@sigloch/contracts 10.9.0 → 10.12.0

package/dist/se/analysis-freshness-rules.d.ts

@@ -40,5 +40,25 @@ export declare const AF_RULES: readonly [{
     readonly evaluate: (graph: OntologyGraph) => RuleViolation[];
     readonly domain: readonly ["graph"];
 }];
+/** TR-01: a stamped trade study names >=1 existing CR, each carrying a relation(label: decides) edge. */
+export declare function tradeDecisionRecorded(graph: OntologyGraph): RuleViolation[];
+/** IR-01: every CR named by a stamped assumption review exists; an empty list is a legitimate outcome. */
+export declare function assumptionReviewPromoted(graph: OntologyGraph): RuleViolation[];
+/** CR-SM-355: the task-outcome rules — owned by trade / irr (TASK_OWNED_RULES), never in the kern focus. */
+export declare const TASK_OUTCOME_RULES: readonly [{
+    readonly id: "TR-01";
+    readonly name: "Trade decision recorded as CR";
+    readonly severity: "warning";
+    readonly evaluate: typeof tradeDecisionRecorded;
+    readonly domain: readonly ["graph"];
+}, {
+    readonly id: "IR-01";
+    readonly name: "Assumption review promoted to CR";
+    readonly severity: "warning";
+    readonly evaluate: typeof assumptionReviewPromoted;
+    readonly domain: readonly ["graph"];
+}];
+/** Evaluate the task-outcome rules (CR-SM-355). */
+export declare function evaluateTaskOutcomeRules(graph: OntologyGraph): RuleViolation[];
 /** Evaluate all analysis-freshness-presence rules. */
 export declare function evaluateAFRules(graph: OntologyGraph): RuleViolation[];

package/dist/se/analysis-freshness-rules.js

@@ -38,6 +38,77 @@ export const AF_RULES = [
     { id: 'AF-04', name: 'FMEA freshness stamp present', severity: 'warning', evaluate: fmeaFreshnessPresent, domain: ['graph'] },
     { id: 'AF-05', name: 'Implementation Plan freshness stamp present', severity: 'warning', evaluate: implplanFreshnessPresent, domain: ['graph'] },
 ];
+/**
+ * CR-SM-355: Task-Ausgangsregeln fuer trade und irr — die aus dem Task entstandenen Massnahmen sind
+ * als CR dokumentiert. Traeger ist `crRefs` im Frischestempel. Ohne Stempel feuern sie nicht (dann
+ * feuert der Eintritt AF-02/AF-03, und der Task ist nicht durch). `label` wird als `Trace.label`
+ * gelesen wie bei MS-02 — `decides` ist kein TraceType, sondern das SP-1-Label einer relation-Kante.
+ */
+function stampedCrRefs(graph, artifactId) {
+    const sys = graph.elements.find(e => e.type === 'SYS');
+    if (!sys)
+        return null;
+    const raw = sys.attributes?.analysisFreshness?.[artifactId];
+    const parsed = AnalysisFreshnessStampSchema.safeParse(raw);
+    if (!parsed.success)
+        return null;
+    return { sys, crRefs: parsed.data.crRefs ?? [] };
+}
+/** TR-01: a stamped trade study names >=1 existing CR, each carrying a relation(label: decides) edge. */
+export function tradeDecisionRecorded(graph) {
+    const stamped = stampedCrRefs(graph, 'trade');
+    if (!stamped)
+        return [];
+    const { sys, crRefs } = stamped;
+    const base = { rule_id: 'TR-01', severity: 'warning', context: { element_type: sys.type, element_name: sys.name } };
+    if (crRefs.length === 0) {
+        return [{
+                ...base,
+                element_id: sys.id,
+                message: 'Trade Study is stamped but names no decision CR (analysisFreshness.trade.crRefs is empty) — a trade without a recorded decision is a list, not a trade',
+                fix_hint: 'Record the decision as a CR with relation(label: decides) edges and list its id in analysisFreshness.trade.crRefs (se-trade)',
+            }];
+    }
+    const byId = new Map(graph.elements.map(e => [e.id, e]));
+    const decidesFrom = new Set(graph.traces.filter(t => t.type === 'relation' && t.label === 'decides').map(t => t.source));
+    return crRefs.flatMap(id => {
+        const cr = byId.get(id);
+        if (!cr || cr.type !== 'CR') {
+            return [{ ...base, element_id: sys.id, message: `Trade Study names ${id} as its decision, but no CR with that id exists`, fix_hint: 'Point analysisFreshness.trade.crRefs at an existing CR, or add the CR through graph_mutate (se-trade)' }];
+        }
+        if (!decidesFrom.has(id)) {
+            return [{ ...base, element_id: id, message: `${id} is named as a trade decision but carries no relation(label: decides) edge`, fix_hint: 'Add a relation edge from the CR to the element it decides, with label "decides" (se-trade)' }];
+        }
+        return [];
+    });
+}
+/** IR-01: every CR named by a stamped assumption review exists; an empty list is a legitimate outcome. */
+export function assumptionReviewPromoted(graph) {
+    const stamped = stampedCrRefs(graph, 'assumption-review');
+    if (!stamped)
+        return [];
+    const { sys, crRefs } = stamped;
+    const byId = new Map(graph.elements.map(e => [e.id, e]));
+    return crRefs
+        .filter(id => byId.get(id)?.type !== 'CR')
+        .map(id => ({
+        rule_id: 'IR-01',
+        severity: 'warning',
+        element_id: sys.id,
+        message: `Assumption Review names ${id} as a promoted assumption, but no CR with that id exists`,
+        fix_hint: 'Point analysisFreshness.assumption-review.crRefs at an existing CR, or add the CR through graph_mutate (se-irr)',
+        context: { element_type: sys.type, element_name: sys.name },
+    }));
+}
+/** CR-SM-355: the task-outcome rules — owned by trade / irr (TASK_OWNED_RULES), never in the kern focus. */
+export const TASK_OUTCOME_RULES = [
+    { id: 'TR-01', name: 'Trade decision recorded as CR', severity: 'warning', evaluate: tradeDecisionRecorded, domain: ['graph'] },
+    { id: 'IR-01', name: 'Assumption review promoted to CR', severity: 'warning', evaluate: assumptionReviewPromoted, domain: ['graph'] },
+];
+/** Evaluate the task-outcome rules (CR-SM-355). */
+export function evaluateTaskOutcomeRules(graph) {
+    return TASK_OUTCOME_RULES.flatMap(r => r.evaluate(graph));
+}
 /** Evaluate all analysis-freshness-presence rules. */
 export function evaluateAFRules(graph) {
     return AF_RULES.flatMap(r => r.evaluate(graph));

package/dist/se/conformance-rules.d.ts

@@ -24,6 +24,7 @@ export declare const FileFactsSchema: z.ZodObject<{
     testCases: z.ZodDefault<z.ZodArray<z.ZodString>>;
     importedSymbols: z.ZodDefault<z.ZodArray<z.ZodString>>;
     parsedSymbols: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    zodSymbols: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 export type FileFacts = z.infer<typeof FileFactsSchema>;
 /** One file→file import edge (repo-relative paths) — the module-drift evidence (CR-212). */
@@ -44,6 +45,7 @@ export declare const CodeFactsSchema: z.ZodObject<{
         testCases: z.ZodDefault<z.ZodArray<z.ZodString>>;
         importedSymbols: z.ZodDefault<z.ZodArray<z.ZodString>>;
         parsedSymbols: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        zodSymbols: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
     importEdges: z.ZodOptional<z.ZodArray<z.ZodObject<{
         from: z.ZodString;
@@ -54,6 +56,10 @@ export declare const CodeFactsSchema: z.ZodObject<{
         open: "open";
         done: "done";
     }>>>;
+    fileScope: z.ZodOptional<z.ZodEnum<{
+        all: "all";
+        referenced: "referenced";
+    }>>;
 }, z.core.$strip>;
 export type CodeFacts = z.infer<typeof CodeFactsSchema>;
 /** A conformance rule: pure over (graph, facts) — never touches I/O itself. */
@@ -103,7 +109,6 @@ export interface ImportCoverage {
     unassigned: string[];
 }
 export declare function importCoverage(graph: OntologyGraph, facts: CodeFacts): ImportCoverage;
-/** All RC conformance rules — evaluated by executors that can supply CodeFacts. */
 export declare const CODE_CONFORMANCE_RULES: ConformanceRuleDefinition[];
 /** Run all RC rules against a graph + extracted code facts. */
 export declare function evaluateConformanceRules(graph: OntologyGraph, facts: CodeFacts): RuleViolation[];

package/dist/se/conformance-rules.js

@@ -15,7 +15,7 @@
  * @sigloch/contracts/se — single source of truth for SE validation rules.
  */
 import { z } from 'zod/v4';
-import { RealRefSchema, TestRefsSchema } from './ontology.js';
+import { readTestRefs, readRealRef } from './ontology.js';
 import { CLOSED_STATUS } from './cr-quality-rules.js';
 /** Parser facts about one source file (extracted by the executor). */
 export const FileFactsSchema = z.object({
@@ -29,6 +29,12 @@ export const FileFactsSchema = z.object({
     importedSymbols: z.array(z.string()).default([]),
     /** Symbols X invoked as `X.parse(` / `X.safeParse(` — the schema is actually used (CR-211). */
     parsedSymbols: z.array(z.string()).default([]),
+    /**
+     * Exported consts whose initializer is a Zod schema (`export const X = z.…`) — for RC-08
+     * (CR-SM-358). Optional, ABSENT = silence: the extractor did not look, which is not the
+     * same as "this file declares no schema" (same asymmetry as `declaredDependencies`).
+     */
+    zodSymbols: z.array(z.string()).optional(),
 });
 /** One file→file import edge (repo-relative paths) — the module-drift evidence (CR-212). */
 export const ImportEdgeSchema = z.object({
@@ -67,6 +73,13 @@ export const CodeFactsSchema = z.object({
      * `docs/cr/` was never looked at, it does not "have no CRs".
      */
     crFiles: z.record(z.string(), z.enum(['open', 'done'])).optional(),
+    /**
+     * Which files `files` covers (CR-SM-358): `referenced` = only files a realRef/testRefs
+     * entry names (the contract above), `all` = every source file of the repo. RC-09 asks
+     * "who ELSE parses this contract" and can only answer it over `all` — a partial scan
+     * would report the absence of what it never looked at. ABSENT = `referenced`.
+     */
+    fileScope: z.enum(['referenced', 'all']).optional(),
 });
 const missingFile = (facts, file) => facts.files[file]?.exists !== true;
 // RC-01: every valid FUNC realRef must resolve — file on disk, symbol declared in
@@ -81,14 +94,14 @@ function codeRefMustResolve(graph, facts) {
             continue;
         if (el.attributes?.concept === true || el.attributes?.external === true)
             continue;
-        const parsed = RealRefSchema.safeParse(el.attributes?.realRef);
-        if (!parsed.success)
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound')
             continue; // no/invalid binding → R-20 territory
-        const ref = parsed.data;
+        const ref = parsed.value;
         if (missingFile(facts, ref.file)) {
             violations.push({
                 rule_id: 'RC-01',
-                severity: 'error',
+                severity: 'warning',
                 element_id: el.id,
                 message: `${el.id} realRef.file '${ref.file}' does not exist on disk`,
                 fix_hint: 'Re-realize the FUNC (graph_realize) against the current source tree, or fix the moved/renamed file path',
@@ -101,7 +114,7 @@ function codeRefMustResolve(graph, facts) {
         if (!facts.files[ref.file].declaredSymbols.includes(ref.symbol)) {
             violations.push({
                 rule_id: 'RC-01',
-                severity: 'error',
+                severity: 'warning',
                 element_id: el.id,
                 message: `${el.id} realRef.symbol '${ref.symbol}' is not declared in '${ref.file}'`,
                 fix_hint: 'The symbol was renamed or removed — re-realize the FUNC against the current code',
@@ -125,14 +138,14 @@ function testRefMustResolve(graph, facts) {
             continue;
         if (el.attributes?.concept === true)
             continue;
-        const parsed = TestRefsSchema.safeParse(el.attributes?.testRefs);
-        if (!parsed.success)
+        const parsed = readTestRefs(el.attributes);
+        if (parsed.state !== 'bound')
             continue; // no/invalid binding → R-19 territory
-        for (const ref of parsed.data) {
+        for (const ref of parsed.value) {
             if (missingFile(facts, ref.file)) {
                 violations.push({
                     rule_id: 'RC-02',
-                    severity: 'error',
+                    severity: 'warning',
                     element_id: el.id,
                     message: `${el.id} testRefs entry file '${ref.file}' does not exist on disk`,
                     fix_hint: 'The test file was moved or deleted — rebind the TEST (graph_realize) to the current file, or drop the entry',
@@ -146,7 +159,7 @@ function testRefMustResolve(graph, facts) {
             if (caseName !== undefined && !facts.files[ref.file].testCases.some((name) => name.includes(caseName))) {
                 violations.push({
                     rule_id: 'RC-02',
-                    severity: 'error',
+                    severity: 'warning',
                     element_id: el.id,
                     message: `${el.id} testRefs entry case '${ref.case}' is not declared in '${ref.file}'`,
                     fix_hint: 'The test case was renamed or removed — rebind the TEST case name',
@@ -169,14 +182,14 @@ function schemaRefMustResolve(graph, facts) {
             continue;
         if (el.attributes?.concept === true || el.attributes?.external === true)
             continue;
-        const parsed = RealRefSchema.safeParse(el.attributes?.realRef);
-        if (!parsed.success)
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound')
             continue; // no/invalid binding → R-26 territory
-        const ref = parsed.data;
+        const ref = parsed.value;
         if (missingFile(facts, ref.file)) {
             violations.push({
                 rule_id: 'RC-03',
-                severity: 'error',
+                severity: 'warning',
                 element_id: el.id,
                 message: `${el.id} realRef.file '${ref.file}' does not exist on disk`,
                 fix_hint: 'Re-bind the SCHEMA (graph_realize) to the current source tree, or fix the moved/renamed file path',
@@ -189,7 +202,7 @@ function schemaRefMustResolve(graph, facts) {
         if (!facts.files[ref.file].declaredSymbols.includes(ref.symbol)) {
             violations.push({
                 rule_id: 'RC-03',
-                severity: 'error',
+                severity: 'warning',
                 element_id: el.id,
                 message: `${el.id} realRef.symbol '${ref.symbol}' is not a declared export in '${ref.file}'`,
                 fix_hint: 'The schema export was renamed or removed — re-bind the SCHEMA against the current code',
@@ -199,6 +212,61 @@ function schemaRefMustResolve(graph, facts) {
     }
     return violations;
 }
+// The files the MODEL names as a SCHEMA's interface: realRef files of the FUNCs io-connected
+// (producer or consumer) to a FLOW whose data format is this SCHEMA (FUNC ─io→ FLOW
+// ─relation→ SCHEMA), restricted to files that exist. RC-04 asks whether one of them parses
+// the schema, RC-09 whether anyone ELSE does — one derivation, so both ask the same question.
+function interfaceFiles(graph, schemaId, facts, typeOf) {
+    const flowIds = new Set(graph.traces
+        .filter(t => t.type === 'relation' && t.target === schemaId && typeOf.get(t.source) === 'FLOW')
+        .map(t => t.source));
+    if (flowIds.size === 0)
+        return [];
+    const funcIds = new Set(graph.traces
+        .filter(t => t.type === 'io' &&
+        ((flowIds.has(t.target) && typeOf.get(t.source) === 'FUNC') ||
+            (flowIds.has(t.source) && typeOf.get(t.target) === 'FUNC')))
+        .map(t => (flowIds.has(t.target) ? t.source : t.target)));
+    const files = [];
+    for (const fnId of funcIds) {
+        const fn = graph.elements.find(e => e.id === fnId);
+        const cr = readRealRef(fn?.attributes);
+        if (cr.state === 'bound' && !missingFile(facts, cr.value.file))
+            files.push(cr.value.file);
+    }
+    return files;
+}
+// Does `file` parse the schema? It must call `.parse`/`.safeParse` on the symbol AND have it in
+// scope — imported, or declared right there: the definition file does not import its own schema
+// (CR-SM-358, found by the positive control on graphcode's Format-E door, where the modelled
+// translator lives in the schema's own file).
+function parsesAt(facts, file, ref) {
+    const f = facts.files[file];
+    if (f?.exists !== true || !f.parsedSymbols.includes(ref.symbol))
+        return false;
+    return f.importedSymbols.includes(ref.symbol) || file === ref.file;
+}
+// Files outside `allowed` that import AND parse the symbol — the parsers the model does not
+// name. Test files (testCases present) are exempt; consumer ratchets cover them. Empty unless
+// the extractor saw every file (`fileScope: 'all'`): a partial scan cannot name who else parses.
+function foreignParsers(facts, symbol, allowed) {
+    if (facts.fileScope !== 'all')
+        return [];
+    return Object.entries(facts.files)
+        .filter(([file, f]) => f.exists && !allowed.has(file) && f.testCases.length === 0 &&
+        f.importedSymbols.includes(symbol) && f.parsedSymbols.includes(symbol))
+        .map(([file]) => file)
+        .sort();
+}
+// A SCHEMA whose realRef symbol is declared but, by the extractor's own account, not a Zod
+// schema. False when the extractor did not report `zodSymbols` (silence, not a verdict) or
+// when the symbol is not declared at all (RC-03's finding, not this one).
+function boundToNonZod(facts, ref) {
+    const f = facts.files[ref.file];
+    if (f?.exists !== true || f.zodSymbols === undefined)
+        return false;
+    return f.declaredSymbols.includes(ref.symbol) && !f.zodSymbols.includes(ref.symbol);
+}
 // RC-04: a bound SCHEMA that the graph says is realized at an interface must
 // actually be parsed there (CR-211). The graph gives the check LOCATIONS: FUNCs
 // io-connected to a FLOW whose data format IS this SCHEMA (FUNC ─io→ FLOW
@@ -218,43 +286,29 @@ function schemaRefMustBeUsed(graph, facts) {
             continue;
         if (el.attributes?.concept === true)
             continue;
-        const parsed = RealRefSchema.safeParse(el.attributes?.realRef);
-        if (!parsed.success || parsed.data.symbol === undefined)
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound' || parsed.value.symbol === undefined)
             continue;
-        const ref = parsed.data;
-        // The FLOWs whose data format is this SCHEMA (FLOW ─relation→ SCHEMA).
-        const flowIds = new Set(graph.traces
-            .filter(t => t.type === 'relation' && t.target === el.id && typeOf.get(t.source) === 'FLOW')
-            .map(t => t.source));
-        if (flowIds.size === 0)
-            continue;
-        // FUNCs io-connected to those FLOWs (producer or consumer).
-        const funcIds = new Set(graph.traces
-            .filter(t => t.type === 'io' &&
-            ((flowIds.has(t.target) && typeOf.get(t.source) === 'FUNC') ||
-                (flowIds.has(t.source) && typeOf.get(t.target) === 'FUNC')))
-            .map(t => (flowIds.has(t.target) ? t.source : t.target)));
-        // Realized FUNCs among them: a resolvable realRef whose file exists.
-        const realizedFiles = [];
-        for (const fnId of funcIds) {
-            const fn = graph.elements.find(e => e.id === fnId);
-            const cr = RealRefSchema.safeParse(fn?.attributes?.realRef);
-            if (cr.success && !missingFile(facts, cr.data.file))
-                realizedFiles.push(cr.data.file);
-        }
+        const ref = parsed.value;
+        if (boundToNonZod(facts, ref))
+            continue; // RC-08 owns this cause (CR-SM-358)
+        const realizedFiles = interfaceFiles(graph, el.id, facts, typeOf);
         if (realizedFiles.length === 0)
             continue; // nothing realized to check against
-        const usedSomewhere = realizedFiles.some(file => {
-            const f = facts.files[file];
-            return f.importedSymbols.includes(ref.symbol) && f.parsedSymbols.includes(ref.symbol);
-        });
+        const usedSomewhere = realizedFiles.some(file => parsesAt(facts, file, ref));
         if (!usedSomewhere) {
+            // CR-SM-358: where it IS parsed, if the extractor saw every file — then the finding says
+            // where the binding has to point, and RC-09 stays quiet about the same cause.
+            const actual = foreignParsers(facts, ref.symbol, new Set([ref.file, ...realizedFiles]));
             violations.push({
                 rule_id: 'RC-04',
                 severity: 'warning',
                 element_id: el.id,
-                message: `${el.id} schema '${ref.symbol}' is not parsed in any realized FUNC at its modelled interface`,
-                fix_hint: `Import and call ${ref.symbol}.parse()/.safeParse() in one of the io-connected FUNC's code files — or mark the SCHEMA concept:true if no code realizes it yet`,
+                message: `${el.id} schema '${ref.symbol}' is not parsed in any realized FUNC at its modelled interface` +
+                    (actual.length > 0 ? ` — it is parsed in: ${actual.join(', ')}` : ''),
+                fix_hint: actual.length > 0
+                    ? `The parse sits in ${actual.join(', ')}: point the FUNC realRef at that file, or move the parse into the modelled FUNC`
+                    : `Import and call ${ref.symbol}.parse()/.safeParse() in one of the io-connected FUNC's code files — or mark the SCHEMA concept:true if no code realizes it yet`,
                 context: { element_type: el.type, element_name: el.name },
             });
         }
@@ -295,12 +349,12 @@ function buildModResolver(graph) {
     for (const el of graph.elements) {
         if (el.type !== 'FUNC')
             continue;
-        const cr = RealRefSchema.safeParse(el.attributes?.realRef);
-        if (!cr.success)
+        const cr = readRealRef(el.attributes);
+        if (cr.state !== 'bound')
             continue;
         const modTrace = graph.traces.find(t => t.source === el.id && t.type === 'allocate' && typeOf.get(t.target) === 'MOD');
         if (modTrace)
-            fileToMod.set(cr.data.file, modTrace.target);
+            fileToMod.set(cr.value.file, modTrace.target);
     }
     // MOD.path longest-prefix fallback for files with no direct binding.
     const modPaths = graph.elements
@@ -439,10 +493,10 @@ function externalRefMustNameDependency(graph, facts) {
         // `concept: true` has no binding that could rot — a concept node claims nothing about code.
         if (el.attributes?.external !== true || el.attributes?.concept === true)
             continue;
-        const parsed = RealRefSchema.safeParse(el.attributes?.realRef);
-        if (!parsed.success)
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound')
             continue;
-        const match = WORKSPACE_PATH.exec(parsed.data.file);
+        const match = WORKSPACE_PATH.exec(parsed.value.file);
         if (!match)
             continue; // not the shape this rule can decide
         const pkg = `${WORKSPACE_SCOPE}/${match[1]}`;
@@ -452,7 +506,7 @@ function externalRefMustNameDependency(graph, facts) {
             rule_id: 'RC-06',
             severity: 'warning',
             element_id: el.id,
-            message: `${el.id} binds to '${parsed.data.file}', but '${pkg}' is not a declared dependency`,
+            message: `${el.id} binds to '${parsed.value.file}', but '${pkg}' is not a declared dependency`,
             fix_hint: `Add '${pkg}' to dependencies, or re-point the realRef at the package that now owns the symbol`,
             context: { element_type: el.type, element_name: el.name },
         });
@@ -514,14 +568,101 @@ function crNodeMatchesFile(graph, facts) {
     return violations;
 }
 /** All RC conformance rules — evaluated by executors that can supply CodeFacts. */
+// ---------------------------------------------------------------------------
+// RC-08 / RC-09 (CR-SM-358) — the contract has a checker, and only the modelled places use it.
+//
+// Why these two replace ND-01 in substance: parallel paths are not similar to each other
+// (spike CR-GC-637: name similarity 0.000 in 7 of 7 documented pairs); they share a CONTRACT.
+// A second translator of the same contract is found by asking who parses it, not what it
+// looks like. RC-01..RC-07 ask model → code ("does the binding resolve?"); RC-09 is the
+// first rule that asks code → model ("does the model know everyone who reads this?").
+// ---------------------------------------------------------------------------
+// RC-08: a bound SCHEMA must bind a Zod schema, not a type. A type is checked by the
+// compiler and gone at runtime: whatever produces the data cannot prove it, and whoever
+// reads it cannot check it. Data that nobody parses yet only has a reader nobody knows yet.
+function schemaRefMustBeZod(graph, facts) {
+    const violations = [];
+    for (const el of graph.elements) {
+        if (el.type !== 'SCHEMA')
+            continue;
+        if (el.attributes?.concept === true)
+            continue;
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound' || parsed.value.symbol === undefined)
+            continue;
+        const ref = parsed.value;
+        if (!boundToNonZod(facts, ref))
+            continue;
+        violations.push({
+            rule_id: 'RC-08',
+            severity: 'warning',
+            element_id: el.id,
+            message: `${el.id} realRef '${ref.symbol}' in '${ref.file}' is not a Zod schema — the contract cannot be checked at runtime`,
+            fix_hint: `Declare the contract as a Zod schema (export const ${ref.symbol}Schema = z.…) and bind the SCHEMA to it — a producer needs a checkable schema even while no reader is known`,
+            context: { element_type: el.type, element_name: el.name },
+        });
+    }
+    return violations;
+}
+// RC-09: a Zod-bound SCHEMA may be parsed only where the model says — in the realRef files
+// of its producers/translators (the same set RC-04 checks) or in its own definition file.
+// Any other file that imports AND parses the symbol is a translator the model does not
+// know: a second path. The definition may live in another package (no facts entry) — only a
+// proven type binding (RC-08) silences the rule. One finding per SCHEMA, listing the files — the count must not grow
+// with usage (Gate 7, class CR-GC-315). Test files (testCases present) are exempt; ratchets
+// in the consumer cover them. Runs only when the extractor saw every file (`fileScope:'all'`).
+function schemaParsedOnlyAtInterface(graph, facts) {
+    if (facts.fileScope !== 'all')
+        return [];
+    // (foreignParsers repeats this guard; checking here skips the graph walk entirely.)
+    const typeOf = new Map(graph.elements.map(e => [e.id, e.type]));
+    const violations = [];
+    for (const el of graph.elements) {
+        if (el.type !== 'SCHEMA')
+            continue;
+        if (el.attributes?.concept === true)
+            continue;
+        const parsed = readRealRef(el.attributes);
+        if (parsed.state !== 'bound' || parsed.value.symbol === undefined)
+            continue;
+        const ref = parsed.value;
+        // Only a PROVEN type binding silences RC-09 (RC-08 owns it). A definition outside this
+        // repo — the family's shared contracts live in @sigloch/contracts — has no facts entry,
+        // and those are exactly the contracts reused most; a `.parse()` on the symbol is already
+        // the evidence that it is a runtime checker.
+        if (boundToNonZod(facts, ref))
+            continue;
+        const iface = interfaceFiles(graph, el.id, facts, typeOf);
+        // One cause, one finding (Gate 4): if the model names an interface and NONE of it parses,
+        // the parse merely sits elsewhere — that is RC-04's finding (which names the file), not a
+        // second path. A second path needs a first one: a modelled parser AND a foreign one.
+        const ifaceParses = iface.some(file => parsesAt(facts, file, ref));
+        if (iface.length > 0 && !ifaceParses)
+            continue;
+        const foreign = foreignParsers(facts, ref.symbol, new Set([ref.file, ...iface]));
+        if (foreign.length === 0)
+            continue;
+        violations.push({
+            rule_id: 'RC-09',
+            severity: 'warning',
+            element_id: el.id,
+            message: `${el.id} schema '${ref.symbol}' is parsed in ${foreign.length} file(s) the model does not know as its producer or translator: ${foreign.join(', ')}`,
+            fix_hint: 'Route the caller through the modelled translator — or, if it is a translator in its own right, model it: FUNC ─io→ FLOW ─relation→ this SCHEMA, with the FUNC realRef on that file',
+            context: { element_type: el.type, element_name: el.name },
+        });
+    }
+    return violations;
+}
 export const CODE_CONFORMANCE_RULES = [
-    { id: 'RC-01', name: 'FUNC realRef resolves to a declared symbol', severity: 'error', domain: ['FUNC'], evaluate: codeRefMustResolve },
-    { id: 'RC-02', name: 'testRefs entries resolve to runnable tests', severity: 'error', domain: ['TEST'], evaluate: testRefMustResolve },
-    { id: 'RC-03', name: 'SCHEMA realRef resolves to a declared export', severity: 'error', domain: ['SCHEMA'], evaluate: schemaRefMustResolve },
+    { id: 'RC-01', name: 'FUNC realRef resolves to a declared symbol', severity: 'warning', domain: ['FUNC'], evaluate: codeRefMustResolve },
+    { id: 'RC-02', name: 'testRefs entries resolve to runnable tests', severity: 'warning', domain: ['TEST'], evaluate: testRefMustResolve },
+    { id: 'RC-03', name: 'SCHEMA realRef resolves to a declared export', severity: 'warning', domain: ['SCHEMA'], evaluate: schemaRefMustResolve },
     { id: 'RC-04', name: 'SCHEMA realRef is parsed at its interface', severity: 'warning', domain: ['SCHEMA'], evaluate: schemaRefMustBeUsed },
     { id: 'RC-05', name: 'cross-module import drift', severity: 'warning', domain: ['MOD'], evaluate: importDriftConformance },
     { id: 'RC-06', name: 'external realRef names a declared dependency', severity: 'warning', domain: ['FUNC', 'MOD', 'SCHEMA'], evaluate: externalRefMustNameDependency },
     { id: 'RC-07', name: 'CR node agrees with docs/cr', severity: 'warning', domain: ['CR', 'SYS'], evaluate: crNodeMatchesFile },
+    { id: 'RC-08', name: 'SCHEMA realRef is a Zod schema', severity: 'warning', domain: ['SCHEMA'], evaluate: schemaRefMustBeZod },
+    { id: 'RC-09', name: 'SCHEMA is parsed only at its modelled interface', severity: 'warning', domain: ['SCHEMA'], evaluate: schemaParsedOnlyAtInterface },
 ];
 /** Run all RC rules against a graph + extracted code facts. */
 export function evaluateConformanceRules(graph, facts) {

package/dist/se/cr-quality-rules.d.ts

@@ -8,6 +8,11 @@ import type { MetricPolicy } from './policy.js';
 /**
  * Abgeschlossen heisst: nicht mehr steuerbar. Alles andere ist Grundgesamtheit.
  * Exportiert fuer RC-07 (CR-SM-329), das dieselbe Frage gegen `docs/cr/done/` stellt.
+ *
+ * CR-SM-362 (ITEM-2026-536): nur noch `done`. Die Menge kannte `dropped`/`rejected`, der
+ * Element-Vertrag (`OntologyElement.status`) nicht — die Regeln rechneten mit Werten, die der
+ * Vertrag verbietet. Verworfen ist eine Begruendung im CR-Text, kein eigener Zustand: das
+ * Verzeichnis `done/` schliesst ihn, der Knoten spiegelt `done`.
  */
 export declare const CLOSED_STATUS: ReadonlySet<string>;
 export declare const CR_RULES: RuleDefinition[];

package/dist/se/cr-quality-rules.js

@@ -36,8 +36,13 @@ const SCOPE_TYPES = new Set(['FUNC', 'MOD', 'SCHEMA', 'REQ', 'UC']);
 /**
  * Abgeschlossen heisst: nicht mehr steuerbar. Alles andere ist Grundgesamtheit.
  * Exportiert fuer RC-07 (CR-SM-329), das dieselbe Frage gegen `docs/cr/done/` stellt.
+ *
+ * CR-SM-362 (ITEM-2026-536): nur noch `done`. Die Menge kannte `dropped`/`rejected`, der
+ * Element-Vertrag (`OntologyElement.status`) nicht — die Regeln rechneten mit Werten, die der
+ * Vertrag verbietet. Verworfen ist eine Begruendung im CR-Text, kein eigener Zustand: das
+ * Verzeichnis `done/` schliesst ihn, der Knoten spiegelt `done`.
  */
-export const CLOSED_STATUS = new Set(['done', 'dropped', 'rejected']);
+export const CLOSED_STATUS = new Set(['done']);
 function crMustTrack(graph) {
     const typeOf = new Map(graph.elements.map(e => [e.id, e.type]));
     const crs = graph.elements.filter(e => {
@@ -49,7 +54,7 @@ function crMustTrack(graph) {
         .filter(cr => !graph.traces.some(t => t.source === cr.id && t.type === 'relation' && SCOPE_TYPES.has(typeOf.get(t.target) ?? '')))
         .map(cr => ({
         rule_id: 'CR-R01',
-        severity: 'error',
+        severity: 'warning',
         element_id: cr.id,
         message: `${cr.id} names no scope (no relation to FUNC/MOD/SCHEMA/REQ/UC)`,
         fix_hint: 'Add a relation trace to the FUNC, MOD, SCHEMA, REQ or UC this CR changes — a milestone alone is a date, not a scope',
@@ -76,7 +81,7 @@ function crDoneRequiresCommit(graph) {
     })
         .map(cr => ({
         rule_id: 'CR-R02',
-        severity: 'error',
+        severity: 'warning',
         element_id: cr.id,
         message: `${cr.id} is done but has no commitRef`,
         fix_hint: 'Add commitRef with Git SHA, or set architectureOnly=true',
@@ -176,8 +181,8 @@ function crShouldHaveMilestone(graph) {
 // Exports
 // ---------------------------------------------------------------------------
 export const CR_RULES = [
-    { id: 'CR-R01', name: 'CR must track', severity: 'error', evaluate: crMustTrack, domain: ['CR'] },
-    { id: 'CR-R02', name: 'Done requires commit', severity: 'error', evaluate: crDoneRequiresCommit, domain: ['CR'] },
+    { id: 'CR-R01', name: 'CR must track', severity: 'warning', evaluate: crMustTrack, domain: ['CR'] },
+    { id: 'CR-R02', name: 'Done requires commit', severity: 'warning', evaluate: crDoneRequiresCommit, domain: ['CR'] },
     // CR-SM-243: domain ist 'all', nicht CR — die Regel meldet am getrackten ZIELKNOTEN
     // ("dieser Knoten wird von 2 offenen CRs angefasst"), und der kann jeden Typ haben. Eine
     // Aufzaehlung waere eine Momentaufnahme der heute getrackten Typen, kein Modell; 'all'

package/dist/se/evaluate-all.js

@@ -10,7 +10,7 @@ import { CR_RULES, evaluateCRRules } from './cr-quality-rules.js';
 import { ND_RULES, evaluateNDRules } from './near-duplicate-rules.js';
 import { AO_RULES, evaluateAORules } from './ao-rules.js';
 import { BQ_RULES, evaluateBQRules } from './quality-rules.js';
-import { AF_RULES, evaluateAFRules } from './analysis-freshness-rules.js';
+import { AF_RULES, evaluateAFRules, TASK_OUTCOME_RULES, evaluateTaskOutcomeRules } from './analysis-freshness-rules.js';
 import { CODE_CONFORMANCE_RULES } from './conformance-rules.js';
 /**
  * CR-SM-285: das Profil haengt am KATALOG, nicht am ID-Praefix.
@@ -36,6 +36,7 @@ const CATALOGS = [
     { profile: 'se', rules: FM_RULES },
     { profile: 'se', rules: VIEW_RULES },
     { profile: 'se', rules: AF_RULES },
+    { profile: 'se', rules: TASK_OUTCOME_RULES }, // CR-SM-355: Task-Ausgaenge trade / irr
     // Sprach-/Textqualitaet statt SE-Struktur — das ist die Trennlinie, die die Praefixliste meinte.
     { profile: 'coding', rules: BQ_RULES },
     { profile: 'coding', rules: ND_RULES },
@@ -97,5 +98,6 @@ export function evaluateAllRules(graph, policy) {
         ...evaluateFMRules(graph, policy),
         ...evaluateViewRules(graph, policy),
         ...evaluateAFRules(graph),
+        ...evaluateTaskOutcomeRules(graph), // CR-SM-355
     ];
 }

package/dist/se/fmea-rules.js

@@ -7,7 +7,7 @@
  *   by dimension nature: physical budgets (weight/power/cost) live on the part
  *   (MOD); behavioral budgets (timing/memory-throughput) on the FCHAIN/FUNC.
  */
-import { TestRefsSchema } from './ontology.js';
+import { readTestRefs } from './ontology.js';
 import { actionPriority, apMethod } from './action-priority.js';
 const PHYSICAL_BUDGET_PAIRS = [
     ['costBudget', 'measuredCost', 'cost'],
@@ -106,10 +106,10 @@ export function fm03HighRiskUnverified(graph, policy) {
             graph.elements.some(el => {
                 if (el.id !== t.source || el.type !== 'TEST')
                     return false;
-                const parsed = TestRefsSchema.safeParse(el.attributes?.testRefs);
-                if (!parsed.success)
+                const parsed = readTestRefs(el.attributes);
+                if (parsed.state !== 'bound')
                     return false; // keine Bindung → keine Evidenz
-                return parsed.data.every(ref => ref.result === 'passed');
+                return parsed.value.every(ref => ref.result === 'passed');
             }));
         return !hasPassedTest;
     })
@@ -121,7 +121,7 @@ export function fm03HighRiskUnverified(graph, policy) {
         // dieselbe Quelle. `rpn-interim` heisst „bestaetigtes AP, wo bekannt; RPN, wo nicht".
         return {
             rule_id: 'FM-03',
-            severity: 'error',
+            severity: 'warning',
             element_id: e.id,
             message: `${e.id} has Action Priority High (S${s}/O${o}/D${d}, ${method}) without passed test verification`,
             fix_hint: 'Add a TEST whose every testRefs entry has result=passed, and a verify trace to this risk REQ',
@@ -166,7 +166,7 @@ export function nfr01BudgetOvershoot(graph) {
 export const FM_RULES = [
     { id: 'FM-01', name: 'RiskReqFmeaAttributes', severity: 'warning', evaluate: fm01MissingFmeaAttributes, domain: ['REQ'] },
     { id: 'FM-02', name: 'RiskReqMitigation', severity: 'warning', evaluate: fm02MissingMitigation, domain: ['REQ'] },
-    { id: 'FM-03', name: 'HighRiskVerification', severity: 'error', evaluate: fm03HighRiskUnverified, domain: ['REQ'] },
+    { id: 'FM-03', name: 'HighRiskVerification', severity: 'warning', evaluate: fm03HighRiskUnverified, domain: ['REQ'] },
     // CR-SM-243: die Regel prueft drei Typen, nicht einen — physische Budgets am MOD
     // (PHYSICAL_BUDGET_TYPES), Verhaltensbudgets an FUNC und FCHAIN (BEHAVIORAL_BUDGET_TYPES).
     // Die domain nennt dieselben Mengen wie die beiden Konstanten oben; wer eine davon