dsh-logicprobe 0.6.8 → 0.7.1

package/README.en-US.md

@@ -182,7 +182,8 @@ Skills are invoked with `$logicprobe`. See `.zcode/INSTALL.md` for details.
 ## Requirements
 
 - Claude Code v2.1+ / Codex CLI latest / Cursor 2.5+ / Kimi CLI latest / OpenCode latest / ZCode 3.0+
-- DeepSeek Harness (dsh): dev preview — verified on mainline 2026-08-14 (gate bundle loaded and injected in-session)
+- DeepSeek Harness (dsh): dev preview — supports `>= 0.1.0-rc.7` (the standing declaration; this round re-measured 0.1.5-rc.2 / 0.1.5-rc.3 / 0.1.6-alpha.2 / 0.1.7-alpha.1 / 0.1.7-alpha.2 / 0.1.7-rc.1 / 0.1.7-rc.2 / 0.2.0-rc.1 / 0.2.0-rc.2 — per-release evidence in [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md))
+- The Web Plugins-page "Gate injection" switch requires **dsh ≥ 0.1.7-alpha.1** — its settings service must project live fields. On older dsh the plugin still loads and still injects, with the switch simply absent and **no error**: below schemastery 3.18.3 the field degrades to an ordinary boolean, and a settings service without `whileServed` makes the client half register nothing.
 - Python 3.6+ optional (only for the automated harness; manual fallback mode requires none)
 
 ## Configuration
@@ -195,6 +196,8 @@ In DeepSeek Harness, the bundle registers the `logicprobe_verify` tool (through
 | `gateContent` | string | built-in gate text | Override the text injected into the first model step. |
 | `interaction` | `ask` \| `auto` \| `follow-approval` | `follow-approval` | Model-confirmation policy. `follow-approval` resolves to `auto` when the session approval policy is `never`. |
 
+The switch is editable live in the dsh Web GUI: sidebar **Plugins** → this plugin's card → "Gate injection". It takes effect without a profile restart and controls only the injected text — turning it off leaves the skills and the verification tools registered. The same card also carries a coarser row switch: turning that off unmounts the whole row (skills, tools, and this switch go with it). Persistent overrides still go through the profile patch below.
+
 To change it, override the row by id in your profile's `cordis.patch.yml`:
 
 ```yaml
@@ -239,7 +242,7 @@ npm run build
 
 Test chain:
 
-- `npm run test:engine` — state-machine / data-model engine regression (`tests/engine`, `tests/data-engine`, `tests/concurrency`, `tests/apply-smoke`, `tests/exporters`, `tests/external`) plus byte-for-byte Python parity (`tests/python/run.mjs`: the same fixtures are compared between the TS engine and `skills/logicprobe/references/logicprobe-engine.py` across reports / composition / exporter output; auto-SKIP when Python is absent)
+- `npm run test:engine` — state-machine / data-model engine regression (`tests/engine`, `tests/data-engine`, `tests/concurrency`, `tests/apply-smoke`, `tests/dsh-client-half`, `tests/exporters`, `tests/external`) plus byte-for-byte Python parity (`tests/python/run.mjs`: the same fixtures are compared between the TS engine and `skills/logicprobe/references/logicprobe-engine.py` across reports / composition / exporter output; auto-SKIP when Python is absent)
 - `npm run test:full` — `tests/full-suite.mjs` combined end-to-end suite
 - `npm run test:python` — Python parity only (build + `tests/python/run.mjs`)
 - Trigger tests are under `tests/skill-triggering/`: `bash tests/skill-triggering/run-all.sh`

package/README.md

@@ -181,7 +181,8 @@ cp -r logicprobe/skills/* .zcode/skills/
 ## 环境要求
 
 - Claude Code v2.1+ / Codex CLI 最新 / Cursor 2.5+ / Kimi CLI 最新 / OpenCode 最新 / ZCode 3.0+
-- DeepSeek Harness (dsh): dev preview — 已实测 mainline 2026-08-14（gate bundle 加载并注入会话成功）
+- DeepSeek Harness (dsh): dev preview — 支持 `>= 0.1.0-rc.7`（沿用既有声明；本轮实测覆盖 0.1.5-rc.2 / 0.1.5-rc.3 / 0.1.6-alpha.2 / 0.1.7-alpha.1 / 0.1.7-alpha.2 / 0.1.7-rc.1 / 0.1.7-rc.2 / 0.2.0-rc.1 / 0.2.0-rc.2，逐版本证据见 [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md)）
+- Web 端的「Gate 注入」开关需要 **dsh ≥ 0.1.7-alpha.1**（设置服务必须能投影即时字段）。更早的 dsh 上插件照常加载、照常注入，只是开关不出现、**也不报错**：schemastery 早于 3.18.3 时该字段退化为普通布尔值；设置服务没有 `whileServed` 时客户端半侧不注册任何东西。
 - Python 3.6+ 可选（仅自动验证工具需要；手动兜底模式无需任何依赖）
 
 ## 配置
@@ -194,6 +195,8 @@ cp -r logicprobe/skills/* .zcode/skills/
 | `gateContent` | string | 内置 gate 文本 | 覆盖注入到首轮模型上下文中的文本。 |
 | `interaction` | `ask` \| `auto` \| `follow-approval` | `follow-approval` | 模型确认策略；`follow-approval` 在会话 approval policy 为 `never` 时解析为 `auto`。 |
 
+在 dsh Web GUI 里可以直接改这个开关：侧边栏 **插件** → 本插件卡片 → 「Gate 注入」。它实时生效，不必重启 profile，而且只管注入的那段文本——关掉后 skills 与验证工具照常注册。同一张卡片上还有一个更粗粒度的行开关：关掉它会整行卸载插件（技能、工具和这个开关一起消失）。要持久化覆盖，仍按下面的 profile patch 写。
+
 在 profile 的 `cordis.patch.yml` 中按 row id 覆盖：
 
 ```yaml
@@ -237,7 +240,7 @@ npm run build
 
 测试链：
 
-- `npm run test:engine` — 状态机/数据模型引擎回归（`tests/engine`、`tests/data-engine`、`tests/concurrency`、`tests/apply-smoke`、`tests/exporters`、`tests/external`）+ Python 逐字节一致性对照（`tests/python/run.mjs`：同一批 fixture 在 TS 引擎与 `skills/logicprobe/references/logicprobe-engine.py` 之间比对报告/组合/导出产物；无 Python 时自动 SKIP）
+- `npm run test:engine` — 状态机/数据模型引擎回归（`tests/engine`、`tests/data-engine`、`tests/concurrency`、`tests/apply-smoke`、`tests/dsh-client-half`、`tests/exporters`、`tests/external`）+ Python 逐字节一致性对照（`tests/python/run.mjs`：同一批 fixture 在 TS 引擎与 `skills/logicprobe/references/logicprobe-engine.py` 之间比对报告/组合/导出产物；无 Python 时自动 SKIP）
 - `npm run test:full` — `tests/full-suite.mjs` 端到端合并套件
 - `npm run test:python` — 仅 Python parity（构建 + `tests/python/run.mjs`）
 - 触发测试位于 `tests/skill-triggering/`：`bash tests/skill-triggering/run-all.sh`

package/lib/client.js

@@ -0,0 +1,212 @@
+/**
+ * logicprobe — browser half: the gate-injection switch on the dsh Web client's
+ * Plugins page.
+ *
+ * The Plugins page (`@deepseek-ai/dsh-client-ui-plugin-manager`) owns the
+ * sidebar **Plugins** entry and declares the slots a bundle's own configuration
+ * registers into. This module contributes one `plugins.bundle.config` entry,
+ * keyed by this package's npm name, so the switch renders on logicprobe's own
+ * page between its description and its rows.
+ *
+ * Why the switch writes through `configForms` rather than reaching for the
+ * profile file: dsh's settings service exposes only the Config fields declared
+ * `.volatile()`, and it rejects a write to any other path. `enabled` is such a
+ * field (see `src/index.ts`), so flipping the switch is an ordinary
+ * revision-fenced settings write that the running Host picks up in place — the
+ * injection there re-reads the reference on every model step.
+ *
+ * Shape: this is a prebuilt module-system bundle, not a source module. It calls
+ * `window.__ModuleLoader__.load({ id, factory })` with this package's resolved
+ * npm name, and `factory` returns the cordis plugin face. Only the client
+ * baseline is requested (`react` and
+ * `@deepseek-ai/dsh-client-ui-primitives`); every other capability arrives
+ * through cordis `inject`. `scripts/build-client.mjs` publishes this file
+ * verbatim as `lib/client.js`.
+ *
+ * @module dsh-logicprobe/client
+ */
+
+window.__ModuleLoader__.load({
+  id: 'dsh-logicprobe',
+  factory: (require) => {
+    const React = require('react')
+    const { Button, Switch } = require('@deepseek-ai/dsh-client-ui-primitives')
+
+    /** Settings namespace: the Loader entry id this bundle's patch declares. */
+    const NS = 'logicprobe'
+    /** `plugins.bundle.config` key: the bundle's npm package name. */
+    const PACKAGE = 'dsh-logicprobe'
+    /** This page's dictionary namespace. */
+    const LOCALE_NS = 'logicprobe.plugins'
+    /** The Config field the switch writes inside the namespace's section. */
+    const FIELD = 'enabled'
+
+    /** English copy. */
+    const en = {
+      title: 'Gate injection',
+      label: 'Inject the gate text',
+      hint: 'Folds the claim-verification doctrine into the first model step of every session. Turning it off leaves the skills and the verification tools registered — only the injected text is dropped.',
+      overridden: 'Overridden',
+      reset: 'Reset to default',
+      readOnly: 'This deployment stores settings read-only.',
+      unavailable: 'This plugin is not loaded, so it cannot be configured right now.',
+      saveFailed: 'The deployment did not accept that value; the switch shows what is stored.',
+    }
+    /** Simplified Chinese copy. */
+    const zh = {
+      title: 'Gate 注入',
+      label: '注入 gate 文本',
+      hint: '把 claim 核查铁律折进每个会话的第一个模型步。关掉后 skills 与验证工具仍然注册，只是不再注入那段提示文本。',
+      overridden: '已覆盖',
+      reset: '恢复默认',
+      readOnly: '本部署的设置为只读。',
+      unavailable: '该插件当前未加载，暂时无法配置。',
+      saveFailed: '本部署没有接受这个值，开关显示的是已存下的状态。',
+    }
+
+    /** Required cordis services. */
+    const inject = ['slots', 'locale', 'configForms']
+
+    const GROUP = { display: 'flex', flexDirection: 'column', gap: '8px' }
+    const TITLE = { margin: 0, fontSize: '14px', fontWeight: '500', lineHeight: '22px' }
+    const ROW = { display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: '16px' }
+    const LABEL = { fontSize: '13px', lineHeight: '20px' }
+    const NOTE = { margin: 0, fontSize: '12px', lineHeight: '18px', color: 'var(--dsw-alias-label-tertiary)' }
+    const FAILED = { margin: 0, fontSize: '12px', lineHeight: '18px', color: 'var(--dsw-alias-state-error-primary)' }
+
+    /**
+     * Whether a settings-layer value carries this field, which is what marks it
+     * overridden: an override equal to the default is still an override.
+     * @param layer - the raw user layer the form snapshot carries.
+     * @returns whether the layer holds the field.
+     */
+    function carries(layer) {
+      return layer !== null && typeof layer === 'object' && Object.prototype.hasOwnProperty.call(layer, FIELD)
+    }
+
+    /**
+     * Render the gate-injection switch, or the note saying why it cannot render.
+     * @param props - the page's `t` seat, the bound form snapshot hook, and the write actions.
+     * @returns the body of this bundle's configuration section.
+     */
+    function InjectionCard(props) {
+      const t = props.t
+      const state = props.useInjectionForm((snapshot) => snapshot)
+      const [pending, setPending] = React.useState(false)
+      const [failed, setFailed] = React.useState(false)
+
+      /** Run one settings write and report a refusal or a transport failure. */
+      const write = (run) => {
+        setPending(true)
+        setFailed(false)
+        Promise.resolve(run()).then(
+          (accepted) => {
+            setPending(false)
+            setFailed(accepted === false)
+          },
+          () => {
+            setPending(false)
+            setFailed(true)
+          },
+        )
+      }
+
+      if (state.status !== 'ready') {
+        return React.createElement('p', { style: NOTE }, t('unavailable'))
+      }
+
+      const section = state.value !== null && typeof state.value === 'object' ? state.value : {}
+      // The schema default is `true`; only an explicit false means off.
+      const checked = section[FIELD] !== false
+      const overridden = carries(state.user)
+      const locked = state.writable !== true || pending
+
+      const children = [
+        React.createElement('h4', { key: 'title', style: TITLE }, t('title')),
+        React.createElement('div', { key: 'row', style: ROW }, [
+          React.createElement('span', { key: 'label', style: LABEL }, t('label')),
+          React.createElement(Switch, {
+            key: 'switch',
+            checked,
+            disabled: locked,
+            label: t('label'),
+            onChange: (next) => write(() => props.setEnabled(next)),
+          }),
+        ]),
+        React.createElement('p', { key: 'hint', style: NOTE }, state.writable === true ? t('hint') : t('readOnly')),
+      ]
+
+      if (overridden) {
+        children.push(
+          React.createElement('div', { key: 'overridden', style: ROW }, [
+            React.createElement('span', { key: 'badge', style: NOTE }, t('overridden')),
+            React.createElement(
+              Button,
+              {
+                key: 'reset',
+                variant: 'outline',
+                size: 'sm',
+                disabled: locked,
+                onClick: () => write(() => props.resetEnabled()),
+              },
+              t('reset'),
+            ),
+          ]),
+        )
+      }
+
+      if (failed) {
+        children.push(React.createElement('p', { key: 'failed', style: FAILED, role: 'alert' }, t('saveFailed')))
+      }
+
+      return React.createElement('div', { style: GROUP }, children)
+    }
+
+    /**
+     * Mount the switch while the Host serves logicprobe's settings namespace.
+     * @param ctx - the browser plugin context.
+     */
+    function apply(ctx) {
+      ctx.effect(() => ctx.locale.register(LOCALE_NS, { zh, en }), 'dsh-logicprobe: dictionaries')
+      // `whileServed` is the registration barrier that keeps this page alive only
+      // while the Host serves the namespace. Hosts predating it (measured: dsh
+      // 0.1.5-rc.3 and 0.1.6-alpha.2) have no live settings field to offer at all,
+      // so there is nothing to register — and calling it there would throw during
+      // this plugin's own activation, which the Web boot audit then reports as a
+      // failed client entry. Degrade to no page instead.
+      if (typeof ctx.configForms.whileServed !== 'function') return
+      // The page renders the section only for a bundle whose package name is in
+      // its configuration ledger, and the ledger follows this registration. The
+      // registration in turn waits for the namespace to be served, so a profile
+      // whose logicprobe row is switched off shows no trace of the switch.
+      ctx.effect(
+        () =>
+          ctx.configForms.whileServed([NS], () => {
+            const form = ctx.configForms.get(NS)
+            const source = {
+              getSnapshot: () => form.getSnapshot(),
+              subscribe: (listener) => form.subscribe(listener),
+            }
+            return ctx.slots.inject('plugins.bundle.config', () =>
+              ctx.slots.register(
+                {
+                  name: 'plugins.bundle.config',
+                  key: PACKAGE,
+                  locale: LOCALE_NS,
+                  inject: () => ({
+                    hooks: { injectionForm: source },
+                    setEnabled: (next) => form.set(FIELD, next),
+                    resetEnabled: () => form.unset(FIELD),
+                  }),
+                },
+                InjectionCard,
+              ),
+            )
+          }),
+        'dsh-logicprobe: gate-injection switch',
+      )
+    }
+
+    return { inject, apply }
+  },
+})

package/lib/engine.js

@@ -1,5 +1,40 @@
 import { createHash } from 'node:crypto';
 export const ENGINE_SCHEMA_VERSION = 1;
+export function isStateGuard(when) {
+    return 'state' in when;
+}
+/** Allowed keys per invariant kind — the schema is closed, so anything else is a typo or an unsupported feature. */
+const INVARIANT_KEYS = {
+    'never-states': new Set(['id', 'description', 'kind', 'states']),
+    'var-in-range': new Set(['id', 'description', 'kind', 'variable', 'min', 'max', 'when']),
+    'event-before-state': new Set(['id', 'description', 'kind', 'event', 'state']),
+    'leads-to': new Set(['id', 'description', 'kind', 'from', 'to']),
+    'sequence': new Set(['id', 'description', 'kind', 'events']),
+    'atomicity': new Set(['id', 'description', 'kind', 'events', 'commit', 'rollback']),
+    'budget': new Set(['id', 'description', 'kind', 'budget']),
+    'probability': new Set(['id', 'description', 'kind', 'target', 'op', 'p']),
+};
+const KNOWN_INVARIANT_KINDS = new Set(Object.keys(INVARIANT_KEYS));
+/**
+ * Declared keys per model part. The model schema is closed: a key that is not
+ * declared is a typo or an unsupported feature, and silently ignoring it can make
+ * the engine report a property that the model does not actually have (a mistyped
+ * guard variable reads as an always-false guard, which prunes real paths and can
+ * yield a false "no deadlock"). Rejecting is the only safe option for a verifier.
+ */
+const MODEL_KEYS = {
+    root: new Set(['schemaVersion', 'init', 'states', 'transitions', 'variables', 'invariants', 'concurrentPairs', 'boundaryChecks', 'resourcePairs', 'idempotentEvents', 'tickEvents', 'narrative']),
+    state: new Set(['id', 'terminal', 'onEntry', 'onExit', 'maxTicks']),
+    transition: new Set(['from', 'event', 'to', 'guard', 'updates', 'cost', 'weight']),
+    update: new Set(['variable', 'op', 'value']),
+    variable: new Set(['name', 'kind', 'init', 'min', 'max', 'monotonic']),
+    // LogicModelV1 boundary checks are (variable, values). The data-model engine has
+    // its own (entity, field) shape and its own validator — the two must not be mixed.
+    boundaryCheck: new Set(['variable', 'values']),
+    resourcePair: new Set(['resource', 'acquireEvent', 'releaseEvent', 'failEvent']),
+    narrative: new Set(['states', 'events', 'scenarios']),
+    scenario: new Set(['from', 'event', 'scenario']),
+};
 const DEFAULT_MAX_STATES = 10_000;
 const DEFAULT_MAX_PERMUTATION_EVENTS = 5;
 function stableStringify(value) {
@@ -22,6 +57,13 @@ export function validateModel(input) {
         return { ok: false, errors: ['model: must be an object'] };
     }
     const root = input;
+    const rejectUnknownKeys = (value, allowed, path) => {
+        const unexpected = Object.keys(value).filter((key) => !allowed.has(key));
+        if (unexpected.length > 0) {
+            bad(path + '.' + unexpected[0], 'unknown field (allowed: ' + [...allowed].join(', ') + ')');
+        }
+    };
+    rejectUnknownKeys(root, MODEL_KEYS.root, 'model');
     if (root.schemaVersion !== 1)
         bad('schemaVersion', 'must be 1');
     if (typeof root.init !== 'string' || root.init.length === 0)
@@ -37,6 +79,7 @@ export function validateModel(input) {
                 return;
             }
             const state = entry;
+            rejectUnknownKeys(state, MODEL_KEYS.state, 'states[' + index + ']');
             if (typeof state.id !== 'string' || state.id.length === 0)
                 bad('states[' + index + '].id', 'must be a non-empty string');
             else if (seen.has(state.id))
@@ -75,6 +118,7 @@ export function validateModel(input) {
                 return;
             }
             const transition = entry;
+            rejectUnknownKeys(transition, MODEL_KEYS.transition, path);
             if (typeof transition.from !== 'string' || transition.from.length === 0)
                 bad(path + '.from', 'must be a non-empty string');
             else if (!stateIds.has(transition.from))
@@ -98,6 +142,7 @@ export function validateModel(input) {
                             return;
                         }
                         const record = update;
+                        rejectUnknownKeys(record, MODEL_KEYS.update, updatePath);
                         if (typeof record.variable !== 'string' || record.variable.length === 0)
                             bad(updatePath + '.variable', 'must be a non-empty string');
                         if (record.op !== 'set' && record.op !== 'inc' && record.op !== 'dec')
@@ -135,6 +180,7 @@ export function validateModel(input) {
                     return;
                 }
                 const variable = entry;
+                rejectUnknownKeys(variable, MODEL_KEYS.variable, path);
                 if (typeof variable.name !== 'string' || variable.name.length === 0)
                     bad(path + '.name', 'must be a non-empty string');
                 else if (variableNames.has(variable.name))
@@ -168,6 +214,10 @@ export function validateModel(input) {
         else if (!variableNames.has(name))
             bad(path, 'references unknown variable ' + name);
     };
+    const invariantStateIds = new Set(Array.isArray(root.states) ? root.states.map((state) => state.id) : []);
+    // Reference sets for invariant targets: denormalising a kind's target into the
+    // report makes a mistyped id look authoritative, so every reference must resolve.
+    const invariantEventIds = new Set(Array.isArray(root.transitions) ? root.transitions.map((transition) => transition.event) : []);
     if (root.invariants !== undefined) {
         if (!Array.isArray(root.invariants))
             bad('invariants', 'must be an array');
@@ -183,6 +233,17 @@ export function validateModel(input) {
                     bad(path + '.id', 'must be a non-empty string');
                 if (typeof invariant.description !== 'string')
                     bad(path + '.description', 'must be a string');
+                // Reject keys the selected kind does not declare instead of silently ignoring
+                // them: an ignored field (e.g. a `when` scope on a kind that cannot honor it)
+                // still shows up in the echoed report and reads as if it took effect. Kinds an
+                // older reader may not know are skipped so they still fail on `.kind` alone.
+                if (KNOWN_INVARIANT_KINDS.has(invariant.kind)) {
+                    const allowed = INVARIANT_KEYS[invariant.kind];
+                    const unexpected = Object.keys(invariant).filter((key) => !allowed.has(key));
+                    if (unexpected.length > 0) {
+                        bad(path + '.' + unexpected[0], 'unknown field for kind ' + String(invariant.kind) + ' (allowed: ' + [...allowed].join(', ') + ')');
+                    }
+                }
                 if (invariant.kind === 'never-states') {
                     if (!Array.isArray(invariant.states) || invariant.states.length === 0)
                         bad(path + '.states', 'must be a non-empty array');
@@ -190,6 +251,8 @@ export function validateModel(input) {
                         invariant.states.forEach((state, stateIndex) => {
                             if (typeof state !== 'string' || state.length === 0)
                                 bad(path + '.states[' + stateIndex + ']', 'must be a non-empty string');
+                            else if (!invariantStateIds.has(state))
+                                bad(path + '.states[' + stateIndex + ']', 'references unknown state ' + state);
                         });
                 }
                 else if (invariant.kind === 'var-in-range') {
@@ -198,18 +261,57 @@ export function validateModel(input) {
                         bad(path + '.min', 'must be a number');
                     if (invariant.max !== undefined && typeof invariant.max !== 'number')
                         bad(path + '.max', 'must be a number');
+                    if (invariant.min === undefined && invariant.max === undefined)
+                        bad(path, 'requires min or max (a range with neither bound is vacuous)');
+                    if (invariant.when !== undefined) {
+                        const when = invariant.when;
+                        if (typeof when !== 'object' || when === null || Array.isArray(when)) {
+                            bad(path + '.when', 'must be an object');
+                        }
+                        else if ('state' in when) {
+                            const scope = when;
+                            for (const key of Object.keys(scope)) {
+                                if (key !== 'state')
+                                    bad(path + '.when.' + key, 'unknown field for a state scope (allowed: state)');
+                            }
+                            const state = scope.state;
+                            if (typeof state !== 'string' || state.length === 0)
+                                bad(path + '.when.state', 'must be a non-empty string');
+                            else if (!invariantStateIds.has(state))
+                                bad(path + '.when.state', 'references unknown state ' + state);
+                        }
+                        else {
+                            validateGuard(when, path + '.when', errors, bad);
+                            for (const variable of guardVariables(when)) {
+                                if (variable === invariant.variable) {
+                                    bad(path + '.when', 'must not reference the constrained variable ' + invariant.variable + ' (it can mask its own violation)');
+                                }
+                                else {
+                                    validateVariableRef(variable, path + '.when');
+                                }
+                            }
+                        }
+                    }
                 }
                 else if (invariant.kind === 'event-before-state') {
                     if (typeof invariant.event !== 'string' || invariant.event.length === 0)
                         bad(path + '.event', 'must be a non-empty string');
+                    else if (!invariantEventIds.has(invariant.event))
+                        bad(path + '.event', 'references unknown event ' + invariant.event);
                     if (typeof invariant.state !== 'string' || invariant.state.length === 0)
                         bad(path + '.state', 'must be a non-empty string');
+                    else if (!invariantStateIds.has(invariant.state))
+                        bad(path + '.state', 'references unknown state ' + invariant.state);
                 }
                 else if (invariant.kind === 'leads-to') {
                     if (typeof invariant.from !== 'string' || invariant.from.length === 0)
                         bad(path + '.from', 'must be a non-empty string');
+                    else if (!invariantStateIds.has(invariant.from))
+                        bad(path + '.from', 'references unknown state ' + invariant.from);
                     if (typeof invariant.to !== 'string' || invariant.to.length === 0)
                         bad(path + '.to', 'must be a non-empty string');
+                    else if (!invariantStateIds.has(invariant.to))
+                        bad(path + '.to', 'references unknown state ' + invariant.to);
                 }
                 else if (invariant.kind === 'sequence') {
                     if (!Array.isArray(invariant.events) || invariant.events.length === 0)
@@ -240,6 +342,8 @@ export function validateModel(input) {
                 else if (invariant.kind === 'probability') {
                     if (typeof invariant.target !== 'string' || invariant.target.length === 0)
                         bad(path + '.target', 'must be a non-empty string');
+                    else if (!invariantStateIds.has(invariant.target))
+                        bad(path + '.target', 'references unknown state ' + invariant.target);
                     if (invariant.op !== '>=' && invariant.op !== '<=' && invariant.op !== '>' && invariant.op !== '<')
                         bad(path + '.op', "must be one of '>=', '<=', '>', '<'");
                     if (typeof invariant.p !== 'number' || !Number.isFinite(invariant.p) || invariant.p < 0 || invariant.p > 1)
@@ -272,6 +376,7 @@ export function validateModel(input) {
                     return;
                 }
                 const check = entry;
+                rejectUnknownKeys(check, MODEL_KEYS.boundaryCheck, path);
                 validateVariableRef(check.variable, path + '.variable');
                 if (!Array.isArray(check.values) || check.values.some((value) => typeof value !== 'number'))
                     bad(path + '.values', 'must be an array of numbers');
@@ -306,6 +411,7 @@ export function validateModel(input) {
                     return;
                 }
                 const pair = entry;
+                rejectUnknownKeys(pair, MODEL_KEYS.resourcePair, path);
                 if (typeof pair.resource !== 'string' || pair.resource.length === 0)
                     bad(path + '.resource', 'must be a non-empty string');
                 if (typeof pair.acquireEvent !== 'string' || pair.acquireEvent.length === 0)
@@ -323,6 +429,7 @@ export function validateModel(input) {
         }
         else {
             const narrative = root.narrative;
+            rejectUnknownKeys(narrative, MODEL_KEYS.narrative, narrativePath);
             const stateIds = new Set(Array.isArray(root.states) ? root.states.map((state) => state.id) : []);
             const eventIds = new Set(Array.isArray(root.transitions) ? root.transitions.map((transition) => transition.event) : []);
             const fromEventGroups = new Set(Array.isArray(root.transitions) ? root.transitions.map((transition) => transition.from + '|' + transition.event) : []);
@@ -368,6 +475,7 @@ export function validateModel(input) {
                         return;
                     }
                     const scenario = entry;
+                    rejectUnknownKeys(scenario, MODEL_KEYS.scenario, scenarioPath);
                     if (typeof scenario.from !== 'string' || scenario.from.length === 0)
                         bad(scenarioPath + '.from', 'must be a non-empty string');
                     else if (!stateIds.has(scenario.from))
@@ -845,10 +953,18 @@ function S5_eventCompleteness(model) {
     }
     return checkResult('S5', 'Event Completeness', findings, findings.length === 0 ? 'All states handle all relevant events' : findings.length + ' unhandled (state, event) pairs');
 }
-function invariantHolds(invariant, runtime) {
+/** Whether a `var-in-range` `when` scope selects this runtime state. */
+function whenScopeHolds(when, runtime) {
+    return isStateGuard(when) ? when.state === runtime.state : evalGuard(when, runtime.vars);
+}
+function invariantHolds(invariant, runtime, isInitial = false) {
     if (invariant.kind === 'never-states')
         return !invariant.states.includes(runtime.state);
     if (invariant.kind === 'var-in-range') {
+        // The initial runtime state is checked unconditionally: a machine must never be
+        // able to escape the range simply by starting outside the scope.
+        if (!isInitial && invariant.when !== undefined && !whenScopeHolds(invariant.when, runtime))
+            return true;
         const value = runtime.vars[invariant.variable];
         if (typeof value !== 'number')
             return false;
@@ -865,7 +981,7 @@ function shortestViolationForInvariant(model, options, invariant) {
         return shortestEventBeforeStateViolation(model, options, invariant);
     }
     const init = initialState(model);
-    if (!invariantHolds(invariant, init)) {
+    if (!invariantHolds(invariant, init, true)) {
         return { invariant, path: [], reason: 'Initial state violates the invariant.' };
     }
     const visited = new Set([runtimeKey(init)]);
@@ -1375,6 +1491,15 @@ function mapInvariantForComparison(invariant, mapping) {
             state: mapStateId(mapping, invariant.state),
         };
     }
+    if (invariant.kind === 'var-in-range') {
+        const mapped = { ...invariant, id: invariant.id + ':before', description: invariant.description + ' (from BEFORE)' };
+        // A state scope must follow the state rename, otherwise D2 reports a spurious
+        // regression when the scope later refers to a state id that no longer exists.
+        if (mapped.when !== undefined && isStateGuard(mapped.when)) {
+            mapped.when = { state: mapStateId(mapping, mapped.when.state) };
+        }
+        return mapped;
+    }
     return { ...invariant, id: invariant.id + ':before', description: invariant.description + ' (from BEFORE)' };
 }
 function D2_invariantContinuity(before, after, options, mapping) {