' is parsed in ${foreign.length} file(s) the model does not know as its producer or translator: ${foreign.join(', ')}`,
+            fix_hint: 'Route the caller through the modelled translator — or, if it is a translator in its own right, model it: FUNC ─io→ FLOW ─relation→ this SCHEMA, with the FUNC realRef on that file',
+            context: { element_type: el.type, element_name: el.name },
+        });
+    }
+    return violations;
+}
+// ---------------------------------------------------------------------------
+// RC-10 (CR-SM-344): a MOD must be resolvable — carry a `path`, or have at least one
+// allocated FUNC with a bound realRef. Those are the only two ways `buildModResolver`
+// maps a file to a MOD; a MOD with neither can never own a file, so RC-05 and the
+// boundary measurement are blind to it BY CONSTRUCTION. Measured at sigllm: 0 RC-05
+// findings at 19 % import coverage, 8 at 81 % — the zero was the absence of a question.
+// The cost in the message comes from `importCoverage` (the same resolution), not from a
+// second count. `concept`/`external` are exempt — the same exemptions as R-20.
+// ABSENT `importEdges` = silence, like RC-05: without an import graph RC-05 has nothing to
+// judge, so there is no blindness to report — and the cost could not be named.
+// ---------------------------------------------------------------------------
+function modMustBeResolvable(graph, facts) {
+    if (facts.importEdges === undefined)
+        return []; // extractor supplied no import graph — silence
+    const typeOf = new Map(graph.elements.map(e => [e.id, e.type]));
+    const boundFuncs = new Set(graph.elements.filter(e => e.type === 'FUNC' && readRealRef(e.attributes).state === 'bound').map(e => e.id));
+    const resolvedByFunc = new Set(graph.traces
+        .filter(t => t.type === 'allocate' && boundFuncs.has(t.source) && typeOf.get(t.target) === 'MOD')
+        .map(t => t.target));
+    const blind = graph.elements.filter(e => e.type === 'MOD' &&
+        e.attributes?.concept !== true && e.attributes?.external !== true &&
+        !(typeof e.attributes?.path === 'string' && e.attributes.path.length > 0) &&
+        !resolvedByFunc.has(e.id));
+    if (blind.length === 0)
+        return [];
+    const coverage = importCoverage(graph, facts);
+    const cost = `${coverage.unassigned.length} of ${coverage.endpoints} import endpoints stay unassigned in this repo`;
+    return blind.map(el => ({
+        rule_id: 'RC-10',
+        severity: 'warning',
+        element_id: el.id,
+        message: `${el.id} has neither a path nor an allocated FUNC with a realRef — no file can resolve to it, RC-05 is blind here (${cost})`,
+        fix_hint: `Set the module's source directory via graph_mutate Format-E \`~ ${el.id} @path <dir>\` — or bind one of its allocated FUNCs (\`~ FUNC-x @realRef {"file":…,"symbol":…}\`); mark it concept:true if no code realizes it yet`,
+        context: { element_type: el.type, element_name: el.name },
+    }));
+}
 export const CODE_CONFORMANCE_RULES = [
     { id: 'RC-01', name: 'FUNC realRef resolves to a declared symbol', severity: 'warning', domain: ['FUNC'], evaluate: codeRefMustResolve },
     { id: 'RC-02', name: 'testRefs entries resolve to runnable tests', severity: 'warning', domain: ['TEST'], evaluate: testRefMustResolve },
@@ -522,6 +697,9 @@ export const CODE_CONFORMANCE_RULES = [
     { id: 'RC-05', name: 'cross-module import drift', severity: 'warning', domain: ['MOD'], evaluate: importDriftConformance },
     { id: 'RC-06', name: 'external realRef names a declared dependency', severity: 'warning', domain: ['FUNC', 'MOD', 'SCHEMA'], evaluate: externalRefMustNameDependency },
     { id: 'RC-07', name: 'CR node agrees with docs/cr', severity: 'warning', domain: ['CR', 'SYS'], evaluate: crNodeMatchesFile },
+    { id: 'RC-08', name: 'SCHEMA realRef is a Zod schema', severity: 'warning', domain: ['SCHEMA'], evaluate: schemaRefMustBeZod },
+    { id: 'RC-09', name: 'SCHEMA is parsed only at its modelled interface', severity: 'warning', domain: ['SCHEMA'], evaluate: schemaParsedOnlyAtInterface },
+    { id: 'RC-10', name: 'MOD has resolvable files', severity: 'warning', domain: ['MOD'], evaluate: modMustBeResolvable },
 ];
 /** Run all RC rules against a graph + extracted code facts. */
 export function evaluateConformanceRules(graph, facts) {

package/dist/se/cr-quality-rules.d.ts

@@ -8,6 +8,11 @@ import type { MetricPolicy } from './policy.js';
 /**
  * Abgeschlossen heisst: nicht mehr steuerbar. Alles andere ist Grundgesamtheit.
  * Exportiert fuer RC-07 (CR-SM-329), das dieselbe Frage gegen `docs/cr/done/` stellt.
+ *
+ * CR-SM-362 (ITEM-2026-536): nur noch `done`. Die Menge kannte `dropped`/`rejected`, der
+ * Element-Vertrag (`OntologyElement.status`) nicht — die Regeln rechneten mit Werten, die der
+ * Vertrag verbietet. Verworfen ist eine Begruendung im CR-Text, kein eigener Zustand: das
+ * Verzeichnis `done/` schliesst ihn, der Knoten spiegelt `done`.
  */
 export declare const CLOSED_STATUS: ReadonlySet<string>;
 export declare const CR_RULES: RuleDefinition[];

package/dist/se/cr-quality-rules.js

@@ -1,3 +1,4 @@
+import { readRealRef } from './ontology.js';
 // ---------------------------------------------------------------------------
 // CR-R01: ein offener CR nennt, WAS er aendert (CR-SM-295)
 //
@@ -36,8 +37,13 @@ const SCOPE_TYPES = new Set(['FUNC', 'MOD', 'SCHEMA', 'REQ', 'UC']);
 /**
  * Abgeschlossen heisst: nicht mehr steuerbar. Alles andere ist Grundgesamtheit.
  * Exportiert fuer RC-07 (CR-SM-329), das dieselbe Frage gegen `docs/cr/done/` stellt.
+ *
+ * CR-SM-362 (ITEM-2026-536): nur noch `done`. Die Menge kannte `dropped`/`rejected`, der
+ * Element-Vertrag (`OntologyElement.status`) nicht — die Regeln rechneten mit Werten, die der
+ * Vertrag verbietet. Verworfen ist eine Begruendung im CR-Text, kein eigener Zustand: das
+ * Verzeichnis `done/` schliesst ihn, der Knoten spiegelt `done`.
  */
-export const CLOSED_STATUS = new Set(['done', 'dropped', 'rejected']);
+export const CLOSED_STATUS = new Set(['done']);
 function crMustTrack(graph) {
     const typeOf = new Map(graph.elements.map(e => [e.id, e.type]));
     const crs = graph.elements.filter(e => {
@@ -173,6 +179,76 @@ function crShouldHaveMilestone(graph) {
     }));
 }
 // ---------------------------------------------------------------------------
+// CR-R05: kein Blatt-REQ ohne Bauauftrag (CR-SM-343) — die REQ-Seite von CR-R01.
+//
+// RD-01 fragt nach einem Traeger, R-01 nach einer Verifikation; ob ein REQ einen BAUAUFTRAG
+// hat, fragte niemand. Gemessen am Fremdlauf sigllm: `se-plan` meldete „20 von 20 geordnet",
+// im selben Graphstand hatten 24 von 64 Blatt-REQ keinen Auftrag — genau die, die alle 16
+// offenen FM-03-Risiken mildern.
+//
+// Beauftragt ist ein Blatt-REQ (kein `compose`→REQ-Kind), wenn ein CR eine `relation` (a)
+// direkt darauf traegt oder (b) auf eine FUNC, die es `satisfy`t. **MOD und SYS zaehlen
+// nicht:** ein Modul ist ein Behaelter — mitgerechnet las sigllm 55/64 statt 40/64 und sah
+// gesund aus. Wer ein REQ an einem MOD-/SYS-Traeger beauftragt, zieht die `relation` direkt
+// auf das REQ. FCHAIN ist kein Weg: `CR -relation-> FCHAIN` ist kein TRACE_PATTERN, eine
+// solche Kante waere R-18 — ein FCHAIN-getragenes REQ braucht also ebenfalls die direkte Kante.
+//
+// Jeder CR zaehlt, auch ein abgeschlossener: gebaut ist beauftragt.
+//
+// **Eine gebaute FUNC deckt ohne CR** (CR-SM-375): traegt die FUNC eine gueltige `realRef`
+// oder ist sie `external`, ist der Bauauftrag erledigt — Bestand vor der CR-Disziplin braucht
+// keinen nachgetragenen Auftrag. `concept: true` ist nicht gebaut, auch mit realRef. Fuer
+// MOD/SYS/FCHAIN aendert das nichts: dort deckt nur die direkte `CR -relation-> REQ`.
+//
+// **Ohne CR-Knoten schweigt die Regel** und zaehlt weder im Zaehler noch im Nenner
+// (`RULE_PRECONDITION`, readiness.ts). Ein Repo ohne Plan im Graphen (`cr: docs`) bekaeme
+// sonst auf jedem REQ einen Befund — die Regel wuerde abgeschaltet und waere danach ueberall
+// still (Fail-open-Klasse ND-01/ND-02 vor CR-SM-286).
+// ---------------------------------------------------------------------------
+function funcIsBuilt(e) {
+    if (e.attributes?.concept === true)
+        return false;
+    return e.attributes?.external === true || readRealRef(e.attributes).state === 'bound';
+}
+function leafReqNeedsBuildOrder(graph) {
+    const crIds = new Set(graph.elements.filter(e => e.type === 'CR').map(e => e.id));
+    if (crIds.size === 0)
+        return [];
+    const typeOf = new Map(graph.elements.map(e => [e.id, e.type]));
+    const ordered = new Set(); // CR -relation-> X, oder eine bereits gebaute FUNC
+    for (const t of graph.traces) {
+        if (t.type === 'relation' && crIds.has(t.source))
+            ordered.add(t.target);
+    }
+    for (const e of graph.elements) {
+        if (e.type === 'FUNC' && funcIsBuilt(e))
+            ordered.add(e.id);
+    }
+    const covered = new Set();
+    const parents = new Set();
+    for (const t of graph.traces) {
+        if (t.type === 'relation' && crIds.has(t.source) && typeOf.get(t.target) === 'REQ')
+            covered.add(t.target);
+        if (t.type === 'satisfy' && typeOf.get(t.source) === 'FUNC' && ordered.has(t.source))
+            covered.add(t.target);
+        if (t.type === 'compose' && typeOf.get(t.source) === 'REQ' && typeOf.get(t.target) === 'REQ')
+            parents.add(t.source);
+    }
+    return graph.elements
+        .filter(e => e.type === 'REQ' && !parents.has(e.id) && !covered.has(e.id))
+        .map(req => ({
+        rule_id: 'CR-R05',
+        severity: 'warning',
+        element_id: req.id,
+        message: `${req.id} is a leaf REQ with no build order (no CR relation to it or to a FUNC that satisfies it, and no built FUNC satisfies it)`,
+        fix_hint: `Add a CR relation through graph_mutate Format-E \`CR-x -relation-> ${req.id}\` — or to the FUNC that satisfies it; a CR on its MOD/SYS carrier does not count`,
+        context: {
+            element_type: req.type,
+            element_name: req.name,
+        },
+    }));
+}
+// ---------------------------------------------------------------------------
 // Exports
 // ---------------------------------------------------------------------------
 export const CR_RULES = [
@@ -185,6 +261,7 @@ export const CR_RULES = [
     // Damit ist sie nach R-08/R-18 die dritte 'all'-Regel — bewusst, nicht vergessen.
     { id: 'CR-R03', name: 'No concurrent mutation', severity: 'warning', evaluate: noConcurrentMutation, domain: ['all'] },
     { id: 'MS-03', name: 'CR without milestone', severity: 'info', evaluate: crShouldHaveMilestone, domain: ['CR'] },
+    { id: 'CR-R05', name: 'Leaf REQ has a build order', severity: 'warning', evaluate: leafReqNeedsBuildOrder, domain: ['REQ'] },
 ];
 // CR-SM-236: `policy` wird durchgereicht, auch wo diese Familie heute keine Schwelle hat —
 // ein Sonderweg je Familie waere genau der zweite Pfad, den der Regelsatz verbietet.

package/dist/se/evaluate-all.d.ts

@@ -30,5 +30,12 @@ export declare function getRuleDefsForProfile(profile: ProfileId): typeof ALL_RU
  * CR-SM-233: `policy` ist **Pflicht und ohne Fallback** — ein Aufruf ohne Policy ist ein
  * Typfehler, keine stille 0.7. Wer keine eigene Quelle hat (Konfiguration, Host), nimmt
  * `DEFAULT_METRIC_POLICY` sichtbar an der Aufrufstelle.
+ *
+ * CR-SM-378: `only` ist ein REGELFILTER, kein zweiter Auswerter — dieselbe Normalisierung,
+ * dieselbe Reihenfolge, dieselben `evaluate`-Aufrufe; eine Regel ausserhalb des Filters laeuft nur
+ * nicht. Das Ergebnis ist gleich dem Vollergebnis, nachtraeglich auf `only` gefiltert. Grund:
+ * der Steuer-Operator (se-engine `bestBySteer`) bewertete jeden Kandidaten mit dem ganzen
+ * Katalog, inklusive des quadratischen ND-01 — 8,9 von 17,1 s bei 2000 Knoten fuer Befunde, die
+ * er nie las. Ohne `only` laeuft der ganze Katalog.
  */
-export declare function evaluateAllRules(graph: OntologyGraph, policy: MetricPolicy): RuleViolation[];
+export declare function evaluateAllRules(graph: OntologyGraph, policy: MetricPolicy, only?: ReadonlySet<string>): RuleViolation[];

package/dist/se/evaluate-all.js

@@ -1,16 +1,16 @@
-import { V3_RULES, evaluateRules } from './rules.js';
-import { SC_RULES, evaluateSCRules } from './schema-quality-rules.js';
-import { UC_RULES, evaluateUCRules } from './uc-quality-rules.js';
-import { FC_RULES, evaluateFCRules } from './fchain-quality-rules.js';
-import { MT_RULES, evaluateMTRules } from './metric-rules.js';
+import { V3_RULES } from './rules.js';
+import { SC_RULES } from './schema-quality-rules.js';
+import { UC_RULES } from './uc-quality-rules.js';
+import { FC_RULES } from './fchain-quality-rules.js';
+import { MT_RULES } from './metric-rules.js';
 import { toEvaluableGraph } from './flat-graph.js';
-import { FM_RULES, evaluateFMRules } from './fmea-rules.js';
-import { VIEW_RULES, evaluateViewRules } from './view-rules.js';
-import { CR_RULES, evaluateCRRules } from './cr-quality-rules.js';
-import { ND_RULES, evaluateNDRules } from './near-duplicate-rules.js';
-import { AO_RULES, evaluateAORules } from './ao-rules.js';
-import { BQ_RULES, evaluateBQRules } from './quality-rules.js';
-import { AF_RULES, evaluateAFRules, TASK_OUTCOME_RULES, evaluateTaskOutcomeRules } from './analysis-freshness-rules.js';
+import { FM_RULES } from './fmea-rules.js';
+import { VIEW_RULES } from './view-rules.js';
+import { CR_RULES } from './cr-quality-rules.js';
+import { ND_RULES } from './near-duplicate-rules.js';
+import { AO_RULES } from './ao-rules.js';
+import { BQ_RULES } from './quality-rules.js';
+import { AF_RULES, TASK_OUTCOME_RULES } from './analysis-freshness-rules.js';
 import { CODE_CONFORMANCE_RULES } from './conformance-rules.js';
 /**
  * CR-SM-285: das Profil haengt am KATALOG, nicht am ID-Praefix.
@@ -67,14 +67,31 @@ export function getRuleDefsForProfile(profile) {
         return ALL_RULE_DEFS;
     return ALL_RULE_DEFS.filter(r => r.profile === profile);
 }
+/**
+ * Die ausgewerteten Kataloge in der Reihenfolge der kanonischen Befund-Sequenz (CR-SM-240).
+ * Ohne `CODE_CONFORMANCE_RULES` — die brauchen `CodeFacts` (s. CATALOGS). Die Reihenfolge ist
+ * Vertrag: das Golden (`se-rule-output-identity.test.ts`) pinnt sie.
+ */
+const EVALUATED_CATALOGS = [
+    V3_RULES, BQ_RULES, UC_RULES, FC_RULES, SC_RULES, ND_RULES, MT_RULES, CR_RULES, AO_RULES,
+    FM_RULES, VIEW_RULES, AF_RULES,
+    TASK_OUTCOME_RULES, // CR-SM-355
+];
 /**
  * Evaluate all rules against a graph. Single call replaces the individual evaluator calls.
  *
  * CR-SM-233: `policy` ist **Pflicht und ohne Fallback** — ein Aufruf ohne Policy ist ein
  * Typfehler, keine stille 0.7. Wer keine eigene Quelle hat (Konfiguration, Host), nimmt
  * `DEFAULT_METRIC_POLICY` sichtbar an der Aufrufstelle.
+ *
+ * CR-SM-378: `only` ist ein REGELFILTER, kein zweiter Auswerter — dieselbe Normalisierung,
+ * dieselbe Reihenfolge, dieselben `evaluate`-Aufrufe; eine Regel ausserhalb des Filters laeuft nur
+ * nicht. Das Ergebnis ist gleich dem Vollergebnis, nachtraeglich auf `only` gefiltert. Grund:
+ * der Steuer-Operator (se-engine `bestBySteer`) bewertete jeden Kandidaten mit dem ganzen
+ * Katalog, inklusive des quadratischen ND-01 — 8,9 von 17,1 s bei 2000 Knoten fuer Befunde, die
+ * er nie las. Ohne `only` laeuft der ganze Katalog.
  */
-export function evaluateAllRules(graph, policy) {
+export function evaluateAllRules(graph, policy, only) {
     // CR-SM-284: die Hebung der flach committeten SSOT laeuft HIER, nicht beim Aufrufer.
     //
     // `toEvaluableGraph` gibt es seit CR-SM-258 — und sie wurde von keinem Produktionspfad und
@@ -84,20 +101,6 @@ export function evaluateAllRules(graph, policy) {
     //
     // Idempotent und identitaetserhaltend (s. dort), also eine Normalisierung am einzigen Eingang
     // und kein Fallback: ein bereits genesteter Graph geht unveraendert und uneingepackt durch.
-    graph = toEvaluableGraph(graph);
-    return [
-        ...evaluateRules(graph, policy),
-        ...evaluateBQRules(graph, policy),
-        ...evaluateUCRules(graph, policy),
-        ...evaluateFCRules(graph, policy),
-        ...evaluateSCRules(graph, policy),
-        ...evaluateNDRules(graph),
-        ...evaluateMTRules(graph, policy),
-        ...evaluateCRRules(graph, policy),
-        ...evaluateAORules(graph, policy),
-        ...evaluateFMRules(graph, policy),
-        ...evaluateViewRules(graph, policy),
-        ...evaluateAFRules(graph),
-        ...evaluateTaskOutcomeRules(graph), // CR-SM-355
-    ];
+    const evaluable = toEvaluableGraph(graph);
+    return EVALUATED_CATALOGS.flatMap((rules) => rules.flatMap((rule) => (only === undefined || only.has(rule.id) ? rule.evaluate(evaluable, policy) : [])));
 }