dsh-logicprobe 0.8.0 → 0.9.0

package/skills/logicprobe/references/dsh-model-schema.md

@@ -68,7 +68,8 @@ The same reasoning applies to every id a check names. A reference to a state, ev
 | `transitions[].guard` variables | a declared variable |
 | `resourcePairs[].acquireEvent` / `.releaseEvent` / `.failEvent` | a declared event |
 | `invariants[].event` (`event-before-state`) | a declared event |
-| `invariants[].state` / `.states[]` / `.from` / `.to` / `.target` / `.when.state` | a declared state |
+| `invariants[].state` / `.states[]` / `.from` / `.target` / `.when.state` | a declared state |
+| `invariants[].to` and every member of `invariants[].to[]` (`leads-to`) | a declared state |
 
 A vacuous check is worse than a rejected one: a `leads-to` invariant whose `to` state is misspelled can never be violated, and a `never-states` list holding a nonexistent id can never be reached, so both report "pass" for a model that was never actually checked.
 
@@ -162,13 +163,13 @@ A guard is exactly one of:
 | `never-states` | `{ states: ["ERROR"] }` | No reachable runtime state may be in the forbidden set |
 | `var-in-range` | `{ variable, min?, max?, when? }` | Every reachable runtime state selected by `when` keeps the variable in range (at least one of `min`/`max` is required) |
 | `event-before-state` | `{ event: "power_ready", state: "ACTIVE" }` | Every path entering `state` must have passed through `event` first |
-| `leads-to` | `{ from: "MIGRATING", to: "DONE" }` | Every path from `from` must eventually reach `to` |
+| `leads-to` | `{ from: "MIGRATING", to: "DONE" }`, or `to: ["DONE", "FAILED"]` | Every path from `from` must eventually reach `to`. With a target set, every path must reach at least one member. The set must be non-empty and free of duplicates |
 | `sequence` | `{ events: ["backup", "modify", "commit"] }` | Events must occur in the given order |
 | `atomicity` | `{ events: ["write"], commit: "commit", rollback?: "rollback" }` | Atomic group must end with commit/rollback before leaving scope |
 | `budget` | `{ budget: n }` | No reachable path may accumulate transition cost greater than n (A12). Costs are non-negative; a transition without `cost` counts 1, so legacy machines keep step-count semantics |
 | `probability` | `{ target, op: one of >= <= > <, p }` | P(ever hitting target) must satisfy the bound (A13, DTMC from transition `weight`, default 1; value iteration) |
 
-A7 reports the shortest violating path for each failed invariant. An empty path means the initial state already violates it.
+A7 reports a violating path for each failed invariant, and an empty path means the initial state already violates it. The state-predicate kinds, `sequence`, `atomicity` and `budget` are breadth-first, so their witness is the shortest one; `leads-to` and `probability` report a witness without claiming minimality.
 
 ### Scoping a range to a state (`when`)
 
@@ -281,7 +282,7 @@ When `beforeModel` is passed to `logicprobe_verify`, the engine treats `model` a
 | Check | Purpose |
 |---|---|
 | D1 Behavioral Preservation | Every BEFORE (state, event) that could fire must still be fireable from the mapped AFTER state |
-| D2 Invariant Continuity | Every BEFORE invariant (mapped through `stateMapping`) must still hold in AFTER |
+| D2 Invariant Continuity | Every BEFORE invariant (mapped through `stateMapping`) must still hold in AFTER. State predicates go through the same reachability search as S7; `leads-to`, `sequence`, `atomicity`, `budget` and `probability` are re-decided by the searches their own probes (A9-A13) use |
 | D3 Regression Delta | Lists added/removed states, events, and transitions |
 | D4 Deadlock/Liveness Regression | New deadlock states or closed SCCs not present in BEFORE |
 
@@ -306,7 +307,7 @@ List events that must be idempotent in `idempotentEvents`. For every reachable s
 ## Advanced constraints (S8, A9-A14)
 
 - **S8 Monotonic Variables**: declare `monotonic: "inc"|"dec"` on a variable; updates must not move in the opposite direction.
-- **A9 Leads-To**: `{ kind: "leads-to", from, to }` — every path from `from` must eventually reach `to`.
+- **A9 Leads-To**: `{ kind: "leads-to", from, to }` — every path from `from` must eventually reach `to`. `to` is one state id or a non-empty array of state ids for "reach any one of these"; a duplicated member is a validation error rather than a shorthand. Either way the property stays universal: one branch that loops forever, or that stops before every target, refutes it.
 - **A10 Sequence**: `{ kind: "sequence", events }` — events must appear in order.
 - **A11 Atomicity**: `{ kind: "atomicity", events, commit, rollback? }` — once an atomic event starts, the machine must reach commit/rollback before leaving the atomic scope or terminating.
 - **A12 Budget**: `{ kind: "budget", budget }` — no reachable path may accumulate transition cost above the budget; reports the shortest over-budget path and flags reachable positive-cost cycles as unbounded.

package/skills/logicprobe/references/logic-verification-guide.md

@@ -271,6 +271,8 @@ def shortest_violating_path(states, init, invariant_check):
     return None  # Invariant holds for all reachable states
 ```
 
+That template decides one runtime state at a time, so it only fits the state-predicate kinds. A `leads-to`, `sequence`, `atomicity`, `budget` or `probability` invariant asserts a property of a whole run: reuse the search in its own section (A9-A13) as the witness finder, or A7 will report "all invariants hold" for a model where one of them fails.
+
 ### S8: Monotonic Variables
 
 For counters or progress variables that must only move in one direction, list the events that increase/decrease them. Any event that moves against the declared direction is a finding.
@@ -291,11 +293,13 @@ IDEMPOTENT_EVENTS = {"retry", "sync", "webhook_delivery"}
 
 ### A9: Leads-To
 
-For progress claims ("from MIGRATING, eventually DONE"), check every path from the source state. If a path dead-ends or loops before reaching the target, flag it.
+For progress claims ("from MIGRATING, eventually DONE"), check every path from the source state. If a path dead-ends or loops before reaching the target, flag it. When the code has several acceptable outcomes, give the invariant a target set and check every path reaches at least one member; that is still a universal claim, so a branch that reaches none of them fails.
 
 ```python
 LEADS_TO = [
     ("MIGRATING", "DONE"),
+    # or a set of acceptable outcomes
+    ("DRAINING", ["IDLE", "FAULT"]),
 ]
 ```
 
@@ -438,7 +442,7 @@ The BEFORE model comes from **code, not the plan**. The plan may describe the cu
 
 **Behavioral preservation**: For each event sequence accepted by BEFORE, trace the same sequence in AFTER. If AFTER ends in a different state (or rejects the sequence), flag as BEHAVIORAL DELTA. The plan must explicitly document this delta — if it doesn't, it's a regression.
 
-**Invariant continuity**: Re-run S7 invariant checks on both models. Any invariant that passes on BEFORE but fails on AFTER is a regression — the refactoring broke an existing guarantee.
+**Invariant continuity**: Re-decide every invariant on AFTER, mapped through `stateMapping`. Any invariant that holds on BEFORE but fails on AFTER is a regression — the refactoring broke an existing guarantee. State predicates go through the same reachability search as S7; `leads-to`, `sequence`, `atomicity`, `budget` and `probability` are re-decided by the searches their own probes (A9-A13) use, so continuity agrees with the standalone verdict. A state reference that the mapping drops is reported as a mapped-state warning instead of silently changing the property.
 
 **Complexity delta**: Count objectively:
 
@@ -507,7 +511,7 @@ Manual verification is reliable for state machines with **≤ 10 states and ≤
 
 **A6 Resource Injection**: For each state that appears to allocate (names containing "alloc", "init", "start", "open", "connect", "begin"), check if there is a recovery/error path if the allocation fails. If no recovery exists, flag as RESOURCE VULNERABLE.
 
-**A7 Minimal Counter-Example**: For each invariant that failed in S7, find the SHORTEST event sequence that violates it. This is the most useful output — it gives the plan author an exact repro.
+**A7 Minimal Counter-Example**: For each invariant that failed, find the event sequence that violates it. This is the most useful output — it gives the plan author an exact repro. The searches for state predicates, `sequence`, `atomicity` and `budget` are breadth-first, so their witness is the shortest one; the `leads-to` walk and the `probability` bound report what they found without claiming minimality.
 
 ### Manual Mode Output Format
 

package/skills/logicprobe/references/logicprobe-engine.py

@@ -392,11 +392,32 @@ def validate_model(input_value):
                         bad(p + '.from', 'must be a non-empty string')
                     elif lfrom not in invariant_state_ids:
                         bad(p + '.from', 'references unknown state ' + lfrom)
+                    # `to` is one state id or a target set. A set with a duplicate
+                    # member is a model-authoring slip that would otherwise give one
+                    # meaning two hashes, so it is rejected rather than deduplicated.
                     lto = entry.get('to')
-                    if not isinstance(lto, str) or len(lto) == 0:
-                        bad(p + '.to', 'must be a non-empty string')
-                    elif lto not in invariant_state_ids:
-                        bad(p + '.to', 'references unknown state ' + lto)
+                    if isinstance(lto, str):
+                        if len(lto) == 0:
+                            bad(p + '.to', 'must be a non-empty string')
+                        elif lto not in invariant_state_ids:
+                            bad(p + '.to', 'references unknown state ' + lto)
+                    elif isinstance(lto, list):
+                        if len(lto) == 0:
+                            bad(p + '.to', 'must be a non-empty array of state ids')
+                        else:
+                            seen_targets = set()
+                            for target_index, target in enumerate(lto):
+                                at = p + '.to[' + str(target_index) + ']'
+                                if not isinstance(target, str) or len(target) == 0:
+                                    bad(at, 'must be a non-empty string')
+                                elif target not in invariant_state_ids:
+                                    bad(at, 'references unknown state ' + target)
+                                elif target in seen_targets:
+                                    bad(at, 'duplicates state ' + target + ' in the target set')
+                                else:
+                                    seen_targets.add(target)
+                    else:
+                        bad(p + '.to', 'must be a state id or a non-empty array of state ids')
                 elif kind == 'sequence':
                     evs = entry.get('events')
                     if not isinstance(evs, list) or len(evs) == 0:
@@ -1190,10 +1211,98 @@ def _shortest_violation_for_invariant(model, max_states, invariant):
     return None
 
 
-def _run_invariants(model, max_states):
+def _is_path_property_invariant(invariant):
+    # Whether an invariant asserts a property of whole runs rather than of a single
+    # runtime state. These kinds cannot be decided by a state predicate, so they are
+    # not part of _shortest_violation_for_invariant (and therefore not of S7), which
+    # owns the states; A9-A13 own the verdicts, and _path_property_violation below
+    # makes the same verdicts available to A7 and D2.
+    return invariant['kind'] in ('leads-to', 'sequence', 'atomicity', 'budget', 'probability')
+
+
+def _probability_violated(invariant, probability):
+    # Whether a probability invariant's bound fails for the computed hit probability.
+    eps = 1e-9
+    op = invariant['op']
+    if op == '>=':
+        return probability < invariant['p'] - eps
+    if op == '>':
+        return probability <= invariant['p'] + eps
+    if op == '<=':
+        return probability > invariant['p'] + eps
+    return probability >= invariant['p'] - eps
+
+
+def _reachable_runtime_states(model, max_states):
+    # Every runtime state reachable from init, capped like the other searches.
+    init = _initial_state(model)
+    visited = set([_runtime_key(init)])
+    reached = [init]
+    queue = deque([init])
+    steps = 0
+    while queue:
+        steps += 1
+        if steps > max_states:
+            break
+        current = queue.popleft()
+        for event in _all_events(model):
+            for nxt in _step_runtime(model, current, event):
+                k = _runtime_key(nxt)
+                if k in visited:
+                    continue
+                visited.add(k)
+                reached.append(nxt)
+                queue.append(nxt)
+    return reached
+
+
+def _path_property_violation(model, max_states, invariant):
+    # Violation of a path-property invariant, or None when it holds. Each kind
+    # delegates to the search its dedicated probe uses (A9 leads-to, A10 sequence, A11
+    # atomicity, A12 budget, A13 probability), so a verdict reported here can never
+    # disagree with the probe that owns the kind.
+    kind = invariant['kind']
+    if kind == 'leads-to':
+        targets = set(_leads_to_targets(invariant))
+        label = _leads_to_target_label(invariant)
+        for runtime in _reachable_runtime_states(model, max_states):
+            if runtime['state'] != invariant['from']:
+                continue
+            bad = _find_leads_to_bad_path(model, runtime, targets, label)
+            if bad is not None:
+                return {'invariant': invariant, 'path': bad['path'], 'reason': bad['reason']}
+        return None
+    if kind == 'sequence':
+        return _find_sequence_violation(model, max_states, invariant)
+    if kind == 'atomicity':
+        return _find_atomicity_violation(model, max_states, invariant)
+    if kind == 'budget':
+        violation = _find_budget_violation(model, max_states, invariant)
+        if violation is None:
+            return None
+        reason = ('a reachable cycle keeps accumulating cost, so no finite budget holds'
+                  if violation['unbounded']
+                  else 'a run accumulates cost ' + str(violation['cost']) + ', above the declared budget ' + str(invariant['budget']))
+        return {'invariant': invariant, 'path': violation['path'], 'reason': reason}
+    if kind == 'probability':
+        computed = _compute_hit_probability(model, max_states, invariant['target'])
+        probability = computed['probability']
+        if not _probability_violated(invariant, probability):
+            return None
+        reason = ('P(hit ' + invariant['target'] + ') = ' + '{:.6f}'.format(probability)
+                  + ' does not satisfy ' + invariant['op'] + ' ' + str(invariant['p'])
+                  + ('' if computed['converged'] else ' (value iteration did not converge)'))
+        return {'invariant': invariant, 'path': [], 'reason': reason}
+    return None
+
+
+def _run_invariants(model, max_states, include_path_properties=False):
     violations = []
     for invariant in model.get('invariants') or []:
-        violation = _shortest_violation_for_invariant(model, max_states, invariant)
+        if include_path_properties and _is_path_property_invariant(invariant):
+            violation = _path_property_violation(model, max_states, invariant)
+        else:
+            violation = _shortest_violation_for_invariant(model, max_states, invariant)
         if violation is not None:
             violations.append(violation)
     return violations
@@ -1575,14 +1684,27 @@ def A6_resource_injection(model):
 
 
 def A7_shortest_violations(model, max_states):
-    violations = _run_invariants(model, max_states)
+    # Path-property invariants are included: "for any invariant that fails" is this
+    # check's contract, and a check that silently skips five of the eight kinds cannot
+    # honour it. The searches for the state kinds, for sequence, atomicity and budget
+    # are breadth-first, so their first witness is the shortest one; the leads-to walk
+    # and the probability bound have no such guarantee, and their message says what it
+    # found instead of claiming minimality.
+    violations = _run_invariants(model, max_states, True)
     findings = []
     for violation in violations:
         invariant = violation['invariant']
+        path_length = len(violation['path'])
+        if _is_path_property_invariant(invariant):
+            message = ('Invariant "' + invariant['id'] + '" violated: ' + violation['reason']
+                       + ('' if path_length == 0 else ' (witness path length: ' + str(path_length) + ')'))
+        else:
+            message = ('Invariant "' + invariant['id'] + '" shortest violating path length: ' + str(path_length)
+                       + (' (initial state)' if path_length == 0 else ''))
         findings.append({
             'code': 'A7_SHORTEST_COUNTEREXAMPLE',
             'severity': 'warning',
-            'message': 'Invariant "' + invariant['id'] + '" shortest violating path length: ' + str(len(violation['path'])) + (' (initial state)' if len(violation['path']) == 0 else ''),
+            'message': message,
             'path': violation['path'],
             'evidence': {'invariant': invariant['id']},
         })
@@ -1648,6 +1770,14 @@ def _map_invariant_for_comparison(invariant, mapping):
         when = invariant.get('when')
         if when is not None and 'state' in when:
             out['when'] = {'state': _map_state_id(mapping, when['state'])}
+    elif invariant['kind'] == 'leads-to':
+        # A target set maps member by member; a rename that drops a state is reported by
+        # D2's own mapped-state check rather than silently changing the property.
+        out['from'] = _map_state_id(mapping, invariant['from'])
+        to = invariant['to']
+        out['to'] = _map_state_id(mapping, to) if isinstance(to, str) else [_map_state_id(mapping, s) for s in to]
+    elif invariant['kind'] == 'probability':
+        out['target'] = _map_state_id(mapping, invariant['target'])
     return out
 
 
@@ -1683,7 +1813,33 @@ def D2_invariant_continuity(before, after, max_states, mapping):
                     'evidence': {'invariant': invariant['id'], 'variable': mapped['variable']},
                 })
                 continue
-        violation = _shortest_violation_for_invariant(after, max_states, mapped)
+        elif mapped['kind'] == 'leads-to':
+            # The state references of a path-property invariant must follow stateMapping
+            # too, otherwise a pure rename searches for a state AFTER does not declare.
+            for state in [mapped['from']] + _leads_to_targets(mapped):
+                if state not in after_states:
+                    findings.append({
+                        'code': 'D2_MAPPED_STATE_MISSING',
+                        'severity': 'warning',
+                        'message': 'BEFORE invariant "' + invariant['id'] + '" maps to state ' + state + ', which is not declared in AFTER.',
+                        'evidence': {'invariant': invariant['id'], 'state': state},
+                    })
+        elif mapped['kind'] == 'probability':
+            if mapped['target'] not in after_states:
+                findings.append({
+                    'code': 'D2_MAPPED_STATE_MISSING',
+                    'severity': 'warning',
+                    'message': 'BEFORE invariant "' + invariant['id'] + '" maps to state ' + mapped['target'] + ', which is not declared in AFTER.',
+                    'evidence': {'invariant': invariant['id'], 'state': mapped['target']},
+                })
+        # Every invariant the engine can decide is re-decided against AFTER.
+        # Path-property kinds go through the same searches their dedicated probes use,
+        # so D2 can no longer report "all BEFORE invariants continue to hold" while
+        # A9-A13 fail on the very same model.
+        if _is_path_property_invariant(mapped):
+            violation = _path_property_violation(after, max_states, mapped)
+        else:
+            violation = _shortest_violation_for_invariant(after, max_states, mapped)
         if violation is not None:
             findings.append({
                 'code': 'D2_INVARIANT_REGRESSION',
@@ -1869,29 +2025,71 @@ def S8_monotonic_variables(model):
                          'Monotonic variables are respected' if not findings else 'Monotonic findings: ' + str(len(findings)))
 
 
-def _find_leads_to_bad_path(model, start, target):
-    if start['state'] == target:
+def _leads_to_targets(invariant):
+    # Target states of a leads-to invariant. The schema accepts one state id or a
+    # non-empty array of them, so "reach any of these" needs no separate kind.
+    to = invariant['to']
+    return [to] if isinstance(to, str) else list(to)
+
+
+def _leads_to_target_label(invariant):
+    # Target list as findings print it. A single target renders as its bare id, so
+    # existing messages stay byte-identical.
+    return ', '.join(_leads_to_targets(invariant))
+
+
+def _find_leads_to_bad_path(model, start, targets, label):
+    # Find a run from start that reaches none of targets, or None when every run
+    # reaches at least one of them. The property is universal (see the A9 row in
+    # SKILL.md): one branch that loops forever, or that stops before any target,
+    # refutes it.
+    #
+    # Depth-first walk of the run graph with three colours; runs at a target are
+    # success leaves that are never expanded. A node reached while it is on the
+    # current walk (GRAY) closes a cycle that avoids every target. A node with no
+    # outgoing step at all stops the machine where it stands, which is the same
+    # violation for a different reason. A node whose walk completed without a
+    # violation is BLACK, and reaching it again from another branch is a shared
+    # sub-graph, not a cycle -- that is why the colour map cannot be a plain visited
+    # set: a diamond (two branches rejoining) is acyclic and must pass, while a
+    # genuine cycle must not. A run is identified by its state plus its variable
+    # values.
+    if start['state'] in targets:
         return None
-    visited = set()
-    queue = deque([{'runtime': start, 'path': []}])
-    while queue:
-        entry = queue.popleft()
-        k = _runtime_key(entry['runtime'])
-        if entry['runtime']['state'] == target:
+    GRAY = 1
+    BLACK = 2
+    color = {}
+    stack = [{'runtime': start, 'path': [], 'nexts': None, 'index': 0}]
+    color[_runtime_key(start)] = GRAY
+    while stack:
+        frame = stack[-1]
+        if frame['nexts'] is None:
+            nexts = []
+            for event in _all_events(model):
+                for nxt in _step_runtime(model, frame['runtime'], event):
+                    nexts.append({'next': nxt, 'event': event})
+            frame['nexts'] = nexts
+            if not nexts:
+                return {'path': frame['path'], 'reason': 'Dead end before target ' + label}
+        if frame['index'] >= len(frame['nexts']):
+            color[_runtime_key(frame['runtime'])] = BLACK
+            stack.pop()
             continue
-        if k in visited:
-            return {'path': entry['path'], 'reason': 'Cycle avoids target ' + target}
-        visited.add(k)
-        nexts = []
-        for event in _all_events(model):
-            for nxt in _step_runtime(model, entry['runtime'], event):
-                nexts.append({'next': nxt, 'event': event})
-        if not nexts:
-            return {'path': entry['path'], 'reason': 'Dead end before target ' + target}
-        for item in nexts:
-            queue.append({'runtime': item['next'],
-                          'path': list(entry['path']) + [{'from': entry['runtime']['state'], 'event': item['event'], 'to': item['next']['state']}]})
-    return {'path': [], 'reason': 'No path reaches target ' + target}
+        item = frame['nexts'][frame['index']]
+        frame['index'] += 1
+        step = {'from': frame['runtime']['state'], 'event': item['event'], 'to': item['next']['state']}
+        if item['next']['state'] in targets:
+            continue
+        key = _runtime_key(item['next'])
+        seen = color.get(key)
+        if seen == GRAY:
+            return {'path': frame['path'] + [step], 'reason': 'Cycle avoids target ' + label}
+        if seen == BLACK:
+            continue
+        color[key] = GRAY
+        stack.append({'runtime': item['next'], 'path': frame['path'] + [step], 'nexts': None, 'index': 0})
+    # Every branch either reached the target or rejoined a branch that did.
+    return None
 
 
 def A9_leads_to(model, exploration):
@@ -1899,10 +2097,12 @@ def A9_leads_to(model, exploration):
     for invariant in model.get('invariants') or []:
         if invariant['kind'] != 'leads-to':
             continue
+        targets = set(_leads_to_targets(invariant))
+        label = _leads_to_target_label(invariant)
         for runtime in exploration['reachable']:
             if runtime['state'] != invariant['from']:
                 continue
-            bad = _find_leads_to_bad_path(model, runtime, invariant['to'])
+            bad = _find_leads_to_bad_path(model, runtime, targets, label)
             if bad is not None:
                 findings.append({
                     'code': 'A9_LEADS_TO_VIOLATION',
@@ -2282,7 +2482,6 @@ def _compute_hit_probability(model, max_states, target_state):
 
 def A13_probability(model, max_states):
     findings = []
-    eps = 1e-9
     for invariant in model.get('invariants') or []:
         if invariant['kind'] != 'probability':
             continue
@@ -2291,16 +2490,7 @@ def A13_probability(model, max_states):
         converged = result['converged']
         op = invariant['op']
         p_bound = invariant['p']
-        violated = False
-        if op == '>=':
-            violated = probability < p_bound - eps
-        elif op == '>':
-            violated = probability <= p_bound + eps
-        elif op == '<=':
-            violated = probability > p_bound + eps
-        else:
-            violated = probability >= p_bound - eps
-        if violated:
+        if _probability_violated(invariant, probability):
             findings.append({
                 'code': 'A13_PROBABILITY_VIOLATION',
                 'severity': 'error',

package/skills/logicprobe-datamodel/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: logicprobe-datamodel
-description: "Use when reviewing design documents, architecture specs, technical proposals, schema changes, data contracts, or refactoring plans that make claims about entities, fields, constraints, relationships, data invariants, migration coverage, or before/after data-model equivalence. When the document contains schema changes, data migration logic, or data-behavioral assertions ('all records must have X', 'target count equals source count', 'no orphan rows', 'migration is non-breaking'), escalate into data-model verification — generate and run executable checks for structural consistency, data invariants, migration coverage, copy consistency, and breaking changes before trusting any claim. Also proactively SUGGEST this skill for code-level data/schema behavioral questions."
+description: "Use when reviewing design documents, architecture specs, technical proposals, schema changes, data contracts, or refactoring plans that make claims about entities, fields, constraints, relationships, data invariants, migration coverage, copy consistency, rollback symmetry, or before/after data-model equivalence. When the document contains schema changes, data migration logic, or data-behavioural assertions ('all records must have X', 'target count equals source count', 'no orphan rows', 'ids never move backwards', 'exactly one row per event', 'rollback restores the old shape', 'migration is non-breaking'), escalate into data-model verification — generate and run executable checks for structural consistency (DS1-DS4), data invariants and adversarial probes (DA1-DA12: null/boundary injection, uniqueness, referential integrity, migration coverage, copy consistency, rollback symmetry, idempotency, monotonicity, ordering, leads-to, atomicity), and before/after data regression (DD1-DD4) before trusting any claim. Behavioural, state-machine, protocol and concurrency claims belong to the sibling logicprobe skill. Also proactively SUGGEST this skill for code-level data/schema behavioural questions."
 ---
 
 # Logic Probe Data

package/src/concurrency-tool.ts

@@ -1,4 +1,4 @@
-import { defineTool } from '@deepseek-ai/dsh-tools'
+import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { JsonValue } from './json-value.js'
 import { runConcurrencyScan } from './concurrency.js'
 
@@ -13,7 +13,7 @@ export const LOGICPROBE_CONCURRENCY_SCAN_TOOL_NAME = 'logicprobe_concurrency_sca
 export const logicProbeConcurrencyScanTool = defineTool({
   name: LOGICPROBE_CONCURRENCY_SCAN_TOOL_NAME,
   description:
-    'Scan a document or plan text for concurrency risk points. Use ONLY after confirming the target actually has concurrency requirements or behavior (threads, async tasks, interrupts, shared state, parallel execution). If the target is purely sequential, do not call this tool. Returns findings for keywords like thread-safe, lock-free, data race, race condition, atomic, synchronized, mutex, semaphore, shared variable, reentrant, interrupt-safe. Absolute claims (thread-safe, lock-free, no data race) are flagged as errors requiring dedicated verification.',
+    'Scan a document or plan text for concurrency risk points. Use ONLY after confirming the target actually has concurrency requirements or behavior (threads, async tasks, interrupts, shared state, parallel execution). If the target is purely sequential, do not call this tool. Returns findings for keywords like thread-safe, lock-free, wait-free, data race, race condition, atomic, synchronized, mutex, semaphore, spinlock, shared variable, shared memory, reentrant, interrupt-safe, ISR, IRQ, NMI, critical section, disable_irq/enable_irq. Absolute claims (thread-safe, lock-free, no data race, interrupt-safe, ISR-safe) are flagged as errors requiring dedicated verification, and each carries suggestions naming the analysis to run instead (TSan/Helgrind, CBMC, TLA+, or RTOS-aware interrupt analysis). logicprobe does not prove concurrency safety.',
   parameters: {
     text: {
       type: 'string',