Supplied source documents

Esdieff accepts explicit SDF documents and retains every acquisition attempt. Source inspection and typed source projections are available independently of completed model assessment, following ADR 0013: Shared workflow and report guarantees.

For deliberate retrieval of a pinned public GitHub file into a new local snapshot, use the separate acquisition operation. Its receipt is independent of ordinary Model checking and is never loaded automatically.

The command accepts files and one standard-input document:

esdieff check --format json model.sdf.json
esdieff check --assessment expanded-modified-v1 --format json model.sdf.json
esdieff check --assessment expanded-pattern-syntax-v1 --format json model.sdf.json
esdieff check --root product.sdf.json common.sdf.json product.sdf.json
esdieff inspect --view source --document model.sdf.json --pointer /sdfData/Temperature model.sdf.json
esdieff check --format json -

All supplied files are candidates; their order selects no model role or precedence. A root or inspection document must explicitly name a supplied input. Use -- before a filename beginning with -. Paths retain their exact filesystem identities even when their display labels need Unicode replacement. Namespace URIs do not trigger acquisition.

Direct check also accepts repeatable --directory DIR inputs. It selects immediate regular .sdf.json files, or descends with --recursive, before ordinary acquisition. Repeatable --exclude RELATIVE_PATH prunes literal files or subtrees relative to every supplied directory. See directory discovery for selection, overlap and finite-work rules and a runnable mixed collection. Discovered roots use their joined acquisition paths relative to the invocation directory. Rust inputs and saved Check plan version 1 retain their existing explicit-source contracts. esdieff diff --old PATH --new PATH compares two Model revisions supplied as two files or two directories. Directories use the same discovery rules, and each discovered document is keyed by its path relative to its directory.

The Rust library supplies the same operations:

#![allow(unused)]
fn main() {
use esdieff::{Catalogue, Class, CheckRequest, InspectRequest, SourceInput};

let catalogue = Catalogue::from_inputs(&[
    SourceInput::supplied("sensor", br#"{"sdfData":{"Temperature":{"type":"number","maximum":100}}}"#)
        .label("Sensor description"),
])?;
let id = catalogue.source_id("sensor").expect("supplied source");
let report = catalogue.check(CheckRequest::new().root(id))?;
for condition in report.diagnostics().conditions() {
    println!("{}: {}", condition.code(), condition.message());
}
let source = catalogue.source(id).expect("listed source");
let temperature = source.definitions(Class::Data).require()?.next().expect("definition").1;
let maximum = temperature.data_description().require()?.number("maximum").require()?;
assert_eq!(maximum.lexeme(), "100");
let inspection = catalogue.inspect(InspectRequest::new(id, "/sdfData/Temperature"))?;
assert!(inspection.outcome().complete());
Ok::<(), &'static str>(())
}

Condition::primary() returns the location a condition is about and Condition::related() yields its related locations in report order, both as a ReportLocation. An absent primary means the condition has no single location, and an unavailable one means the report could not establish it. Source and sample locations carry their SourceId, pointer and any available byte span. Effective locations carry the root document of their effective-document space and a pointer, with no source id or span. Author and edit request locations keep their request key, pointer and any available plan span.

Catalogue::take_inputs consumes SourceInput::owned buffers; bounded buffers move into retained storage. Oversized spare capacity is reduced before retention, and retained capacity consumes the catalogue byte allowance. Borrowed inputs are copied into owned storage once. Identity metadata is validated before copying or acquisition. Limits changes supported finite acquisition, decoding and presentation allowances; zero and unsupported configurations are request errors.

Source views distinguish Field::Absent, Present and Unavailable. They expose all six classes, nested source groups, authored Property flags, Action input/output, Event output, data types, declared defaults, required map-entry syntax, choice branches and opaque JSON. They retain the full-description or direct-item context. Authored choice branches have no implied shared-quality inheritance; sdfRequired syntax has no implied resolved declaration identities. Source access inserts no effective defaults. Wider direct-item content remains accessible as raw JSON while unsupported typed meaning is unavailable.

Source and effective data descriptions expose minimum(), maximum(), exclusive_minimum(), exclusive_maximum(), multiple_of(), minimum_length(), maximum_length(), minimum_items() and maximum_items() as borrowed exact numbers. Positive steps and nonnegative integral lengths/counts distinguish malformed shape from absent or unavailable capability, without machine-sized count limits. Named pattern(), format(), sdf_type(), unit(), content_format() and unique_items() access preserves available scalar content without claiming syntax, registry, sample or consistency assessment. Unfamiliar selectors retain their text and unsupported meaning. constant() and declared_default() retain JSON without inserting values. These guarantees follow ADR 0022: Scalar constraints and characteristic states.

Property readable_characteristic(), writable_characteristic() and observable_characteristic() return Characteristic::Declared(bool) for an authored value in the inspected view, including inheritance, or SpecifiedDefault(true) for established effective absence. Source absence remains Field::Absent. The existing Boolean methods return the same values, and provenance remains available separately. A specified default characteristic is distinct from documentary default data.

Data-description nullable_characteristic() uses the same states for null admission. Full effective absence after inheritance/overrides has the specified value true; source absence stays absent. Direct-item nullable and its implicit default retain their unresolved meaning. Nullable, mandatory presence, documentary default and const are separate, following ADR 0024: Effective alternatives and nullable characteristics.

Grouping definitions expose repetition_minimum() and repetition_maximum() as authored exact numbers. Array-data descriptions keep their own minItems and maxItems qualities. A present class keyword outside an established base containment role has an unavailable typed child projection and retained raw JSON; its spelling alone does not establish an invalid model under the extensible framework.

An exact number retains its original JSON lexeme and offers sign, integrality, checked machine conversion and budgeted exact ordering. Scalar decoding limitations preserve raw source values and independent usable views. Duplicate decoded member names are refused at every depth under A002; no first or last value wins. These guarantees follow ADR 0012: Exact numbers and JSON input policies.

Checking identifies established source Given Name, document-block, definition-map and namespace-mapping problems. Names compare case-sensitively; spaces, slashes and tildes remain usable through escaped JSON Pointers. Literal data and opaque extension content do not acquire base definition roles merely because they contain familiar spellings.

Full data descriptions at Property and sdfData definitions, Action input/output, Event output and established nested properties or choice alternatives check parameter shapes recursively: strings, Boolean flags, numeric bounds, positive multipleOf, nonnegative integral lengths/counts, nonempty string-array enum, and map-shaped properties, sdfChoice, items and named full descriptions. Direct items descriptions check the restricted base shapes: number-valued minimum/maximum, nonnegative integral minLength/maxLength, text-valued type/format, nonempty string-array enum, and map-valued sdfChoice. Explicit object items check their properties map and each Full data description within it. Item choice alternatives are also Full data descriptions, so array alternatives and ordinary array-valued properties retain their recursive checks.

Map-data required receives its nonempty string-array shape check in Full data descriptions and Direct items descriptions when a reliable explicit type:"object" establishes its base context. Missing, nonobject, extended or unavailable type and unknown member identity do not establish that context. The borrowed required_entries() accessor presents nonempty authored syntax: Present alone does not establish an applicable object constraint, resolve sdfRequired, or check sample presence. Full descriptions retain documentary syntax access independently of applicability; Direct items descriptions retain their object guard. Empty lists and unavailable decoded entries remain typed Unavailable rather than authored absence. These source and effective distinctions follow ADR 0020: Owned effective views and nearest origins.

Surviving enum and sdfChoice conflict in both established roles independently of their values’ shape; ordinary null still occupies the quality, while possible reference-patch null deletion is deferred to composition. Unavailable decoded text does not become a nonstring error. Wider direct-item array, default, nullable, nested-items and other content stays available through raw JSON; needed typed meaning remains unavailable. It does not acquire full semantics or a blanket nested-array ban. Declaration requiredness, contradictions and sample admission remain separate unfinished work. The sdfType lexical restriction and wider extension meaning remain explicitly unassessed. These recursive role and provenance guarantees follow ADR 0020: Owned effective views and nearest origins.

The Information block’s title, description, version, modified, copyright, license and $comment entries receive string-shape checks. Established definitions and full data descriptions also check description, label and $comment; Direct items descriptions check their established description and $comment metadata. String contents do not acquire a semantic-version or SPDX requirement. The explicit expanded modified request additionally checks Gregorian dates and UTC labels, independently of composition, under the modified metadata contract. Its early Information pass records a reliable nonstring modified exactly once before unrelated traversal. Reliably absent info receives a nonblocking warning, following ADR 0003: Check findings and completeness. Strict warning policy changes the outcome disposition while retaining the warning’s severity and basis.

Unfamiliar unqualified Quality Names receive spelling advice. Familiarity covers the base spellings defined in the recorded RFC, including information qualities. Initial and expanded assessments give each assessed source at most one optional-vocabulary notice summarizing recognized qualified spellings, familiar names outside their established role and unfamiliar textual type, format or sdfType selectors. Its bounded observed_occurrences argument counts the occurrences actually inspected, which can be fewer than the source contains after a work limit. Full instead names and locates each inspected occurrence in its own notice, keeping observed_occurrences: 1 for source occurrences. It leaves out oma:id at its registered positions, because it checks that Recorded extension vocabulary itself. Both optional Full notices and unfamiliar-name warnings carry the decoded name in arguments.quality, also shown in human reports. The report contract describes bounded retention and omitted locations. Qualified spelling recognition establishes neither registration nor extension meaning. Given Names, namespace prefixes, literal const/default/enum content and opaque extension subtrees are excluded from Quality Name scanning. No registry snapshot or retrieval is implied, following ADR 0002: Recorded standards baseline.

Acceptance restriction A001 rejects sdfRequiredInputData at assessed vocabulary positions with guidance toward sdfInputData and an object input’s properties and required. The condition has acceptance basis A001, rather than an RFC-invalidity claim, following ADR 0008: Reject the historical Action input quality. A source composition patch’s null member is a deletion selector. A proven surviving non-null metadata or historical quality can retain a target-independent finding at a reliably established role; this does not establish the whole Effective definition. Unknown needed context and opaque keys remain deferred. Source inspection assesses no SDF vocabulary and remains available independently.

In established definition and data-description roles, any present sdfRef or unavailable member identity conservatively leaves possible merge/deletion context. Null members then cannot establish surviving qualities, including with wider reference forms. This uncertainty proves neither a valid reference nor resolved composition. An unsupported sdfRef spelling in an Information block or document map leaves its opaque content retained and does not import reference semantics into that role. These boundaries follow ADR 0006: Scoped reference failures and RFC 7396 Section 2.

Namespace mappings use generic RFC 3986 URI syntax, including percent escapes, bracketed IP literals, queries and fragments. Syntax checking introduces no scheme, DNS or retrieval requirement, and different documents may share a namespace URI. Grouping repetition counts must be nonnegative mathematically integral numbers; their shape check proves no grouping emptiness. In a source composition patch, null deletions are deferred to effective processing, while surviving names and definite non-null map/count overrides retain independent findings.

Before emitting structural or vocabulary findings, checking establishes the document’s declared critical-feature context. Reliably absent info, or a readable information map with reliably absent features or an empty feature array, permits ordinary base checking. Other declarations and unavailable relevant identities defer this source’s structural semantics, including namespace, metadata and A001 conclusions, with an explicit limitation. A readable text list of unsupported critical features receives its own explanation; wider or unreadable declarations receive a scoped inability-to-understand condition without a closed-grammar rejection. Supplied JSON decoding, duplicate-name refusal and the top-level map envelope remain independent; unaffected companion documents continue to receive their findings. Extension meaning remains unsupported, apart from the recorded value domain of oma:id.

Effective composition copies established definition and full-data targets, processes mandatory target-root references, then applies the consumer’s JSON Merge Patch without sdfRef before resolving surviving nested references. A consumer deletion can remove an otherwise unavailable nested reference. Opaque maps, Information blocks and direct-item imports do not gain full-definition meaning through map shape alone. Missing targets, cycles and unsupported reference forms leave affected portions explicitly unavailable, following ADR 0006: Scoped reference failures. A name reference selects the element at its pointer in the target document’s resolved model, for same-document pointers and CURIEs from other documents alike, so declarations that exist only through a copy can be referenced and required. Looking up the pointer composes each sdfRef on its path before descending, on the same work, node and reference allowances. Path compositions nested inside the lookups of other path compositions stop at a fixed stack bound of 32 levels, or the reference depth when that is lower, and exceeding it leaves the affected result undetermined with operation.limit. A copied sdfRef whose target, read in the context of the document that wrote it, is the copied definition or lies beneath it by pointer tokens relocates to the corresponding position in the importing definition and selects there in the resolved model. Relocation repeats at every enclosing copy boundary, so nested copies and target root chains follow the final importer’s refinements, while other copied references keep their original target. A target that a patch deleted is missing, with no fallback to the source, and a cycle through relocation or path composition is a scoped failure at the reference, following ADR 0036: Copied reference relocation.

Supplied CURIE composition uses the reference’s original namespace mapping and literal concatenation of its binding and reference tail. A copied CURIE keeps the mappings of the document that wrote it, even when the importer maps the same prefix differently, while one written in a composition patch uses the importer’s mappings even when its text equals the inherited one. A prefix that the writing document never mapped is the unmapped-prefix error at that original reference. Esdieff establishes a supplied target by exact decoded namespace text and a percent-decoded JSON Pointer fragment, without URI normalization, relative-URL resolution or retrieval. The supported prefix subset is ASCII [A-Za-z_][A-Za-z0-9_.-]*; wider NCName characters retain an explicit capability limitation. Multiple documents may contribute different addressed definitions to one namespace. Each contributor addresses the pointer in its resolved model, and an ambiguous or unavailable import met while composing its path leaves the lookup unavailable. Multiple contributors to the same address remain ambiguous even with identical content. Reliable missing prefix mappings and established malformed reference syntax are errors; a mapped but unavailable target is incomplete. Each such error is one finding at the reference as written, however many copies or checked documents reach it, while an unavailable target is reported at each effective position it leaves unfinished. Fragment-bearing bindings retain every character during assembly, so unsupported assembled forms cannot silently select another address. These boundaries follow ADR 0023: Supplied global composition and dependency scope.

Global candidate discovery first establishes the context needed for a contribution identity. Clear-context reliable absence of defaultNamespace excludes a contribution; raw absence under unknown critical features does not. An unreadable acquisition, envelope or relevant member also remains an unavailable possible contributor. Such uncertainty can prevent a unique lookup without making that candidate an established imported dependency or assessing unrelated definitions and metadata. Catalogue checks independently assess every supplied source; selected checks independently assess roots and examine only surviving dependency content through the shared effective evaluator. Imports met while composing a contributor’s path to a global target are needed dependencies too. Explicit expanded modified assessment additionally examines info.modified once per distinct needed dependency source, without assessing its other Information qualities. All supplied attempts remain visible.

Catalogue::effective(EffectiveRequest::new(id).pointer("/sdfThing/Device")) returns an owned effective result borrowing the catalogue. Its typed definitions, groupings, affordances and data descriptions use the same established roles as source access. A selected opaque map retains generic JSON access; typed class collections require an established parent role that permits that class. Known collection entries yield (name, Field<handle>), so an unavailable entry retains accessible siblings. Generic JSON traversal preserves independently established subviews; generating a semantically incomplete containing subtree returns Unavailable. Original scalars retain exact source lexemes and locations.

InspectRequest::required_declarations(true) requests declaration relationships in the selected source or effective subtree of a Model source. Sample sources are rejected before definition lookup in either view; ordinary raw source inspection of a Sample remains available. The command equivalent is esdieff inspect --required-declarations. Report::required_declarations() is Absent by default; when requested its collection reports state(), complete(), unavailable_reason() and owners(). Owner syntax and reference/target views preserve known invalid, missing, ambiguous and unavailable relationships independently. Short names select every directly contained affordance/grouping class sharing that Given Name, including the empty name; true array entries select the carrying affordance/grouping. These relationships do not interpret map-data required or nullable as declaration optionality.

An established outside pointer target has a source Definition, a complete relationship and capability NotRequested; its effective Definition is Absent. Request Catalogue::effective explicitly to examine that target’s content. In-scope targets expose actual processed coordinates and refinements, with capability completion separate from relationship completion. An authored pointer to an outside reusable contribution does not acquire the coordinate of a copy inside the selected subtree. Pointer entries resolve at their coordinate in the resolved model in both views, so an importer’s pointer to a declaration that exists only through its copy is resolved, and a deleted one is missing. The source view reports such a target with its source Declaration contribution and capability NotRequested. The target’s source Declaration contribution survives map refinement and root data-description substitution, while content origins and importing consumer retain their existing meanings. A copied pointer whose target, read in the context of the document that wrote it, is the copied definition or lies beneath it relocates to the importing definition’s coordinate like a copied sdfRef and selects the declaration there with its own Declaration contribution. Deleting that declaration leaves the relationship missing, and a declaration reinserted at the coordinate is the one selected. Data-only requiredness can remain unavailable while independent short-name or outside-pointer siblings are resolved. Source matches remain partial when unresolved inheritance could add matching classes. These distinctions follow ADR 0026: Required declaration relationships and source evidence.

EffectiveModel::explanation(pointer) identifies nearest content contributors, including deletion. Its consumer() identifies the source importing sdfRef when a composition boundary is established, independently of content origins. A mandatory target-root chain keeps the outer consumer; a separately composed nested reference starts its own boundary. default_explanation(pointer) separately identifies established implicit Property capability and full-description nullable defaults with no fabricated source. Deleting inherited writable:false leaves the JSON member absent, retains its deletion explanation and yields the typed true default. Defaults are never inserted into source or composed JSON. Copied sdfRequired pointers in definitions keep their authored text and available typed requiredness, and relocate when their relationships are resolved; independent targets and directly contained short names remain distinguishable. Copied prefixed sdfRef and sdfRequired references are read with their authoring document’s mappings, and both relocate when they point into the copied definition. Whether a reference is copied follows its own sdfRef member or sdfRequired array. Only one written in the composition patch belongs to the importer, so patching a sibling quality such as a description leaves a copied reference copied, following ADR 0036: Copied reference relocation. A copied pointer into the copied definition from a full data description, including Action input/output and Event output, keeps the separate data-only limitation with unavailable typed requiredness, while independent constraints remain accessible. Direct-item requiredness meaning remains unestablished. These ownership and provenance guarantees follow ADR 0020: Owned effective views and nearest origins and ADR 0023.

EffectiveDataDescription::alternatives() yields (AlternativeId, Field<EffectiveDataDescription>) after actual reference composition and shared-quality inheritance. Choice names and enum occurrence indices retain identity; enum values become const alternatives without changing composed JSON. Surviving explicit qualities replace whole shared qualities. Reference-deleted branch qualities permit shared fallback, while ordinary const null remains a value. Nested collections derive after their final inheritance. Absent, known empty and unavailable collections differ from individually unavailable branches. Known partial branches retain accessible independent qualities, including inherited bounds, while inherited restricted donor qualities stay typed-unavailable until explicitly overridden. source_alternatives() remains the composed branch syntax without shared inheritance. Existing pointer selectors select composed JSON; derived branch origins use direct EffectiveJson::explanation(), quality_explanation(key) and default_explanation(key) handles. This bounded view follows ADR 0024: Effective alternatives and nullable characteristics.

Checking assesses both source definitions and surviving effective vocabulary through shared rules. Composed contexts can produce distinct effective observations, even when a contribution retains a source origin. An unchanged local source observation is skipped only with proof of completed source evaluation, identical role and clear feature context, and unchanged rule premises. Source optional-vocabulary notices retain their actually-inspected observed_occurrences meaning; effective notices omit that source-count argument. Full effective notices identify the effective position and retain the nearest source contribution as a related location.

The initial assessment retains all eight fixed areas. Full has established immutable membership: thirteen assessment areas in esdieff.full-model/1 and fifty-four model requirements in rfc9880.model/1, described in the model assessment inventory. Applicable unfinished work still limits requested completion. Source acquisition and inspection do not imply completion of a requested assessment. Effective inspection establishes only its selected view and necessary composition, without implicitly assessing Information metadata or model vocabulary. A selected inspection can pass while an acquisition outside its needed work failed; a global lookup requiring that candidate’s contribution identity retains uncertainty. Every candidate still appears in its report.

Reports use JSON report 1.0. Human and JSON output share outcome, source identities, scope, requested assessment, standards basis and policy. Checks identify A001 and A002 as their acceptance restrictions; standalone inspection identifies A002. Detail or payload omission preserves aggregate findings and semantic completion. The CLI exits with 0 for passed requested work, 1 for failed work, 2 for invocation/configuration errors, 3 for undetermined work and 4 for host/output failures.

Additional source-workflow condition codes have these stable meanings:

Input size, decoded allocation, traversal, number and diagnostic budgets are finite operation bounds. Conservative report accounting covers bounded metadata DTOs, retained conditions, serializer capacity growth and output buffers under supported internal JSON layouts. These allowances do not promise a hard process RSS ceiling.

For effective unit spelling and dated registry guidance, request Assessment::ExpandedUnits or CLI --assessment expanded-units-v1. Report::unit_guidance() retains the six fixed observation counts and completion independently of located details. Report::registry_knowledge(id) and UnitGuidance::source_edition() borrow actual-use section and raw-edition facts. An embedding may deliberately withhold recorded evidence while retaining independent spelling errors. See the unit contract, following ADR 0027: Unit names and recorded registry guidance.

For complete content-format declaration spelling, separate decimal identifier range and dated registration guidance, request Assessment::ExpandedContentFormat or CLI --assessment expanded-content-format-v1. The two added area statuses and existing requested coverage aggregates distinguish finished syntax from unknown registration or unavailable evidence. Report::registry_knowledge(id) borrows actual-use CoAP, media-type and HTTP-coding facts; RecordedRegistryPolicy::WithholdRecorded keeps independent spelling errors while honestly withholding needed evidence. Parameters have explicit excluded-meaning Notices; payload validation and protocol binding remain separate. See the content-format contract, following ADR 0029: Content-format declarations and recorded registry guidance.

Assessment::FullBaseline also checks Recorded extension vocabulary. oma:id on an sdfObject or sdfAction definition or a full data description must be a whole number in the CDDL uint domain. So 3303 and 3303.0 are admitted, while "3303", -1 and 3303.5 are extension.recorded_value_excluded errors whose basis kind is registration, citing the OMNA SDF Quality Names registry with oma:id as id. Either way Full assesses M028. Each effective coordinate is checked, including inherited and overriding values, and at these positions oma:id does not stop base meaning. Report::registry_knowledge("omna.sdf-quality-names") borrows the recorded OMNA evidence once a value was checked against it. Withholding recorded evidence lists that record as unavailable, reports no excluded value and leaves M028 undetermined. oma:id elsewhere and other oma: names stay unsupported extension vocabulary. See Recorded extension vocabulary, following ADR 0038: Recorded extension vocabulary.

For effective model pattern syntax, request Assessment::ExpandedPatternSyntax or CLI --assessment expanded-pattern-syntax-v1. Its nine-area inventory adds pattern-syntax/1 to the initial eight, with typed status independent of optional detail. Full binds the same syntax work to M047 and its pattern/format area; broader applicable meaning may remain unfinished. Other profiles, inspection and Sample retain their purposes. Limits::pattern_bytes, pattern_nesting and pattern_alternatives reduce the supported ceilings; original operation work/allocation still cover all patterns together. See the pattern contract, following ADR0014: Bounded partial ECMAScript pattern capability and ADR0028: Bounded effective model pattern syntax.

AuthorRequest::new(catalogue, request_key, generated_key, thing_name) owns an explicit composition recipe. Add namespace bindings and AuthorObject declarations selecting supplied Source IDs and decoded pointers, then call author(). AuthorRequest::from_plan accepts the same bounded JSON recipe used by esdieff author; number lexemes in refinements stay exact. AuthorResult::generated_document() exposes a candidate independently of its generation(), fidelity() and outcome(). Its catalogue() includes immutable supplied sources and a distinct Generated SDF document, ready for the ordinary check, effective and inspect operations. document_deliverable() applies the CLI’s established-fidelity and requested-check policy. Author reports use the additive author operation in report 1.1, with separate authoring and requested-check coverage. This follows ADR 0017: Reference-preserving sdfThing authoring.

An authored refinement’s ordinary EffectiveModel::explanation keeps inherited, overridden and deleted source contributors. AuthorResult::request_origin(generated_source_view) adds the exact logical recipe coordinate and an available original-plan span; typed requests have no plan span. AuthorResult::checking() exposes its optional requested assessment, outcome and coverage without reparsing JSON. The authoring unit, assessment areas, full-baseline requirements and separate inspection unit retain distinct count meanings. See the refinement and explanation examples.

EditRequest::new(catalogue, request_key, source_id, generated_key) selects one existing document. Add explicit present-member replacements or removals with with_edit, then call edit(). The result retains original source evidence separately from its active catalogue(), where the generated document substitutes for that source. Candidate bytes and editing fidelity remain inspectable independently of optional Model checking. The editing contract defines the admitted owners and qualities, exact preservation, request locations and report version 1.2.

ComparisonRequest::new(earlier, later) compares two Model revisions supplied as Catalogues with the same limits, and compare() classifies each difference between their corresponding groupings as breaking, compatible or undetermined from the Client’s side. Documents correspond by source key. The RevisionComparison result borrows both Catalogues and exposes typed differences with their Client directions, effective locations in each revision and nearest content origins. ComparisonRequest::acknowledgements(&acknowledgements) supplies Difference acknowledgements of intended differences, which keep their classifications while only unacknowledged differences decide disposition(). The revision comparison contract defines correspondence, classification, acknowledgements, the shared allowance and report version 1.4, following ADR 0039: Client-side revision comparison and ADR 0040: Acknowledged revision differences.

Catalogue::generate(GenerationRequest::new(document)) builds Generated values for every affordance description of one model document, and select(kind, pointer) narrows the request to one description. Each value aims at one Generation target, such as a minimum or a value just below it, and Sample-value checking settles it, so the GenerationResult gives each description’s values with their targets and admissions. The generation contract defines the targets, their order, the ceilings, the JSON Lines Trace entries and report version 1.5, following ADR 0041: Generated values settled by Sample-value checking.

Catalogue::check_trace(TraceRequest::new(document, trace)) checks a Recorded trace, a JSON Lines file of Trace entries, against one model document. The document is composed once and every entry is checked on its own, so a malformed line fails alone, and the TraceResult counts passing entries and lists failed and undetermined ones with their line numbers, labels and conditions located in the trace file. The trace contract defines the entry format, the outcomes, the bounds and report version 1.5, following ADR 0042: Recorded traces with independent entries.