Public workflow and report contract

This text specifies the shared guarantees behind the library, command and JSON report. The reasons are ADR 0010: Domain-oriented library and caller simplicity, ADR 0011: Machine-readable report contracts, and ADR 0012: Exact numbers and JSON input policies. Domain terms follow the domain language. Standards semantics come from RFC 9880 Sections 4.4 and 4.7, RFC 6901 Sections 3 and 4 for pointer tokens, and RFC 7396 Section 2 for merge/deletion. Resource limits and report fields are toolkit contracts, not RFC limits.

Library work and ownership

The public boundary is document-supplied domain work. A Catalogue owns each supplied source’s identity, acquisition result and content. Construction accepts owned content, or converts borrowed caller content into owned storage once. Views borrow the catalogue/result; callers do not keep the original strings alive, own reference graphs, manually merge JSON, or expose a particular parser/numeric dependency. Internals may use immutable sharing and caches, but do not expose mutable checked state.

The operation families are check(request), source(document), effective(request), check_sample(request), author(request), edit(request) and compare(request), using the same source/result/report foundation. Requests use builders with private fields. Operations produce usable results alongside scoped conditions. Malformed source input, unavailable dependencies and exceeded admitted work budgets are domain results. Configuration errors, unknown selectors and hard ceilings that prevent complete plan/request admission are request errors. Neither is a panic contract.

Each acquisition attempt receives a unique request-local SourceId before reading. Identity is an opaque caller key, distinct from a bounded display label, optional acquisition URI, content identity and SDF namespace. Duplicate caller keys are request errors. Same bytes supplied twice are two contributors, with no deduplication or precedence. CLI paths have distinct explicit identities; input position is not a semantic role. Source content is immutable owned bytes; UTF-8 text is available if decoding permits it, and raw bytes remain inspectable after decoding failures. Partial read/size-limit content records retained bytes and content_complete:false; it never purports to be the whole source. Acquisition failure has no content and stays visible. An optional caller content-version token is opaque; no path or label is a content hash. Reproducible callers may provide a digest; mandatory library hashing is not required.

Before copying any caller metadata, request validation checks UTF-8 byte lengths: caller key at most 256, display label 512, optional acquisition URI 2,048, content-version token 128 and digest 256. It preflights all attempts together against 1 MiB combined caller metadata, including exact raw filesystem identity bytes, every repeated source/scope-reference representation and all model, sample and generated attempts. These roles share one ceiling of 256 source attempts. Internal/report SourceId is a compact nonzero u32 allocated per request; it is separate from the bounded unique caller key. UTF-8 keys compare exactly, without case folding or normalization. Raw filesystem identities can contain non-UTF-8 bytes and are retained exactly for acquisition; their bytes consume the combined metadata budget. CLI adapters use bounded opaque caller keys to associate these identities, rather than forcing raw path bytes into UTF-8 keys.

Oversized semantic keys, URI/version/digest metadata, or aggregate metadata are request errors before ownership/copying or model processing. Keys/version identifiers are never clipped to fit. Only a display label may be shortened or omitted for presentation with a structured label_omitted reason; its full accepted form can remain available in owned metadata. Oversized supplied labels are request errors unless the caller explicitly requests label omission before retention. Library-owned baseline, policy and inventory metadata share a 64 KiB request budget. The mandatory report envelope is reserved before work using worst-case JSON escaping (up to six output bytes per input byte), all accepted source counts, fixed field overhead, repeated source/scope references, outcome/coverage counters and omission records. A report configuration smaller than that reserve is rejected before copying or acquisition. Optional report details consume only the remaining budget. No source attempt, aggregate finding or semantic identity is erased to meet a small report budget.

The default request has catalogue scope, including all supplied definitions and all source attempts. Explicit selected scope contains a nonempty set of supplied SourceId roots. Other sources are lookup candidates; reports separately identify roots, needed dependency sources, independently assessed sources and unavailable required sources. A missing/failed root is incomplete; an unreadable unrelated candidate remains in sources without alone spoiling selected-model work. If inability to inspect a candidate prevents establishing a needed addressed contributor or ambiguity, that lookup is incomplete. No implied network fetching or first/last input preference applies. Selected scope is rooted in documents, not individual definitions.

Selected checks independently assess their roots and use the shared effective evaluator for surviving imported content. Dependency source membership does not promise independent assessment of every definition or Information quality in that source. Catalogue checks do independently assess all sources. Global target discovery uses exact decoded namespace text and decoded target-pointer identity after the needed critical-feature context is established, as ADR 0023: Supplied global composition and dependency scope specifies. Possible contributors with unavailable identity remain distinct from established dependencies.

Source views expose all retained JSON and raw content, even when effective work fails. Typed source projections distinguish malformed/unsupported fields from absent fields. Effective views expose Things, Objects, Properties, Actions, Events and sdfData definitions with class-specific grouping, affordance, input/output and data-description access. Consumers can traverse groupings, inspect required declarations, obtain effective Property capabilities, data types and constraints, choices/enum alternatives, declared defaults and opaque qualities without rebuilding their semantics. Data-entry required remains separate from declaration sdfRequired. Extended data types remain tagged known/extended/undetermined values, not guessed base types.

An effective definition handle is scoped to its owning result and points to a root-document/effective path. Available subviews remain usable if another subview is incomplete. Missing, present, deleted and unavailable are distinct outcomes. Known defaults are returned as effective semantic values with a default origin when established; source access does not insert them. A lookup supports Lookup::Found, NotFound, Ambiguous, and Unavailable, so uncertainty cannot be mistaken for absence. Domain accessors return Field::Absent, Present(T), or Unavailable(reason) as appropriate. Option<T> is reserved for an established optional absence.

The implemented effective owner is EffectiveModel, returned by Catalogue::effective(EffectiveRequest::new(source_id).pointer(selector)) or borrowed from Report::effective_model(). It owns compact derived records and borrows immutable catalogue sources; its views borrow that owner. Effective named collection rows are (name, Field<handle>), preserving known unavailable entries and accessible siblings without changing source iterator item types. A containing handle can retain independent subviews when one descendant is unavailable. Unknown needed identity makes the affected collection or lookup unavailable.

explanation(pointer) describes composed content and its nearest source, inheritance, override or deletion contributors. default_explanation(pointer) separately describes an established implicit semantic value without an authored contributor. Both can describe the same absent path: a null patch deleting inherited writable:false retains a Deleted content explanation and a Default explanation for the typed true capability. No defaults are inserted into JSON. Direct-item defaults and copied requiredness in full data descriptions remain scoped limitations, with raw syntax accessible. These guarantees follow ADR 0020: Owned effective views and nearest origins.

Explanation::consumer() returns the established importing source sdfRef as an optional immutable source view. Ordinary source content has no importing consumer. An outer consumer survives its mandatory target-root chain; separately composed nested references establish their own consumers. Human inspection and optional JSON consumer locations expose the same boundary without changing nearest content origins or fabricating authored default sources.

Checks evaluate independent source definitions and surviving effective vocabulary through one role and rule set. Distinct composed observations contribute to aggregate findings before detail retention. Unchanged local replay requires completed source evaluation, identical established role and clear feature context, and unchanged rule premises; traversal still reaches composed descendants. Initial and expanded source extension.optional_unsupported summaries count actually inspected source occurrences in observed_occurrences. Their effective summaries retain that code and basis but omit the source-only count. Condition, byte and pointer presentation limits leave semantic totals and requested-unit status unchanged.

Full reports retain extension.optional_unsupported per inspected occurrence, with its decoded Quality Name in arguments.quality and its source location as primary. A composed observation has its effective position as primary and the nearest source contribution as one related location. quality.unfamiliar conditions also carry arguments.quality, in every assessment. Human reports show the name separately from the pointer, so it remains visible when a pointer is omitted. These details identify unsupported content behind unfinished Full requirements without changing its severity, interpretation or coverage status. Full optional notices count occurrences rather than summaries. Each source notice keeps observed_occurrences: 1; effective notices omit that source-only argument. Existing condition and diagnostic-byte limits bound how many occurrences are retained. Existing pointer limits omit pointers with their structured reason, and the name is charged against the diagnostic-byte limit before retention. No additional location collection or independent limit is used.

Accessible JSON has an Esdieff wrapper providing JSON kind, map/array traversal, scalar access and bounded generation. It retains arbitrary JSON numbers as numbers. No serde_json::Value, decimal-library type or mutable graph escapes into the public contract. Opaque structural access does not prove unknown extension meaning or permit generic edits to checked state.

Numbers and locations

An exact numeric view exposes its accepted original JSON lexeme, mathematical sign/integrality and budgeted exact ordering. Explicit checked machine conversions may return not-representable; they never round silently and cannot replace exact access. Comparison and later equality have their own finite-work result. The public number type is independent of its private representation. Unchanged generated numbers preserve an accepted raw lexeme, including 10e1000000 and 1e-1000000. A normalized internal coefficient is not a mandatory emitted token. Exact access to a count such as 18446744073709551616 establishes mathematical information, not normative CDDL uint membership, as ADR 0012 requires.

Locations are tagged source, effective or sample locations. A source location contains source_id, an optional decoded RFC 6901 pointer, and an optional half-open UTF-8 byte span. Byte spans refer to the retained original source, including key/token spans where relevant, and are not recomputed offsets in generated JSON. A root pointer is the empty string. Failed acquisition has a source identity with no invented pointer/span. A sample location uses its separate sample-source identity and pointer/span. An effective location contains the selected root identity and effective pointer; it is not a claim that this path exists in a supplied source. Non-renderable paths have pointer:null and a structured omission reason, with available spans retained.

An available explanation identifies the effective target, explanation kind (source, inherited, override, deleted, or default) and relevant source location(s). It may identify only the nearest contributor and patch location; it does not promise a complete history. Unavailable is explicit. For Device.ambient’s temperature minimum, the effective path ends /minimum, with the Temperature source /sdfData/Temperature/minimum. Its maximum 100 points to the patch source /sdfThing/Device/sdfObject/ambient/sdfProperty/temperature/maximum. The removed description’s explanation targets effective /sdfThing/Device/sdfObject/ambient/description despite the quality’s absence, identifies deletion at the null patch source and, when available, the inherited Sensor description. Controller.level inherits minimum from the supplied Level document, while maximum 80 and removed description refer to the Controller patch. Explanations of relocated content keep their nearest content origins, and their importing consumer is the original authored reference, following ADR 0036: Copied reference relocation.

An established Boolean default explanation additionally carries optional default_value:true, with the same value shown in human output. The field is absent for other origin kinds. It covers the already-supported Property readable/writable/observable and full-description nullable defaults, preserves separate deletion and default rows, and adds no JSON quality or interaction value. Detail admission reserves the annotation before construction; omitted explanation rows keep an explicit reason and do not erase typed characteristic access. This additive 1.x field follows ADR 0022: Scalar constraints and characteristic states.

Effective inspection additionally reports optional result.alternatives owner records with an effective owner location and collection state of absent, present or unavailable. Present can be empty. Known branches retain an id tagged choice with name or enum with occurrence index; branch states are available, partial or unavailable, with independent complete, json_present, optional unavailable reason and nearest/default/consumer explanations. A partial branch’s derived json can retain opaque raw quality values while unavailable_qualities explicitly identifies unestablished meanings. Raw JSON is not sample admission or consistency evidence. The composed result.json and existing pointer selectors retain their meaning. Count, byte, pointer or work omissions use explicit reasons and never imply an absent collection or completed meaning. Human output exposes the same collection, branch and unavailable-quality distinctions. These additive fields deliberately retain emitted check/inspect version 1.0 and follow ADR 0024: Effective alternatives and nullable characteristics.

Required declaration relationships

Requested required-declaration inspection adds result.required_declarations to the existing inspect1.0 result. Its twelve mandatory fields are state, complete, unavailable_reason, owners_known, owners_retained, references_known, references_retained, targets_known, targets_retained, owners_omitted, traversal_complete and owners. Counts describe discovered work and retained or presented subsets; no total of undiscovered owners is inferred. available with completed empty owners differs from unavailable, while a retained unfinished traversal is partial. Known invalid findings can coexist with complete traversal. Optional owner rows separate source and effective locations, relationship status, importing consumer and target capability (established, partial, unavailable, not_requested). Missing targets produce the Advice notice required.target_missing and scoped incompleteness; established wrong roles and malformed syntax are independent RFC errors. This inspection keeps the one existing inspection unit and the initial assessment inventory unchanged, following ADR 0026: Required declaration relationships and source evidence.

The requested operation admits the existing mandatory envelope plus twelve times selector bytes plus 1024 bytes before semantic work. The same additional reserve is subtracted from optional wire and scratch allowances. The summary is emitted directly into the existing output buffers with exact decimal Counts, fixed printable ASCII reasons of at most 96 bytes and quote/backslash escaping. It creates no summary Value/map, owned escaped text, numeric string, redundant selector flag or hidden empty owner transport DTO. A fixed Counts record occupies 28 bytes and the optional presentation plan 48 bytes in the 64-bit test executable. The worst supported literal control with seven ten-digit Counts, a maximally escaped reason and the one owner suffix omission emits 636 bytes; the conservative global diagnostic addition is 40 bytes, below the 768-byte wire bound. The complete early human prefix is 497 bytes, below 512. JSON and human are alternative outputs within the existing buffer allowance.

Optional owners stop at the first failed admission. One directly emitted omissions record gives the exact retained-minus-shown owner suffix and that first cause (count_limit, byte_limit or report_limit). The mandatory summary remains with empty owners at the exact admitted report cap, where optional wire and scratch are zero. Global diagnostic truncation and deduplicated reasons reflect the omission. The current borrowed reason inventory is at most eight entries: count_limit, byte_limit, not_available, report_limit, location_limit, byte_or_count_limit and presentation_limit. One additional owner omission reason needs at most 128 bytes borrowed-vector growth, 128 bytes for a Value cell and 16 bytes reason-string capacity, 272 bytes within the 528-byte allowance and 4096-byte additional mandatory ownership share. Reasons are deduplicated before known-length JSON conversion. Admitted optional location limitations use fixed flags; their global reasons and per-location DTO metadata are covered by that owner’s optional precharge.

Each optional owner reserves 1024 wire bytes, each reference 2048 and each target 3072, plus 512 per source/effective/related location and six times measured pointer or text bytes. Checked sums refuse unfit owners before constructing DTOs. Scratch reserves 32768 plus eight times the complete owner wire bound, covering nested DTO maps, strings, vector growth, parent serialization and temporary encoding. Actual retained wire size, plus 64 bytes for human row framing, is verified against that admission. Fixed missing/syntax/context conditions use the existing 512-wire/32768-scratch diagnostic admission. Semantic traversal edges, source positions, coordinates, contributor context, record capacities and all four operation counters are precharged before their work or allocation. Semantic failure changes completion; presentation omission does not.

Assessment identities and coverage

esdieff.initial/1 is the immutable default model-assessment identity. Its inventory is the agreed initial structure/composition inventory, independent of implemented checks. The eight stable area identities are document-envelope/1, base-roles-names/1, metadata-namespaces/1, established-composition/1, basic-parameters/1, alternatives-requiredness/1, extensions-policies/1, and advisory-four/1. Precise membership and guards are as follows.

The eight areas are assessed through the original bounded traversal, composition and required-declaration resolver. Completion requires every applicable area to be assessed or established not applicable; a definite error can coexist with complete work. Needed acquisition, composition, critical meaning or checking limits leave affected areas undetermined. The advisory area completes its four local proofs when relevant meanings and traversal are established, is not applicable after reliable absence, and is undetermined when needed meaning or work is unavailable. Warnings retain their basis and severity under strict policy. See initial contradiction advice for guards, witnesses and numeric work.

Declared or specified-default nullable true excludes the first three classes before applicability is recorded. A failed derived numeric precharge also retains an operation.limit condition in advisory-four/1, with Operational basis advisory-numeric-work and fixed proof_class, operation and affected qualities arguments. Multiple specific limits still make only the one advisory requested area incomplete. Unavailable meaning and omitted presentation details retain their separate causes; Full includes the same advisory area once.

The parameter context matrix is part of that identity: full descriptions at Property, sdfData, Action input/output, Event output, properties entries and sdfChoice alternatives; direct items require a map and only their established sdfRef, description, $comment, optional number/string/Boolean/integer/object type, choice/enum, minimum/maximum, format, minLength/maxLength meanings. An object direct item additionally permits required/properties, whose property descriptions are full descriptions. Direct-item choice alternatives are full descriptions. Wider framework-admitted vocabulary is retained with scoped limitations, not silently imported full-description meanings. Direct format checks text shape; direct array/minItems/nullable/nested-items/default meanings remain limited as recorded in ADR 0012 and the standards questions.

Map-data required shape checking applies to a reliable explicit type:"object" in either data-description role. A missing, nonobject, extended or unavailable type does not establish that applicability; unknown member identity also prevents it. Borrowed required_entries() presents nonempty authored syntax independently of semantic applicability in full descriptions, with the established object guard in direct items. An available list alone is not proof of an applicable map constraint or mandatory sample entries. Composition applies null deletions before assessing surviving effective qualities, and replay must preserve the containing object-type premise, following ADR 0020: Owned effective views and nearest origins.

Broader omitted requirements include formal CDDL numeric admission, detailed modified/unit/content-format checks, ECMA-262 pattern syntax, broader const/default consistency, full sample matching, and unresolved grammar/reference-form/item/requiredness/group-presence questions. A successful initial result therefore always reports broader baseline coverage as partial. Absence of a proof never establishes satisfiability.

esdieff.expanded.modified/1 explicitly requests those unchanged eight areas plus modified-date-time/1. Its ninth area checks ordinary Information modified dates and UTC labels directly, with exact fractions and finite recorded leap knowledge. Its membership stays fixed; other expanded work does not silently enter it. The modified metadata contract and ADR 0021: Explicit modified metadata assessment specify the additional meaning.

esdieff.expanded.numeric/1 explicitly requests the unchanged Initial eight areas plus advisory-numeric-three/1. Its ninth area attempts integer interval gaps, numeric const against every applicable bound, and positive-step interval gaps in established effective Full descriptions. The numeric advice contract and ADR 0030: Bounded numeric advice specify the exact role, meaning, null and finite arithmetic guards. The added mandatory reserve is zero; requested aggregates remain nine even with all optional rows and condition details omitted. Other profiles and Full do not implicitly acquire the new area. Undetermined numeric rows use Operational expanded-numeric-establishment; numeric capability conditions use Operational expanded-numeric-capability with no citation key. Completed or not-applicable numeric rows use Advice advisory-numeric-three/1. Numeric proofs preserve four original operand identities and absent-type argument/location absence.

esdieff.expanded.consistency/1 explicitly requests the unchanged Initial eight areas plus const-consistency/1 and default-consistency/1, for ten areas. The declared-value consistency contract and ADR 0031: Bounded declared-value consistency specify candidate selection, complete alternative witnesses and supported reasoning. Each definitively excluded candidate adds one Warning/Advice, independently of existing Initial producers and rejected leaf count. Documentary defaults are not inserted. The nearest real candidate source is primary, with effective constraints, origins and consumers related. Unknown needed meaning or finite evaluation limits leave the affected area undetermined; independent established advice remains. The added mandatory reserve is zero. Omitted rows/details preserve the ten-area aggregates and warning counts. Other profiles and Full retain their inventories.

esdieff.expanded.content-format/1 explicitly adds content-format-syntax/1 and content-format-registry/1 to the unchanged initial eight. The content-format contract distinguishes whole declaration spelling, decimal range, dated positives, current registration unknown, needed withheld evidence and excluded parameter meaning. The two private area states contribute to existing mandatory requested aggregates; located coverage rows remain optional. No mandatory per-name result graph or duplicate status map is added. Available registry metadata means actual admitted consultation, including a later unfinished lookup; an unconsulted table is Absent, and needed withheld knowledge has unavailable state with snapshot null. Completing these two areas alone does not complete any unfinished initial work. This follows ADR 0029: Content-format declarations and recorded registry guidance.

esdieff.expanded.pattern-syntax/1 explicitly requests those same initial eight areas plus pattern-syntax/1. It checks surviving effective Full string patterns with partial Unicode ECMAScript syntax capability, independently of explicit string type. Syntax-admitted and independently invalid inputs are assessed; no applicable string patterns after complete traversal is not applicable. Needed unknown context/text, unsupported syntax capability and operational limits make the one area undetermined. Every new condition carries that area identity. pattern.syntax is an RFC/ECMA error, pattern.unsupported uses Operational pattern-syntax-capability, pattern.unavailable uses pattern-establishment, and syntax operation.limit uses pattern-syntax-capability. Optional omissions preserve counts and status. See the pattern contract and ADR 0028: Bounded effective model pattern syntax.

Both ExpandedPatternSyntax and Full reserve 171 additional report bytes above the actual existing request envelope before composition or syntax work. The same reserve is removed from optional wire/scratch space. Full binds pattern syntax to M047 and full.pattern-format/1; repeated findings or limits do not add requested units. Initial, modified, unit, content-format, inspect and sample inventories retain their meanings.

full-baseline selects the immutable assessment and baseline rfc9880/base-1, area inventory esdieff.full-model/1, and its 54-member model relation rfc9880.model/1. The cited inventory covers the normative body and Appendices A/C with exclusive clause ownership, formal CDDL number rules and explicit nonmodel roles. Its 13 area members are full.document-syntax/1, full.model-roles/1, full.metadata/1, full.namespace-reference/1, full.composition-requiredness/1, full.critical-extensions/1, full.data-grammar/1, full.formal-numbers/1, full.scalar-meaning/1, full.pattern-format/1, full.compound-meaning/1, full.special-type-unit/1 and advisory-four/1. Known membership is independent of implemented capability. Every applicable unfinished requirement remains unassessed or undetermined. Sample admission, registry administration, device/protocol/operator duties and optional general analyses do not enter the model denominator.

Each model requirement joins its occurrences using undetermined before unassessed, assessed, then not applicable. Its owning area joins requirements once; the separate advisory area retains its existing meaning. Definite errors are assessed work. Full incomplete_checks counts unfinished areas among 13, while optional requirement aggregates count unfinished requirements among 54. They are never summed together. Historical Full reports with null inventory and coverage.inventory_unavailable remain interpretable as unknown membership, never an empty inventory.

Full broader coverage names rfc9880.model/1 with available membership. Its state is complete exactly when those54 model obligations are all assessed or not applicable; otherwise it is partial. The separate advisory area still contributes to the13-area requested outcome. Thus a model-complete report may have an incomplete requested outcome if only advice is unfinished. Completed model work can contain errors and a failed disposition; complete never means valid, universally supported or successful sample/device/protocol behavior. Full omits the optional broader omitted_areas list; absence does not establish completion. Other operations retain their partial/unavailable broader representation. Human and JSON presentations use the same state calculation.

Reports identify requested inventory, completion within it, and broader coverage separately. Coverage statuses are assessed, not_applicable, unassessed, or undetermined; assessed includes findings and does not mean satisfied. Unsupported applicable requested work is incomplete. Excluded initial work is outside that request and appears in broader coverage; it does not alone make the initial incomplete. Adding checks to meet existing inventory obligations is implementation progress. Enlarging membership, guards or semantic scope requires a new assessment/requirement identity. A bug fix may change a result for unchanged input while preserving the advertised meaning; it cannot silently redefine the meaning to match new behavior.

Report::assessment_area_status(id) returns a typed semantic status independently of optional coverage rows and conditions. Field::Present(AssessmentStatus) identifies a requested area; Absent means outside a known requested inventory; Unavailable means complete inventory membership cannot be established. An inspection requests no model assessment areas. Requested-but-not-applicable differs from not requested. Report::requested_coverage() exposes typed inventory, count-unit and aggregate accessors. Unknown needed context in any requested document makes the one modified area undetermined while independent definite errors remain visible.

Full also exposes requirement_inventory(), requirement_coverage(), requirement_status(id) and requirement_descriptors(). These borrowed accessors do not render or allocate a report. Known members have authoritative Present statuses even with zero retained detail; an unknown member is Absent, and other operations return Absent because they do not request the model inventory. Descriptors supply a stable ID, RFC citations, owning area and current check/limitation description. The description is capability documentation, never a runtime verdict.

Conditions preserve their producing assessment_unit. Full may add optional coverage_owner for the actual requested area. Modified work owns M012; both unit dimensions join M023 once; content work owns M024 and pattern syntax M047. Recorded extension values own M028. Required relationships preserve producing inspection and own M020 only in the Full recording context. Generic data conditions use the actual role and parameter: selector admission M034, numeric bounds M036, formal counts M037 and literal admission M035. No universal code-to-owner map is invented. Missing owner detail does not remove typed semantic states or mandatory inventory binding.

The report baseline records the RFC edition, specifically adopted corrections, interpretations, deviations, acceptance restrictions, and recorded external knowledge actually used. Temporal facts have their own interval and evidence identities, separate from registry knowledge. No registry snapshot means unavailable knowledge, not zero relevant entries or an unregistered-name conclusion. Findings identify a baseline requirement citation, recorded registration, adopted interpretation/deviation identifier, acceptance-policy identifier, advice class or operational limitation. Policy A001/A002 identities remain separate from RFC requirements.

Full content-format rule consultation records content-format-model-meaning/1 under the content-format contract. This records admitted use independently of successful establishment and optional diagnostics; it does not expand the existing content-format assessment’s scope.

baseline.interpretations lists copied-reference-relocation/1 from ADR 0036: Copied reference relocation whenever a result relied on it. That is when requested work relocated a copied reference, read a copied CURIE reference with its authoring document’s namespace mappings, or found that a name reference target in the resolved model differs from the document as written. The target differs when the written document has no element at its pointer, when the selected element holds copied content or a deletion that the written element lacks, or when composition removed the element the written document has there. A copied CURIE counts even when its prefix has no mapping in its authoring document. Reports that did none of these omit the identifier.

baseline.interpretations lists undeclared-extensions-ignorable/1 from ADR 0037: Undeclared extension vocabulary whenever a reported conclusion relied on it. That is when Full model meaning, contextual equality, declared-value consistency, numeric advice or Sample admission set aside undeclared extension vocabulary in a description and established its conclusion as if that vocabulary were absent. Recorded extension vocabulary set aside the same way, such as oma:id under ADR 0038: Recorded extension vocabulary, counts too when the report did not consult its recorded registry evidence. That is the case in a Sample report, in an assessment other than FullBaseline and in a FullBaseline check that withholds recorded evidence. Where FullBaseline consulted the evidence, setting the recorded quality aside names nothing. The sample contract describes the Sample case. An extension quality that no such conclusion consulted names nothing. Neither does one in a description whose base meaning is already stopped, for example by a base quality outside its role. Initial contradiction advice never consults the vocabulary. Reports that relied on no such description omit the identifier.

Outcomes, conditions and truncation

outcome contains complete, retained aggregate errors, warnings, notices, incomplete_checks, strict_warnings, and disposition. Requested work is complete only when every applicable requested requirement is assessed or established not applicable. Definite errors and scoped incompleteness can coexist. failed means an error exists or strict warnings are selected and at least one warning exists; otherwise unfinished work gives undetermined; otherwise passed. A failed incomplete result keeps complete:false. Strict warning policy changes disposition/exit eligibility, not warning severity, condition code, baseline meaning or error count.

Conditions have stable string code, severity (error, warning, notice, incomplete), basis, requirement/proof identity where applicable, optional primary source/effective/sample location, related locations and bounded structured arguments. Human message is explanatory and unstable. Report ordering is deterministic for the same supplied identities/request/version where practical, but consumers must not rely on ordering or wording. Codes are not message templates. For example:

This minimum code catalogue can grow additively with new operation-specific codes. Existing codes keep severity and meaning; changing either allocates a new code. Code parameters grow through optional fields without changing existing parameter meanings. Future codes are handled as strings with an unknown-code fallback; a client must still use structural severity/outcome. Future disposition/severity/basis semantics require a report major version, so a 1.x client can safely classify the fixed values above. The registration basis kind is the one exception. It joined version 1.0 in place because no report reader predates the first release, as recorded in ADR 0038: Recorded extension vocabulary.

The metadata.info_absent and quality.unfamiliar warnings identify their advice rules with a basis.id equal to the condition code and retain the supporting RFC citation. Advice identifiers and citations serve separate roles and can appear together.

Selected civil-value conditions use the domain, severity and basis catalogue in the civil-time contract. Actual convention use adds ADR0018-selected-representation to the shared interpretation array. Temporal knowledge retains its existing optional shape and records only actual C72 queries. These fields survive optional condition/witness/coverage omission and discarded branch evidence. Declared-value consistency keeps its existing advisory codes and check report shape.

The optional-vocabulary summary’s arguments.observed_occurrences is a Count of unsupported optional occurrences actually inspected in that source. It is bounded detail and can be absent if the condition is omitted; unfinished checking can leave additional occurrences uninspected. Check reports identify A001 and A002 in policy.restrictions, while standalone source inspection applies A002 without assessing SDF vocabulary. The A001 condition keeps its acceptance basis and current Action-input guidance, following ADR 0008: Reject the historical Action input quality.

Diagnostic count and byte budgets limit detail storage and rendering, not assessment. Aggregate counts and completion are updated before any condition is dropped. diagnostics records retained/omitted counts and count/byte/location omission reasons; details can be entirely empty while errors remain nonzero. Aggregate requirement-status and outcome counters remain even when coverage rows/details are omitted. Presentation-only pointer omission or condition truncation leaves otherwise completed checking complete. A semantic ancestry/storage/work limit makes affected requested conclusions incomplete. Rendering never allocates a complete oversized report and cuts it afterward.

Finite default work and allocation

ADR 0012’s input/number defaults remain: 4 MiB per source, 32 MiB catalogue, 256 documents, 64 nested containers, 100,000 JSON nodes per source, 1,024 bytes per number token, 512 coefficient digits, explicit exponent magnitude 1,000,000, and 2,000,000 numeric units per request. The following additional defaults close catalogue/derived/report amplification. They are capability, not standards limits or performance targets.

Capacity arithmetic is checked. Check work admits effective-result storage before composing the next root. Failed admission retains an operation.limit cause at that checked effective root, preserves earlier findings and supplied scope, and contributes to aggregate diagnostics even if detail is omitted. No zero/unlimited sentinel is accepted. Configuration validation enforces finite representable values, supported stack/identity ceilings, and enough report space for the mandatory supplied-source inventory; invalid configurations are request errors before work. Independent definite results and raw retained content survive limits. Builders allow lowering/raising supported budgets, but no public guarantee of accepting every arbitrary usize value exists.

A parser may borrow immutable raw source spans or allocate compact decoded values. Composition may share immutable/COW values or materialize them only after charging nodes, bytes and byte work. Either strategy must obey the same public limits. In particular, a 4 MiB opaque source value expanded thousands of times cannot bypass derived-byte/work budgets merely because its expansion count is under 100,000. Traversing shared content still charges check work. No performance target is invented; ordinary catalogue evidence is structural operation/allocation evidence and a bounded representative timing observation, not throughput qualification.

JSON report 1.0 and compatibility

Every supported JSON result is a single UTF-8 JSON object with schema:"esdieff.report". Required top-level fields are operation, request, sources, baseline, policy, outcome, coverage, diagnostics and result. Check and inspect retain version 1.0. Sample and author use their distinct version 1.1 payloads, edit adds version 1.2, diff uses version 1.5 after 1.4, and generate and trace add version 1.5 below. The sample contract, authoring contract, editing contract, revision comparison contract, generation contract and trace contract specify these operation payloads without changing check/inspect meanings. A reader rejects an unknown operation before interpreting its result. request identifies assessment/inventory identity and scope. sources includes every acquisition attempt with role, bounded identity/label and acquisition/decode/content-completeness status and never embeds whole source content. baseline identifies actual standards/corrections/interpretations/knowledge. policy identifies acceptance restrictions and strict warnings. coverage carries requested and broader inventories with aggregate statuses and optionally bounded rows. diagnostics carries aggregates, omission reasons and retained conditions. result is tagged by operation.

The tables below specify the normative shared check/inspect version-1.0 envelope. Later operation contracts add their own fields and tags. R means required; O means optional and omitted when absent. Only explicit T|null permits null. No absent optional field is interpreted as an assessed result. All maps admit additional optional fields under version-1.x rules, but every listed field retains its meaning/type. Id is a nonzero JSON integer from 1 through 256, unique within sources; IDs are request-local handles, not durable namespace/content identities. All references must select listed IDs; all source roles share that ceiling. Count is a JSON integer from 0 through 4,294,967,295; aggregate counters must not saturate or wrap. The accepted finite-work ceilings guarantee count bounds; configurations that cannot do so are rejected. Bytes is a Count measured in UTF-8 bytes except explicit raw filesystem-byte identity. Spans are [start,end] Count pairs with start <= end; spans cannot exceed retained source bytes. General JSON model numbers remain exact and are not restricted to Count.

The existing mandatory Full request.inventory binds both 13-area and 54-requirement memberships even when every new optional field is absent. Optional requirement rows have exact retained/omitted counts summing to54; a nonzero omission has one coverage.requirement_rows record with its reason and count. Area rows plus rows_omitted sum to the requested area total. Coverage-only omission also appears in diagnostics.omissions, sets truncated and links its reason in diagnostics.reasons. Consumers compare surviving condition multisets, including codes, bases, arguments, producing IDs and coordinates; duplicate facts cannot stand in for erased facts. Unknown additive fields, row order and human wording do not change meaning. Missing entire optional groups do not imply empty membership or finished per-requirement work. incomplete_checks counts each declared requested area once, independently of condition or row retention. Scope IDs and mandatory metadata remain within the original reserve; copied opaque source content is never automatically embedded.

Inspection does not implicitly request a model assessment. Its one declared inspection unit covers the acquisition, decoding, selection and, for an effective view, composition required to establish the requested view. Its explicit document selector supplies the root; unrelated candidate failures remain visible without alone making this work incomplete. Inspect outcome.complete is true only when that requested operation is complete, and incomplete_checks counts its one unfinished unit. An available subview does not erase other requested limitations. Broader coverage remains partial/undetermined: source inspection passing establishes a usable requested view, never RFC conformance. A presentation-only omission can produce a partial displayed payload while the operation’s semantic work remains complete. If required semantic view establishment is incomplete, the disposition is undetermined unless independent errors or strict warnings already make it failed. The operation tag and count_unit distinguish its one operation from check’s declared assessment areas without inventing a standards inventory.

Check result contains no additional payload beyond shared coverage. Inspection result contains a bounded source/effective selected view, explicit partial/unavailable state and explanations; large content is accessed via library-owned source or explicit CLI inspection output, never automatically included in every check report. Sample result contains separate sample source/selector, tagged admitted, rejected or undetermined conclusion and relevant effective model selector/locations. Authoring result contains generated-document identities/content availability, assessment and fidelity state (established or undetermined); generated bytes are obtained from owned result accessors or an explicit CLI document output. Its generated catalogue supports the same check and inspection operations. Failed or limited authoring never presents a partial candidate as faithfully completed output.

Report wire types are explicit DTOs, independent of Rust struct layout/private graph/enum serialization. JSON null means the explicitly unavailable/absent field defined by its containing tag, never a generic successful default. Version 1.x permits additive optional fields and condition codes; readers ignore unknown fields and retain unknown codes, and handle integer aggregates without lossy floating-point conversion. Existing required fields, fixed outcome/severity/basis/acquisition/decode values, units and absence semantics cannot change within 1.x. Renaming/removal/type changes need a major version. New operations have new tags: a check/inspect reader rejects an unknown operation before interpreting its result. Future sample/author tags can be added with their own pinned contracts, without changing existing check/inspect meanings. Rust views/builders use private fields, nonexhaustive extensible result enums and stable accessors; implementation dependencies and storage remain replaceable. Rust source compatibility is maintained for documented public callers within the supported crate version family, with breaking interface changes explicitly versioned independently of the JSON report.

Authored-quality editing report 1.2

Operation edit uses version 1.2 under ADR 0034: Authored-quality editing with source substitution. The shared source, scope, outcome and diagnostic meanings remain intact. The edit envelope adds the following mandatory operation fields.

Generation and fidelity may be complete/established while a requested check leaves editing coverage undetermined. Completed checking with findings completes assessment of the editing unit but gives a failed disposition. Available Full model inventories retain 13 assessment areas and 54 requirements, including mandatory aggregate coverage when optional rows are omitted. Unavailable inventories keep their ordinary null meaning. Individual edits never inflate RFC completion counts.

Every supplied/generated attempt stays in sources, including the substituted original evidence. active_sources excludes that original and retains every other distinct contributor. Scope identifies actual generated roots, needed dependencies, assessed sources and unavailable required sources. Optional detail omission cannot remove source identities, substitution, edit count, errors, candidate completeness, fidelity or established checking aggregates. Diagnostic omission remains explicit through ordinary omission records.

Original source locations refer to original bytes, generated locations to generated bytes, and effective locations to the active Catalogue. Replacement findings can have related original-member and edit-request locations. A removed generated member is absent and has no invented generated span. These bounded relationships do not claim exhaustive provenance.

Revision comparison report 1.5

Operation diff uses version 1.5 under ADR 0039: Client-side revision comparison, ADR 0040: Acknowledged revision differences and ADR 0044: Versions of breaking revisions. Version 1.4 succeeded 1.3, because Difference acknowledgements change what the outcome counts and the disposition mean and add required fields. Version 1.5 succeeds 1.4, because outcome.warnings now counts Version warnings and diagnostics.items holds them. Every diff report is emitted at 1.5. It reports one comparison of an earlier and a later Catalogue. The shared source, outcome and diagnostic meanings remain intact, and the revision comparison contract specifies every field.

Generated values report 1.5

Operation generate uses version 1.5 under ADR 0041: Generated values settled by Sample-value checking. It reports the Generated values of one selected model document and their admissions. Composition spends the request’s allowance, each description’s values are built on an allowance of their own, and each value is checked with the allowance one sample request receives, so running out leaves only the affected description partial. The 64-value and 1024-description ceilings keep the request finite, and every description and kept value is charged the report bytes its largest rendering needs, so every output format fits report_bytes. Values and descriptions that do not fit are counted with byte_limit and report_limit records and leave the operation undetermined. The shared source, outcome and diagnostic meanings remain intact, and the generation contract specifies every field.

Recorded trace report 1.5

Operation trace uses version 1.5 under ADR 0042: Recorded traces with independent entries. It reports one Recorded trace checked against one selected model document. The document is composed once on the request’s allowance, each distinct Sample selector is resolved once, and each Trace entry is decoded and checked with the allowances one sample request receives, so a malformed or heavy entry affects only itself. The file, line and entry ceilings are request errors, and each listed entry is charged the report bytes its larger rendering needs, so both formats fit report_bytes. Failed and undetermined entries that do not fit are counted with a report_limit record. The shared source, outcome and diagnostic meanings remain intact, and the trace contract specifies every field.

SARIF projection

check --format sarif and diff --format sarif emit a SARIF 2.1.0 log for code-scanning annotations, following ADR 0043: SARIF and Markdown report projections. The library gives the same log through Report::to_sarif(directory) for a check report and RevisionComparison::to_sarif(directory), where directory is the directory relative paths were resolved from. A log projects the same report as the JSON format. It renders only the conditions or differences that report retained and changes no conclusion, disposition or exit code.

The log has one run. tool.driver names Esdieff and the crate version, and lists one descriptor per result code in rules and one per notification code in notifications. Each descriptor has the code as its id and short description. Its full description names a condition code’s severity and basis kind, which the code keeps, or what a diff classification, undetermined reason or warning code means, and its help text points to the contract that describes the codes. run.columnKind is unicodeCodePoints. run.originalUriBaseIds gives %SRCROOT% the invocation directory as a file URI ending in /, when that directory is known. run.properties holds the report’s disposition and the omittedResults and omittedNotifications counts described below. The one invocation has executionSuccessful:true, because the report was produced, and holds the tool execution notifications.

A check result is a retained condition of severity error, warning or notice, at level error, warning or note, with its code as ruleId and its message. Errors come first, then warnings, then notes. A retained incomplete condition is a tool execution notification at level warning instead, with its code as descriptor, because unfinished checking is not a finding about the model.

The physical location of a check result comes from its primary source location, or else from its first related source location, and the other related locations follow in relatedLocations. The artifact URI is the source’s file path relative to the invocation directory, with / separators, percent-encoded segments, . and .. segments resolved as RFC 3986 resolves them, and the base %SRCROOT%, so code scanning finds the files when Esdieff runs from the repository root. A path outside the invocation directory, whether absolute or reached through .. segments, becomes an absolute file URI without a base. The region comes from the retained byte span. startLine and endLine count lines from 1, where CR, LF and CR LF end a line. startColumn and endColumn count Unicode code points from 1 within the line, and endColumn is the column just past the span. byteOffset and byteLength give the span itself. A location without a span, such as a source that could not be acquired, is a file-level location whose region is only startLine:1, because code scanning requires a start line. An effective location becomes a logical location whose fullyQualifiedName is the effective pointer, with properties view:"effective" and document, the label or else the key of its root document. A source without a UTF-8 file path, such as standard input, has no physical location, and its source pointer becomes a logical location with view:"source".

A diff result is a Version warning or a retained difference. Version warnings come first, each at level warning with its code as rule, located at the later document’s version or the nearest member that would hold it, with the earlier version as a related location. Differences follow in report order. A breaking difference is level error with rule comparison.breaking, an undetermined one is level warning with its reason code as rule, and a compatible one is level note with rule comparison.compatible. The message names the classification, then the kind, subject, document source key and effective pointer, and the undetermined reason or the Breaking witness with its admissions, in the words the Markdown changelog uses. Every diff result carries suppressions. An Acknowledged difference has one suppression of kind external with status accepted, so reviewers still see the break while code scanning treats it as intended, and the list is empty for every other difference and every Version warning. The later revision’s side locates the result when it has a nearest content origin, or when the earlier side has none either. Otherwise the earlier side does, as for a removed definition. The side’s origin gives the physical location, and its effective location gives a logical location with the property revision. The other revision’s side is a related location whose message names that revision.

The log stays within the report byte limit, which it applies on its own, so it can show differences whose details the JSON report left out for space, and the other way around. After the envelope, results and then notifications are kept in order while they fit, and the first that does not fit ends the list. omittedResults counts every finding the outcome counts that the log does not show, whether the report or the log left it out: the errors, warnings and notices of a check, and every Version warning and difference of a comparison. omittedNotifications counts the incomplete conditions of a check the same way. When either count is nonzero, a final notification at level warning states both.

Markdown changelog

diff --format markdown and RevisionComparison::to_markdown() give a Markdown changelog of a Revision comparison for release notes, following ADR 0043: SARIF and Markdown report projections. Like the SARIF log, it projects the same report as the JSON format, renders only the differences that report retained and changes no disposition or exit code.

It starts with the title # Model changes and a disposition line that counts breaking, undetermined and compatible differences, and the acknowledged ones when acknowledgements were supplied. A Warnings section lists each Version warning with the later document, its version or the place it is absent, the earlier version, the breaking count and the code. Sections follow for unacknowledged breaking, unacknowledged undetermined, compatible and acknowledged differences, in that order, and a section without differences is left out. Each item is one list entry naming the kind, the subject, the document’s source key and the effective pointer, taken from the later revision’s side when it has one. An undetermined item adds its reason and code, and an item with a Breaking witness adds the witness value, its Client direction and both admissions. An acknowledged item starts with its classification.

Model text appears only in code spans, including Given Names in pointers, quality names, source keys and witness values. A span’s fence is longer than any run of backticks inside it, and control characters, line breaks among them, become \uXXXX escapes, so a name can neither end its span nor start a new block. Reason messages are plain text with Markdown punctuation escaped.

The changelog stays within the report byte limit, which it applies on its own like the SARIF log. Items are kept in order while they fit, warnings first. When any difference or warning is not listed, whether the report or the changelog left it out, a closing line counts them.

CLI contract

The direct command is esdieff check [--directory DIR] [--recursive] [--exclude RELATIVE_PATH] [--root INPUT] [--assessment initial-v1|expanded-modified-v1|expanded-units-v1|expanded-content-format-v1|expanded-pattern-syntax-v1|expanded-numeric-v1|expanded-consistency-v1|full-baseline] [--registry-knowledge recorded|withheld] [--strict-warnings] [--format human|json|sarif] [INPUT...].

At least one positional INPUT or directory request is required. INPUT is an explicit file path or - for one stdin document. Repeat --directory DIR to prepare model sources from several directories. --recursive enables descent for all supplied directories, and repeatable --exclude RELATIVE_PATH omits literal files or subtrees relative to each directory. These traversal options require a directory request and apply only to direct checking and diff. Plan mode, inspect, sample, author and edit do not accept discovery options. The directory discovery contract defines selection, ordering, overlap and finite preparation limits.

An explicitly selected root must match exactly one supplied attempt by its exact native acquisition path. For a discovered root, this is the joined directory/file path. Directory, positional file and root paths resolve from the invocation directory. Repeated -, unknown or multiply matched roots and malformed options are usage errors. Positional files and discovered files are model candidates. Position never picks the root. Default roots are absent, which requests catalogue scope. Non-UTF-8 filesystem paths get a safe display label with their distinct identity preserved. Path labels are not namespace meanings.

The default is initial-v1; expanded-modified-v1 explicitly selects the fixed nine-area inventory, expanded-units-v1 selects the ten-area unit inventory, expanded-content-format-v1 selects the ten-area declaration inventory, expanded-pattern-syntax-v1 selects the fixed nine-area inventory comprising the initial eight plus pattern-syntax/1, expanded-numeric-v1 selects the Initial eight plus advisory-numeric-three/1, and expanded-consistency-v1 selects the unchanged Initial eight plus const-consistency/1 and default-consistency/1, with requested denominator 10. Explicit registry-knowledge values require an expanded unit/content or full-baseline assessment.

After successful invocation preparation, exactly one requested report goes to stdout, with a trailing newline. Directory preparation failures exit 2 with stderr and empty stdout before model content or stdin is read. Acquisition and decoding problems are in the ordinary report. stderr contains usage errors and output/host failures, not semantic conclusions omitted from JSON. Human and JSON formats use the same outcome/scope/coverage/baseline/policy. Exit 0 is passed requested work, 1 is failed (including strict warnings), 2 is invocation/configuration error, 3 is undetermined work without blocking errors, 4 is inability to emit the requested report or another host operation failure. Failed+incomplete uses 1 and keeps structural incompleteness. Truncated detail alone does not change exit status. stdin is read under input limits; no implicit retrieval/discovery occurs.

--format sarif emits the SARIF projection of a direct check or diff report, and --format markdown the Markdown changelog of a diff report, each with the exit code of that report’s disposition. Plan mode, inspect, sample and trace refuse --format sarif, and every operation other than diff refuses --format markdown, each with exit 2 and empty stdout.

esdieff diff --old PATH --new PATH [--recursive] [--exclude RELATIVE_PATH] [--acknowledged FILE] [--format human|json|sarif|markdown] compares an earlier and a later Model revision and emits one revision comparison report. Both PATHs are directories or both are files. Each directory is prepared separately with the directory discovery rules, and --recursive and --exclude apply to both. A document’s source key is its path relative to its directory, with components joined by /, so documents pair by location. In the two-file form both documents take the key document and correspond directly. A file beside a directory, - on either side, a missing --old or --new, a nonexistent PATH, and a relative path that is not UTF-8 or exceeds the 256-byte source key are invocation errors. Standard input is never read. --acknowledged FILE may appear once and names a file of Difference acknowledgements. The file is read and decoded before either revision’s content, and -, an unreadable file and any file the acknowledgement decoder refuses are invocation errors. Both revisions finish preparation before either one’s content is read, and both are acquired and compared under one operation allowance. Exit codes follow check and the disposition, which only unacknowledged differences decide: a comparison passes with exit 0, an unacknowledged breaking difference exits 1 and otherwise an unacknowledged undetermined one exits 3.

diff also accepts --acknowledgements-output FILE and --replace-acknowledgements. They write the JSON report’s eligible acknowledgement entries to a named file for review, following the acknowledgement export rules. Export preserves the report format and comparison exit status. Existing output requires explicit replacement and cannot alias a selected revision document or supplied acknowledgement file. Invalid destinations and exports the acknowledgement reader cannot accept exit 2 before delivery. Delivery failures exit 4.

esdieff generate --document MODEL [--kind KIND --pointer POINTER] [--format human|json|jsonl] MODEL_INPUT... emits the Generated values of one selected description, or of every affordance description of MODEL, as one human report, one generate report or JSON Lines Trace entries. MODEL, the inputs and - follow esdieff sample, and --kind and --pointer come together or not at all. A selector that selects nothing is an invocation error. Exit 0 is generation completed for every selected description and 3 is any other result, since generation never fails.

esdieff trace --document MODEL --trace FILE [--format human|json] MODEL_INPUT... checks the Recorded trace FILE against MODEL and emits one human report or one trace report. MODEL and the inputs follow esdieff sample. FILE is a path or -, and standard input may be used once across the inputs and the trace. The trace is read before any model input, and a trace that is missing, unreadable or larger than 64 MiB, a line over 1 MiB and more than 100,000 entries are invocation errors. A malformed entry fails only itself. Exit codes follow check: 1 for any failed entry, otherwise 3 for any undetermined entry, otherwise 0.

esdieff inspect --view source|effective --document INPUT --pointer POINTER ... is a complementary explicit inspect operation using the same report metadata/locations; callers can inspect retained source after assessment failures. Effective inspection never silently falls back to source. Its selector and requested output remain finite. Future sample/author commands use distinct operation tags and the shared source/report/exit rules, but operation-specific selectors, request options and document write/collision behavior are separately specified before those commands ship. Authoring’s report and document bytes have separate explicit destinations; it never mixes a report and generated SDF on stdout or writes an unasked destination.

Concrete cross-workflow obligations

The six-class Temperature/Sensor/Device fixture provides source and effective views: all six classes appear, ambient’s inherited minimum is -50, maximum 100, writable false, Event-output maximum 150, deleted description absent; source Sensor/Temperature are unchanged. The Controller/Level fixture uses explicit Controller roots, differently named prefixes for one namespace, minimum 0, maximum 80 and deleted description with unchanged source Level. Scope contrast adds an independently bad unused source: catalogue work fails, selected relevant work retains its appropriate outcome, and every supplied source remains visible.

For the selected temperature sample 101, a later sample request reports rejected, with sample root pointer ""/byte span [0,3] and model effective maximum path ending /maximum, related to the patch maximum 100; source Event-output maximum 150 is irrelevant to this selected description. Undetermined sample meaning cannot become rejection. Sample admitted/rejected is independent of strict-warning disposition. Sample request details remain future contract work, but its source/result/location foundation is settled here.

For a later authored Device Thing built from Sensor with the same override, the result owns generated SDF documents with new generated source identities, an assessed catalogue and effective views, while reusable source identities/content remain unchanged. Generated known numbers retain mathematical values and accepted unchanged lexemes. It reports any opaque-context fidelity limitation; structural retention alone is insufficient. Name/namespace request assembly, collision choices and file write policy remain the separate authoring decision. The shared contract does not force an internal flattened format, generic mutation API or speculative plugin system.

Explicit unit assessments add policy.recorded_registry, result.unit_guidance, and actual-use entries in baseline.registry_knowledge and baseline.interpretations under the existing 1.x additive field rules. The ten-area profile preserves the initial eight meanings. Fixed counters, null owner failure, scoped dated positives, withheld evidence and independent consultation/completion meanings are specified in the unit contract, following ADR 0027: Unit names and recorded registry guidance. Optional row and located-advice omission does not remove semantic summary fields. Full joins both unit dimensions into M023 and its requested special-type/unit area once.

Selected resource formats retain the Sample report version 1.1 and its nine-area inventory. baseline.format_knowledge contains only the six facts actually consulted by that Sample request, or null if its initial consultation owner could not be established. An established empty observation array differs from initial unavailability. The borrowed Report::format_knowledge getter and each static record’s four fields follow the URI and UUID sample contract. Non-Sample operations omit this field. UUID interpretation identities share the existing interpretation array; optional presentation omission preserves both.

Selected abstract-value meaning

Sample report version 1.1 adds mandatory result.meaning.abstract_values, result.meaning.const and result.meaning.admission. The two area objects have status, basis and limitations; their statuses exactly match sample-abstract-values/1 and sample-const/1. The admission object has basis and limitations, alongside the existing authoritative result.admission. The library exposes these same finite sets through SampleResult::meaning(). Not-applicable areas have empty sets. Undetermined admission has an empty supporting set. A definite independent rejection can retain its proof while an abstract obligation remains unfinished. A complete ordinary admission includes the general Appendix C reference without making absent const applicable.

References are unique complete (kind, id, citation) triples, in stable producing order. RFC references have a precise citation and no ID. Interpretation references have an immutable ID and precise citation. Operational references have an ID and preserve an existing precise citation when one exists. In particular, the temporal-knowledge, temporal-meaning and resource-meaning limitations retain their distinct cited triples even when IDs coincide with a general establishment limitation. The producer’s 24 support tags project to at most 23 unique references: temporal exceptional-slot and leap checks share the same RFC citation in this view. Original diagnostic and temporal-knowledge identities keep their existing shapes. The limitation inventory has nine unique triples. Borrowed iterator length and size hints count emitted unique references.

SampleResult::consulted_interpretations() observes actual request consultation of byte-string-json/1 and unix-time-posix-coordinate/1. Their union also appears in mandatory baseline.interpretations. An attempted interpretation survives discarded candidates, representation rejection and later limits. Consultation does not establish final support. Recognition alone, unavailable context, null-only admission and refused input preflight do not claim use. Existing civil and resource observations retain their separate contracts.

A later whole choice or enum witness replaces earlier tentative const proof and limitations. An unknown potentially matching branch prevents universal exclusion. Independent model findings and established sample areas remain authoritative. The human report prints the same three reference sets and consulted sample IDs; its labels and prose remain presentation details. Optional row/detail/location omission never removes mandatory statuses, references, consultation or counts.

The channels and their limits follow ADR 0007: Generated SDF and sample JSON, equality follows ADR 0015: Bounded value equality in a resolved data context, and ownership follows ADR 0025: Selected numeric samples. These are information-level conclusions, without a formal CDDL or protocol binding claim. Check and inspection retain their current payloads and report version. An older Sample 1.x report lacking the additive meaning fields leaves this capability unavailable; absence does not mean not applicable or established.