@sigloch/contracts 10.10.0 → 10.13.0

package/dist/se/rules.js

@@ -4,7 +4,7 @@
  * @sigloch/contracts/se — single source of truth for SE validation rules.
  */
 import { z } from 'zod/v4';
-import { ElementType, TraceType, TestRefsSchema, RealRefSchema } from './ontology.js';
+import { ElementType, TraceType, readTestRefs, readRealRef } from './ontology.js';
 import { traceRejection, admittingAlternatives, isValidTrace, BOUNDED_PATTERNS, REQUIRED_PATTERNS, maxOccurs } from './meta-model.js';
 import { indexOf } from './graph-index.js';
 import { moduleCrossings, subtreeFuncs } from './module-crossings.js';
@@ -35,6 +35,17 @@ export const ViolationContext = z.object({
      * unterschlagen.
      */
     also_affects: z.array(z.string()).optional(),
+    /**
+     * CR-SM-363 (FC-05): die NEBENKOMPONENTEN einer zerfallenen FCHAIN, je mit Ursache —
+     * `missing-link` (Haupt- und Nebenteil sind ueber eine FUNC ausserhalb der Kette verbunden;
+     * `via` nennt sie) oder `bag` (nur eine gemeinsame Quelle, parallele Dienste). EIN Befund je
+     * Kette (CR-SM-242), die Komponenten hier statt als n Befunde.
+     */
+    side_components: z.array(z.object({
+        members: z.array(z.string()),
+        cause: z.enum(['missing-link', 'bag']),
+        via: z.array(z.string()),
+    })).optional(),
     /**
      * CR-SM-341: der Ablehnungsgrund von R-18, maschinenlesbar statt nur als Satz.
      *
@@ -242,24 +253,15 @@ function funcMustSatisfyReq(graph) {
                 .map(st => idx.byId.get(st.target))
                 .filter((e) => !!e)
             : [];
-        // Also include constraints whose description mentions this func's name
-        const namePattern = fn.name.toLowerCase();
-        const matchingConstraints = allReqs.filter(r => r.kinds?.includes('non-functional') && r.description.toLowerCase().includes(namePattern));
         // CR-SM-346 (ITEM-2026-299): der Kandidatenkreis wird am META-MODELL gefiltert, nicht
-        // an einer zweiten, hier abgeschriebenen kinds-Liste. `FUNC -satisfy-> REQ` laesst nur
-        // BEHAVIOURAL_KINDS zu; bis hierher bot die Regel ALLE REQ an — gemessen an sigllm hatte
-        // damit KEINER von 33 Befunden einen legalen Kandidaten, und die Vorlage aus CR-SM-342
-        // gab korrekt `null` zurueck. 86 Befunde, 0 Empfehlungen: der Befund war unbedienbar.
+        // an einer zweiten, hier abgeschriebenen kinds-Liste — `isValidTrace` statt Eigenbau: eine
+        // Regel, die Kandidaten anbietet, die ihr eigenes Meta-Modell abweist, erzeugt Waste statt
+        // Fuehrung. `FUNC -satisfy-> REQ` laesst nur `functional` zu (CR-SM-366).
         //
-        // Besonders der `matchingConstraints`-Zweig zog gezielt `non-functional` herein — genau
-        // die Sorte, die das Muster abweist. Er bleibt stehen (ein REQ kann mehrere kinds tragen,
-        // und die Namensnennung ist ein echtes Relevanzsignal), aber er entscheidet nicht mehr
-        // ueber die Legalitaet.
-        //
-        // `isValidTrace` statt Eigenbau: eine Regel, die Kandidaten anbietet, die ihr eigenes
-        // Meta-Modell abweist, erzeugt Waste statt Fuehrung — und zwei Wahrheiten ueber dieselbe
-        // Grammatik sind genau der Defekt, den CR-SM-286/-302 beseitigt haben.
-        const candidates = [...new Map([...siblingReqs, ...matchingConstraints, ...allReqs].map(e => [e.id, e])).values()]
+        // CR-SM-366: der fruehere `matchingConstraints`-Zweig (non-functional-REQ, deren Text den
+        // FUNC-Namen nennt) ist entfallen. Er zog genau die Sorte herein, die das Muster abweist;
+        // seit ein REQ genau EIN kind traegt, konnte kein Treffer den Filter je passieren.
+        const candidates = [...new Map([...siblingReqs, ...allReqs].map(e => [e.id, e])).values()]
             .filter(r => isValidTrace({ source: 'FUNC', target: 'REQ', type: 'satisfy', targetKinds: r.kinds }));
         return {
             rule_id: 'R-02',
@@ -663,35 +665,6 @@ function decompositionConsistency(graph) {
         context: { element_type: req.type, element_name: req.name },
     }));
 }
-// ---------------------------------------------------------------------------
-// RD-03: No premature decomposition (all children same satisfy target)
-// ---------------------------------------------------------------------------
-function noPrematureDecomposition(graph) {
-    const idx = indexOf(graph);
-    const reqs = idx.elementsOfType('REQ');
-    const parentReqs = reqs.filter(req => idx.out(req.id, 'compose').some(t => idx.typeOf(t.target) === 'REQ'));
-    return parentReqs
-        .filter(parent => {
-        const childIds = graph.traces
-            .filter(t => t.source === parent.id && t.type === 'compose' &&
-            idx.typeOf(t.target) === 'REQ')
-            .map(t => t.target);
-        if (childIds.length < 2)
-            return false;
-        const satisfyTargets = childIds.map(cid => idx.in(cid, 'satisfy').filter(t => t.source !== cid).map(t => t.source));
-        // All children satisfied by the same single source
-        const allSame = satisfyTargets.every(targets => targets.length === 1 && targets[0] === satisfyTargets[0]?.[0]);
-        return allSame && satisfyTargets[0]?.length === 1;
-    })
-        .map(req => ({
-        rule_id: 'RD-03',
-        severity: 'info',
-        element_id: req.id,
-        message: `${req.id} children all have the same satisfy target — decomposition may be unnecessary`,
-        fix_hint: 'Consider merging sub-REQs back into parent if they share the same verifiable level',
-        context: { element_type: req.type, element_name: req.name },
-    }));
-}
 function breadthCounts(graph) {
     const idx = indexOf(graph);
     // CR-SM-264: `typeOf` und `byId` baute diese Regel je Aufruf selbst — der Index hat beide.
@@ -856,7 +829,9 @@ function actorMustHaveTrace(graph) {
         severity: 'warning',
         element_id: a.id,
         message: `${a.id} has no io traces (disconnected actor)`,
-        fix_hint: 'Link to a UC or FLOW via io trace',
+        // CR-SM-371: ein ACTOR hat genau zwei legale Kanten (ACTOR -io-> FLOW, FLOW -io-> ACTOR);
+        // der UC wird ueber den FLOW an einer FUNC seiner Kette erreicht, nie direkt (R-18).
+        fix_hint: `Wire the actor through a FLOW via graph_mutate Format-E: \`${a.id} -io-> FLOW-x\` (it sends) or \`FLOW-x -io-> ${a.id}\` (it receives), plus \`FLOW-x -io-> FUNC-y\` or \`FUNC-y -io-> FLOW-x\` for a FUNC in the use case's chain — never an io edge to the UC itself`,
         context: {
             element_type: a.type,
             element_name: a.name,
@@ -956,7 +931,6 @@ function validTracePattern(graph) {
         });
         if (!why)
             return [];
-        const { detail, hint } = explainRejection(why, t, src, tgt);
         // CR-SM-341: derselbe Grund, den `detail` in Prosa giesst — hier zusaetzlich als Struktur.
         // Keine zweite Rechnung: `why` liegt vor, die Alternativen befragen `isValidTrace`.
         const shape = {
@@ -965,6 +939,7 @@ function validTracePattern(graph) {
             targetKinds: idx.byId.get(t.target)?.kinds,
         };
         const alt = admittingAlternatives(shape);
+        const { detail, hint } = explainRejection(why, t, src, tgt, alt.sources);
         const where = why.reason === 'no-pattern' ? undefined : why.pattern.where;
         return [{
                 rule_id: 'R-18',
@@ -999,7 +974,7 @@ function validTracePattern(graph) {
  * `kinds` steht da und passt nicht (Kante heben oder Kind korrigieren). Wer das nicht
  * unterscheiden kann, sucht am falschen Ende.
  */
-function explainRejection(why, t, src, tgt) {
+function explainRejection(why, t, src, tgt, admittingSources) {
     if (why.reason === 'no-pattern') {
         return {
             detail: `${src} → ${tgt} is not a valid ${t.type} pattern`,
@@ -1020,7 +995,11 @@ function explainRejection(why, t, src, tgt) {
         }
         : {
             detail: `${admits}, but ${end} declares {${[...why.declared].sort().join(', ')}}`,
-            hint: `Correct '${where.field}' on ${end}, or use a source type whose ${t.type} pattern admits them (FCHAIN carries every kind)`,
+            // CR-SM-366: den Erfueller NENNEN statt "FCHAIN carries every kind" — das galt nie fuer
+            // die Code-Bindung und gilt seit dem FCHAIN-where gar nicht mehr.
+            hint: admittingSources.length > 0
+                ? `Correct '${where.field}' on ${end}, or ${t.type} it from ${admittingSources.join(' | ')} — the pattern admitting {${[...why.declared].sort().join(', ')}}`
+                : `Correct '${where.field}' on ${end} to a subset of {${allowed}} — no source type admits {${[...why.declared].sort().join(', ')}} (retired kind? split a mixed REQ)`,
         };
 }
 /**
@@ -1162,7 +1141,7 @@ function testMustHaveRunnableBinding(graph) {
         .filter(e => e.attributes?.concept !== true) // concept-only TESTs are exempt
         // CR-SM-231: `testRefs` (Array, min 1) statt `testRef` (Objekt). Semantik unveraendert —
         // Praesenz und Form, keine Datei-Existenz; die pruefst RC-02.
-        .filter(e => !TestRefsSchema.safeParse(e.attributes?.testRefs).success)
+        .filter(e => readTestRefs(e.attributes).state !== 'bound')
         .map(test => ({
         rule_id: 'R-19',
         severity: 'warning',
@@ -1194,12 +1173,12 @@ function testFileExclusivity(graph) {
     for (const el of graph.elements) {
         if (el.type !== 'TEST')
             continue;
-        const parsed = TestRefsSchema.safeParse(el.attributes?.testRefs);
-        if (!parsed.success)
+        const parsed = readTestRefs(el.attributes);
+        if (parsed.state !== 'bound')
             continue; // keine/ungueltige Bindung → R-19-Gebiet
         // Innerhalb EINES Knotens ist dieselbe Datei zweimal kein Konflikt, sondern eine
         // Redundanz — sie wuerde sonst als Selbstkollision gemeldet.
-        for (const file of new Set(parsed.data.map(r => r.file))) {
+        for (const file of new Set(parsed.value.map(r => r.file))) {
             const owners = claimedBy.get(file) ?? [];
             owners.push(el.id);
             claimedBy.set(file, owners);
@@ -1244,7 +1223,7 @@ function funcMustHaveCodeBinding(graph) {
     const composeFuncChildren = (id) => graph.traces
         .filter(t => t.source === id && t.type === 'compose' && funcById.has(t.target))
         .map(t => t.target);
-    const hasCodeRef = (el) => RealRefSchema.safeParse(el.attributes?.realRef).success;
+    const hasCodeRef = (el) => readRealRef(el.attributes).state === 'bound';
     const isExempt = (el) => el.attributes?.concept === true || el.attributes?.external === true;
     // A FUNC is bound iff it is exempt, has a codeRef, or is a parent whose
     // compose→FUNC children are all bound (recursive, cycle-safe).
@@ -1299,7 +1278,7 @@ function funcMustHaveCodeBinding(graph) {
                 severity: 'warning',
                 element_id: fn.id,
                 message: `${fn.id} is not fully realized — unbound compose ${leafList.length === 1 ? 'child' : 'children'}: ${leafList.join(', ')}`,
-                fix_hint: `Realize the leaves ${leafList.join(', ')} (graph_realize) — the parent inherits their binding`,
+                fix_hint: `Bind the leaves via graph_mutate Format-E (${leafList.map((id) => `\`~ ${id} @realRef {"file":…,"symbol":…}\``).join(', ')}) — the parent inherits their binding`,
                 context: { element_type: fn.type, element_name: fn.name },
             });
         }
@@ -1329,6 +1308,10 @@ function funcMustHaveCodeBinding(graph) {
 //       Co-adjacency at a shared FLOW is not an asserted interface — treating it
 //       as one produced P·C findings per hub FLOW and made reuse the expensive
 //       choice. The FCHAIN is the modelled claim; the test is owed on the claim.
+//       CR-SM-376: second way to cover a chain. Since CR-SM-366 an FCHAIN carries
+//       only NFRs; its effect is covered through its members when EVERY member
+//       FUNC (FCHAIN ─compose→ FUNC) satisfies at least one REQ. Verifying those
+//       member REQs is R-01's job, not R-21's.
 // ---------------------------------------------------------------------------
 function fchainMustHaveIntegrationTest(graph, policy) {
     const idx = indexOf(graph);
@@ -1362,6 +1345,22 @@ function fchainMustHaveIntegrationTest(graph, policy) {
             testedChains.add(t.source);
         }
     }
+    // CR-SM-376: der zweite Weg — die Kette ist ueber ihre Glieder gedeckt, wenn JEDE Glied-FUNC
+    // (direkte FCHAIN -compose-> FUNC, dieselbe Definition wie `chainsByFunc`) eine REQ erfuellt.
+    // `unmetMembers` liefert die Glieder ohne REQ; leer = gedeckt. Eine Kette ohne Glied kann hier
+    // nicht auftauchen: ZWEIG 2 hat mindestens die beiden Enden der Uebergabe als Glieder.
+    const funcsWithReq = new Set(idx.tracesOfType('satisfy').filter(t => isFunc(t.source) && typeOf.get(t.target) === 'REQ').map(t => t.source));
+    const membersOf = new Map();
+    for (const [fn, chains] of chainsOf) {
+        for (const ch of chains) {
+            const list = membersOf.get(ch);
+            if (list)
+                list.push(fn);
+            else
+                membersOf.set(ch, [fn]);
+        }
+    }
+    const unmetMembers = (ch) => (membersOf.get(ch) ?? []).filter(fn => !funcsWithReq.has(fn)).sort();
     // CR-SM-313: die Infrastruktur-Ausnahme. Die ZAHL kommt aus der Kennzahl (CR-SM-314), nicht
     // aus einer zweiten Rechnung — eine Uebergabe an eine Funktion, die quer durch alle Ketten
     // laeuft, ist kein fehlender Integrationstest, sondern ein Bus. `null` = keine Ausnahme.
@@ -1401,8 +1400,9 @@ function fchainMustHaveIntegrationTest(graph, policy) {
             });
             continue;
         }
-        // ZWEIG 2 — gemeinsame Kette, aber keine davon geprueft: Befund an der Kette. Unveraendert.
-        if (shared.some(ch => testedChains.has(ch)))
+        // ZWEIG 2 — gemeinsame Kette, aber keine davon gedeckt: Befund an der Kette. Gedeckt heisst
+        // (a) verifizierte Ketten-REQ oder (b, CR-SM-376) jede Glied-FUNC erfuellt eine REQ.
+        if (shared.some(ch => testedChains.has(ch) || unmetMembers(ch).length === 0))
             continue;
         const anchor = shared[0];
         const key = `${anchor}|${p}>${c}`;
@@ -1414,8 +1414,8 @@ function fchainMustHaveIntegrationTest(graph, policy) {
             rule_id: 'R-21',
             severity: 'warning',
             element_id: anchor,
-            message: `${anchor} has no integration test covering connection ${p} → ${c}`,
-            fix_hint: 'Verify an FCHAIN-satisfied REQ with an integration TEST',
+            message: `${anchor} has no integration test covering connection ${p} → ${c}; member FUNCs without a REQ: ${unmetMembers(anchor).join(', ')}`,
+            fix_hint: 'Give each member FUNC of the chain a REQ it satisfies (FUNC -satisfy-> REQ), or attach an end-to-end non-functional REQ to the chain (FCHAIN -satisfy-> REQ) and verify it with an integration TEST',
             context: { element_type: anchorEl?.type, element_name: anchorEl?.name },
         });
     }
@@ -1501,7 +1501,7 @@ function schemaMustHaveSchemaRef(graph) {
     const idx = indexOf(graph);
     return idx.elementsOfType('SCHEMA')
         .filter(e => e.attributes?.concept !== true && e.attributes?.external !== true)
-        .filter(e => !RealRefSchema.safeParse(e.attributes?.realRef).success)
+        .filter(e => readRealRef(e.attributes).state !== 'bound')
         .map(sc => ({
         rule_id: 'R-26',
         severity: 'warning',
@@ -1526,7 +1526,7 @@ function schemaMustHaveContractTest(graph) {
     const tests = idx.elementsOfType('TEST');
     return idx.elementsOfType('SCHEMA')
         .filter(sc => sc.attributes?.concept !== true)
-        .filter(sc => { const r = RealRefSchema.safeParse(sc.attributes?.realRef); return r.success && r.data.symbol !== undefined; })
+        .filter(sc => { const r = readRealRef(sc.attributes); return r.state === 'bound' && r.value.symbol !== undefined; })
         .filter(sc => !graph.traces.some(t => t.type === 'verify' && t.target === sc.id && typeOf.get(t.source) === 'TEST'))
         .map(sc => ({
         rule_id: 'R-32',
@@ -1679,14 +1679,13 @@ export const V3_RULES = [
     { id: 'R-19', name: 'Runnable TEST binding', severity: 'warning', evaluate: testMustHaveRunnableBinding, domain: ['TEST'] },
     { id: 'R-29', name: 'Test file exclusivity', severity: 'error', evaluate: testFileExclusivity, domain: ['TEST'] },
     { id: 'R-20', name: 'FUNC realRef binding', severity: 'warning', evaluate: funcMustHaveCodeBinding, domain: ['FUNC'] },
-    { id: 'R-21', name: 'FUNC↔FUNC handover needs a shared chain and an integration test', severity: 'warning', evaluate: fchainMustHaveIntegrationTest, domain: ['FCHAIN', 'FUNC'] },
+    { id: 'R-21', name: 'FUNC↔FUNC handover needs a shared chain covered by member REQs or an integration test', severity: 'warning', evaluate: fchainMustHaveIntegrationTest, domain: ['FCHAIN', 'FUNC'] },
     { id: 'R-22', name: 'FUNC must be allocated to MOD', severity: 'warning', evaluate: funcMustBeAllocated, domain: ['FUNC'] },
     { id: 'R-23', name: 'MOD must have allocated FUNC', severity: 'warning', evaluate: modMustHaveAllocatedFunc, domain: ['MOD'] },
     { id: 'R-26', name: 'SCHEMA must have realRef', severity: 'warning', evaluate: schemaMustHaveSchemaRef, domain: ['SCHEMA'] },
     { id: 'R-32', name: 'SCHEMA must have contract TEST', severity: 'warning', evaluate: schemaMustHaveContractTest, domain: ['SCHEMA'] },
     { id: 'RD-01', name: 'Unresolved requirement', severity: 'warning', evaluate: unresolvedRequirement, domain: ['REQ'] },
     { id: 'RD-02', name: 'Decomposition consistency', severity: 'warning', evaluate: decompositionConsistency, domain: ['REQ'] },
-    { id: 'RD-03', name: 'No premature decomposition', severity: 'info', evaluate: noPrematureDecomposition, domain: ['REQ'] },
     { id: 'RD-04', name: 'Decomposition breadth', severity: 'warning', evaluate: decompositionBreadth, domain: ['FUNC', 'MOD', 'SYS'] },
     { id: 'RD-05', name: 'Decomposition too narrow', severity: 'warning', evaluate: decompositionNarrow, domain: ['FUNC', 'MOD', 'SYS'] },
     { id: 'MS-01', name: 'Milestone empty scope', severity: 'warning', evaluate: msEmptyScope, domain: ['MS'] },

package/dist/se/uc-quality-rules.d.ts

@@ -8,7 +8,5 @@ export declare function uc01HasRequirements(graph: OntologyGraph): RuleViolation
 export declare function uc02HasActor(graph: OntologyGraph): RuleViolation[];
 export declare function uc03HasScenario(graph: OntologyGraph): RuleViolation[];
 export declare function uc04GoalDefined(graph: OntologyGraph): RuleViolation[];
-export declare function uc05HasPostcondition(graph: OntologyGraph): RuleViolation[];
-export declare function uc06HasPrecondition(graph: OntologyGraph): RuleViolation[];
 export declare const UC_RULES: RuleDefinition[];
 export declare function evaluateUCRules(graph: OntologyGraph, policy: MetricPolicy): RuleViolation[];

package/dist/se/uc-quality-rules.js

@@ -112,53 +112,15 @@ export function uc04GoalDefined(graph) {
     }));
 }
 // ---------------------------------------------------------------------------
-// UC-05: UC should have postcondition REQ (CR-165: compose only, satisfy UC→REQ invalid)
-// ---------------------------------------------------------------------------
-export function uc05HasPostcondition(graph) {
-    const idx = indexOf(graph);
-    return idx.elementsOfType('UC')
-        .filter(uc => !idx.out(uc.id, 'compose').some(t => {
-        const target = idx.byId.get(t.target);
-        return target?.type === 'REQ' && target.kinds?.includes('postcondition');
-    }))
-        .map(uc => ({
-        rule_id: 'UC-05',
-        severity: 'info',
-        element_id: uc.id,
-        message: `${uc.id} has no postcondition requirement`,
-        fix_hint: 'Add a REQ with kinds=["postcondition"] via compose trace',
-        context: { element_type: uc.type, element_name: uc.name },
-    }));
-}
-// ---------------------------------------------------------------------------
-// UC-06: UC should have precondition REQ (CR-165: compose only, satisfy UC→REQ invalid)
-// ---------------------------------------------------------------------------
-export function uc06HasPrecondition(graph) {
-    const idx = indexOf(graph);
-    return idx.elementsOfType('UC')
-        .filter(uc => !idx.out(uc.id, 'compose').some(t => {
-        const target = idx.byId.get(t.target);
-        return target?.type === 'REQ' && target.kinds?.includes('precondition');
-    }))
-        .map(uc => ({
-        rule_id: 'UC-06',
-        severity: 'info',
-        element_id: uc.id,
-        message: `${uc.id} has no precondition requirement`,
-        fix_hint: 'Add a REQ with kinds=["precondition"] via compose trace',
-        context: { element_type: uc.type, element_name: uc.name },
-    }));
-}
-// ---------------------------------------------------------------------------
 // Aggregated
 // ---------------------------------------------------------------------------
+// CR-SM-357: UC-05/UC-06 (Pre-/Postcondition-REQ) sind gestrichen — Schreibregel in se:author-uc,
+// wie BQ in author-req (CR-GC-602): sie feuerten an fast jedem UC, und niemand handelte darauf.
 export const UC_RULES = [
     { id: 'UC-01', name: 'UC has requirements', severity: 'warning', evaluate: uc01HasRequirements, domain: ['UC'] },
     { id: 'UC-02', name: 'UC has actor', severity: 'warning', evaluate: uc02HasActor, domain: ['UC'] },
     { id: 'UC-03', name: 'UC has scenario', severity: 'warning', evaluate: uc03HasScenario, domain: ['UC'] },
     { id: 'UC-04', name: 'UC has goal', severity: 'warning', evaluate: uc04GoalDefined, domain: ['UC'] },
-    { id: 'UC-05', name: 'UC has postcondition', severity: 'info', evaluate: uc05HasPostcondition, domain: ['UC'] },
-    { id: 'UC-06', name: 'UC has precondition', severity: 'info', evaluate: uc06HasPrecondition, domain: ['UC'] },
 ];
 // CR-SM-236: `policy` wird durchgereicht, auch wo diese Familie heute keine Schwelle hat —
 // ein Sonderweg je Familie waere genau der zweite Pfad, den der Regelsatz verbietet.

package/dist/se/view-rules.js

@@ -3,7 +3,7 @@
  * VR-01: TEST with a testRefs entry that has no result (info).
  * CL-01: ACTOR without UCs in at least 2 distinct operatingModes (warning).
  */
-import { TestRefsSchema } from './ontology.js';
+import { readTestRefs } from './ontology.js';
 // ---------------------------------------------------------------------------
 // VR-01: ein testRefs-Eintrag ohne Ergebnis
 //
@@ -20,17 +20,17 @@ export function vr01TestNoResult(graph) {
     for (const el of graph.elements) {
         if (el.type !== 'TEST')
             continue;
-        const parsed = TestRefsSchema.safeParse(el.attributes?.testRefs);
-        if (!parsed.success)
+        const parsed = readTestRefs(el.attributes);
+        if (parsed.state !== 'bound')
             continue; // keine/ungueltige Bindung → R-19-Gebiet
-        const pending = parsed.data.filter(ref => ref.result === undefined);
+        const pending = parsed.value.filter(ref => ref.result === undefined);
         if (pending.length === 0)
             continue;
         violations.push({
             rule_id: 'VR-01',
             severity: 'info',
             element_id: el.id,
-            message: `${el.id} has ${pending.length} of ${parsed.data.length} testRefs entries without a result — assumed pending: ${pending.map(r => r.file).join(', ')}`,
+            message: `${el.id} has ${pending.length} of ${parsed.value.length} testRefs entries without a result — assumed pending: ${pending.map(r => r.file).join(', ')}`,
             fix_hint: 'Record the run outcome on the entry (result, ranAt, evidence) — a binding without a result is not evidence',
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sigloch/contracts",
-  "version": "10.10.0",
+  "version": "10.13.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",