@sigloch/contracts 6.1.0 → 9.1.0

package/dist/se/rules.js

@@ -5,7 +5,8 @@
  */
 import { z } from 'zod/v4';
 import { ElementType, TraceType, TestRefsSchema, RealRefSchema } from './ontology.js';
-import { isValidTrace } from './meta-model.js';
+import { isValidTrace, BOUNDED_PATTERNS, maxOccurs } from './meta-model.js';
+import { indexOf } from './graph-index.js';
 export const RuleSeverity = z.enum(['error', 'warning', 'info']);
 /** Candidate target for resolving a violation (e.g. a REQ to satisfy, a TEST to link). */
 export const ViolationCandidate = z.object({
@@ -44,21 +45,25 @@ export const RuleViolation = z.object({
  * Blaettern (so schon R-30 seit CR-SM-249, so R-20 seit CR-210).
  *
  * Bewusst EIN Helper statt drei Kopien: eine zweite Definition von "Blatt" waere ein
- * zweiter Weg zu derselben Aussage, und der billigere gewinnt immer.
+ * zweiter Weg zu derselben Aussage, und der billigere gewinnt immer. CR-SM-263 haengt als
+ * vierter Nutzer daran (MT-02, `metric-rules.ts`) — deshalb exportiert.
  */
-function decomposedFuncs(graph) {
-    const funcIds = new Set(graph.elements.filter(e => e.type === 'FUNC').map(f => f.id));
+export function decomposedFuncs(graph) {
+    const idx = indexOf(graph);
+    const funcIds = new Set(idx.elementsOfType('FUNC').map(f => f.id));
     return new Set(graph.traces
         .filter(t => t.type === 'compose' && funcIds.has(t.source) && funcIds.has(t.target))
         .map(t => t.source));
 }
 function findParentModule(graph, elementId) {
-    const trace = graph.traces.find(t => t.source === elementId && t.type === 'allocate');
+    const idx = indexOf(graph);
+    const trace = idx.out(elementId, 'allocate')[0];
     return trace?.target;
 }
 /** Get all outgoing traces of a given type from an element. */
 function outgoingTraces(graph, elementId, traceType) {
-    return graph.traces.filter(t => t.source === elementId && (!traceType || t.type === traceType));
+    const idx = indexOf(graph);
+    return traceType === undefined ? idx.outAll(elementId) : idx.out(elementId, traceType);
 }
 /** Tokenize id/name/description into a lowercase token set (drops tokens < 3 chars). */
 function overlapTokens(...parts) {
@@ -69,35 +74,69 @@ function overlapTokens(...parts) {
         .split(/[^a-z0-9]+/)
         .filter(t => t.length >= 3));
 }
+/**
+ * CR-SM-261: Tokenmenge je Element, einmal je Prozess statt einmal je Vergleich.
+ *
+ * `toCandidates` rief `overlapTokens` frueher INNERHALB des Sort-Komparators auf. Ein Sort
+ * ueber k Kandidaten macht rund k·log k Vergleiche, jeder Vergleich hat beide Seiten neu
+ * tokenisiert (join + toLowerCase + Regex-Split) — und das je meldendem Element. Bei R-31 mit
+ * 33 Befunden gegen 46 FLOWs sind das ueber 11 000 Tokenisierungen fuer 46 verschiedene
+ * Elemente. Das Profil aus CR-SM-260 hat R-31 deshalb mit 25,9 % und n^2,10 gemessen, obwohl
+ * die Regel selbst nur Mengen aufbaut: die Kosten lagen vollstaendig in der Kandidatenliste.
+ *
+ * Der Schluessel ist das Element-OBJEKT, nicht die id — zwei Graphen im selben Prozess (der
+ * Probegraph aus `applyRule` neben dem Original) teilen sich ids, aber nicht die Objekte.
+ * `WeakMap` gibt die Eintraege frei, sobald der Graph es tut; es entsteht kein Cache, den
+ * jemand invalidieren muesste, und damit auch keine zweite Wahrheit ueber ein Element.
+ */
+const TOKEN_CACHE = new WeakMap();
+function tokensOf(e) {
+    let t = TOKEN_CACHE.get(e);
+    if (t === undefined) {
+        t = overlapTokens(e.id, e.name, e.description);
+        TOKEN_CACHE.set(e, t);
+    }
+    return t;
+}
 /**
  * Map elements to ViolationCandidate format. When `ref` is given, rank candidates
  * by id/name/description token overlap with `ref` (descending) so the most relevant
  * target is first — e.g. REQ-bootstrap → TEST-bootstrap (CR-GC-203 item 3). Ranking
  * is a hint, not an auto-link; semantic confirmation stays with the caller.
  */
-function toCandidates(elements, ref) {
+function toCandidates(
+// CR-SM-264: `readonly`, weil die Kandidaten jetzt aus `idx.elementsOfType()` kommen. Seit
+// CR-SM-261 sortiert diese Funktion ohnehin eine eigene Liste (decorate-sort-undecorate) und
+// fasst die Eingabe nicht mehr an — der mutable Typ war schon vorher zu weit.
+elements, ref) {
     if (!ref)
         return elements.map(e => ({ id: e.id, type: e.type, name: e.name }));
-    const refTokens = overlapTokens(ref.id, ref.name, ref.description);
+    const refTokens = tokensOf(ref);
     const score = (e) => {
         let n = 0;
-        for (const tok of overlapTokens(e.id, e.name, e.description))
+        for (const tok of tokensOf(e))
             if (refTokens.has(tok))
                 n++;
         return n;
     };
-    return [...elements]
-        .sort((a, b) => score(b) - score(a))
-        .map(e => ({ id: e.id, type: e.type, name: e.name }));
+    // CR-SM-261: EINMAL bewerten, dann sortieren. Vorher stand `score` im Komparator und lief
+    // damit rund 2·k·log k mal statt k mal. Der Index ist der Gleichstands-Tiebreak und haelt die
+    // Ausgabe byte-identisch: `Array.prototype.sort` ist seit ES2019 stabil, die alte Fassung hat
+    // bei gleichem Score also die Eingangsreihenfolge behalten — diese tut es explizit.
+    return elements
+        .map((e, i) => ({ e, i, s: score(e) }))
+        .sort((a, b) => b.s - a.s || a.i - b.i)
+        .map(({ e }) => ({ id: e.id, type: e.type, name: e.name }));
 }
 // ---------------------------------------------------------------------------
 // R-01: Every REQ must have at least one verify trace
 // ---------------------------------------------------------------------------
 function reqMustHaveVerification(graph) {
-    const reqs = graph.elements.filter(e => e.type === 'REQ');
-    const tests = graph.elements.filter(e => e.type === 'TEST');
+    const idx = indexOf(graph);
+    const reqs = idx.elementsOfType('REQ');
+    const tests = idx.elementsOfType('TEST');
     return reqs
-        .filter(req => !graph.traces.some(t => t.target === req.id && t.type === 'verify'))
+        .filter(req => idx.in(req.id, 'verify').length === 0)
         .map(req => ({
         rule_id: 'R-01',
         severity: 'error',
@@ -116,14 +155,15 @@ function reqMustHaveVerification(graph) {
 // R-02: Every FUNC must satisfy at least one REQ
 // ---------------------------------------------------------------------------
 function funcMustSatisfyReq(graph) {
+    const idx = indexOf(graph);
     // CR-SM-256: Grundgesamtheit sind die BLAETTER. Ein zerlegter FUNC erfuellt keine REQ,
     // die nicht schon eine seiner Blatt-Funktionen erfuellt — wer ihn befriedigen will,
     // muss eine satisfy-Kante erfinden, die dieselbe REQ ein zweites Mal beansprucht.
     // Am graphcode-Selbstmodell (graphVersion 171) melden 12 der 13 Bloecke R-02 UND R-31,
     // also dieselbe Ursache zweimal gezaehlt — die Klasse CR-SM-235/-242.
     const decomposed = decomposedFuncs(graph);
-    const funcs = graph.elements.filter(e => e.type === 'FUNC' && !decomposed.has(e.id));
-    const allReqs = graph.elements.filter(e => e.type === 'REQ');
+    const funcs = idx.elementsOfType('FUNC').filter(e => !decomposed.has(e.id));
+    const allReqs = idx.elementsOfType('REQ');
     // CR-GC-366: der Filter prueft den ZIELTYP. Vorher war er zieltyp-blind (`type === 'satisfy'`),
     // womit ein `FUNC -satisfy-> UC` die Regel stumm schaltete, obwohl kein Requirement erfuellt war —
     // der Regelname versprach mehr als der Code pruefte. Am graphcode-Selbstmodell verdeckte das 6 von
@@ -132,15 +172,15 @@ function funcMustSatisfyReq(graph) {
     // Ziele das Meta-Modell gerade zulaesst.
     const reqIds = new Set(allReqs.map(r => r.id));
     return funcs
-        .filter(fn => !graph.traces.some(t => t.source === fn.id && t.type === 'satisfy' && reqIds.has(t.target)))
+        .filter(fn => !idx.out(fn.id, 'satisfy').some(t => reqIds.has(t.target)))
         .map(fn => {
         const modId = findParentModule(graph, fn.id);
         // Candidate REQs: same module's other FUNCs satisfy these, or constraints referencing this func
         const siblingReqs = modId
             ? graph.traces
                 .filter(t => t.type === 'allocate' && t.target === modId && t.source !== fn.id)
-                .flatMap(t => graph.traces.filter(st => st.source === t.source && st.type === 'satisfy'))
-                .map(st => graph.elements.find(e => e.id === st.target))
+                .flatMap(t => idx.out(t.source, 'satisfy'))
+                .map(st => idx.byId.get(st.target))
                 .filter((e) => !!e)
             : [];
         // Also include constraints whose description mentions this func's name
@@ -167,12 +207,13 @@ function funcMustSatisfyReq(graph) {
 // R-03: ASIL isolation
 // ---------------------------------------------------------------------------
 function asilIsolation(graph) {
+    const idx = indexOf(graph);
     const violations = [];
-    const modules = graph.elements.filter(e => e.type === 'MOD');
+    const modules = idx.elementsOfType('MOD');
     for (const mod of modules) {
         const allocated = graph.traces
             .filter(t => t.target === mod.id && t.type === 'allocate')
-            .map(t => graph.elements.find(e => e.id === t.source))
+            .map(t => idx.byId.get(t.source))
             .filter((e) => !!e);
         const hasD = allocated.some(e => e.asil === 'D');
         const hasQM = allocated.some(e => e.asil === 'QM');
@@ -206,22 +247,22 @@ function asilIsolation(graph) {
 // `null` → messen, nicht urteilen: die Regel schweigt.
 // ---------------------------------------------------------------------------
 function maxModuleSize(graph, policy) {
+    const idx = indexOf(graph);
     const violations = [];
     const steps = policy.moduleSize;
     if (steps === null)
         return violations;
-    const modules = graph.elements.filter(e => e.type === 'MOD');
+    const modules = idx.elementsOfType('MOD');
     for (const mod of modules) {
-        const allocatedIds = graph.traces.filter(t => t.target === mod.id && t.type === 'allocate').map(t => t.source);
-        const allocated = allocatedIds.map(id => graph.elements.find(e => e.id === id)).filter((e) => !!e);
+        const allocatedIds = idx.in(mod.id, 'allocate').map(t => t.source);
+        const allocated = allocatedIds.map(id => idx.byId.get(id)).filter((e) => !!e);
         const funcCount = allocated.length;
         if (funcCount <= steps.coupled)
             continue;
         // Count crossing flows: io paths from FUNCs in this module to FUNCs in other modules
         const funcIds = new Set(allocatedIds);
-        const crossings = graph.traces.filter(t => {
-            if (t.type !== 'io')
-                return false;
+        // CR-SM-264: nur die io-Kanten, nicht alle Traces je MOD.
+        const crossings = idx.tracesOfType('io').filter(t => {
             const srcIn = funcIds.has(t.source);
             const tgtIn = funcIds.has(t.target);
             return (srcIn && !tgtIn) || (!srcIn && tgtIn);
@@ -263,10 +304,11 @@ function maxModuleSize(graph, policy) {
 // R-05: Every TEST must verify at least one REQ
 // ---------------------------------------------------------------------------
 function testMustVerifyReq(graph) {
-    const tests = graph.elements.filter(e => e.type === 'TEST');
-    const allReqs = graph.elements.filter(e => e.type === 'REQ');
+    const idx = indexOf(graph);
+    const tests = idx.elementsOfType('TEST');
+    const allReqs = idx.elementsOfType('REQ');
     return tests
-        .filter(test => !graph.traces.some(t => t.source === test.id && t.type === 'verify'))
+        .filter(test => idx.out(test.id, 'verify').length === 0)
         .map(test => ({
         rule_id: 'R-05',
         severity: 'warning',
@@ -290,11 +332,13 @@ function testMustVerifyReq(graph) {
 // R-08: Bidirectional trace consistency
 // ---------------------------------------------------------------------------
 function traceConsistency(graph) {
+    const idx = indexOf(graph);
+    // CR-SM-266 D5: kein `category !== 'audit'`-Filter mehr — das Attribut ist weg, und mit ihm
+    // die Moeglichkeit, eine Kante per Selbstauskunft aus der Referenzintegritaet zu nehmen.
     return graph.traces
-        .filter(t => t.category !== 'audit')
         .filter(t => {
-        const sourceExists = graph.elements.some(e => e.id === t.source);
-        const targetExists = graph.elements.some(e => e.id === t.target);
+        const sourceExists = idx.byId.has(t.source);
+        const targetExists = idx.byId.has(t.target);
         return !sourceExists || !targetExists;
     })
         .map(t => ({
@@ -315,11 +359,14 @@ function traceConsistency(graph) {
 // concern, stricter check — no parallel path); up to two warnings per FLOW.
 // ---------------------------------------------------------------------------
 function flowCompleteness(graph) {
-    const flows = graph.elements.filter(e => e.type === 'FLOW');
+    const idx = indexOf(graph);
+    const flows = idx.elementsOfType('FLOW');
     // Producers/consumers of a FLOW are FUNCs or ACTORs (io endpoints on the
-    // upstream/downstream side); UC may consume too. Offer both as candidates.
-    const sources = graph.elements.filter(e => e.type === 'FUNC' || e.type === 'ACTOR');
-    const io = graph.traces.filter(t => t.type === 'io');
+    // upstream/downstream side). CR-SM-266 D4: UC ist KEIN Konsument mehr — das Pattern
+    // `FLOW -io-> UC` ist entfallen, ein FLOW erreicht einen UC nur noch ueber ein Kettenglied.
+    // Der fix_hint hat den UC vorher noch angeboten und haette in eine R-18-Ablehnung gefuehrt.
+    const sources = graph.elements.filter(e => e.type === 'FUNC' || e.type === 'ACTOR'); // Mehrtyp: ein Durchlauf ist hier billiger als vier Index-Listen zu mischen (Reihenfolge!)
+    const io = idx.tracesOfType('io');
     const violations = [];
     for (const f of flows) {
         const ctx = { element_type: f.type, element_name: f.name, candidate_targets: toCandidates(sources) };
@@ -339,7 +386,7 @@ function flowCompleteness(graph) {
                 severity: 'warning',
                 element_id: f.id,
                 message: `${f.id} has no consumer (outgoing io)`,
-                fix_hint: 'Link a FUNC, ACTOR, or UC as the target via io trace',
+                fix_hint: 'Link a FUNC or ACTOR as the target via io trace',
                 context: ctx,
             });
         }
@@ -361,6 +408,7 @@ function flowCompleteness(graph) {
 /** Trace types on which a direct 2-cycle is a real finding (CR-GC-315). */
 const CIRCULAR_TRACE_TYPES = new Set(['compose', 'allocate', 'relation']);
 function noDirectCircular(graph) {
+    const idx = indexOf(graph);
     const violations = [];
     // Direction-independent key: A↔B is ONE cycle, reported once. Keying on the
     // message (CR-GC-315 predecessor) never collapsed anything — the two
@@ -369,7 +417,7 @@ function noDirectCircular(graph) {
     for (const t of graph.traces) {
         if (!CIRCULAR_TRACE_TYPES.has(t.type))
             continue;
-        if (!graph.traces.some(other => other.source === t.target && other.target === t.source && other.type === t.type))
+        if (!idx.out(t.target, t.type).some(other => other.target === t.source))
             continue;
         const key = `${t.type}|${[t.source, t.target].sort().join('|')}`;
         if (seen.has(key))
@@ -391,12 +439,12 @@ function noDirectCircular(graph) {
 // RD-01: Unresolved requirement (leaf REQ without satisfy)
 // ---------------------------------------------------------------------------
 function unresolvedRequirement(graph) {
-    const reqs = graph.elements.filter(e => e.type === 'REQ');
+    const idx = indexOf(graph);
+    const reqs = idx.elementsOfType('REQ');
     // Leaf REQs: no compose→REQ children
-    const leafReqs = reqs.filter(req => !graph.traces.some(t => t.source === req.id && t.type === 'compose' &&
-        graph.elements.some(e => e.id === t.target && e.type === 'REQ')));
+    const leafReqs = reqs.filter(req => !idx.out(req.id, 'compose').some(t => idx.typeOf(t.target) === 'REQ'));
     return leafReqs
-        .filter(req => !graph.traces.some(t => t.target === req.id && t.type === 'satisfy'))
+        .filter(req => idx.in(req.id, 'satisfy').length === 0)
         .map(req => ({
         rule_id: 'RD-01',
         severity: 'warning',
@@ -415,12 +463,11 @@ function unresolvedRequirement(graph) {
 // RD-02: Decomposition consistency (parent REQ should not have FUNC satisfy)
 // ---------------------------------------------------------------------------
 function decompositionConsistency(graph) {
-    const reqs = graph.elements.filter(e => e.type === 'REQ');
-    const parentReqs = reqs.filter(req => graph.traces.some(t => t.source === req.id && t.type === 'compose' &&
-        graph.elements.some(e => e.id === t.target && e.type === 'REQ')));
+    const idx = indexOf(graph);
+    const reqs = idx.elementsOfType('REQ');
+    const parentReqs = reqs.filter(req => idx.out(req.id, 'compose').some(t => idx.typeOf(t.target) === 'REQ'));
     return parentReqs
-        .filter(req => graph.traces.some(t => t.target === req.id && t.type === 'satisfy' &&
-        graph.elements.some(e => e.id === t.source && e.type === 'FUNC')))
+        .filter(req => idx.in(req.id, 'satisfy').some(t => idx.typeOf(t.source) === 'FUNC'))
         .map(req => ({
         rule_id: 'RD-02',
         severity: 'warning',
@@ -434,18 +481,18 @@ function decompositionConsistency(graph) {
 // RD-03: No premature decomposition (all children same satisfy target)
 // ---------------------------------------------------------------------------
 function noPrematureDecomposition(graph) {
-    const reqs = graph.elements.filter(e => e.type === 'REQ');
-    const parentReqs = reqs.filter(req => graph.traces.some(t => t.source === req.id && t.type === 'compose' &&
-        graph.elements.some(e => e.id === t.target && e.type === 'REQ')));
+    const idx = indexOf(graph);
+    const reqs = idx.elementsOfType('REQ');
+    const parentReqs = reqs.filter(req => idx.out(req.id, 'compose').some(t => idx.typeOf(t.target) === 'REQ'));
     return parentReqs
         .filter(parent => {
         const childIds = graph.traces
             .filter(t => t.source === parent.id && t.type === 'compose' &&
-            graph.elements.some(e => e.id === t.target && e.type === 'REQ'))
+            idx.typeOf(t.target) === 'REQ')
             .map(t => t.target);
         if (childIds.length < 2)
             return false;
-        const satisfyTargets = childIds.map(cid => graph.traces.filter(t => t.source !== cid && t.target === cid && t.type === 'satisfy').map(t => t.source));
+        const satisfyTargets = childIds.map(cid => idx.in(cid, 'satisfy').filter(t => t.source !== cid).map(t => t.source));
         // All children satisfied by the same single source
         const allSame = satisfyTargets.every(targets => targets.length === 1 && targets[0] === satisfyTargets[0]?.[0]);
         return allSame && satisfyTargets[0]?.length === 1;
@@ -473,8 +520,10 @@ function noPrematureDecomposition(graph) {
  */
 const DECOMPOSITION_BREADTH_MAX = 11;
 function decompositionBreadth(graph) {
-    const typeOf = new Map(graph.elements.map(e => [e.id, e.type]));
-    const byId = new Map(graph.elements.map(e => [e.id, e]));
+    const idx = indexOf(graph);
+    // CR-SM-264: `typeOf` und `byId` baute diese Regel je Aufruf selbst — der Index hat beide.
+    const typeOf = idx;
+    const byId = idx.byId;
     const counts = new Map();
     const bump = (parentId, kind) => {
         const key = `${parentId}\u0000${kind}`;
@@ -485,8 +534,8 @@ function decompositionBreadth(graph) {
             counts.set(key, { parentId, kind, n: 1 });
     };
     for (const t of graph.traces) {
-        const src = typeOf.get(t.source);
-        const tgt = typeOf.get(t.target);
+        const src = typeOf.typeOf(t.source);
+        const tgt = typeOf.typeOf(t.target);
         if (t.type === 'compose' && src === 'FUNC' && tgt === 'FUNC') {
             bump(t.source, 'sub-FUNC');
         }
@@ -515,9 +564,10 @@ function decompositionBreadth(graph) {
 // R-14: UC must have at least 1 compose trace (→ FCHAIN or REQ) (CR-117)
 // ---------------------------------------------------------------------------
 function ucMustHaveCompose(graph) {
-    const ucs = graph.elements.filter(e => e.type === 'UC');
+    const idx = indexOf(graph);
+    const ucs = idx.elementsOfType('UC');
     return ucs
-        .filter(uc => !graph.traces.some(t => t.source === uc.id && t.type === 'compose'))
+        .filter(uc => idx.out(uc.id, 'compose').length === 0)
         .map(uc => ({
         rule_id: 'R-14',
         severity: 'warning',
@@ -549,14 +599,15 @@ function ucMustHaveCompose(graph) {
 // einen einzigen Befund ueber beide Selbstmodelle.
 // ---------------------------------------------------------------------------
 function fchainCompleteness(graph) {
-    const fchains = graph.elements.filter(e => e.type === 'FCHAIN');
-    const funcs = graph.elements.filter(e => e.type === 'FUNC');
-    const ucs = graph.elements.filter(e => e.type === 'UC');
+    const idx = indexOf(graph);
+    const fchains = idx.elementsOfType('FCHAIN');
+    const funcs = idx.elementsOfType('FUNC');
+    const ucs = idx.elementsOfType('UC');
     const ucIds = new Set(ucs.map(u => u.id));
     const violations = [];
     for (const fc of fchains) {
         const ctx = { element_type: fc.type, element_name: fc.name };
-        if (!graph.traces.some(t => t.source === fc.id && t.type === 'compose')) {
+        if (idx.out(fc.id, 'compose').length === 0) {
             violations.push({
                 rule_id: 'R-15',
                 severity: 'warning',
@@ -566,7 +617,7 @@ function fchainCompleteness(graph) {
                 context: { ...ctx, candidate_targets: toCandidates(funcs) },
             });
         }
-        if (!graph.traces.some(t => t.target === fc.id && t.type === 'compose' && ucIds.has(t.source))) {
+        if (!idx.in(fc.id, 'compose').some(t => ucIds.has(t.source))) {
             violations.push({
                 rule_id: 'R-15',
                 severity: 'warning',
@@ -583,9 +634,10 @@ function fchainCompleteness(graph) {
 // R-16: ACTOR must have at least 1 io trace (CR-117)
 // ---------------------------------------------------------------------------
 function actorMustHaveTrace(graph) {
-    const actors = graph.elements.filter(e => e.type === 'ACTOR');
+    const idx = indexOf(graph);
+    const actors = idx.elementsOfType('ACTOR');
     return actors
-        .filter(a => !graph.traces.some(t => (t.source === a.id || t.target === a.id) && t.type === 'io'))
+        .filter(a => idx.out(a.id, 'io').length === 0 && idx.in(a.id, 'io').length === 0)
         .map(a => ({
         rule_id: 'R-16',
         severity: 'warning',
@@ -602,9 +654,10 @@ function actorMustHaveTrace(graph) {
 // R-17: SYS must have at least 1 compose trace (CR-117)
 // ---------------------------------------------------------------------------
 function sysMustHaveCompose(graph) {
-    const systems = graph.elements.filter(e => e.type === 'SYS');
+    const idx = indexOf(graph);
+    const systems = idx.elementsOfType('SYS');
     return systems
-        .filter(sys => !graph.traces.some(t => t.source === sys.id && t.type === 'compose'))
+        .filter(sys => idx.out(sys.id, 'compose').length === 0)
         .map(sys => ({
         rule_id: 'R-17',
         severity: 'warning',
@@ -629,10 +682,10 @@ function sysMustHaveCompose(graph) {
 // zusaetzlich compose) — genau deshalb ist jetzt der Zeitpunkt.
 // ---------------------------------------------------------------------------
 function msEmptyScope(graph) {
-    const crIds = new Set(graph.elements.filter(e => e.type === 'CR').map(e => e.id));
-    return graph.elements
-        .filter(e => e.type === 'MS')
-        .filter(ms => !graph.traces.some(t => t.type === 'relation' && t.target === ms.id && crIds.has(t.source)))
+    const idx = indexOf(graph);
+    const crIds = new Set(idx.elementsOfType('CR').map(e => e.id));
+    return idx.elementsOfType('MS')
+        .filter(ms => !idx.in(ms.id, 'relation').some(t => crIds.has(t.source)))
         .map(ms => ({
         rule_id: 'MS-01',
         severity: 'warning',
@@ -646,7 +699,8 @@ function msEmptyScope(graph) {
 // MS-02: Milestone depends-on dangling target
 // ---------------------------------------------------------------------------
 function msDanglingDependency(graph) {
-    const msIds = new Set(graph.elements.filter(e => e.type === 'MS').map(e => e.id));
+    const idx = indexOf(graph);
+    const msIds = new Set(idx.elementsOfType('MS').map(e => e.id));
     return graph.traces
         .filter(t => t.type === 'relation' && t.label === 'depends-on' && msIds.has(t.source))
         .filter(t => !msIds.has(t.target))
@@ -667,24 +721,75 @@ function msDanglingDependency(graph) {
 // here we only judge pairs whose endpoints both resolve. Audit traces are exempt.
 // ---------------------------------------------------------------------------
 function validTracePattern(graph) {
-    const typeById = new Map(graph.elements.map(e => [e.id, e.type]));
+    const idx = indexOf(graph);
+    // CR-SM-264: die Typ-Map kommt aus dem Index statt je Aufruf neu gebaut zu werden.
+    const typeById = { get: (id) => idx.typeOf(id) };
+    // CR-SM-266 D5: der `category !== 'audit'`-Filter ist WEG. Er war die Ausnahme fuer das
+    // einzige audit-Pattern (`SESSION -produces-> *`); mit dessen Entfernung waere er zum
+    // Schlupfloch geworden — eine Kante mit `category: 'audit'` haette die Matrix komplett
+    // umgangen. Das Attribut existiert nicht mehr (ontology.ts), hier faellt der Leser mit.
     return graph.traces
-        .filter(t => t.category !== 'audit')
         .filter(t => {
         const src = typeById.get(t.source);
         const tgt = typeById.get(t.target);
         if (!src || !tgt)
             return false; // dangling endpoint → R-08, not R-18
-        return !isValidTrace({ source: src, target: tgt, type: t.type, label: t.label });
+        // CR-SM-266 B: die where-Patterns lesen die Kinds des betroffenen Endes mit.
+        return !isValidTrace({
+            source: src, target: tgt, type: t.type, label: t.label,
+            sourceKinds: idx.byId.get(t.source)?.kinds,
+            targetKinds: idx.byId.get(t.target)?.kinds,
+        });
     })
-        .map(t => ({
+        .map((t) => ({
         rule_id: 'R-18',
         severity: 'error',
         element_id: t.source,
         message: `Invalid trace ${t.source} -${t.type}-> ${t.target}: ` +
             `${typeById.get(t.source)} → ${typeById.get(t.target)} is not a valid ${t.type} pattern`,
         fix_hint: 'Use a trace type whose TRACE_PATTERNS allows this source/target element-type pair',
-    }));
+    }))
+        .concat(cardinalityViolations(graph));
+}
+/**
+ * CR-SM-266b — das ZWEITE BEIN von R-18: die Kardinalitaets-Obergrenzen.
+ *
+ * Bewusst dieselbe `rule_id` und keine eigene, nach dem Muster von R-10 (Produzent/Konsument)
+ * und R-15 seit CR-SM-249: die Aussage ist dieselbe — "diese Kante ist nach dem Meta-Modell
+ * nicht zulaessig" —, nur ist die Bedingung hier eine ueber die MENGE statt ueber das Paar.
+ * Eine eigene ID kostete dauerhaft einen Nenner-Anteil, eine Katalogzeile, eine
+ * readiness-Zuordnung und einen Golden-File-Eintrag (Gate 6), und ein Leser muesste sie von
+ * R-18 unterscheiden, obwohl der naechste Schritt derselbe ist: Kante weg.
+ *
+ * EIN Befund je Quellknoten, nicht je ueberzaehliger Kante. Bei n Allokationen sind nicht
+ * n-1 Kanten "falsch" — es ist EINE Entscheidung offen (welches Modul), und n-1 Befunde
+ * wuerden den Zaehler ueber den Nenner-Beitrag treiben, die Fehlmessung aus CR-SM-242.
+ */
+function cardinalityViolations(graph) {
+    const idx = indexOf(graph);
+    const violations = [];
+    for (const p of BOUNDED_PATTERNS) {
+        const max = maxOccurs(p.cardinality);
+        for (const el of idx.elementsOfType(p.source)) {
+            const matching = idx.out(el.id, p.type).filter(t => idx.typeOf(t.target) === p.target);
+            if (matching.length <= max)
+                continue;
+            violations.push({
+                rule_id: 'R-18',
+                severity: 'error',
+                element_id: el.id,
+                message: `${el.id} has ${matching.length} ${p.type} traces to ${p.target} — ` +
+                    `the meta-model allows at most ${max} (${matching.map(t => t.target).join(', ')})`,
+                fix_hint: `Keep exactly one ${p.type} trace from ${el.id} to a ${p.target} and delete the others`,
+                context: {
+                    element_type: el.type,
+                    element_name: el.name,
+                    existing_traces: matching.map(t => ({ source: t.source, target: t.target, type: t.type })),
+                },
+            });
+        }
+    }
+    return violations;
 }
 // ---------------------------------------------------------------------------
 // R-19: Runnable TEST binding (CR-GC-205 Item 4) — a TEST that is not explicitly
@@ -697,8 +802,8 @@ function validTracePattern(graph) {
 // only and surfaces an unbound runnable TEST in rules_evaluate / readiness.
 // ---------------------------------------------------------------------------
 function testMustHaveRunnableBinding(graph) {
-    return graph.elements
-        .filter(e => e.type === 'TEST')
+    const idx = indexOf(graph);
+    return idx.elementsOfType('TEST')
         .filter(e => e.attributes?.concept !== true) // concept-only TESTs are exempt
         // CR-SM-231: `testRefs` (Array, min 1) statt `testRef` (Objekt). Semantik unveraendert —
         // Praesenz und Form, keine Datei-Existenz; die pruefst RC-02.
@@ -729,6 +834,7 @@ function testMustHaveRunnableBinding(graph) {
 // zu sein.
 // ---------------------------------------------------------------------------
 function testFileExclusivity(graph) {
+    const idx = indexOf(graph);
     const claimedBy = new Map();
     for (const el of graph.elements) {
         if (el.type !== 'TEST')
@@ -758,7 +864,7 @@ function testFileExclusivity(graph) {
                 element_id: owner,
                 message: `${owner} claims test file '${file}', which is also claimed by ${sorted.filter(o => o !== owner).join(', ')}`,
                 fix_hint: 'A test file belongs to at most one TEST. Split the file, or drop the entry from all but the one acceptance it really evidences',
-                context: { element_type: 'TEST', element_name: graph.elements.find(e => e.id === owner)?.name },
+                context: { element_type: 'TEST', element_name: idx.byId.get(owner)?.name },
             });
         }
     }
@@ -778,7 +884,8 @@ function testFileExclusivity(graph) {
 // RC-01's job); this guards presence/shape only. Cycle-safe.
 // ---------------------------------------------------------------------------
 function funcMustHaveCodeBinding(graph) {
-    const funcById = new Map(graph.elements.filter(e => e.type === 'FUNC').map(e => [e.id, e]));
+    const idx = indexOf(graph);
+    const funcById = new Map(idx.elementsOfType('FUNC').map(e => [e.id, e]));
     const composeFuncChildren = (id) => graph.traces
         .filter(t => t.source === id && t.type === 'compose' && funcById.has(t.target))
         .map(t => t.target);
@@ -869,9 +976,10 @@ function funcMustHaveCodeBinding(graph) {
 //       choice. The FCHAIN is the modelled claim; the test is owed on the claim.
 // ---------------------------------------------------------------------------
 function fchainMustHaveIntegrationTest(graph) {
+    const idx = indexOf(graph);
     const typeOf = new Map(graph.elements.map(e => [e.id, e.type]));
     const isFunc = (id) => typeOf.get(id) === 'FUNC';
-    const io = graph.traces.filter(t => t.type === 'io');
+    const io = idx.tracesOfType('io');
     // FUNC↔FUNC connections via the FLOW hop: (producer FUNC) → FLOW → (consumer FUNC).
     const connections = [];
     for (const e of graph.elements) {
@@ -894,7 +1002,7 @@ function fchainMustHaveIntegrationTest(graph) {
         }
     }
     // FCHAINs whose satisfy-REQ is verified by a TEST = chains with an integration test.
-    const verifiedReqs = new Set(graph.traces.filter(t => t.type === 'verify').map(t => t.target));
+    const verifiedReqs = new Set(idx.tracesOfType('verify').map(t => t.target));
     const testedChains = new Set();
     for (const t of graph.traces) {
         if (t.type === 'satisfy' && typeOf.get(t.source) === 'FCHAIN' && verifiedReqs.has(t.target)) {
@@ -918,7 +1026,7 @@ function fchainMustHaveIntegrationTest(graph) {
         if (seen.has(key))
             continue;
         seen.add(key);
-        const anchorEl = graph.elements.find(e => e.id === anchor);
+        const anchorEl = idx.byId.get(anchor);
         violations.push({
             rule_id: 'R-21',
             severity: 'warning',
@@ -940,11 +1048,12 @@ function fchainMustHaveIntegrationTest(graph) {
 // deliberately not checked (CR-GVE-173/174).
 // ---------------------------------------------------------------------------
 function funcMustBeAllocated(graph) {
-    const funcs = graph.elements.filter(e => e.type === 'FUNC');
-    const mods = graph.elements.filter(e => e.type === 'MOD');
+    const idx = indexOf(graph);
+    const funcs = idx.elementsOfType('FUNC');
+    const mods = idx.elementsOfType('MOD');
     const modIds = new Set(mods.map(m => m.id));
     return funcs
-        .filter(fn => !graph.traces.some(t => t.source === fn.id && t.type === 'allocate' && modIds.has(t.target)))
+        .filter(fn => !idx.out(fn.id, 'allocate').some(t => modIds.has(t.target)))
         .map(fn => ({
         rule_id: 'R-22',
         severity: 'warning',
@@ -967,13 +1076,13 @@ function funcMustBeAllocated(graph) {
 // R-22: one rule per element perspective (like R-01 REQ-side beside R-02/R-05).
 // ---------------------------------------------------------------------------
 function modMustHaveAllocatedFunc(graph) {
-    const mods = graph.elements.filter(e => e.type === 'MOD');
-    const funcs = graph.elements.filter(e => e.type === 'FUNC');
+    const idx = indexOf(graph);
+    const mods = idx.elementsOfType('MOD');
+    const funcs = idx.elementsOfType('FUNC');
     const modIds = new Set(mods.map(m => m.id));
-    const unallocatedFuncs = funcs.filter(fn => !graph.traces.some(t => t.source === fn.id && t.type === 'allocate' && modIds.has(t.target)));
+    const unallocatedFuncs = funcs.filter(fn => !idx.out(fn.id, 'allocate').some(t => modIds.has(t.target)));
     return mods
-        .filter(mod => !graph.traces.some(t => t.target === mod.id && t.type === 'allocate' &&
-        graph.elements.some(e => e.id === t.source && e.type === 'FUNC')))
+        .filter(mod => !idx.in(mod.id, 'allocate').some(t => idx.typeOf(t.source) === 'FUNC'))
         .map(mod => ({
         rule_id: 'R-23',
         severity: 'warning',
@@ -1001,8 +1110,8 @@ function modMustHaveAllocatedFunc(graph) {
 // out of scope here (pure, no I/O — that is RC-03's job).
 // ---------------------------------------------------------------------------
 function schemaMustHaveSchemaRef(graph) {
-    return graph.elements
-        .filter(e => e.type === 'SCHEMA')
+    const idx = indexOf(graph);
+    return idx.elementsOfType('SCHEMA')
         .filter(e => e.attributes?.concept !== true && e.attributes?.external !== true)
         .filter(e => !RealRefSchema.safeParse(e.attributes?.realRef).success)
         .map(sc => ({
@@ -1025,8 +1134,9 @@ function schemaMustHaveSchemaRef(graph) {
 // realRef with a file. RESOLUTION (file on disk) is a consumer/RC concern.
 // ---------------------------------------------------------------------------
 function physicalModMustHaveRealRef(graph) {
-    return graph.elements
-        .filter(e => e.type === 'MOD' && e.attributes?.kind === 'physical')
+    const idx = indexOf(graph);
+    return idx.elementsOfType('MOD')
+        .filter(e => e.attributes?.kind === 'physical')
         .filter(e => e.attributes?.concept !== true && e.attributes?.external !== true)
         .filter(e => !RealRefSchema.safeParse(e.attributes?.realRef).success)
         .map(mod => ({
@@ -1077,8 +1187,9 @@ function physicalModMustHaveRealRef(graph) {
 // waere Neubau-Zwang statt Steuerung.
 // ---------------------------------------------------------------------------
 function funcMustBeInEffectChain(graph) {
-    const funcs = graph.elements.filter(e => e.type === 'FUNC');
-    const fchains = graph.elements.filter(e => e.type === 'FCHAIN');
+    const idx = indexOf(graph);
+    const funcs = idx.elementsOfType('FUNC');
+    const fchains = idx.elementsOfType('FCHAIN');
     const funcIds = new Set(funcs.map(f => f.id));
     const fchainIds = new Set(fchains.map(fc => fc.id));
     // CR-SM-256: dieselbe Definition wie R-02 und R-31, nicht mehr die lokale Kopie.
@@ -1112,15 +1223,16 @@ function funcMustBeInEffectChain(graph) {
 // eigenen Nenner-Beitrag, was CR-SM-242 fuer IO-01 als Fehlmessung nachgewiesen hat.
 // ---------------------------------------------------------------------------
 function funcMustBeWired(graph) {
+    const idx = indexOf(graph);
     // CR-SM-256: Grundgesamtheit sind die BLAETTER, wie bei R-02 und R-30. Durch einen
     // Blackbox-Block fliessen keine Daten — die io-Kanten haengen an seinen Kindern.
     // CR-GC-375 hat das fuer R-31 ausdruecklich offengelassen ("eine eigene Frage, hier
     // bewusst nicht"); die Messung liegt jetzt vor: 12 von 13 Bloecken am
     // graphcode-Selbstmodell melden nur deshalb, und keiner aus einem anderen Grund.
     const decomposed = decomposedFuncs(graph);
-    const funcs = graph.elements.filter(e => e.type === 'FUNC' && !decomposed.has(e.id));
-    const flows = graph.elements.filter(e => e.type === 'FLOW');
-    const io = graph.traces.filter(t => t.type === 'io');
+    const funcs = idx.elementsOfType('FUNC').filter(e => !decomposed.has(e.id));
+    const flows = idx.elementsOfType('FLOW');
+    const io = idx.tracesOfType('io');
     const hasInput = new Set(io.map(t => t.target)); // FLOW -io-> FUNC
     const hasOutput = new Set(io.map(t => t.source)); // FUNC -io-> FLOW
     return funcs