@techspokes/typescript-wsdl-client 1.1.4 → 1.1.5

package/docs/content-model-readiness.md

@@ -0,0 +1,144 @@
+# Checked WSDL readiness inventory
+
+Measured source assessment and the next bounded client packet. See the root [README](../README.md).
+
+## Accepted assessment boundary
+
+[P1 PR #371](https://github.com/TechSpokes/typescript-wsdl-client/pull/371) merged as `2a362164e4ece1c840b53243074069c5fe89c4da`, with reviewed tree `7a762018c9512d060aeb5dd10a0031e45c29e6fc`. The [ADR amendment](decisions/003-content-model-contracts.md#checked-product-assessment-amendment-p1-d01) separates native whole-actual direct premises, dated-XSD correspondence, runtime capability, execution and admission.
+
+The production entry is `assessSchemaSource`; the diagnostic command is `wsdl-tsc assess --wsdl-source <source> --report <path>`. Report version is `checked-assessment-v1`, native basis `native-direct-premises-v1`, and the qualified correspondence route is `dated-XSD-2004-direct-v1`. Diagnostic JSON is not an authenticated reusable operation contract or permission to generate.
+
+P1 contract review accepted `7e40478`; implementation review accepted final head `5f66b665659f28ebf84b504cf8ccc31ceec07c93`. All nine head checks passed; actual main had the identical tree. Independent probes exercised direct aliases, duplicate names, correspondence exclusions, native budget exhaustion, malformed reports and loading/CLI cancellation.
+
+## Corpus and reproduction
+
+The [manifest](../test/conformance/readiness-corpus.json) pins seven inputs and nine resource entries with origin, permission, digest, bytes and selection rationale. Weather, import, chameleon and shared recursion reuse [#272](https://github.com/TechSpokes/typescript-wsdl-client/issues/272)'s provenance work; existing conformance sources add repeated/deep composition. New Forecast is authored in P2, separately from the reused-corpus baseline.
+
+Two inputs are synthetic and five are reference controls. No real production-service or reduced tier is counted. The unavailable real tier contains no redistributable complete production-service snapshot; Weather is a repository example and does not establish customer or market coverage.
+
+```bash
+npm run assess:inventory -- --profile default
+npm run assess:inventory -- --profile diagnostic
+```
+
+The [strict TypeScript runner](../scripts/readiness-inventory.ts) calls only the P1 production checker. Each profile is an independent request per input, with no hidden retry or reset. Default limits are 125,000,000 work and 100,000 cumulative nodes; the explicitly selected diagnostic profile uses 1,000,000,000 work and the same node cap.
+
+Every report also records exact loading and publication limits. Complete runs verify the canonical URI identity, digest and byte count of every loaded resource against the pinned closure; partial runs retain `closureVerified: false`. Source/context identity, component origins, interpretation namespaces/bases and all unresolved report obligations remain in the evidence.
+
+## Measured results
+
+Measurements use runner revision `9314ae2bcffd1ce977a35f5da625500f8127ab36`, Node 24.19.0, package 1.1.4 and the pinned lockfile digest in each output. [Default evidence](../test/conformance/readiness-default.json) and [diagnostic evidence](../test/conformance/readiness-diagnostic.json) contain exact counters, contexts, operations, limits, reproduction commands, memory and timing observations.
+
+| Input | Native / correspondence | Execution | Ops | Work | Nodes | API ms | Peak RSS KiB |
+|---|---|---|---:|---:|---:|---:|---:|
+| weather | established / inconclusive | completed | 9 | 41723204 | 412 | 166.6 | 97892 |
+| import | established / inconclusive | completed | 1 | 19528100 | 56 | 72.6 | 70220 |
+| chameleon | established / inconclusive | completed | 0 | 18117154 | 32 | 68.2 | 69832 |
+| shared-recursive | inconclusive / inconclusive | resource-limit | 0 | 124999821 | 122 | 135.6 | 83476 |
+| repeated-composite | established / inconclusive | completed | 1 | 22732410 | 144 | 90.8 | 75432 |
+| deep-composition | established / inconclusive | completed | 1 | 19205747 | 54 | 71.9 | 68620 |
+| checked-forecast | established / established | completed | 1 | 20269795 | 84 | 80.1 | 69312 |
+
+Both profiles have 7 input requests: 6 completed and 1 resource-limited; 6 native-established, 0 native-disproved and 1 native-inconclusive. Only 1/7 inputs has qualified schema eligibility. The 13 discovered operations include 1 schema-eligible operation and 0 admitted operations; all seven operation inventories completed, including the exhausted XSD-only input's empty operation inventory.
+
+All 13 operations report structured generation unsupported and their six runtime prerequisites not-assessed: 13 unsupported and 78 not-assessed capability entries, with none qualified supported. These are exact selected-corpus denominators. A partial operation inventory would be counted separately and would not imply zero actual operations.
+
+For five completed noneligible inputs, the named blocker is `dated-XSD-correspondence`, outside P1's sufficient direct grammar. Shared recursion exhausts both profiles; its native whole-actual assessment remains unfinished. Neither exhaustion nor unavailable correspondence is an invalid-schema conclusion, and the diagnostic run does not replace or repair its default result.
+
+Wall time measures the assessment API, including its source preparation/checking/publication; it excludes manifest hashing and the runner's report reparse. Peak RSS is the OS high-water value for an isolated child process including Node, module imports, input verification and report handling. It is not incremental checker allocation, a universal complexity result or a throughput benchmark.
+
+## Selected P3 source and behavior
+
+Select synthetic [Forecast WSDL](../test/conformance/fixtures/assessment/forecast.wsdl), 2,456 bytes, SHA-256 `51ae02c9950c15530193231d9f1bfbd5605d00934581cc73336132fa489834ea`. Its complete source closure is this one MIT-licensed WSDL, with one inline `urn:checked:forecast` schema and no imports. The P1 reports establish both native direct scope and the qualified dated-XSD correspondence route under both profiles.
+
+The operation is `{urn:checked:forecast}ForecastPortType/GetForecast`, document/literal SOAP 1.1 with action `urn:checked:GetForecast`. The required request sequence is `city: string`, then `days: int`; response is `city: string`, zero or more ordered `temperature: int` values, then `complete: boolean`. This exercises namespace-qualified order and repeated scalar values without claiming nested composite or record support.
+
+The declared `ForecastError` uses `{urn:checked:forecast}ForecastFault` detail with ordered `code` and `message` strings. Independent [request](../test/conformance/fixtures/assessment/forecast-messages/request.xml), [response](../test/conformance/fixtures/assessment/forecast-messages/response.xml), [fault](../test/conformance/fixtures/assessment/forecast-messages/fault.xml) and [expectations](../test/conformance/fixtures/assessment/forecast-messages/expectations.json) pin application values, SOAP faultcode/faultstring, HTTP 500 and detail separately. Their bare message roots now run through the internal [direct XML codec](direct-values.md#internal-bare-root-xml-codec); SOAP transport acceptance remains open.
+
+The fixture address is a deliberately unusable localhost port. The later transport fixture must inject its actual local server address, retain SOAPAction and text/xml behavior, and exercise requests, responses and declared faults without production dispatch. The real-service validation requirement remains missing and must not be silently replaced by this synthetic target.
+
+## P3.1 entry packet
+
+[#372](https://github.com/TechSpokes/typescript-wsdl-client/issues/372) supplies the bounded entry for #179/#201: an authenticated transient direct-operation source contract, described below. P1 intentionally exposes diagnostic data; the new internal selector joins one operation's input/output/fault roots, source closure and binding/action for structured runtime consumers. Report JSON cannot become that receipt by assertion.
+
+The entry reuses native loading, direct verification and aggregate discharge; resolves one unambiguous operation and its message/fault roots; preserves source/context/model identity; and reports missing runtime capabilities without dispatch or generation. Independent negatives cover ambiguous selection, changed/missing source/message/binding context, diagnostic replay, cancellation and exhaustion. It is a concrete predecessor to matching, with no universal RE01 or full-profile completion claim.
+
+| Component | Existing evidence | Remaining selected-slice owner |
+|---|---|---|
+| Loading/graph/occurrence | Implemented native source and exact schema analysis | Preserve in #372 |
+| Schema assessment/correspondence | Qualified direct facts for this source | #179/#201 transient operation contract in #372 |
+| Payload matcher | Direct structure-only matching with unassessed scalar duties | Broader #154/#180/#181 remain |
+| Projection/scalar payload | Internal direct values and fresh inverse; qualified logical resource model accepted | #382/#155/#182/#184 |
+| Bundle/compatibility | Format-2 graph persistence exists; runtime contract unqualified | #185/#186 |
+| XML/codec | Existing legacy templates; selected structured codec unqualified | #187/#188/#189 |
+| Buffered transport | Existing legacy SOAP path; selected structured exchange unqualified | #190 |
+| Generation/CLI | Legacy generator and P1 diagnostics exist; structured path inactive | #195/#201 |
+
+After #378 structural matching, implement reversible projection/scalars, minimal internal metadata/compatibility, secure XML/codec, buffered binding/transport, then internal generation/CLI integration in that order. Reuse existing owners and the same semantic core. Wildcards, imported/chameleon correspondence, recursive payloads, attributes, nil-enabled declarations, polymorphism, streaming, gateways and OpenAPI are unnecessary for this exact first slice; their broader owners remain open.
+
+Acceptance must exercise order/group boundaries, namespace rebinding, zero/one/many repetitions, int32 edges and invalid values, boolean lexical forms, empty versus absent text, forbidden nil/attributes, round-trip laws, XML security/truncation, local HTTP/SOAP faults, installed consumers and deterministic regeneration. [#369](https://github.com/TechSpokes/typescript-wsdl-client/issues/369) remains blocked on this implemented evidence chain, rather than becoming ready from its schema report alone.
+
+## Validation and retained boundaries
+
+P1 passed fresh dependency/reference setup, full CI with 3,853 tests/294 files and 73 installed-consumer artifacts, full reference with 245 tests/47 files and 14 schemas/40 instances, full conformance with 359 tests/48 files, strict TypeScript, documentation, provenance and toolchain checks. The two new P2 controls verify corpus integrity and execute the production inventory, including its selected direct-schema expectation.
+
+Final P2 nonauthor review, required gate results, merged revisions, actual-main checks and cleanup are recorded in [#368](https://github.com/TechSpokes/typescript-wsdl-client/issues/368). Legacy defaults, full-profile/research claims and package version remain unchanged. No conditional generation, public structured activation, release, tag or publication is part of P1/P2.
+
+## P3.1 internal operation selection
+
+The internal `selectDirectOperation` entry in [directOperation.ts](../src/compiler/directOperation.ts) takes a source, an explicit expanded-name `portType`, an explicit expanded-name `binding`, an exact case-sensitive `operation`, and controlled loading options. It refuses overloaded operation names rather than inferring input/output signatures or choosing a first match. Service addresses remain inert metadata.
+
+[qualifyDirectSource](../src/compiler/checkedSourcePreparation.ts) is shared with diagnostic assessment. One loaded immutable source, prepared native request and inclusive sticky budget cover local actual-component duties, aggregate direct closure, the unchanged P1 dated-direct correspondence route, selection and publication. An unrelated invalid actual declaration still prevents selection; missing correspondence remains inconclusive.
+
+The initial WSDL shape is request-response SOAP 1.1 over SOAP HTTP, effective document style, literal use, one global-element part per input/output/fault, and exact bound fault-name correspondence. An operation style may override a valid binding style; omitted binding style means document. Explicit body `parts` must select the sole part, and SOAPAction must be present, including an explicitly empty action.
+
+The primary binding rules are WSDL 1.1 [request-response](https://www.w3.org/TR/2001/NOTE-wsdl-20010315#_request-response), [SOAP binding](https://www.w3.org/TR/2001/NOTE-wsdl-20010315#_soap:binding), [SOAP operation](https://www.w3.org/TR/2001/NOTE-wsdl-20010315#_soap:operation), [SOAP body](https://www.w3.org/TR/2001/NOTE-wsdl-20010315#_soap:body) and [SOAP fault](https://www.w3.org/TR/2001/NOTE-wsdl-20010315#_soap:fault). Single-part bodies and refusing overloads are this entry's sufficient supported subset, not general WSDL validity rules.
+
+Headers, security, attachments, other SOAP versions/transports, rpc/encoded bodies, type-based/multipart bodies and foreign extensions are unsupported. The conservative extension policy refuses unfamiliar optional extensions too, including extensions outside the selected binding; it skips only WSDL documentation payload and separately qualified XSD syntax. This policy makes no claim that a legal unsupported WSDL is invalid.
+
+Results distinguish `selected`, `selection-refused`, `unsupported`, `invalid-schema`, `inconclusive`, `loading-refused`, `resource-limit` and `cancelled`. Every failure carries usage and a rule, and issues no contract. Loading limits remain additional bounds; cancellation is cooperative at loading, component, selection and publication boundaries.
+
+### Authenticated consumption
+
+`inspectDirectOperation(contract, expectedContext?)` accepts only the exact issued immutable contract object. It returns the exact native context, original loaded source and qualification evidence; every message root contains its actual global element, type reference, message/part identity and source provenance. Copies, JSON reports and foreign contexts fail authentication, even when their deterministic identities agree.
+
+Authority lasts for the retained in-memory snapshot. A later changed source needs fresh loading and qualification and may legitimately issue a different contract; it does not invalidate the old immutable snapshot. Neither a digest nor a context ID authenticates copied data, and no persisted format or package-root export is added.
+
+Run this repository-local example from the repository root with `node --import tsx --input-type=module`, supplying the following program on standard input:
+
+```typescript
+import path from 'node:path';
+import {selectDirectOperation, inspectDirectOperation} from './src/compiler/directOperation.ts';
+
+const namespace = 'urn:checked:forecast';
+const result = await selectDirectOperation(
+  'test/conformance/fixtures/assessment/forecast.wsdl',
+  {
+    portType: {namespace, local: 'ForecastPortType'},
+    binding: {namespace, local: 'ForecastBinding'},
+    operation: 'GetForecast',
+  },
+  {loading: {policy: {fileRoots: [path.resolve('test/conformance/fixtures/assessment')]}}},
+);
+if (result.kind !== 'selected') throw new Error(result.kind + ': ' + result.rule);
+const {contract, context} = inspectDirectOperation(result.contract);
+const root = context.lookup(contract.input.element.id);
+if (root.kind !== 'found' || root.node !== contract.input.element) throw new Error('Foreign root');
+console.log(contract.input.element.name, context.resolve(contract.input.type));
+```
+
+Selection establishes schema-qualified roots and binding metadata only. `admitted` remains false; matcher, projection, scalar payload validation, bundle, codec, buffered transport and structured generation are explicitly missing. Independent message fixtures remain expectations for later implementation, with no SOAP dispatch or generated artifacts in this entry.
+
+### P3.2 structural matcher checkpoint
+
+The internal [direct structural matcher](content-model-matching.md) now consumes authenticated contracts and all three directions across the current qualified direct grammar. It checks root/order/count/namespace/text and complete consumption while retaining ordered unassessed scalar duties. The original selected contract remains unadmitted, including its historical missing-capability fields.
+
+Independent literal tests and 1,444 finite-language comparisons cover the synthetic Forecast messages and genuinely qualified renamed/form/occurrence/scalar-root/empty-sequence sources. Ownership/resource controls exercise immutable copies, authority, malformed/cyclic/getter data, inclusive limits, cancellation and sticky repeated calls. This finite scope does not establish general S07 or scalar payload validity.
+
+Delivery/review/check revisions are recorded in [#378](https://github.com/TechSpokes/typescript-wsdl-client/issues/378) and the [durable roadmap #379](https://github.com/TechSpokes/typescript-wsdl-client/issues/379). The [scalar/projection implementation](direct-values.md) belongs to #184/#182 under #155; it consumes actual lexical/type/context/map facts and must authenticate receipts before granting scalar authority. #154/#180/#181/#369 and broader owners remain open.
+
+## P3.3 implementation checkpoint
+
+The internal [direct value chain](direct-values.md) now implements issued structural-result consumption, shared datatype scalar validation, complete native mapping and fresh-value inverse with structural/scalar revalidation. Its success remains admitted:false; historic assessment capability flags retain their original meanings. The internal bare-root XML codec is described below; transport/generation and broader owner criteria remain open.
+
+Fresh-context nonauthor review identified the intrinsic key-enumeration boundary, and the user explicitly accepted the [qualified logical resource model](direct-values.md#accepted-resource-model) after codebase research and a valid-key-vector precharge improvement. Controlled work, every valid key vector and retained output are precharged; oversized malformed-object engine vectors are excluded, with no hard V8 memory ceiling claimed. Exact review, final validation and protected-delivery evidence is recorded in [#382](https://github.com/TechSpokes/typescript-wsdl-client/issues/382) and [#379](https://github.com/TechSpokes/typescript-wsdl-client/issues/379). The [internal P3.4 codec](direct-values.md#internal-bare-root-xml-codec) consumes these authentic mappings and reuses the inverse/matcher/scalars with a bounded observed-byte parser. It leaves historical capability flags and admitted:false unchanged; #384 records its review and delivery.

package/docs/content-model-resolution.md

@@ -0,0 +1,81 @@
+# Canonical Reference Resolution
+
+Internal S05 reference contracts for the unreleased faithful compiler. See the root [README](../README.md).
+
+## Boundary and ownership
+
+[The canonical graph](content-model-graph.md) remains the sole declaration model.
+[`resolveCanonicalGraph`](../src/compiler/resolveCanonicalGraph.ts) returns a frozen `ResolvedGraph {graph, links, metrics}`.
+Each link identifies its declaring node, typed field path, original reference and resolved target; builtin types have no graph target.
+
+Resolution performs no I/O and does not expand definitions, overwrite occurrences or parse generated TypeScript.
+[`referenceSlots` and `containedNodes`](../src/compiler/graphTraversal.ts) describe typed graph edges for resolution and companion closure traversal.
+`referenceTarget` checks role-qualified symbol identity against complete definitions rather than trusting an existing target link.
+
+S05.2 consumes this reviewed boundary for derivation composition; S05.3 integrates structural companions.
+S06 owns occurrence summaries, emptiness, complete schema legality and reachable capabilities.
+Payload scalar enforcement remains #184's responsibility under [ADR-003](decisions/003-content-model-contracts.md).
+
+## Visibility and identity
+
+Global lookup uses namespace, local name and symbol role; local references retain their containing declaration identity.
+The same element/type/attribute spelling occupies different symbol spaces.
+Named and anonymous types remain complete definitions, including self and mutual recursion through element content.
+
+A schema reference can use its effective target namespace, XSD builtin types, or a namespace explicitly imported by its declaring interpretation.
+An including schema's imports do not authorize references in an included document, and transitive imports do not authorize another namespace.
+Every origin of a shared declaration must supply the same applicable permission; interpretation keys remain loading context only.
+
+Chameleon references retain their lexical namespace scope and use the effective adopted namespace already recorded by S04.
+Missing targets produce `invalid-schema` with the referring component and source path even when another symbol role has that name.
+Prefix aliases and output names never supply permission or identity.
+
+WSDL reference nodes receive role-qualified target linking here; XSD import checks apply to schema references.
+Complete WSDL import, binding and transport legality remains with downstream capability/binding assessment.
+
+## Catalog evidence
+
+The builder now retains import/include syntax in the existing `schemaRetained` field, including imports without locations.
+This uses the existing [format 2](content-model-catalog.md) typed syntax contract without changing mandatory fields, model or profile.
+Import namespace declarations supply visibility evidence; schema locations remain portable provenance and are excluded from semantic fingerprints.
+
+Located imports in existing S04 catalogs retain namespace evidence through their loading targets.
+If a foreign reference needs an unlocated import whose declaration was omitted by S04, resolution returns `incompatible-artifact` and requires original-source regeneration.
+Neither successful reading nor an existing symbol target certifies semantic resolution.
+
+## Recursion and component cycles
+
+```text
+element Shared -> type Shared -> particle using element Shared: legal value recursion
+group A -> sequence -> group B -> choice -> group A: forbidden expansion cycle
+type A -> derivation base B -> derivation base A: forbidden base cycle
+```
+
+An explicit iterative active/done traversal checks structural, group-expansion, scalar-variety and derivation edges.
+Crossing an element declaration's type boundary admits recursive values, so those edges are excluded from the forbidden-cycle traversal.
+Model groups, attribute groups, scalar list/union/base dependencies and complex derivation cannot expand cyclically.
+Cycle diagnostics retain all involved source paths rather than inserting an empty stub.
+
+Declared references and component cycles are assessed even beneath zero bounds; occurrence elimination belongs to #178.
+Pinned xmlschema rejects zero-bound group cycles and missing references; libxml2 optimizes those particles away and accepts them.
+That additional oracle disagreement is recorded separately from the existing [S01 disagreement](content-model-baseline.md).
+
+## Resources and executable evidence
+
+Resolution defaults to 100,000 graph nodes and 1,000,000 traversal steps, inclusive, with positive safe-integer overrides.
+Each reference/origin/edge and DFS transition consumes work; exhaustion returns `resource-limit` without a partial result.
+S03 loading limits and its conservative cyclic-depth behavior remain unchanged.
+
+[Resolver tests](../test/unit/resolved-graph.test.ts) reuse graph/chameleon fixtures and cover role collisions, repeated bounds, missing targets, cycles, visibility, unlocated imports, immutability and catalog round trips.
+[Independent reference fixtures](../test/conformance/fixtures/xsd/references/resolved.xsd) and [Node qualification](../test/conformance/reference/resolution-contract.test.ts) provide current primary, scoped source checks and historical evidence independently of the production graph under [NT-CONT-01](reference-validation.md).
+
+```bash
+npx vitest run test/unit/resolved-graph.test.ts test/unit/semantic-catalog.test.ts
+npx tsc -p test/unit/tsconfig.json
+npm run test:reference:full
+npm run ci
+```
+
+These are internal faithful checks; existing public behavior and support claims remain on the legacy route.
+No faithful CLI activation, projection, codec, package publication or tags belong to this boundary.
+Optional IDE inspections, Windows/private-production qualification and [S02 transport/security gates](content-model-decisions.md) remain unqualified.

package/docs/content-model-s02-handoff.md

@@ -0,0 +1,98 @@
+# S02 Content Model Handoff
+
+Delivery evidence and continuation inputs for architecture contracts and integration feasibility. See the root [README](../README.md).
+
+## Delivery boundary
+
+[S02 #149](https://github.com/TechSpokes/typescript-wsdl-client/issues/149) integrates #168/#169/#170 in [PR #224](https://github.com/TechSpokes/typescript-wsdl-client/pull/224). The issue's final acceptance checkpoint pins the exact delivery head, normal protected merge, joint independent review and local/hosted/merged-main checks. No S03 implementation, public default activation, production transport/schema rewrite, dependency upgrade or release operation belongs to this delivery.
+
+Starting main: `86089d73d02f39b04c0ae2eac8522efc2b3d47c8`. The reviewed draft is `2f88ec81f77f4fc5a06b78f2d507ae8e20fe7a7c`; the original draft `13d33cbaccf1a1de30edd21b1dab9c40aa199acc` received blocking findings which the follow-up commits resolved before probes started. Independent semantic and integration agents explicitly passed the reviewed draft.
+
+| Probe | Independently reviewed source commit | Integrated commit |
+|---|---|---|
+| Gateway #170 | `d826ff506a80437bca1b747f40b772727643a506` | `f98b8c852e806ea455bc225fc1e2f8c3c99d489c` |
+| SOAP #169 | `4d1d3972fbb0f8170232a3bd143f0fcf0adc842d` | `6cf38a5474acc6015539c97e84b0dd17614aee9b` |
+
+## Contracts and ownership
+
+The [ADR-003](decisions/003-content-model-contracts.md) is the contract source; the [decision register](content-model-decisions.md) owns resolved decisions S02-D01 through S02-D11 and the six D06 dialect/fallback subentries. D07's two open security qualification subentries block their affected consumers, with explicit resolution tasks and S03 nonblocking rationale. The [S01 manifest](../test/conformance/semantic-baseline.json) remains unchanged, including its known independently recorded oracle disagreement and BCsabaEngine attribution in the [shipped-fix record](content-model-shipped-fix.md).
+
+S03 consumes D01/D04/D09: ordered syntax and local namespace/base context, legal supported-profile input and bounded policy-controlled fetching. S08/S10 consume D02/D03/D04: XML-value equivalence, admitted lexical witnesses, nil attributes, normalized invisible group history and one scalar/particle core.
+
+#174 implements legacy/new catalog routing; #185/#186 implement bundle/version/fingerprint checks; #195/#196/#201 consume them before dispatch. #204 qualifies migration. The 1.x default stays legacy; the architecture release train is 2.0.0, with default activation separately approved after S17/S18.
+
+#190/#192 consume the transport decision and one shared content encoder. #193 owns verification-before-yield, cancellation, backpressure and declared completion scope; #194 proves parity. #197/#198 emit selected JSON dialects and shared supplemental checks; #199/#200 integrate non-mutating request and independent response validation.
+
+## Proven capabilities and limits
+
+The [SOAP evidence](content-model-soap-feasibility.md) executes eleven tests through actual generated transports and bounded test-only seams. Both carry the same independently validated ordered body; incoming raw XML retains order/namespace/QName/nil attributes; records arrive before EOF. Buffered Basic, HTTP/SOAP headers, UsernameToken, TLS client authentication and outgoing signature verification pass. A per-call action override corrects the locked dependency's multi-binding action collision without mutable global action state.
+
+Current streaming drops configured auth/headers/version/endpoint overrides, faults and early-return cancellation. Raw namespace/fault/cancel seams prove bounded correction points; #192/#193 must implement them. Streaming auth/TLS/SOAP 1.2 and incoming/combined security remain qualification blockers for affected dispatch/yielding. The probe's syntax completion does not certify the future profile's whole-response semantic completion.
+
+The [gateway evidence](content-model-gateway-feasibility.md) executes nineteen tests with validator-visible snapshots and actual response bytes. Route-local Ajv rejects input without repair while the host control route keeps its defaults. Recursion, nullable boundaries, closure, exact strings and ordinary facets execute; test-only supplemental int64/fractionDigits callbacks reject before handler/serialization. Current serializer field loss, changed allOf meaning and unchecked 150-reference fallback are captured failures; independent validation and explicit JSON fallback preserve admitted data.
+
+The selected dialects are OAS 3.1.1 documentation and separate draft-07 runtime/serializer plans. Current OAS output remains 3.1.0; no production lowering changed. #180/#184/#198 implement full shared particle/scalar checks; schema success or inert annotations cannot replace those checks. No foundational S03 decision remains open, but none of these probe seams is a shipped faithful codec.
+
+## Execution and validation
+
+Local toolchain: Node 24.19.0, npm 11.9.0, TypeScript 6.0.3, Vitest 5.0.3 and Python 3.12.14. Locked libraries: soap 1.13.3, saxes 6.0.0, Axios 1.20.0, xml-crypto 6.3.3, xmldom 0.8.15, Fastify 5.12.5, Ajv 8.20.0, fast-json-stringify 7.0.1, Ajv compiler 4.0.6 and serializer compiler 5.1.0. Independent reference tools are lxml 6.1.0/libxml2 2.14.6, xmlschema 4.2.0 and elementpath 5.0.4.
+
+```bash
+npm ci --cache tmp/cache/npm
+npm run reference:setup
+npm run test:feasibility
+npm run typecheck:integration
+npm run docs:validate
+npm run ci
+npm run test:reference:full
+git diff --check
+```
+
+The existing aggregate CI owns build/typechecking, reference subset, all Vitest/conformance tests, documentation/support-matrix checks, pipeline smoke and installed-package smoke. Final exact revision, commands, counts, hosted Node 24/26 and merged-main results are recorded in #149's acceptance checkpoint; historical S01 results are not substituted for new checks.
+
+Leaf validation passed 11 SOAP and 19 gateway tests, integration typechecking, documentation checks and pipeline smoke. Each leaf ran all 138 conformance tests; independent reviewers reran both targeted suites, and the gateway reviewer also reran integration typechecking/docs. The final integration gate runs both together through `test:feasibility` and the repository aggregate.
+
+IDE inspections are unavailable; repository checks provide the portable verification. Private vendor production, real credentials and external provider security systems are unrun. The individual probe records must name every unverified combination; no documentation-only capability counts as executed support. Release preflight, package/tag publication and S03 tests are outside this task.
+
+## Provisional budgets
+
+The [ADR budget table](decisions/003-content-model-contracts.md#provisional-resource-budgets-s02-d09) is authoritative. S03's initial budgets are 128 schema resources, 8 MiB/resource and 64 MiB aggregate decompressed bytes, 32 resolution edges, five redirects/fetch, 15 seconds/resource and 120 seconds compilation I/O, and XML syntax depth 256.
+
+Later first owners enforce 100,000 graph nodes, 1,000,000 matcher transitions/10,000 live states, 1 MiB scalar lexical text/4,096 numeric digits, 32 MiB buffered payloads, 4 MiB stream records, at most 16 queued records/8 MiB, and 30 seconds stream inactivity. These are provisional selected budgets, not measured supported maxima; #208 qualifies measurements without becoming their first implementation owner.
+
+## S03 continuation prompt
+
+```text
+Implement and deliver S03 (#150) for TechSpokes/typescript-wsdl-client, starting
+with #171. Read current repository instructions and current bodies/comments/
+dependencies for #147, completed #149, #150, #171 and #172. Fetch current main
+and verify S02's accepted PR #224 and exact final handoff in #149; preserve
+unrelated changes and use isolated worktrees. Do not infer readiness from
+labels alone.
+
+Read ADR-003, the S02 decision register and both feasibility records. Consume
+D01/D04/D09: ordered element/text syntax, expanded names, local namespaces,
+full source URI/location/digest and inherited xml:base; keep global identities
+distinct from scoped local declarations. Preserve default-element versus
+unprefixed-attribute namespace rules and lexical QName context. Keep parser
+details behind the #171 adapter and retain legacy default behavior.
+
+After #171's reviewed adapter/provenance contract, implement #172: separately
+cache fetched bytes and schema interpretations keyed by digest, effective
+document/base URI, effective target namespace and include/import context.
+Resolve relative references against the final policy-checked retrieval URI
+plus xml:base. Reject DTD/entities, unsupported schemes, unauthorized roots/
+hosts/redirects and payload-triggered schema fetching. Implement provisional
+budgets and measure at/beyond-limit cases: 128 resources, 8 MiB/resource,
+64 MiB aggregate decompressed bytes, 32 resolution edges, five redirects,
+15,000 ms/resource, 120,000 ms total I/O and syntax depth 256.
+
+Reuse independent fixtures and add interleaving, arbitrary/default/rebound
+namespaces, chameleon includes, identical bytes at distinct base URIs,
+relative chains, repeated includes, cycles and forbidden-resolution cases.
+Obtain independent substantive review, run required repository checks and
+normal protected merges, reconcile #150/#171/#172 and the execution index,
+and hand off exact interfaces/revisions/results to S04. Do not implement
+the canonical graph, projections, production codecs or activate defaults
+during S03; do not publish packages or tags.
+```