dsh-logicprobe 1.3.0 → 1.4.1

package/lib/uml-tool.js

@@ -1,153 +1,153 @@
-import { defineTool } from '@deepseek-ai/dsh-tools';
-import { createHash } from 'node:crypto';
-import { REPORT_SCHEMAS, DEFAULT_HASH_SPEC, modelHash, refusalVerdict, verdictOf, verdictOfFindings } from './engine.js';
-import { renderUml, parseUml, parseFindings, reviewUml, explainLabels, checkUmlIntent, UmlError } from './uml.js';
-import { renderReportText } from './report-view.js';
-export const LOGICPROBE_UML_TOOL_NAME = 'logicprobe_uml';
-/**
- * DSH tool wrapping the UML front end: model a code flow as a UML diagram
- * (`action: "render"`), read a UML diagram back into a LogicModelV1
- * (`action: "parse"`), or review the modelling itself (`action: "review"`).
- *
- * review is the half that makes the feature a check rather than a drawing
- * utility: it reports structural defects the diagram would present as valid
- * flow (unreachable states, dead ends, ambiguous and non-exhaustive branches,
- * self-loops with no exit), documentation gaps (a symbol no reader can map back
- * to code), and — the fidelity check — whether the rendered diagram reads back
- * as the model it was drawn from.
- */
-export const logicProbeUmlTool = defineTool({
-    name: LOGICPROBE_UML_TOOL_NAME,
-    description: 'Model a code flow as UML, and audit the modelling. action="render" turns a LogicModelV1 into diagram source: mermaid (state, activity, sequence) or plantuml (state, sequence). action="parse" reads Mermaid or PlantUML state or activity text back into a LogicModelV1, so a hand-drawn diagram can be verified. A sequence diagram is refused: a trace cannot reconstruct a machine. So is any other diagram family (class, ER, gantt, mindmap). That refusal carries errorCode "UML_NOT_A_STATE_DIAGRAM". A PlantUML component, package or deployment diagram declares no kind, so the parser detects those constructs itself. It returns a by-product model and reports the error UML_NOT_A_STATE_DIAGRAM, with `discardedConstructs` and `discardedEdges`. Never treat that model as a model of the file. action="review" audits the modelling: structural defects (UML002-UML009), documentation gaps (UML010-UML015), and a fidelity check that re-parses the rendered diagram (UML017). Give it a model, a diagram, or both. action="explain-labels" prints the label and comment conventions the parser accepts, without needing a diagram. Rendering never invents structure. A construct the notation cannot express becomes a warning. For dependency questions on a component or class diagram, use `logicprobe_structure_verify` instead. Declare `intent` (present, verify, fidelity) to say what the artifact is for: a view that cannot serve it is refused before any work, with errorCode UML_INTENT_UNSERVABLE, UML_VIEW_UNREPRESENTABLE or UML_INTENT_MISMATCH. Omit it and nothing changes. Read `verdict`, not `ok`: error findings mean a failed review.',
-    parameters: {
-        action: {
-            type: 'string',
-            required: true,
-            enum: ['render', 'parse', 'review', 'explain-labels'],
-            description: 'render = model → UML source; parse = UML source → model; review = audit the modelling (and its fidelity to the model); explain-labels = print the label and comment conventions this parser accepts.',
-        },
-        model: {
-            type: 'json',
-            description: 'LogicModelV1 machine. Required for render; accepted by review (alone, or next to diagram to check the two against each other).',
-        },
-        diagram: {
-            type: 'string',
-            description: 'UML source text. Required for parse; accepted by review.',
-        },
-        notation: {
-            type: 'string',
-            enum: ['auto', 'mermaid', 'plantuml'],
-            description: 'Diagram language. Default auto: detected from the text for parse/review, mermaid for render.',
-        },
-        kind: {
-            type: 'string',
-            enum: ['state', 'activity', 'sequence'],
-            description: 'Diagram kind to render. Default state. sequence is one BFS trace, not the whole machine. PlantUML activity is refused (its structured-flowchart syntax cannot faithfully carry a graph with merges or cycles) — use mermaid for that view.',
-        },
-        intent: {
-            type: 'string',
-            enum: ['present', 'verify', 'fidelity'],
-            description: 'What the artifact is for, declared up front: present = a human will read the diagram (any view), verify = it must be parseable into a LogicModelV1 for the engine (state or activity), fidelity = the point is the render-and-reparse proof (review only, state or activity). A view that cannot serve the intent is refused before any work, with errorCode UML_INTENT_UNSERVABLE, UML_VIEW_UNREPRESENTABLE or UML_INTENT_MISMATCH. Omit it and nothing changes: a sequence view is still rendered, and review still reports UML019.',
-        },
-        roundTrip: {
-            type: 'boolean',
-            description: 'review only: render and re-parse the model to prove the diagram carries it. Default true.',
-        },
-        maxSteps: {
-            type: 'integer',
-            description: 'Cap on the sequence trace length when rendering kind=sequence. Default 60.',
-        },
-        reportView: {
-            type: 'string',
-            enum: ['digest', 'full'],
-            description: 'digest (default) prints the diagram or report body; full prints the structured result as JSON.',
-        },
-    },
-    output: {
-        schema: {
-            type: 'json',
-            description: 'Render result (diagram source), parse result (LogicModelV1 + labels), or the modelling review report with findings, round-trip diff and next steps.',
-        },
-        render(args, value) {
-            // A rendered diagram is source text: the report body prints it verbatim, once.
-            // Echoing the whole result as JSON printed the same diagram a second time, escaped.
-            return [{ type: 'text', text: renderReportText(value, { full: args.reportView === 'full' }) }];
-        },
-    },
-    timeoutMs: 10_000,
-    isConcurrencySafe: () => true,
-    async execute(args) {
-        try {
-            if (args.action === 'render') {
-                if (args.model === undefined)
-                    return errorResult('action=render needs `model` (a LogicModelV1 object)');
-                const result = renderUml(args.model, (args.notation === undefined || args.notation === 'auto' ? 'mermaid' : args.notation), (args.kind ?? 'state'), args.maxSteps, args.intent);
-                return { ok: true, ran: true, ...verdictOf(0, result.warnings.length), schema: REPORT_SCHEMAS.umlRender, action: 'render', notation: result.notation, kind: result.diagram, diagram: result.primary, hashes: { diagram: createHash('sha256').update(result.primary).digest('hex') }, warnings: result.warnings };
-            }
-            if (args.action === 'parse') {
-                if (args.diagram === undefined)
-                    return errorResult('action=parse needs `diagram` (Mermaid or PlantUML text)');
-                checkUmlIntent(args.intent, 'parse');
-                const result = parseUml(args.diagram, args.notation ?? 'auto');
-                // A diagram from another family still parses into *something*. `parseFindings`
-                // says so, and the verdict is what stops that something from being trusted:
-                // `ok: true` only means the parser ran.
-                const findings = parseFindings(result);
-                return {
-                    ok: true,
-                    ran: true,
-                    ...parseVerdict(result, findings),
-                    schema: REPORT_SCHEMAS.umlParse,
-                    action: 'parse',
-                    notation: result.notation,
-                    kind: result.diagram,
-                    model: result.model,
-                    labels: result.labels,
-                    findings,
-                    discardedConstructs: result.discardedConstructs,
-                    discardedEdges: result.discardedEdges,
-                    hashes: { hashSpec: DEFAULT_HASH_SPEC, modelHash: modelHash(result.model), diagram: createHash('sha256').update(args.diagram).digest('hex') },
-                    warnings: result.warnings,
-                };
-            }
-            // R9: the label contract was documented in the library and in `explainLabels()`, but no
-            // tool exposed it, so it was reachable only by reading the source or the docs.
-            if (args.action === 'explain-labels') {
-                checkUmlIntent(args.intent, 'labels');
-                const notation = (args.notation === undefined || args.notation === 'auto' ? 'mermaid' : args.notation);
-                return {
-                    ok: true,
-                    ran: true,
-                    ...verdictOf(0, 0),
-                    schema: REPORT_SCHEMAS.umlExplainLabels,
-                    action: 'explain-labels',
-                    ...explainLabels(notation),
-                };
-            }
-            const report = reviewUml({
-                model: args.model,
-                diagram: args.diagram,
-                notation: args.notation ?? 'auto',
-                diagramKind: (args.kind ?? 'state'),
-                roundTrip: args.roundTrip,
-                maxSteps: args.maxSteps,
-                intent: args.intent,
-            });
-            return report;
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            return errorResult(message, error instanceof UmlError ? error.code : undefined);
-        }
-    },
-});
-/** The parse verdict counts parser notes as findings: an ignored line is information the model does not carry. */
-function parseVerdict(result, findings) {
-    const errors = findings.filter((finding) => finding.severity === 'error').length;
-    const warnings = findings.filter((finding) => finding.severity === 'warning').length + result.warnings.length;
-    const firstCode = findings.find((finding) => finding.severity === 'error')?.code ?? findings.find((finding) => finding.severity === 'warning')?.code;
-    return verdictOf(errors, warnings, firstCode);
-}
-function errorResult(message, errorCode = 'UML_INPUT') {
-    return { ok: false, ran: false, ...refusalVerdict(message), errorCode, error: message };
-}
+import { defineTool } from '@deepseek-ai/dsh-tools';
+import { createHash } from 'node:crypto';
+import { REPORT_SCHEMAS, DEFAULT_HASH_SPEC, modelHash, refusalVerdict, verdictOf, verdictOfFindings } from './engine.js';
+import { renderUml, parseUml, parseFindings, reviewUml, explainLabels, checkUmlIntent, UmlError } from './uml.js';
+import { renderReportText } from './report-view.js';
+export const LOGICPROBE_UML_TOOL_NAME = 'logicprobe_uml';
+/**
+ * DSH tool wrapping the UML front end: model a code flow as a UML diagram
+ * (`action: "render"`), read a UML diagram back into a LogicModelV1
+ * (`action: "parse"`), or review the modelling itself (`action: "review"`).
+ *
+ * review is the half that makes the feature a check rather than a drawing
+ * utility: it reports structural defects the diagram would present as valid
+ * flow (unreachable states, dead ends, ambiguous and non-exhaustive branches,
+ * self-loops with no exit), documentation gaps (a symbol no reader can map back
+ * to code), and — the fidelity check — whether the rendered diagram reads back
+ * as the model it was drawn from.
+ */
+export const logicProbeUmlTool = defineTool({
+    name: LOGICPROBE_UML_TOOL_NAME,
+    description: 'Model a code flow as UML, and audit the modelling. action="render" turns a LogicModelV1 into diagram source: mermaid (state, activity, sequence) or plantuml (state, sequence). action="parse" reads Mermaid or PlantUML state or activity text back into a LogicModelV1, so a hand-drawn diagram can be verified. A sequence diagram is refused: a trace cannot reconstruct a machine. So is any other diagram family (class, ER, gantt, mindmap). That refusal carries errorCode "UML_NOT_A_STATE_DIAGRAM". A PlantUML component, package or deployment diagram declares no kind, so the parser detects those constructs itself. It returns a by-product model and reports the error UML_NOT_A_STATE_DIAGRAM, with `discardedConstructs` and `discardedEdges`. Never treat that model as a model of the file. action="review" audits the modelling: structural defects (UML002-UML009), documentation gaps (UML010-UML015), and a fidelity check that re-parses the rendered diagram (UML017). Give it a model, a diagram, or both. action="explain-labels" prints the label and comment conventions the parser accepts, without needing a diagram. Rendering never invents structure. A construct the notation cannot express becomes a warning. For dependency questions on a component or class diagram, use `logicprobe_structure_verify` instead. Declare `intent` (present, verify, fidelity) to say what the artifact is for: a view that cannot serve it is refused before any work, with errorCode UML_INTENT_UNSERVABLE, UML_VIEW_UNREPRESENTABLE or UML_INTENT_MISMATCH. Omit it and nothing changes. Read `verdict`, not `ok`: error findings mean a failed review.',
+    parameters: {
+        action: {
+            type: 'string',
+            required: true,
+            enum: ['render', 'parse', 'review', 'explain-labels'],
+            description: 'render = model → UML source; parse = UML source → model; review = audit the modelling (and its fidelity to the model); explain-labels = print the label and comment conventions this parser accepts.',
+        },
+        model: {
+            type: 'json',
+            description: 'LogicModelV1 machine. Required for render; accepted by review (alone, or next to diagram to check the two against each other).',
+        },
+        diagram: {
+            type: 'string',
+            description: 'UML source text. Required for parse; accepted by review.',
+        },
+        notation: {
+            type: 'string',
+            enum: ['auto', 'mermaid', 'plantuml'],
+            description: 'Diagram language. Default auto: detected from the text for parse/review, mermaid for render.',
+        },
+        kind: {
+            type: 'string',
+            enum: ['state', 'activity', 'sequence'],
+            description: 'Diagram kind to render. Default state. sequence is one BFS trace, not the whole machine. PlantUML activity is refused (its structured-flowchart syntax cannot faithfully carry a graph with merges or cycles) — use mermaid for that view.',
+        },
+        intent: {
+            type: 'string',
+            enum: ['present', 'verify', 'fidelity'],
+            description: 'What the artifact is for, declared up front: present = a human will read the diagram (any view), verify = it must be parseable into a LogicModelV1 for the engine (state or activity), fidelity = the point is the render-and-reparse proof (review only, state or activity). A view that cannot serve the intent is refused before any work, with errorCode UML_INTENT_UNSERVABLE, UML_VIEW_UNREPRESENTABLE or UML_INTENT_MISMATCH. Omit it and nothing changes: a sequence view is still rendered, and review still reports UML019.',
+        },
+        roundTrip: {
+            type: 'boolean',
+            description: 'review only: render and re-parse the model to prove the diagram carries it. Default true.',
+        },
+        maxSteps: {
+            type: 'integer',
+            description: 'Cap on the sequence trace length when rendering kind=sequence. Default 60.',
+        },
+        reportView: {
+            type: 'string',
+            enum: ['digest', 'full'],
+            description: 'digest (default) prints the diagram or report body; full prints the structured result as JSON.',
+        },
+    },
+    output: {
+        schema: {
+            type: 'json',
+            description: 'Render result (diagram source), parse result (LogicModelV1 + labels), or the modelling review report with findings, round-trip diff and next steps.',
+        },
+        render(args, value) {
+            // A rendered diagram is source text: the report body prints it verbatim, once.
+            // Echoing the whole result as JSON printed the same diagram a second time, escaped.
+            return [{ type: 'text', text: renderReportText(value, { full: args.reportView === 'full' }) }];
+        },
+    },
+    timeoutMs: 10_000,
+    isConcurrencySafe: () => true,
+    async execute(args) {
+        try {
+            if (args.action === 'render') {
+                if (args.model === undefined)
+                    return errorResult('action=render needs `model` (a LogicModelV1 object)');
+                const result = renderUml(args.model, (args.notation === undefined || args.notation === 'auto' ? 'mermaid' : args.notation), (args.kind ?? 'state'), args.maxSteps, args.intent);
+                return { ok: true, ran: true, ...verdictOf(0, result.warnings.length), schema: REPORT_SCHEMAS.umlRender, action: 'render', notation: result.notation, kind: result.diagram, diagram: result.primary, hashes: { diagram: createHash('sha256').update(result.primary).digest('hex') }, warnings: result.warnings };
+            }
+            if (args.action === 'parse') {
+                if (args.diagram === undefined)
+                    return errorResult('action=parse needs `diagram` (Mermaid or PlantUML text)');
+                checkUmlIntent(args.intent, 'parse');
+                const result = parseUml(args.diagram, args.notation ?? 'auto');
+                // A diagram from another family still parses into *something*. `parseFindings`
+                // says so, and the verdict is what stops that something from being trusted:
+                // `ok: true` only means the parser ran.
+                const findings = parseFindings(result);
+                return {
+                    ok: true,
+                    ran: true,
+                    ...parseVerdict(result, findings),
+                    schema: REPORT_SCHEMAS.umlParse,
+                    action: 'parse',
+                    notation: result.notation,
+                    kind: result.diagram,
+                    model: result.model,
+                    labels: result.labels,
+                    findings,
+                    discardedConstructs: result.discardedConstructs,
+                    discardedEdges: result.discardedEdges,
+                    hashes: { hashSpec: DEFAULT_HASH_SPEC, modelHash: modelHash(result.model), diagram: createHash('sha256').update(args.diagram).digest('hex') },
+                    warnings: result.warnings,
+                };
+            }
+            // R9: the label contract was documented in the library and in `explainLabels()`, but no
+            // tool exposed it, so it was reachable only by reading the source or the docs.
+            if (args.action === 'explain-labels') {
+                checkUmlIntent(args.intent, 'labels');
+                const notation = (args.notation === undefined || args.notation === 'auto' ? 'mermaid' : args.notation);
+                return {
+                    ok: true,
+                    ran: true,
+                    ...verdictOf(0, 0),
+                    schema: REPORT_SCHEMAS.umlExplainLabels,
+                    action: 'explain-labels',
+                    ...explainLabels(notation),
+                };
+            }
+            const report = reviewUml({
+                model: args.model,
+                diagram: args.diagram,
+                notation: args.notation ?? 'auto',
+                diagramKind: (args.kind ?? 'state'),
+                roundTrip: args.roundTrip,
+                maxSteps: args.maxSteps,
+                intent: args.intent,
+            });
+            return report;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return errorResult(message, error instanceof UmlError ? error.code : undefined);
+        }
+    },
+});
+/** The parse verdict counts parser notes as findings: an ignored line is information the model does not carry. */
+function parseVerdict(result, findings) {
+    const errors = findings.filter((finding) => finding.severity === 'error').length;
+    const warnings = findings.filter((finding) => finding.severity === 'warning').length + result.warnings.length;
+    const firstCode = findings.find((finding) => finding.severity === 'error')?.code ?? findings.find((finding) => finding.severity === 'warning')?.code;
+    return verdictOf(errors, warnings, firstCode);
+}
+function errorResult(message, errorCode = 'UML_INPUT') {
+    return { ok: false, ran: false, ...refusalVerdict(message), errorCode, error: message };
+}

package/lib/uml.js

@@ -618,7 +618,7 @@ function parseTransitionLabel(label, warnings) {
  * comes out would be presented as if it described the file.
  */
 const MERMAID_OTHER_FAMILIES = [
-    'classDiagram', 'erDiagram', 'gantt', 'pie', 'journey', 'mindmap', 'gitGraph',
+    'classDiagram', 'erDiagram', 'gantt', 'pie', 'journey', 'mindmap', 'gitGraph', 'usecase-beta',
     'C4Context', 'C4Container', 'C4Component', 'C4Dynamic', 'C4Deployment',
     'requirementDiagram', 'timeline', 'quadrantChart', 'sankey-beta', 'block-beta',
     'packet-beta', 'architecture-beta', 'radar-beta', 'treemap-beta', 'xychart-beta',
@@ -642,6 +642,12 @@ function detectNotation(text) {
         return 'mermaid';
     throw new UmlError('cannot tell whether this is Mermaid or PlantUML text: expected `stateDiagram-v2` / `flowchart` / `sequenceDiagram`, or `@startuml`');
 }
+/**
+ * PlantUML use case syntax that carries no keyword: a colon actor, or a parenthesised
+ * use case, with an optional alias and an optional relation on the same line.
+ * `:User: --> (Login)` and `(Login) as (L)` are the whole header of such a file.
+ */
+const USECASE_SYNTAX = /^[ \t]*(?::[^:\n]+:(?:[ \t]+as[ \t]+[A-Za-z_][A-Za-z0-9_]*)?|\([^()\n]+\)(?:[ \t]+as[ \t]+\(?[^()\n]+\)?)?)[ \t]*(?:$|-->|->|\.\.>|\.>|--\|>|<\|--|--)/m;
 function detectDiagram(text) {
     if (/^\s*stateDiagram/m.test(text))
         return 'state';
@@ -658,6 +664,13 @@ function detectDiagram(text) {
         // structural one logicprobe emits, everything else in that family is a state diagram too.
         if (/^\s*participant\b/m.test(text) || /->>\s*/.test(text))
             return 'sequence';
+        // A use case diagram has no keyword header at all. The state parser below would read
+        // its arrows as transitions and return a plausible machine with no finding, so the
+        // family is refused by name. Its own model, and the tool that reads it, live in the
+        // dsh-model-everything plugin.
+        if (USECASE_SYNTAX.test(text)) {
+            throw new UmlError('this text is a use case diagram (`:Actor: --> (UseCase)`, `(UseCase) as (U)`), which this plugin does not model: it models state machines and flows, and reading it as one returns a machine the diagram never drew. The dsh-model-everything plugin renders, reads and reviews use case diagrams; keep this diagram as its own view.', 'UML_NOT_A_STATE_DIAGRAM');
+        }
         return 'state';
     }
     throw new UmlError('cannot tell which diagram kind this text declares');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-logicprobe",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "description": "Verifies claims about designs and code. Facts go against the source. Behaviour goes through an executable model: state machines, protocols, composition, data models, migrations. Structure diagrams are read as dependency graphs, at one level or several. Two reports can be compared for regression. Exports UPPAAL, TLA+, PRISM and SPIN input. Ships a native DeepSeek Harness bundle that injects the verification gate into the first model step.",
   "type": "module",
   "main": "lib/index.js",
@@ -40,7 +40,7 @@
       ]
     },
     "compatibility": {
-      "dsh": "^0.1.0-rc.7 || ^0.1.1-rc.1 || ^0.1.2-alpha.2 || ^0.1.2-alpha.3 || ^0.1.2-alpha.4 || ^0.1.2-alpha.5 || ^0.1.2-rc.1 || ^0.1.3-alpha.1 || ^0.1.3-alpha.2 || ^0.1.5-alpha.1 || ^0.1.5-rc.1 || ^0.1.5-alpha.2 || ^0.1.5-rc.2 || ^0.1.5-rc.3 || ^0.1.6-alpha.1 || ^0.1.6-alpha.2 || ^0.1.7-alpha.1 || ^0.1.7-alpha.2 || ^0.1.7-rc.1 || ^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
+      "dsh": "^0.1.0-rc.7 || ^0.1.1-rc.1 || ^0.1.2-alpha.2 || ^0.1.2-alpha.3 || ^0.1.2-alpha.4 || ^0.1.2-alpha.5 || ^0.1.2-rc.1 || ^0.1.3-alpha.1 || ^0.1.3-alpha.2 || ^0.1.5-alpha.1 || ^0.1.5-rc.1 || ^0.1.5-alpha.2 || ^0.1.5-rc.2 || ^0.1.5-rc.3 || ^0.1.6-alpha.1 || ^0.1.6-alpha.2 || ^0.1.7-alpha.1 || ^0.1.7-alpha.2 || ^0.1.7-rc.1 || ^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.1 || ^0.2.1-rc.2",
       "dshReleases": {
         "0.1.0-rc.7": "compatible",
         "0.1.0-rc.8": "compatible",
@@ -67,7 +67,9 @@
         "0.2.0-rc.1": "compatible",
         "0.2.0-rc.2": "compatible",
         "0.2.1-alpha.1": "compatible",
-        "0.2.1-alpha.2": "compatible"
+        "0.2.1-alpha.2": "compatible",
+        "0.2.1-rc.1": "compatible",
+        "0.2.1-rc.2": "compatible"
       },
       "profiles": [
         "headless",
@@ -85,11 +87,11 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",
-    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
-    "@deepseek-ai/dsh-skill-filesystem": "^0.1.0-rc.8 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.1 || ^0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.1 || ^0.2.1-rc.2",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.1 || ^0.2.1-rc.2",
+    "@deepseek-ai/dsh-skill-filesystem": "^0.1.0-rc.8 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.1 || ^0.2.1-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.1 || ^0.2.1-rc.2",
     "@deepseek-ai/schemastery": "^3.18.4"
   },
   "devDependencies": {
@@ -110,7 +112,7 @@
     "@deepseek-ai/dsh-tools": "^0.2.0-rc.2",
     "@deepseek-ai/dsh-user-approval": "^0.2.0-rc.2",
     "@deepseek-ai/schemastery": "^3.18.4",
-    "@types/node": "^26.6.4",
+    "@types/node": "^26.6.5",
     "typescript": "^7.0.2"
   },
   "author": {

package/skills/logicprobe/SKILL.md

@@ -5,6 +5,15 @@ description: "Use when you want to verify something about code: a design doc, sp
 
 # Logic Probe
 
+> **Successor: [`dsh-model-everything`](https://github.com/AmethystLuna/dsh-model-everything).**
+> This plugin continues as `dsh-model-everything`: the same domains, a superset of the
+> tooling, and a skill for each of them. If both are installed, load the
+> `model-everything` skill for new work — it routes to `model-everything-uml`,
+> `model-everything-structure`, `model-everything-datamodel` and
+> `model-everything-interleaving` — and keep this plugin's skills as the reference for its
+> own tool names (`logicprobe_*`). The two do not share a registry: a claim verified through
+> one is not verified in the other.
+
 For an unverified design, failure is only a matter of time. Complex code becomes clear once you model it and run it. Check every claim before you act on it.
 
 ## When This Skill Applies
@@ -161,6 +170,24 @@ UML modelling variant (the task is to draw a flow, not to check a claim):
     → logicprobe_verify → the behavioural checks (S1-S8 / A1-A14)
 ```
 
+### Budgeting the Model Before You Run It
+
+Search cost is the declared domain times the number of states — and a declared range is
+not a bound on the search.
+
+- **`inc`/`dec` are never clamped to `min`/`max`.** The declaration is a property the
+  checks verify, not a limit the engine enforces. A counter whose guard does not pin it
+  ranges past its own declaration, so the reachable set is unbounded however small the
+  declared range looks; S8 reports that as `S8_DOMAIN_NOT_ENFORCED`.
+- **Bound a counter with a guard, not a narrower declaration.** `max: 4` with a guard
+  `retry < 4` closes the loop. `max: 4` alone does not.
+- **Say the budget before running**: values per variable x states. A product in the
+  10^5-and-up range will hit the cap and come back undecided.
+- **Model the check where the code performs it.** A cap check that lives inside the tick
+  handler is a guarded branch of the tick event, not a separate event: as a separate event
+  the environment can starve it, and the leads-to failure you then read is an artefact of
+  the model rather than a property of the code.
+
 ### Native dsh Tools
 
 | Tool | Covers |
@@ -203,6 +230,11 @@ Turn the verdict into an answer, never into a summary of `ok`:
 
 Exit codes: `0` for `pass` / `pass_with_findings`, `2` for `fail`, a refusal, or an unreadable input. In DSH the native tools return the report as data — read `verdict`, and treat `errorCode`/`error` as the refusal path.
 
+`summary.truncated: true`, or a finding whose code ends in `_UNDECIDED`
+(`S7_UNDECIDED`, `A7_UNDECIDED`, `A9_LEADS_TO_UNDECIDED`, `D2_UNDECIDED`), means the search
+stopped before deciding. That is **not** a pass: name the invariant that went undecided,
+and say the property is undecided rather than reading the silence as success.
+
 ### Writing the Answer: Name the Finding, Not Its Code
 
 `S2_NO_TRANSITIONS`, `UML019`, `DA2` are values of `findings[].code`, not names. A reader
@@ -423,6 +455,20 @@ This skill owns behavioural claims. Three neighbouring domains have their own sk
 | Concurrency claims — "thread-safe", "lock-free", "no data race", "ISR-safe" — mined and routed to TSan/Helgrind/CBMC/TLA+, never proven here | `logicprobe-concurrency` |
 | Entities, fields, relationships, data invariants, schema migrations (DS1-DS4, DA1-DA12, DD1-DD4) | `logicprobe-datamodel` |
 
+### The Same Domains in the Successor
+
+[dsh-model-everything](https://github.com/AmethystLuna/dsh-model-everything) covers each domain above with one skill, and adds two this plugin does not have. Use the mapping when both plugins are installed — the successor's skill is the one to load for new work, because its tools are the ones its own guidance names:
+
+| This plugin | `dsh-model-everything` | What the successor adds |
+|---|---|---|
+| `logicprobe` | `model-everything` | the same doctrine over `model_verify`, `model_compose_verify` and `model_export` |
+| `logicprobe-uml` | `model-everything-uml` | more diagram families (timing, profile, composite, communication, interaction overview) |
+| `logicprobe-structure` | `model-everything-structure` | multi-level refinement between drawings |
+| `logicprobe-datamodel` | `model-everything-datamodel` | the same DS/DA/DD families over `model_datamodel_verify` |
+| `logicprobe-concurrency` | `model-everything-interleaving` | async vocabulary, a family per claim, and a lost update decided rather than routed |
+| — | `model-everything-design` | layering, substitutability, interface width (no counterpart here) |
+| — | `model-everything-report-reading` | how to read a report (no counterpart here) |
+
 ---
 
 ## Red Flags
@@ -437,6 +483,8 @@ If you catch yourself thinking any of these, stop:
 | "I'll check while implementing" | Check before the decision, not after. |
 | "Reasoning is enough" | Reasoning is not a run. One counter-example kills a universal claim. |
 | "The report passed, so the code is fine" | The report covers the model you gave it. Reconcile it, and say what you did not check. |
+| "The declared range limits the search" | The declaration is a property to verify. `inc`/`dec` are never clamped to it; only a guard bounds the value. |
+| "The check found nothing" | Read the verdict: `truncated` and `_UNDECIDED` mean the search stopped, not that the property holds. |
 
 ## Rules
 
@@ -449,4 +497,5 @@ If you catch yourself thinking any of these, stop:
 7. **Don't verify what the code already checks.** If the existing codebase has compile-time assertions, static analysis, or runtime checks for a property, cite those — don't re-verify in a model.
 8. **Hand a neighbouring domain to its own skill.** A diagram is a model, not evidence: modelling or auditing one belongs to `logicprobe-uml`. A concurrency claim is mined and routed, never proven here: that is `logicprobe-concurrency`. Schema, data invariants and migrations are `logicprobe-datamodel`. This skill keeps the doctrine and the behavioural checks.
 9. **Say what this does not prove.** For dimensions logicprobe does not verify — hard real time (deadlines, periods), preemptive concurrency, hybrid-control stability, probabilistic reliability, execution-cost budgets — route to the dedicated tool named in `references/gap-routing-guide.md`. `logicprobe_verify` reports carry the same routing as informational `coverageNotes` on matching models.
-10. **Write-site analysis is out of scope, and stays there.** "Only the ISR writes this flag", "one owner per register" — logicprobe verifies models and diagrams, not *who writes what in the source*. That claim needs a source-side AST/rule check or a static analyzer; this plugin's contribution is to flag the claim as unverified and route it (`logicprobe_concurrency_scan` does exactly that). Do not imply the diagram or the model settled it.
+10. **A declared range is a property, not a bound, and a capped search is not a pass.** `inc`/`dec` are never clamped to `min`/`max`; only a guard that pins the value bounds it. When a report is `truncated` or a check is `_UNDECIDED`, say the property is undecided and narrow the model — never report it as verified.
+11. **Write-site analysis is out of scope, and stays there.** "Only the ISR writes this flag", "one owner per register" — logicprobe verifies models and diagrams, not *who writes what in the source*. That claim needs a source-side AST/rule check or a static analyzer; this plugin's contribution is to flag the claim as unverified and route it (`logicprobe_concurrency_scan` does exactly that). Do not imply the diagram or the model settled it.

package/skills/logicprobe/references/dsh-model-schema.md

@@ -225,6 +225,17 @@ A guard is exactly one of:
 
 `inc`/`dec` default to 1 when `value` is omitted. `set` defaults to 0.
 
+`inc` and `dec` are **never clamped** to the variable's declared `min`/`max`. The declared
+range is a property the checks verify (S7 `var-in-range`), not a bound on the search: a
+counter whose guard does not pin it ranges past its own declaration, so the reachable set
+is unbounded however narrow the declaration looks. S8 reports that as
+`S8_DOMAIN_NOT_ENFORCED` and names the transition, rather than clamping the value and
+deleting the states a range violation is witnessed by. A `set` constant outside the
+declared range contradicts the declaration and is `S8_DOMAIN_SET_OUTSIDE` (error).
+
+To bound a counter, add a guard that pins it — `"max": 4` with a guard
+`{ "variable": "retry", "op": "<", "value": 4 }` — not a narrower `max`.
+
 ## Invariants
 
 Every invariant carries `id` and **`description`** — both required strings — plus a
@@ -396,9 +407,14 @@ The report's `comparison` object includes both model hashes, state/transition co
 
 List events that must be idempotent in `idempotentEvents`. For every reachable state, applying the event twice must produce the same state as applying it once. This is useful for retries, webhook redelivery, and migration replay.
 
-## Advanced constraints (S8, A9-A14)
+## Advanced constraints (S6, S8, A9-A14)
 
-- **S8 Monotonic Variables**: declare `monotonic: "inc"|"dec"` on a variable; updates must not move in the opposite direction.
+- **S6 Guard Completeness** also reports `S6_DEAD_GUARD`: a guarded branch no reachable
+  variable value can satisfy is a branch that can never fire. The test runs over the
+  values the model can produce — each variable's `init` plus every `set` constant — not
+  over the declared domain, so a guard on a value the model never writes is satisfiable on
+  paper and dead in practice.
+- **S8 Variable Declarations**: declare `monotonic: "inc"|"dec"` on a variable; updates must not move in the opposite direction. The same check reads the declared range: `S8_DOMAIN_NOT_ENFORCED` reports an `inc`/`dec` no guard keeps inside `min`/`max`, and `S8_DOMAIN_SET_OUTSIDE` (error) reports a `set` constant outside it.
 - **A9 Leads-To**: `{ kind: "leads-to", from, to }` — every path from `from` must eventually reach `to`. `to` is one state id or a non-empty array of state ids for "reach any one of these"; a duplicated member is a validation error rather than a shorthand. Either way the property stays universal: one branch that loops forever, or that stops before every target, refutes it.
 - **A10 Sequence**: `{ kind: "sequence", events }` — events must appear in order.
 - **A11 Atomicity**: `{ kind: "atomicity", events, commit, rollback? }` — once an atomic event starts, the machine must reach commit/rollback before leaving the atomic scope or terminating.
@@ -408,7 +424,8 @@ List events that must be idempotent in `idempotentEvents`. For every reachable s
 
 ## Limits
 
-- State-space exploration caps at `maxStates` (default 10000); larger guards/domains may report truncation instead of a false pass.
+- Each breadth-first exploration caps at `maxStates` (default 10000). The leads-to walk caps at twenty times that, **shared across every start state of one check**: it is depth-first over run states, and an unbounded counter makes every one of them distinct, so it has no shorter bound available.
+- A cap that bites is **reported, never silently passed**. The report sets `summary.truncated`, and the check that stopped carries a finding whose code ends in `_UNDECIDED` — `S7_UNDECIDED`, `A7_UNDECIDED`, `A9_LEADS_TO_UNDECIDED`, `D2_UNDECIDED`. An undecided check has proven neither the violation nor its absence; read it as "not decided", never as a pass.
 - A3 samples the first `maxPermutationEvents` events (default 5).
 - The engine is a finite-state model checker. It cannot prove properties of the real implementation; follow with code-level review.
 - `cost` values are modeler-provided static labels — A12 verifies against them; real execution time/WCET needs binary-level timing analysis.

package/skills/logicprobe-concurrency/SKILL.md

@@ -5,6 +5,8 @@ description: "Use when a design or plan claims concurrency safety (thread-safe,
 
 # Logic Probe — Concurrency Claims
 
+> **Successor: `dsh-model-everything`.** Its counterpart skill is `model-everything-interleaving`, which covers the same claims plus async and hands a shared location to `model_compose_verify` instead of routing it. Load that one when both plugins are installed; this skill stays accurate for `logicprobe_concurrency_scan`.
+
 This skill does **not** prove concurrency safety, and no report from it should ever be read as a proof. It mines a document, plan or code review for concurrency claims, marks them `UNVERIFIED`, and routes each one to the tool that can actually decide it.
 
 The claim-verification doctrine it inherits — enumerate verifiable claims, cite `file:line`, read `verdict` and never `ok` — lives in the `logicprobe` skill. Load that one when the task is behavioural verification of a state machine rather than a judgement about concurrency claims.

package/skills/logicprobe-datamodel/SKILL.md

@@ -5,6 +5,8 @@ description: "Use when reviewing design docs, specs, plans or migrations claimin
 
 # Logic Probe Data
 
+> **Successor: `dsh-model-everything`.** Its counterpart skill is `model-everything-datamodel`, over `model_datamodel_verify`. Load that one when both plugins are installed; this skill stays accurate for `logicprobe_datamodel_verify`.
+
 An unverified data model fails later. Model the schema and the migration, run them, and it becomes clear. Check every data claim before you act on it.
 
 ## Methodology

package/skills/logicprobe-structure/SKILL.md

@@ -5,6 +5,8 @@ description: "Use when reviewing architecture, module structure or a dependency
 
 # Logic Probe — Structure and Dependency Review
 
+> **Successor: `dsh-model-everything`.** Its counterpart skill is `model-everything-structure`, over `uml_structure_verify`, which also checks several drawings against each other. Load that one when both plugins are installed; this skill stays accurate for `logicprobe_structure_verify`.
+
 A component diagram is a model of an architecture, and a model can be wrong. This skill audits the graph the diagram actually draws — nodes and dependency arrows — against a declared dependency matrix, and says plainly what that does and does not prove.
 
 The claim-verification doctrine it inherits — cite evidence, read `verdict` and never `ok` — lives in the `logicprobe` skill. Load that one for behavioural claims (state machines, protocols, timing); load this one when the question is *where the dependencies point*.

package/skills/logicprobe-uml/SKILL.md

@@ -5,6 +5,8 @@ description: "Use when drawing a code flow as UML or auditing a diagram someone
 
 # Logic Probe — UML Modelling
 
+> **Successor: `dsh-model-everything`.** Its counterpart skill is `model-everything-uml`, which draws and reads more diagram families. Load that one when both plugins are installed; this skill stays accurate for `logicprobe_uml`.
+
 A diagram is a model, and a model can be wrong. A tidy flow chart is not evidence about the code, and a diagram that disagrees with its own model is worse than no diagram, because a reader will believe it.
 
 This skill covers the diagram half of the Logic Probe toolbox. The claim-verification doctrine it inherits — enumerate verifiable claims, cite `file:line`, read `verdict` and never `ok` — lives in the `logicprobe` skill; load that one when the task is to verify behaviour rather than to draw or audit a diagram.