/**
 * cli:audit-ba — rules/dm.ts (DM-001..032 — module scope, all mechanical).
 * Mirrors business-analyse/audit-data-model/SKILL.md. Catalogues delegated to
 * lib/core-catalog, lib/capability-catalog, lib/fk-allowlist,
 * lib/display-field, lib/code-pattern-grammar (all drift-tested).
 */
import { findCodeLikeAttributes, isAttributeRowLoss, type BaEntity } from '../../../../../lib/ba-entities.js'
import { enumValuesOf } from '../../../../../lib/ba-list-split.js'
import { isTenantColumn, knownIndexColumns } from '../../../../../lib/entity-columns.js'
import { referencedFields } from '../../../../../lib/code-pattern-grammar.js'
import type { CorpusModel } from '../corpus/model.js'
import { isAuditAllowlisted } from '../../../../../lib/fk-allowlist.js'
import {
  COMPANY_IDENTITY_ATTRIBUTES,
  PERSON_IDENTITY_ATTRIBUTES,
  matchCoreEntity,
  matchPersonTrigger,
  matchReservedCoreName,
} from '../../../../../lib/core-catalog.js'
import { matchCapabilityAttribute, matchCapabilityTrigger } from '../../../../../lib/capability-catalog.js'
import { PREFERRED_DISPLAY_FIELDS } from '../../../../../lib/display-field.js'
import {
  findCodePatternNearMisses,
  findDecidedCodeNearMisses,
  hasSequence,
  tokenNames,
  validateFormat,
} from '../../../../../lib/code-pattern-grammar.js'
import {
  acceptanceCitationSources,
  citationsFor,
  classifyReferentialCode,
  initialValuesSources,
  isLookupClassification,
  isReferentialCodeError,
  prdCitationSources,
  ruleCitationSources,
  type ReferentialCodeVerdict,
} from '../../../../../lib/ba-referential-codes.js'
import type { BaRule } from '../../../../../lib/ba-rules-rows.js'
import { deriveTestData, type DeriveTestDataReport } from '../../../../../lib/ba-test-data-check.js'
import { TEST_DATA_FILE } from '../../../../../lib/ba-test-data.js'
import type { ModuleModel } from '../corpus/model.js'
import type { ModuleModel } from '../corpus/model.js'
import { camelOf, finding, fold, moduleScope, pascalOf, type RuleDef } from './registry.js'
import { stateAttrsOf } from './xd.js'
import { parseScreenBlocks, type ScreenBlock } from './screen-blocks.js'
import type { FindingAnchor, Finding } from '../types.js'

const DIM = 'data-model' as const

const PRIMITIVE_TOKENS = new Set([
  'DateTime',
  'DateOnly',
  'TimeOnly',
  'String',
  'Boolean',
  'Math',
  'Convert',
  'Int32',
  'Decimal',
  'Guid',
  'TimeSpan',
])

/** One evaluator per rule; helpers keep each check close to its SKILL prose. */

function classificationOf(e: BaEntity): string {
  return fold(e.classification ?? '')
}

// Delegated: DM-012, DM-015 and DM-022 must never drift on what a lookup is.
const isLookup = (e: BaEntity): boolean => isLookupClassification(e.classification)
const isTechnical = (e: BaEntity): boolean => classificationOf(e).includes('technical') || classificationOf(e).includes('technique')
const isComponent = (e: BaEntity): boolean => classificationOf(e).includes('composant') || classificationOf(e).includes('component')

function attrByFoldedName(e: BaEntity, name: string) {
  return e.attributes.find((a) => fold(a.name) === fold(name))
}

/** Whole-token PascalCase tokens of an expression (lowercase tail required —
 *  skips ALL-CAPS enum literals). */
function pascalTokens(text: string): string[] {
  return [...text.matchAll(/\b[A-Z][a-z][A-Za-z0-9]*\b/g)].map((m) => m[0])
}

/** Incoming relations of an entity across the whole project graph. */
function incomingCount(m: ModuleModel, e: BaEntity, model: { graph: { relations: { targetEntity: string }[] } }): number {
  return model.graph.relations.filter((r) => r.targetEntity === e.name).length
}

const ALLOC_NAME_RE = /(sequence|séquence|compteur|counter|numerotation|numérotation)$/i

/** Every SCR block of the module's screen.md docs (same walk as rules/xd.ts —
 *  kept local so this file stays committable on its own). */
function moduleScreenBlocks(model: { docs: { kind: string; app?: string; module?: string; relPath: string; raw: string }[] }, m: ModuleModel): ScreenBlock[] {
  return model.docs
    .filter((d) => d.kind === 'screen' && d.app === m.app && d.module === m.module)
    .flatMap((d) => parseScreenBlocks(d.raw, d.relPath))
}

/** Constraint FACETS that are not enum values — `enumValuesOf` falls back to
 *  every top-level segment when no `/`-run exists, so `| Status | enum | requis |`
 *  would otherwise count « requis » as one value. */
const CONSTRAINT_FACET_WORDS = new Set([
  'requis', 'required', 'obligatoire', 'optionnel', 'optional', 'facultatif',
  'nullable', 'unique', 'readonly', 'lecture seule', 'pk', 'fk', 'defaut', 'default',
])

/** Framework names the generator DROPS if listed (generate.ts `reserved`, minus
 *  `Id` which the authoring contract sanctions in the table). */
const FRAMEWORK_DROPPED = new Set(['createdat', 'updatedat', 'deletedat', 'tenantid'])
/** Framework names attributes.md USED TO claim as implicit while the generated
 *  base class does NOT provide them — listed, they become real columns. */
const FRAMEWORK_NOT_PROVIDED = new Set(['createdby', 'updatedby', 'scope'])

const escapeRe = (v: string): string => v.replace(/[.*+?^${}()|[\]\\]/g, '\\export const DM_RULES: RuleDef[] = [')

/** The DM-015 convention set of a lookup — DM-015 DEMANDS these fields, so
 *  DM-025 must never propose deleting them (the DM-012↔DM-022 arbitration
 *  failure, avoided by construction). */
const LOOKUP_CONVENTION_FIELDS = new Set(['label', 'name', 'isactive', 'sortorder', 'code'])

/**
 * DM-025's evidence: what DESCRIBES an attribute, gathered ONCE per module.
 *   - `corpus`: the folded text every whole-word mention is searched in — UCs
 *     (title, flows, pre/postconditions, ACs), rules (title, condition,
 *     expression, cases, portée), the RAW screen.md docs (columns, filters,
 *     fields, actions… whatever grammar they use), rbac.md, the module and
 *     section index.md;
 *   - `names`: folded attribute names STRUCTURALLY referenced — FK columns of
 *     every relation of the module, index columns, PascalCase tokens of every
 *     Calculé formula, the members a **Dérivé** projects, **Valeurs
 *     initiales** header cells, **Affichage**, **Code saisi**, the fields a
 *     **Code pattern** mask derives from.
 * Exported for its own test: the exemption list is where the bugs would live.
 */
export function attributeEvidence(model: CorpusModel, m: ModuleModel): { corpus: string; names: Set<string> } {
  const text: string[] = []
  for (const uc of m.ucs) {
    text.push(uc.title, ...uc.mainFlow, ...uc.preconditions, ...uc.postconditions)
    text.push(...uc.alternatives.map((b) => b.text), ...uc.exceptions.map((b) => b.text), ...uc.acs.map((a) => a.text))
  }
  for (const r of m.rules) text.push(r.title, r.condition ?? '', r.expression ?? '', r.validCases ?? '', r.invalidCases ?? '', r.portee ?? '')
  for (const d of model.docs) if (d.kind === 'screen' && d.app === m.app && d.module === m.module) text.push(d.raw)
  if (m.rbacContent) text.push(m.rbacContent)
  if (m.indexRaw) text.push(m.indexRaw)
  for (const s of m.sectionNodes) if (s.indexRaw) text.push(s.indexRaw)

  const names = new Set<string>()
  const add = (n: string | null | undefined): void => { if (n) names.add(fold(n)) }
  for (const e of m.entities) {
    for (const r of e.relations) add(r.fk)
    for (const idx of e.indexes) for (const f of idx.fields) add(f)
    for (const a of e.attributes) if (a.computed) for (const t of pascalTokens(a.computed)) add(t)
    for (const d of e.derivedRaw) {
      const nav = /nav\s+[A-Za-z0-9_]+\.([A-Za-z0-9_]+)/.exec(d)
      if (nav) add(nav[1])
      const sel = /select\s+([A-Za-z0-9_]+)/.exec(d)
      if (sel) add(sel[1])
      const pick = /(?:latest|open(?:-period)?)\(([A-Za-z0-9_]+)\)/.exec(d)
      if (pick) add(pick[1])
    }
    for (const c of e.initialValues?.columns ?? []) add(c)
    add(e.display)
    add(e.fields['code saisi'] ?? e.fields['typed code'])
    if (e.codePattern?.format) for (const f of referencedFields(e.codePattern.format)) add(f)
  }
  return { corpus: fold(text.join('\n')), names }
}

export const DM_RULES: RuleDef[] = [
  {
    id: 'DM-001',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      return {
        findings: [
          m.entities.length === 0
            ? finding('DM-001', DIM, 'err', moduleScope(m), `${m.app}/${m.module} : 0 entité déclarée — le module ne peut exposer aucune donnée. Lancer /ba-create-data-model.`)
            : finding('DM-001', DIM, 'ok', moduleScope(m), `${m.entities.length} entité(s) déclarée(s).`),
        ],
      }
    },
  },
  {
    id: 'DM-002',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const empty = m.entities.filter((e) => e.attributes.length === 0).map((e) => e.name)
      return {
        findings: [
          empty.length > 0
            ? finding('DM-002', DIM, 'err', moduleScope(m), 'Entité(s) sans aucun attribut.', empty)
            : finding('DM-002', DIM, 'ok', moduleScope(m), 'Toutes les entités ont ≥ 1 attribut.'),
        ],
      }
    },
  },
  {
    id: 'DM-003',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      // The whole contract of attributes.md § Quality checks — « every string
      // has a length, every decimal precision/scale, every enum non-empty
      // values ». This rule used to implement the string third only: a bare
      // `decimal` gets no .HasPrecision and SQL Server falls back to
      // decimal(18,2) — a declared decimal(5,4) silently loses two decimals.
      const offending: string[] = []
      for (const e of m.entities) {
        for (const a of e.attributes) {
          // A computed member has NO column (generate.ts drops `formula`
          // fields) — nothing to size. It used to err here for nothing.
          if (a.computed !== null) continue
          const type = a.type.trim()
          if (/^string/i.test(type)) {
            const inType = /string\s*\(\s*(\d+)/i.exec(type)
            const inConstraints = /max(?:length)?\s*[:=]?\s*(\d+)/i.exec(a.constraints)
            const len = inType ? Number(inType[1]) : inConstraints ? Number(inConstraints[1]) : 0
            if (!(len > 0)) offending.push(`${e.name}.${a.name} : string sans maxLength (> 0) — nvarchar(max)`)
          } else if (/^decimal/i.test(type)) {
            if (!/^decimal\s*\(\s*\d+\s*,\s*\d+\s*\)/i.test(type)) {
              offending.push(`${e.name}.${a.name} : decimal sans (précision, échelle) — SQL Server retombe sur decimal(18,2)`)
            }
          } else if (/^enum/i.test(type)) {
            const values = enumValuesOf(a.constraints).filter((v) => !CONSTRAINT_FACET_WORDS.has(fold(v)))
            if (values.length === 0) offending.push(`${e.name}.${a.name} : enum sans valeurs (A/B/C dans Contraintes)`)
          }
        }
      }
      return {
        findings: [
          offending.length > 0
            ? finding('DM-003', DIM, 'err', moduleScope(m), 'Type(s) d’attribut incomplet(s) — string sans maxLength, decimal sans précision/échelle, enum sans valeurs : perte silencieuse côté SQL.', offending)
            : finding('DM-003', DIM, 'ok', moduleScope(m), 'Tous les types sont complets (string maxLength, decimal (p,s), enum valeurs).'),
        ],
      }
    },
  },
  {
    id: 'DM-004',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      const moduleNames = new Set(m.entities.map((e) => e.name))
      const projectNames = new Set(model.graph.entities.map((e) => e.name))
      const broken: string[] = []
      for (const e of m.entities) {
        for (const r of e.relations) {
          if (r.scope === 'core') continue // CODE-003/DM-018 own the core leg
          const pool = r.scope === 'same-module' ? moduleNames : projectNames
          if (!pool.has(r.targetEntity)) broken.push(`${e.name} → ${r.targetEntity} (${r.scope})`)
        }
      }
      return {
        findings: [
          broken.length > 0
            ? finding('DM-004', DIM, 'err', moduleScope(m), 'Cible(s) de relation introuvable(s) dans le MCD.', broken)
            : finding('DM-004', DIM, 'ok', moduleScope(m), 'Toutes les cibles de relations résolvent.'),
        ],
      }
    },
  },
  {
    id: 'DM-005',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      // DFS cycle detection over the module-internal edges (self-refs skipped).
      const names = new Set(m.entities.map((e) => e.name))
      const edges = new Map<string, string[]>()
      for (const e of m.entities) {
        edges.set(
          e.name,
          e.relations.filter((r) => r.targetEntity !== e.name && names.has(r.targetEntity)).map((r) => r.targetEntity),
        )
      }
      const cycles: string[] = []
      const state = new Map<string, 'visiting' | 'done'>()
      const stack: string[] = []
      const visit = (n: string): void => {
        state.set(n, 'visiting')
        stack.push(n)
        for (const t of edges.get(n) ?? []) {
          if (state.get(t) === 'visiting') {
            cycles.push([...stack.slice(stack.indexOf(t)), t].join(' → '))
          } else if (!state.has(t)) visit(t)
        }
        stack.pop()
        state.set(n, 'done')
      }
      for (const n of edges.keys()) if (!state.has(n)) visit(n)
      return {
        findings: [
          cycles.length > 0
            ? finding('DM-005', DIM, 'warn', moduleScope(m), 'Chaîne(s) de relations circulaire(s) (les auto-références sont exclues).', [...new Set(cycles)])
            : finding('DM-005', DIM, 'ok', moduleScope(m), 'Aucun cycle de relations.'),
        ],
      }
    },
  },
  {
    id: 'DM-006',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const bad = m.entities.filter((e) => !/^[A-Z][A-Za-z0-9]*$/.test(e.name)).map((e) => e.name)
      return {
        findings: [
          bad.length > 0
            ? finding('DM-006', DIM, 'warn', moduleScope(m), 'Nom(s) d’entité hors PascalCase.', bad)
            : finding('DM-006', DIM, 'ok', moduleScope(m), 'Tous les noms d’entités sont en PascalCase.'),
        ],
      }
    },
  },
  {
    id: 'DM-007',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const bad: string[] = []
      for (const e of m.entities) {
        for (const a of e.attributes) {
          if (!/^[a-zA-Z][A-Za-z0-9]*$/.test(a.name)) bad.push(`${e.name}.${a.name}`)
          // The corpus writes attribute tables in PascalCase (doc-templates) —
          // the camelCase convention concerns the MCD notation. Accept both
          // Pascal and camel; flag underscores/hyphens/digit-first only.
        }
      }
      // Rows the parser REFUSED are this rule's subject too. For as long as the
      // parser dropped them silently, this rule could only ever fire on an
      // underscore — accents, hyphens, digit-first never reached it, and its
      // ok verdict described the survivors, not the document.
      for (const w of m.entityWarnings) if (isAttributeRowLoss(w)) bad.push(w)
      return {
        findings: [
          bad.length > 0
            ? finding('DM-007', DIM, 'warn', moduleScope(m), 'Attribut(s) hors convention (lettres/chiffres, initiale alphabétique).', bad)
            : finding('DM-007', DIM, 'ok', moduleScope(m), 'Tous les attributs respectent la convention de nommage.'),
        ],
      }
    },
  },
  {
    id: 'DM-008',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const bad = m.entities
        .filter((e) => !e.tablePrefix || !/^[a-z]{2,5}_$/.test(e.tablePrefix))
        .map((e) => `${e.name}${e.tablePrefix ? ` (« ${e.tablePrefix} »)` : ' (absent)'}`)
      return {
        findings: [
          bad.length > 0
            ? finding('DM-008', DIM, 'warn', moduleScope(m), 'Préfixe de table absent ou invalide (attendu : 2-5 minuscules + underscore).', bad)
            : finding('DM-008', DIM, 'ok', moduleScope(m), 'Tous les préfixes de table sont valides.'),
        ],
      }
    },
  },
  {
    id: 'DM-009',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      const evidence: string[] = []
      for (const e of m.entities) {
        if (isLookup(e) || isTechnical(e)) continue
        const outgoing = e.relations.length
        const incoming = incomingCount(m, e, model)
        if (outgoing > 0 || incoming > 0) continue
        const iso = e.isolation ?? ''
        const reason = iso.split('—')[1]?.trim() ?? ''
        if (/by-design/i.test(iso) && reason !== '') continue
        evidence.push(`${e.name}${iso ? ' (marqueur présent mais raison vide)' : ' (aucun marqueur Isolation: by-design)'}`)
      }
      return {
        findings: [
          evidence.length > 0
            ? finding('DM-009', DIM, 'warn', moduleScope(m), 'Entité(s) isolée(s) sans justification — lier, reclasser technical, ou ajouter `Isolation: by-design — <raison>`.', evidence)
            : finding('DM-009', DIM, 'ok', moduleScope(m), 'Aucune entité isolée injustifiée.'),
        ],
      }
    },
  },
  {
    id: 'DM-010',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      if (m.rules.length === 0) {
        return { findings: [finding('DM-010', DIM, 'ok', moduleScope(m), 'Aucune règle métier en portée — vérification sans objet.')] }
      }
      const known = new Set<string>()
      for (const e of model.graph.entities) {
        known.add(fold(e.name))
        known.add(fold(e.code))
      }
      const attrs = new Set<string>()
      for (const e of m.entities) for (const a of e.attributes) attrs.add(fold(pascalOf(a.name)))
      const evidence: string[] = []
      for (const r of m.rules) {
        const expr = r.expression ?? ''
        if (!expr) continue
        const unknown = pascalTokens(expr).filter(
          (t) => !PRIMITIVE_TOKENS.has(t) && !known.has(fold(t)) && !attrs.has(fold(t)),
        )
        if (unknown.length > 0) evidence.push(`${r.code} : ${[...new Set(unknown)].join(', ')}`)
      }
      return {
        findings: [
          evidence.length > 0
            ? finding('DM-010', DIM, 'warn', moduleScope(m), 'Expression(s) de règle référençant des entités inconnues du MCD.', evidence)
            : finding('DM-010', DIM, 'ok', moduleScope(m), `Expressions des ${m.rules.length} règle(s) vérifiées contre le MCD.`),
        ],
      }
    },
  },
  {
    id: 'DM-011',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      if (m.ucs.length === 0 && m.rules.length === 0 && m.sections.length === 0) {
        return { findings: [finding('DM-011', DIM, 'ok', moduleScope(m), 'Phases amont vides — traçabilité sans objet.')] }
      }
      const upstream: string[] = []
      for (const uc of m.ucs) {
        upstream.push(uc.title, ...uc.mainFlow, ...uc.preconditions, ...uc.postconditions)
        upstream.push(...uc.alternatives.map((b) => b.text), ...uc.exceptions.map((b) => b.text))
        for (const ac of uc.acs) upstream.push(ac.text)
      }
      for (const r of m.rules) upstream.push(r.title, r.condition ?? '', r.expression ?? '')
      const upstreamFolded = fold(upstream.join('\n'))
      const ucCodes = new Set(m.ucs.map((u) => u.ucCode.toUpperCase()))
      const brCodes = new Set(m.rules.map((r) => r.code.toUpperCase()))
      const sectionFolders = new Set(m.sections.map((s) => fold(s)))

      const tracedDirect = (e: BaEntity): boolean => {
        // (a) Traçabilité refs that resolve to existing UC/BR codes.
        for (const ref of e.traceability) {
          const token = ref.toUpperCase().match(/(UC|BR)-[A-Z0-9_-]+/)?.[0]
          if (token && (ucCodes.has(token) || brCodes.has(token))) return true
        }
        // (b) verbatim name/code in the upstream text.
        const nameRe = new RegExp(`\\b${fold(e.name)}\\b`)
        if (nameRe.test(upstreamFolded) || upstreamFolded.includes(fold(e.code))) return true
        // (c) menu resource/section named after the entity (kebab, ±s).
        const kebab = fold(e.name).replace(/([a-z0-9])([A-Z])/g, '$1-$2')
        if (sectionFolders.has(kebab) || sectionFolders.has(`${kebab}s`) || sectionFolders.has(kebab.replace(/s$/, ''))) return true
        return false
      }
      const traced = new Set(m.entities.filter(tracedDirect).map((e) => e.name))
      // Junction inheritance: traced when every relation target is traced.
      let grew = true
      while (grew) {
        grew = false
        for (const e of m.entities) {
          if (traced.has(e.name) || e.relations.length === 0) continue
          if (e.relations.every((r) => traced.has(r.targetEntity) || !m.entities.some((x) => x.name === r.targetEntity))) {
            traced.add(e.name)
            grew = true
          }
        }
      }
      const untraced = m.entities.filter((e) => !traced.has(e.name)).map((e) => e.name)
      return {
        findings: [
          untraced.length > 0
            ? finding(
                'DM-011',
                DIM,
                'warn',
                moduleScope(m),
                'Entité(s) sans ancre amont (UC/BR/ressource) — ajouter une référence verbatim en Traçabilité ou supprimer l’entité (garde anti-hallucination).',
                untraced,
              )
            : finding('DM-011', DIM, 'ok', moduleScope(m), `${traced.size} entité(s) tracée(s) par l'amont.`),
        ],
      }
    },
  },
  {
    id: 'DM-012',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const lookups = m.entities.filter(isLookup)
      if (lookups.length === 0) {
        return { findings: [finding('DM-012', DIM, 'ok', moduleScope(m), 'Aucune entité lookup en portée.')] }
      }
      // Only a SANCTIONED code is asked to carry its unique index. On a lookup
      // DM-022 errs on, proposing to add `(code) unique` would recommend
      // hardening the very column being removed — two contradictory remedies on
      // one line. The shared verdict arbitrates, so they cannot diverge.
      const sanctioned = (e: BaEntity): boolean =>
        !isReferentialCodeError(classifyReferentialCode(e, []).status)
      const missing = lookups
        .filter((e) => attrByFoldedName(e, 'code'))
        .filter(sanctioned)
        .filter((e) => !e.indexes.some((i) => i.unique && fold(i.fields[0] ?? '') === 'code'))
        .map((e) => e.name)
      return {
        findings: [
          missing.length > 0
            ? finding('DM-012', DIM, 'warn', moduleScope(m), 'Lookup(s) avec attribut `code` sans index unique sur `code` — ajouter `(code) unique` (jamais TenantId : le scaffolder ajoute la branche tenant lui-même).', missing)
            : finding('DM-012', DIM, 'ok', moduleScope(m), `${lookups.length} lookup(s) vérifié(s).`),
        ],
      }
    },
  },
  {
    id: 'DM-013',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const offending: string[] = []
      // Structured twin of `offending` — the router reads THIS, not the
      // French string, to name the entity/attribute it must hand to the
      // authoring skill.
      const anchors: FindingAnchor[] = []
      for (const e of m.entities) {
        for (const a of e.attributes) {
          if (!/guid/i.test(a.type)) continue
          if (!/Id$/i.test(a.name) || fold(a.name) === 'id') continue
          if (fold(a.name) === 'tenantid') continue // realized from tenant mode
          if (isAuditAllowlisted(pascalOf(a.name))) continue
          const pascal = fold(pascalOf(a.name))
          const stem = fold(a.name.replace(/Id$/i, ''))
          const declared = e.relations.some(
            (r) => fold(r.fk) === pascal || fold(r.targetEntity) === stem,
          )
          if (!declared) {
            offending.push(`${e.name}.${a.name}`)
            anchors.push({ kind: 'attribute', id: e.name, attribute: a.name })
          }
        }
      }
      return {
        findings: [
          offending.length > 0
            ? finding(
                'DM-013',
                DIM,
                'err',
                moduleScope(m),
                'FK implicite(s) : attribut *Id:guid sans relation déclarée — toute référence inter-tables est une FK (ajouter l’entrée Relations, quel que soit le scope).',
                offending,
                undefined,
                { anchors },
              )
            : finding('DM-013', DIM, 'ok', moduleScope(m), 'Chaque *Id:guid est une relation déclarée (ou colonne allowlistée).'),
        ],
      }
    },
  },
  {
    id: 'DM-014',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      const lookups = m.entities.filter(isLookup)
      if (lookups.length === 0) {
        return { findings: [finding('DM-014', DIM, 'ok', moduleScope(m), 'Aucune entité lookup en portée.')] }
      }
      const dead: string[] = []
      for (const L of lookups) {
        const viaRelation = model.graph.relations.some((r) => r.targetEntity === L.name || r.targetEntity === L.code)
        const fkName = fold(`${camelOf(L.name)}Id`)
        const viaAttr = model.graph.entities.some((e) => e.attributes.some((a) => fold(a.name) === fkName))
        if (!viaRelation && !viaAttr) dead.push(`${L.name} (${L.code})`)
      }
      return {
        findings: [
          dead.length > 0
            ? finding('DM-014', DIM, 'warn', moduleScope(m), 'Lookup(s) référencé(s) par aucune entité — déclarer la relation N:1, l’attribut FK, ou supprimer.', dead)
            : finding('DM-014', DIM, 'ok', moduleScope(m), `${lookups.length} lookup(s) référencé(s).`),
        ],
      }
    },
  },
  {
    id: 'DM-015',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const evidence: string[] = []
      for (const e of m.entities) {
        if (e.attributes.length === 0) continue // DM-002 owns empties
        const missing: string[] = []
        if (isLookup(e)) {
          // NO `code` leg: a reference value does not carry one — its label is
          // its identity. This rule states a MISSING field; the PRESENCE of a
          // code on a reference table is DM-022 business, never this one.
          if (!attrByFoldedName(e, 'label') && !attrByFoldedName(e, 'name')) missing.push('label|name')
          if (!attrByFoldedName(e, 'isActive')) missing.push('isActive')
        } else if (isTechnical(e)) {
          if (!e.isolation) missing.push('Isolation: by-design')
        } else if (isComponent(e)) {
          const hasFk = e.relations.length > 0 || e.attributes.some((a) => /Id$/i.test(a.name) && fold(a.name) !== 'id' && /guid/i.test(a.type))
          if (!hasFk) missing.push('FK parent')
        } else {
          const hasIdentifier = e.attributes.some((a) => ['name', 'label', 'code', 'nom', 'libelle', 'titre', 'title'].includes(fold(a.name)))
          if (!hasIdentifier) {
            // §26 display corollary: absence is legitimate ONLY when persisted
            // as **Personne** or an explicit **Affichage** line.
            const displayFamily = new Set(PREFERRED_DISPLAY_FIELDS.map((f) => fold(f)))
            const hasDisplayFamily = e.attributes.some((a) => displayFamily.has(fold(a.name)))
            if (!hasDisplayFamily && !e.person && !e.display) missing.push('identifiant métier (name|label) ou **Affichage**/**Personne**')
          }
        }
        if (missing.length > 0) evidence.push(`${e.name}: ${missing.join(', ')}`)
      }
      return {
        findings: [
          evidence.length > 0
            ? finding('DM-015', DIM, 'warn', moduleScope(m), 'Conventions d’attributs par classification non respectées (scaffolds minces / displayName sans fallback sanctionné).', evidence)
            : finding('DM-015', DIM, 'ok', moduleScope(m), 'Conventions de classification respectées.'),
        ],
      }
    },
  },
  {
    id: 'DM-016',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const evidence: string[] = []
      let checked = 0
      for (const e of m.entities) {
        const ownAttrs = new Set(e.attributes.map((a) => fold(pascalOf(a.name))))
        for (const a of e.attributes) {
          if (!a.computed) continue
          checked++
          if (a.computed.length > 1000) evidence.push(`${e.name}.${a.name} : formule > 1000 caractères`)
          const foreign = pascalTokens(a.computed).filter((t) => !PRIMITIVE_TOKENS.has(t) && !ownAttrs.has(fold(t)))
          for (const t of [...new Set(foreign)]) evidence.push(`${e.name}.${a.name} → ${t}`)
        }
      }
      return {
        findings: [
          evidence.length > 0
            ? finding('DM-016', DIM, 'err', moduleScope(m), 'Formule(s) Calculé référençant des propriétés hors entité (JOIN impossible en projection LINQ) — dénormaliser ou déplacer côté service.', evidence)
            : finding('DM-016', DIM, 'ok', moduleScope(m), `${checked} formule(s) Calculé vérifiée(s).`),
        ],
      }
    },
  },
  {
    id: 'DM-017',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const errs: string[] = []
      const warns: string[] = []
      const numberingRules = m.rules.filter((r) => r.type === 'numbering')
      const entityByFoldedName = new Map(m.entities.map((e) => [fold(e.name), e]))

      // Checks 1-4 — per coded entity.
      for (const e of m.entities) {
        if (!e.codePatternRaw) continue
        const cp = e.codePattern
        // 1. a numbering rule names the entity, or Traçabilité carries its BR.
        const ruleBrCodes = new Set(numberingRules.map((r) => r.code.toUpperCase()))
        const namedByRule = numberingRules.some((r) =>
          new RegExp(`\\b${fold(e.name)}\\b`).test(fold(`${r.title} ${r.condition ?? ''} ${r.portee ?? ''}`)),
        )
        const tracedToRule = e.traceability.some((t) => ruleBrCodes.has(t.toUpperCase().match(/BR-[A-Z0-9_-]+/)?.[0] ?? ''))
        if (!namedByRule && !tracedToRule) warns.push(`${e.name}:missing-numbering-rule`)
        // 2. scope tenant|global only.
        if (/parent\s*:/i.test(e.codePatternRaw)) errs.push(`${e.name}:unsupported-scope`)
        // 3. format tokens (closed grammar, {SEQ} or a derived token required).
        if (!cp || cp.format === null) {
          errs.push(`${e.name}:no-format-mask`)
        } else {
          const formatErrors = validateFormat(cp.format, cp.reset ?? 'None')
          for (const err of formatErrors) errs.push(`${e.name}:${err}`)
          // 4. reset ↔ date-token alignment.
          const tokens = new Set(tokenNames(cp.format))
          if (cp.reset === 'Yearly' && !tokens.has('YY') && !tokens.has('YYYY')) warns.push(`${e.name}:reset-misaligned (Yearly sans {YY}/{YYYY})`)
          if (cp.reset === 'Monthly' && !tokens.has('MM')) warns.push(`${e.name}:reset-misaligned (Monthly sans {MM})`)
          if (cp.reset === 'Daily' && !tokens.has('DD')) warns.push(`${e.name}:reset-misaligned (Daily sans {DD})`)
        }
      }

      // Check 5 — MODULE-WIDE: no re-modelled allocator.
      for (const e of m.entities) {
        const nameHit = ALLOC_NAME_RE.test(e.name)
        const attrHit = e.attributes.some((a) => matchCapabilityAttribute(a.name)?.key === 'code-generation')
        if (nameHit || attrHit) errs.push(`allocator:remodelled — ${e.name} (le socle alloue sur core.seq_Sequences ; déclarer **Code pattern**, jamais une entité compteur)`)
      }

      // Check 7 — supplied + {SEQ}: the sequential allocator never consults
      // the uniqueness probe before allocating, so a manually supplied code
      // inside the sequence's FUTURE corridor only fails LATER, at the unique
      // index, when the sequence reaches it. Warn — the import/reprise case
      // is legitimate and the index stays the last-resort net (as at the
      // socle); the remedy is shape separation, never a ban.
      for (const e of m.entities) {
        const cp = e.codePattern
        if (cp?.supplied === true && cp.format !== null && hasSequence(cp.format)) {
          warns.push(
            `${e.name}:supplied-sequential-corridor — codes fournis HORS de la forme du masque ` +
            '(préfixe différent), réservés aux imports/reprises, ou format dérivé sans {SEQ}',
          )
        }
      }

      // Check 6 — MODULE-WIDE: every numbering rule lands on a coded entity.
      for (const r of numberingRules) {
        const text = fold(`${r.title} ${r.condition ?? ''} ${r.portee ?? ''}`)
        const target = [...entityByFoldedName.keys()].find((n) => new RegExp(`\\b${n}\\b`).test(text))
        if (!target) {
          warns.push(`${r.code}:rule:unmappable`)
        } else if (!entityByFoldedName.get(target)!.codePatternRaw) {
          errs.push(`${r.code}:rule:no-code-pattern (entité ${entityByFoldedName.get(target)!.name} sans ligne **Code pattern** — la règle est invisible de toute la chaîne aval)`)
        }
      }

      const findings: Finding[] = []
      if (errs.length > 0) findings.push(finding('DM-017', DIM, 'err', moduleScope(m), 'Code patterns : token inconnu / masque absent / allocateur re-modélisé / règle numbering sans **Code pattern**.', errs))
      if (warns.length > 0) findings.push(finding('DM-017', DIM, 'warn', moduleScope(m), 'Code patterns incomplets (règle numbering manquante, reset mal aligné, règle non mappable).', warns))
      if (findings.length === 0) findings.push(finding('DM-017', DIM, 'ok', moduleScope(m), 'Code patterns cohérents (grammaire fermée, aucune ré-implémentation d’allocateur).'))
      return { findings }
    },
  },
  {
    id: 'DM-018',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const errs: string[] = []
      const warns: string[] = []
      for (const e of m.entities) {
        // (a) whitelist collision.
        const core = matchCoreEntity(e.name)
        if (core) errs.push(`${e.name} → Core ${core.name} (${core.qualifiedTable})`)
        // (b) reserved collision.
        const reserved = matchReservedCoreName(e.name)
        if (reserved) errs.push(`${e.name} → réservé Core ${reserved.name} — utiliser ${reserved.useInstead}`)
        // (c) unlinked person cluster (fail-closed).
        const identityCount = PERSON_IDENTITY_ATTRIBUTES.filter((n) => attrByFoldedName(e, n)).length
        const personSignal = matchPersonTrigger(e.name) !== undefined || identityCount >= 2
        const userRelation = e.relations.some((r) => r.scope === 'core' && fold(r.targetEntity) === 'user')
        const personLine = e.person ?? null
        if (personSignal && !core && !reserved) {
          if (personLine === null && !userRelation) {
            errs.push(`${e.name} : cluster personne sans ligne **Personne** ni relation *→1 User scope core (annuaire décorrélé d'auth_Users)`)
          } else if (personLine !== null && /^none\b/i.test(personLine.trim())) {
            if (!/d[eé]cision client/i.test(personLine)) warns.push(`${e.name} : **Personne** : none sans « décision client : <raison> »`)
          } else if (personLine !== null && !userRelation) {
            errs.push(`${e.name} : **Personne** déclarée mais relation *→1 User — FK UserId, scope core absente`)
          }
        }
        // (d) mandatory person redeclares identity.
        if (personLine !== null && /^mandatory\b/i.test(personLine.trim()) && identityCount > 0) {
          const redeclared = PERSON_IDENTITY_ATTRIBUTES.filter((n) => attrByFoldedName(e, n))
          errs.push(`${e.name} : Personne mandatory mais identité redéclarée localement (${redeclared.join(', ')}) — l'identité vient d'auth_Users`)
        }
        // (e) company-identity cluster.
        if (!core) {
          const companyHits = COMPANY_IDENTITY_ATTRIBUTES.filter((n) => attrByFoldedName(e, n))
          const orgRelation = e.relations.some((r) => r.scope === 'core' && fold(r.targetEntity) === 'tenantorganisation')
          if (companyHits.length >= 1 && !orgRelation) {
            warns.push(`${e.name} : attributs d'identité société (${companyHits.join(', ')}) sans relation *→1 TenantOrganisation scope core`)
          }
        }
      }
      const findings: Finding[] = []
      if (errs.length > 0) findings.push(finding('DM-018', DIM, 'err', moduleScope(m), 'Collision avec le catalogue Core / cluster personne non lié — référencer Core (`scope core`), jamais le recréer.', errs))
      if (warns.length > 0) findings.push(finding('DM-018', DIM, 'warn', moduleScope(m), 'Overrides non tracés / cluster société sans référence TenantOrganisation.', warns))
      if (findings.length === 0) findings.push(finding('DM-018', DIM, 'ok', moduleScope(m), 'Aucune duplication du catalogue Core ; clusters personne/société correctement liés.'))
      return { findings }
    },
  },
  {
    id: 'DM-019',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const errs: string[] = []
      const warns: string[] = []
      for (const e of m.entities) {
        // (a) binary content in ANY entity.
        for (const a of e.attributes) {
          const byType = matchCapabilityAttribute(a.type)
          const byName = matchCapabilityAttribute(a.name)
          if (byType?.key === 'file-storage' || byName?.key === 'file-storage') {
            errs.push(`${e.name}.${a.name} (${a.type}) → contenu binaire en base — les octets passent par IFileStorageService`)
          }
        }
        // (b) attachment-named entity without the metadata shape.
        const trigger = matchCapabilityTrigger(e.name)
        if (trigger?.key === 'file-storage') {
          const hasStoredName = e.attributes.some((a) => /stored/i.test(a.name))
          const hasContentType = e.attributes.some((a) => /contenttype/i.test(a.name))
          const hasSize = e.attributes.some((a) => /size|taille/i.test(a.name))
          const hasParentFk = e.relations.length > 0 || e.attributes.some((a) => /Id$/i.test(a.name) && fold(a.name) !== 'id' && /guid/i.test(a.type))
          if (!(hasStoredName && hasContentType && hasSize && hasParentFk)) {
            warns.push(`${e.name} : entité pièce-jointe sans le shape métadonnées complet (StoredFileName, ContentType, taille, FK parent)`)
          }
        }
      }
      const findings: Finding[] = []
      if (errs.length > 0) findings.push(finding('DM-019', DIM, 'err', moduleScope(m), 'Contenu de fichier dans le MCD — jamais une colonne binaire.', errs))
      if (warns.length > 0) findings.push(finding('DM-019', DIM, 'warn', moduleScope(m), 'Entité(s) pièce jointe hors pattern métadonnées.', warns))
      if (findings.length === 0) findings.push(finding('DM-019', DIM, 'ok', moduleScope(m), 'Aucun contenu binaire ; entités pièce jointe conformes au pattern métadonnées.'))
      return { findings }
    },
  },
  {
    id: 'DM-020',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const evidence: string[] = []
      let checked = 0
      for (const e of m.entities) {
        const declarations = [
          ...e.derivedRaw,
          ...e.attributes.filter((a) => /d[eé]riv[eé]/i.test(a.constraints)).map((a) => `${a.name} — ${a.constraints}`),
        ]
        for (const decl of declarations) {
          checked++
          const nav = /nav\s+([A-Za-z0-9_]+)\.([A-Za-z0-9_]+)/.exec(decl)
          const child = /child\s+([A-Za-z0-9_]+)[\s\S]*?(?:latest\(([A-Za-z0-9_]+)\)|open(?:-period)?\(([A-Za-z0-9_]+)\))[\s\S]*?select\s+([A-Za-z0-9_]+)/.exec(decl)
          if (nav) {
            const navName = nav[1]!
            const resolved = e.relations.some(
              (r) => fold(r.targetEntity) === fold(navName) || fold(r.fk) === fold(`${navName}Id`),
            )
            if (!resolved) evidence.push(`${e.name} : nav ${navName}.${nav[2]} — aucune Relation/FK ${navName}Id sur l'entité`)
          } else if (child) {
            const collection = child[1]!
            const pickField = child[2] ?? child[3]!
            const selectProp = child[4]!
            const childEntity = m.entities.find(
              (x) =>
                x.relations.some((r) => r.targetEntity === e.name && (r.cardinality === '*→1' || r.cardinality === '1→1')) &&
                (fold(x.name) === fold(collection) || fold(`${x.name}s`) === fold(collection)),
            )
            if (!childEntity) {
              evidence.push(`${e.name} : child ${collection} — aucune relation 1→* vers une entité enfant de ce nom`)
            } else {
              if (!attrByFoldedName(childEntity, pickField)) evidence.push(`${e.name} : child ${collection} — champ de pick « ${pickField} » absent de ${childEntity.name}`)
              if (!attrByFoldedName(childEntity, selectProp)) evidence.push(`${e.name} : child ${collection} — propriété sélectionnée « ${selectProp} » absente de ${childEntity.name}`)
            }
          } else {
            evidence.push(`${e.name} : déclaration **Dérivé** non analysable « ${decl.slice(0, 80)} » (attendu \`nav <Nav>.<Prop>\` ou \`child <Coll> pick latest(...)|open(...) select <Prop>\`)`)
          }
        }
      }
      return {
        findings: [
          evidence.length > 0
            ? finding('DM-020', DIM, 'err', moduleScope(m), 'Déclaration(s) **Dérivé** qui ne résolvent pas — corriger les Relations ou le marqueur.', evidence)
            : finding('DM-020', DIM, 'ok', moduleScope(m), checked > 0 ? `${checked} déclaration(s) **Dérivé** résolue(s).` : 'Aucune déclaration **Dérivé** en portée.'),
        ],
      }
    },
  },
  {
    // DM-021 — every code-like signal is CLASSIFIED. Two deterministic checks:
    // (1) near-miss: a `Code pattern` MENTIONED in a declarative shape that
    // does not parse (table cell — the incident shape, wrong case, unbolded,
    // prose) — the whole chain derives NOTHING from it, green-by-vacuity over
    // a real declaration; (2) a code-like attribute (synonym lexicon:
    // Référence/Numéro/Matricule…, string + unique, not computed) with NO
    // species classification (**Code pattern** / **Code saisi**). The rule
    // demands a CLASSIFICATION, it never forbids — a typed referential key
    // stays legitimate once said out loud.
    id: 'DM-021',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      const raw = model.docs.find((d) => d.kind === 'entite' && d.app === m.app && d.module === m.module)?.raw ?? ''
      const nearMisses = raw === '' ? [] : findCodePatternNearMisses(raw)
      const nearMissEntities = new Set(nearMisses.map((x) => x.entity).filter((e): e is string => e !== null))
      const codeLike = findCodeLikeAttributes(m.entities)

      const errs: string[] = []
      const warns: string[] = []
      for (const miss of nearMisses) {
        errs.push(
          `${miss.entity ?? '(hors bloc)'}:near-miss:${miss.shape} — entité.md:${miss.line} « ${miss.text.slice(0, 100)} » : ` +
          'la déclaration ne parse pas, TOUTE la chaîne (derive-code-specs, les deux moitiés scaffoldées, DEV-API-022/DEV-UI-034) ' +
          "n'en dérive RIEN — réécrire la puce canonique `- **Code pattern** : \`MASK\` — …` (jamais une cellule de tableau)",
        )
      }
      for (const hit of codeLike) {
        if (nearMissEntities.has(hit.entity)) {
          errs.push(
            `${hit.entity}.${hit.attribute}:code-like-near-miss — attribut « ${hit.matchedWord} » string+unique dans le MÊME bloc ` +
            "qu'une déclaration ratée : c'est presque sûrement LE code dont la puce a été mal écrite",
          )
        } else {
          warns.push(
            `${hit.entity}.${hit.attribute}:code-like-unclassified — « ${hit.matchedWord} » string+unique sans classification : ` +
            'ALLOUÉ → puce `- **Code pattern** : …` ; SAISI → `- **Code saisi** : ' + hit.attribute + '`' +
            ' ; sur une table de RÉFÉRENCE le code lui-même se DÉCIDE → ' +
            '`- **Code décidé** : … — décision utilisateur du <AAAA-MM-JJ>` (DM-022) ; ni l\'un ni l\'autre → renommer',
          )
        }
      }

      const findings: Finding[] = []
      if (errs.length > 0) {
        findings.push(finding('DM-021', DIM, 'err', moduleScope(m),
          'Signal code-like non classé (déclaration Code pattern non parsable / attribut code-like avec co-signal) — la règle demande une classification, jamais une interdiction.', errs))
      }
      if (warns.length > 0) {
        findings.push(finding('DM-021', DIM, 'warn', moduleScope(m),
          'Attribut(s) code-like (Référence/Numéro/Matricule…) sans espèce déclarée — trancher ALLOUÉ (**Code pattern**) ou SAISI (**Code saisi**).', warns))
      }
      if (findings.length === 0) {
        findings.push(finding('DM-021', DIM, 'ok', moduleScope(m),
          'Aucun signal code-like non classé (déclarations parsables, attributs code-like classés ou absents).'))
      }
      return { findings }
    },
  },
  {
    // DM-022 — a reference value does not carry a code. Its label is its
    // identity and its natural key. Only the USER may decide otherwise, and
    // that DATED decision (`- **Code décidé** : … — décision utilisateur du
    // AAAA-MM-JJ`) OVERRIDES the rule.
    //
    // What this rule does NOT do, and must never start doing: re-argue the
    // EXISTENCE of a code on an entity carrying a decision. Without that
    // sentence written down, the next audit pass proposes the removal again on
    // every run. One single thing stays judged on a decided entity — a decided
    // code is TYPED, never ALLOCATED — because « lookups, junctions and audit
    // logs get no code pattern » (attributes.md) is unchanged, and without it a
    // decision line would silence a real defect.
    //
    // The `warn` leg needs the citation inventory, hence the PRD; this audit
    // legitimately runs BEFORE /ba-create-prd, so when no PRD is on disk the
    // leg goes SILENT with a note instead of crying « dead decision » on every
    // module of a normal BA phase.
    id: 'DM-022',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      const references = m.entities.filter(isLookup)
      if (references.length === 0) {
        return {
          findings: [
            finding('DM-022', DIM, 'ok', moduleScope(m), 'Aucune table de référence en portée.'),
          ],
        }
      }

      const raw =
        model.docs.find((d) => d.kind === 'entite' && d.app === m.app && d.module === m.module)
          ?.raw ?? ''
      const nearMisses = raw === '' ? [] : findDecidedCodeNearMisses(raw)
      const nearMissEntities = new Set(
        nearMisses.map((x) => x.entity).filter((e): e is string => e !== null),
      )

      // The four citation sources. Rules and acceptance criteria are already in
      // the corpus model; the PRD is not (the loader skips `pagespecs/` and has
      // no PRD DocKind), so it is read from disk — as rules/code.ts does.
      const prd = prdCitationSources(m.dir)
      const sources = [
        ...ruleCitationSources(m.rules),
        ...acceptanceCitationSources(m.ucs),
        ...prd.sources,
      ]

      const errs: string[] = []
      const warns: string[] = []

      for (const miss of nearMisses) {
        errs.push(
          `${miss.entity ?? '(hors bloc)'}:decided-near-miss:${miss.shape} — entité.md:${miss.line} ` +
            `« ${miss.text.slice(0, 100)} » : la décision est MENTIONNÉE sans être analysable, donc ` +
            "elle n'existe pour aucun outil — réécrire la puce canonique " +
            '`- **Code décidé** : <ce que le code nomme> — décision utilisateur du <AAAA-MM-JJ>` ' +
            '(jamais une cellule de tableau, jamais sans date réelle)',
        )
      }

      const verdicts: ReferentialCodeVerdict[] = []
      for (const e of references) {
        const citations = citationsFor(e, [...sources, ...initialValuesSources(m.entities, e.name)])
        verdicts.push(classifyReferentialCode(e, citations))
      }

      for (const v of verdicts) {
        if (v.status === 'near-miss') continue // already reported, with its line
        if (nearMissEntities.has(v.entity)) continue // same block, same defect

        if (v.status === 'allocated') {
          errs.push(
            `${v.entity}:allocated-code-on-reference — \`**Code pattern**\` sur une table de ` +
              'référence : le socle NUMÉROTE un référentiel. Un code décidé est SAISI, jamais ' +
              'alloué — retirer la ligne Code pattern (attributes.md : « lookups, junctions and ' +
              'audit logs get no code pattern »)',
          )
          continue
        }
        if (v.status === 'decided') {
          // Guarded on SEARCHABLE code values, never on the row count: a
          // decided table whose seeded rows carry no  column has nothing
          // to search, and « no citation left » would then be a false alarm
          // dressed as « the rule that carried it was rewritten ».
          if (v.citations.length === 0 && prd.files > 0 && v.searchableCodes > 0) {
            warns.push(
              `${v.entity}:decided-code-uncited — décision du ${v.decision?.date} : plus AUCUNE ` +
                'citation de ses codes ne subsiste dans le corpus (la règle qui la portait a pu ' +
                'être réécrite). La décision reste souveraine — ceci ne demande pas de la défaire, ' +
                'seulement de la revisiter',
            )
          }
          continue
        }
        if (v.status === 'blocked' || v.status === 'reprise') {
          const evidence =
            v.citations.length > 0
              ? ` — ${v.citations.length} citation(s) : ${[...new Set(v.citations.map((c) => c.where))].join(', ')}`
              : ` — ${v.searchableCodes} valeur(s) de code cherchée(s) dans les 4 sources, aucune citée`
          errs.push(
            `${v.entity}.${v.codeAttribute}:code-without-decision — code sur une table de ` +
              'référence sans ligne `**Code décidé**`. Le libellé est son identité et sa clé ' +
              `naturelle${evidence}. Trancher : poser la décision datée, ou retirer le code via ` +
              'derive-referential-codes --mode backfill',
          )
        }
      }

      const findings: Finding[] = []
      if (errs.length > 0) {
        findings.push(
          finding(
            'DM-022',
            DIM,
            'err',
            moduleScope(m),
            'Code sur une table de référence sans décision utilisateur — une valeur de référence ne porte pas de code, son libellé est son identité. Seul l’UTILISATEUR peut en décider autrement, et cette décision datée outrepasse la règle.',
            errs,
          ),
        )
      }
      if (warns.length > 0) {
        findings.push(
          finding(
            'DM-022',
            DIM,
            'warn',
            moduleScope(m),
            'Décision « Code décidé » dont plus aucune citation ne subsiste — à revisiter, jamais à défaire d’office.',
            warns,
          ),
        )
      }
      if (findings.length === 0) {
        const note =
          prd.files === 0
            ? ' (inventaire PARTIEL : aucun prd*.md/pagespecs — la 3ᵉ source de citations n’a pas pu être lue, la jambe « décision devenue morte » reste muette)'
            : ''
        findings.push(
          finding(
            'DM-022',
            DIM,
            'ok',
            moduleScope(m),
            `${references.length} table(s) de référence : aucun code non décidé${note}.`,
          ),
        )
      }
      return { findings }
    },
  },
  {
    // DM-023 — every column an **Index** names EXISTS. The mirror of
    // scaffold-entity/validate.ts `knownIndexColumns` (one definition,
    // lib/entity-columns, imported by both): there it is a hard error that
    // fires inside /ba-develop Phase 2, six phases after the BA readiness GO
    // let the typo through. Second leg: TenantId inside a UNIQUE index — the
    // scaffolder prefixes every declared unique with the discriminator, so the
    // shape the doctrine itself used to prescribe (`(TenantId, Code) unique`)
    // emitted `new { e.TenantId, e.TenantId, e.Code }` — CS0833, uncompilable.
    id: 'DM-023',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const errs: string[] = []
      const warns: string[] = []
      const anchors: FindingAnchor[] = []
      for (const e of m.entities) {
        if (e.indexes.length === 0) continue
        const coded = e.codePatternRaw !== null
        // Owning FKs written ON the entity, plus the FK a PARENT's 1→* puts on
        // this entity (`Order 1→* OrderLine — FK OrderId` lives on OrderLine).
        const owningFks = e.relations.filter((r) => r.cardinality === '*→1' || r.cardinality === '1→1').map((r) => r.fk)
        const childFks = m.entities.flatMap((x) => x.relations.filter((r) => r.cardinality === '1→*' && fold(r.targetEntity) === fold(e.name)).map((r) => r.fk))
        const known = knownIndexColumns({ fields: e.attributes.map((a) => a.name), owningFks: [...owningFks, ...childFks], coded })
        for (const idx of e.indexes) {
          for (const col of idx.fields) {
            if (isTenantColumn(col)) {
              if (idx.unique) {
                errs.push(`${e.name} : ${idx.raw} — TenantId dans un index unique : le scaffolder préfixe déjà chaque unique par le discriminant → new { e.TenantId, e.TenantId, … } (CS0833, Configuration non compilable). Retirer TenantId.`)
              }
              continue
            }
            if (!known.has(col.trim().toLowerCase())) {
              errs.push(`${e.name} : ${idx.raw} — colonne « ${col} » : ni attribut déclaré, ni FK synthétisée (*→1/1→1 de l'entité, 1→* d'un parent), ni colonne technique (TenantId, CreatedAt${coded ? ', Code' : ''})`)
              anchors.push({ kind: 'attribute', id: e.name, attribute: col })
            }
          }
          if (coded && idx.unique && idx.fields.length === 1 && fold(idx.fields[0] ?? '') === 'code') {
            warns.push(`${e.name} : ${idx.raw} — redondant : le socle émet lui-même (TenantId, Code) unique pour une entité **Code pattern**`)
          }
        }
      }
      const findings: Finding[] = []
      if (errs.length > 0) findings.push(finding('DM-023', DIM, 'err', moduleScope(m), 'Index déclaré(s) sur une colonne inexistante ou nommant TenantId en unique — le scaffolder échoue (ou ne compile pas) dessus.', errs, undefined, { anchors }))
      if (warns.length > 0) findings.push(finding('DM-023', DIM, 'warn', moduleScope(m), 'Index redondant(s) sur le code d’une entité codée — le socle les émet lui-même.', warns))
      if (findings.length === 0) findings.push(finding('DM-023', DIM, 'ok', moduleScope(m), 'Toutes les colonnes d’index résolvent ; aucun TenantId dans un unique.'))
      return { findings }
    },
  },
  {
    // DM-027 — a framework name in the attribute table. Two classes, told
    // apart because the remedy differs: the generator DROPS CreatedAt/
    // UpdatedAt/DeletedAt/TenantId (warn + skip — the model claims a column
    // it does not own), while CreatedBy/UpdatedBy/Scope — which attributes.md
    // USED TO call implicit — are NOT provided by the generated base class and
    // would become real columns. `Id` is sanctioned (« Show only Id Guid PK »).
    id: 'DM-027',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const evidence: string[] = []
      for (const e of m.entities) {
        for (const a of e.attributes) {
          const n = fold(a.name)
          if (n === 'id') continue
          if (FRAMEWORK_DROPPED.has(n)) evidence.push(`${e.name}.${a.name} — supprimé par le scaffolder (fourni par ExtensionBaseEntity / la tenancy) : ne pas le lister`)
          else if (FRAMEWORK_NOT_PROVIDED.has(n)) evidence.push(`${e.name}.${a.name} — NON fourni par la classe de base générée : deviendra une vraie colonne, à lister seulement si elle est voulue`)
        }
      }
      return {
        findings: [
          evidence.length > 0
            ? finding('DM-027', DIM, 'warn', moduleScope(m), 'Champ(s) framework listé(s) dans la table d’attributs.', evidence)
            : finding('DM-027', DIM, 'ok', moduleScope(m), 'Aucun champ framework listé.'),
        ],
      }
    },
  },
  {
    // DM-026 — a state value nobody reaches any more: the leftover of a state
    // change. mapFlowOntoEnum (derive-kanban-spec) reports the INVERSE (a
    // transition toward a status the enum does not know) — never a status no
    // transition, no kanban column, no lifecycle phase, no filter and no UC
    // ever cites — and only when a kanban exists. This is the model retaining
    // what the BA no longer uses, at VALUE grain (DM-025 is the attribute
    // grain, DM-011 the entity grain). Home: data-model — the dead value lives
    // in entité.md, where sourceDocFor already routes the remedy.
    id: 'DM-026',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      const blocks = moduleScreenBlocks(model, m)
      // Evidence of a value being ALIVE, folded once:
      const alive = new Set<string>()
      for (const r of m.rules) for (const t of r.flow) { alive.add(fold(t.from)); alive.add(fold(t.to)) }
      for (const s of m.screens) for (const c of s.kanban?.columns ?? []) alive.add(fold(c.key))
      for (const b of blocks) for (const v of b.cycleStatuses) alive.add(fold(v))
      // …and the verbatim text of UCs, rules (beyond flow) and screen filters.
      const text: string[] = []
      for (const uc of m.ucs) {
        text.push(uc.title, ...uc.mainFlow, ...uc.preconditions, ...uc.postconditions)
        text.push(...uc.alternatives.map((x) => x.text), ...uc.exceptions.map((x) => x.text), ...uc.acs.map((x) => x.text))
      }
      for (const r of m.rules) text.push(r.title, r.condition ?? '', r.expression ?? '', r.validCases ?? '', r.invalidCases ?? '')
      for (const b of blocks) text.push(...b.filters)
      const corpus = fold(text.join('\n'))
      const escape = (v: string): string => v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')

      const evidence: string[] = []
      let checked = 0
      for (const e of m.entities) {
        for (const a of stateAttrsOf(e)) {
          if (a.enumValues.length === 0) continue
          const dead: string[] = []
          for (const v of a.enumValues) {
            const f = fold(v)
            if (CONSTRAINT_FACET_WORDS.has(f)) continue
            checked++
            if (alive.has(f)) continue
            if (new RegExp(`(^|[^a-z0-9_])${escape(f)}([^a-z0-9_]|$)`).test(corpus)) continue
            dead.push(v)
          }
          if (dead.length > 0) evidence.push(`${e.name}.${a.name} : ${dead.join(', ')}`)
        }
      }
      // Phase order: rules are phase 4, screens phase 7. With NEITHER flow
      // rules NOR screens in scope there is no state machine to compare the
      // enum against — say so, never a warn on a corpus that has not reached
      // the phase (the DM-022 precedent).
      const hasFlow = m.rules.some((r) => r.flow.length > 0)
      if (!hasFlow && blocks.length === 0) {
        return { findings: [finding('DM-026', DIM, 'ok', moduleScope(m), 'Inventaire PARTIEL : aucune règle Flow ni aucun écran en portée — la machine à états n’est pas encore décrite, rien à comparer.')] }
      }
      return {
        findings: [
          evidence.length > 0
            ? finding('DM-026', DIM, 'warn', moduleScope(m), 'Valeur(s) d’énumération d’état qu’aucune transition Flow, colonne kanban, phase de cycle de vie, filtre ni UC n’atteint — reliquat probable d’un changement d’état.', evidence)
            : finding('DM-026', DIM, 'ok', moduleScope(m), `${checked} valeur(s) d’état atteinte(s) par la machine à états ou le corpus.`),
        ],
      }
    },
  },
  {
    // DM-028 — the entity says its tenancy. attributes.md § Quality checks has
    // always demanded « tenantMode set » and audit-prd VIBE-002 « an
    // unambiguous tenant mode », but no grammar existed to SAY it: an
    // unfalsifiable rule. The scaffolder falls back to 'strict', and that
    // Zod default decides the tenant-composite shape of every declared unique
    // index — a platform-wide catalogue silently becomes per-tenant unique.
    // Migration-safe: every existing client model lacks the bullet, so warn by
    // default (ONE finding per module, the default named as an inherited
    // decision), err under --strict (the BR-011 ramp).
    id: 'DM-028',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module, strict }) {
      const m = module!
      if (m.entities.length === 0) {
        return { findings: [finding('DM-028', DIM, 'ok', moduleScope(m), 'Aucune entité en portée — rien à qualifier.')] }
      }
      const missing: string[] = []
      const nearMiss: string[] = []
      for (const e of m.entities) {
        if (e.tenancy !== null) continue
        if (e.tenancyRaw !== null) nearMiss.push(`${e.name} : **Portée** « ${e.tenancyRaw} » — attendu strict | optional | none (le vocabulaire fermé de scaffold-entity)`)
        else missing.push(e.name)
      }
      const findings: Finding[] = []
      if (nearMiss.length > 0) findings.push(finding('DM-028', DIM, 'err', moduleScope(m), 'Portée déclarée mais illisible — aucun tenantMode n’en est dérivé.', nearMiss))
      if (missing.length > 0) {
        findings.push(finding(
          'DM-028', DIM, strict ? 'err' : 'warn', moduleScope(m),
          `${missing.length} entité(s) sans **Portée** : tenantMode retombe sur strict — c’est ce défaut, et non le modèle, qui décide la forme tenant-composite de chaque index unique. Une ligne \`- **Portée** : strict\` en tête du document couvre tout le module.`,
          missing,
        ))
      }
      if (findings.length === 0) findings.push(finding('DM-028', DIM, 'ok', moduleScope(m), `${m.entities.length} entité(s) avec une Portée déclarée.`))
      return { findings }
    },
  },
  {
    // DM-025 — an attribute nothing describes: the attribute-grain twin of
    // DM-011 (entities) and DM-026 (state values). A column the BA no longer
    // uses — after a use case was dropped, a screen redesigned — stays in
    // entité.md, is generated, migrated and shipped, working perfectly and
    // doing nothing. Precision over recall: the name is searched whole-word,
    // accent-folded, in the RAW text of the whole module (not only the parsed
    // field lists), so a French label that names it still counts. The
    // residual false positive is linguistic (« le montant » vs Amount) and is
    // irreducible mechanically — hence warn, never err.
    id: 'DM-025',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      // Phase order: the data model is phase 6, screens phase 7. Run right
      // after /ba-create-data-model — the normal case — the richest source
      // does not exist yet and most attributes would look dead. Say so.
      if (moduleScreenBlocks(model, m).length === 0) {
        return { findings: [finding('DM-025', DIM, 'ok', moduleScope(m), 'Inventaire PARTIEL : aucun écran en portée — la 3ᵉ source (les listes de champs des écrans) n’a pas pu être lue, la couverture des attributs n’est pas jugée.')] }
      }
      const { corpus, names } = attributeEvidence(model, m)
      const dead: string[] = []
      let checked = 0
      for (const e of m.entities) {
        if (isTechnical(e)) continue // journals / outbox — DM-009 exempts them already
        const lookup = isLookup(e)
        const coded = e.codePatternRaw !== null || e.decidedCodeRaw !== null
        const stateNames = new Set(stateAttrsOf(e).map((a) => fold(a.name)))
        const fkNames = new Set(e.relations.map((r) => fold(r.fk)))
        for (const a of e.attributes) {
          const n = fold(a.name)
          if (n === 'id' || n === 'tenantid' || isAuditAllowlisted(pascalOf(a.name))) continue
          if (a.computed !== null) continue // no column
          if (fkNames.has(n) || (/id$/.test(n) && /guid/i.test(a.type))) continue // DM-013 owns FKs
          if (stateNames.has(n)) continue // its VALUES travel, its name rarely — XD-001/002/003 + DM-026 own it
          if (coded && n === 'code') continue // DM-017/021/022
          if (lookup && LOOKUP_CONVENTION_FIELDS.has(n)) continue // DM-015 demands them
          checked++
          if (names.has(n) || names.has(fold(pascalOf(a.name)))) continue
          const re = new RegExp(`(^|[^a-z0-9_])(${escapeRe(n)}|${escapeRe(fold(pascalOf(a.name)))})([^a-z0-9_]|$)`)
          if (re.test(corpus)) continue
          dead.push(`${e.name}.${a.name}`)
        }
      }
      const CAP = 20
      const evidence = dead.length > CAP ? [...dead.slice(0, CAP), `… et ${dead.length - CAP} autre(s)`] : dead
      return {
        findings: [
          dead.length > 0
            ? finding('DM-025', DIM, 'warn', moduleScope(m), `${dead.length} attribut(s) qu’aucun UC, règle, écran, index, formule ni seed ne cite — colonne(s) probablement morte(s), reliquat d’une évolution BA. L’absence de citation n’est pas une preuve d’absence : vérifier avant de supprimer.`, evidence)
            : finding('DM-025', DIM, 'ok', moduleScope(m), `${checked} attribut(s) stocké(s) décrit(s) par le corpus.`),
        ],
      }
    },
  },
  {
    // DM-024 — an index ANTICIPATED from the query patterns the screens
    // declare. DM-012 asks for the unique on a sanctioned reference code and
    // nothing else; the authoring contract (attributes.md § Indexes) asks for
    // « composite for frequent filters » — and the screens declare their
    // filters deterministically. Tight on purpose: SmartListView only, a
    // single-token filter carrying a widget hint (select / date-range /
    // boolean) or naming a state attribute, resolving to a STORED attribute
    // of the bound entity, that is neither an FK column nor a relation target
    // (EF indexes FK columns by itself) nor already the LEADING column of a
    // declared index. Advice, never a blocker — no downstream consumer reads
    // it; ship last, drop if noisy.
    id: 'DM-024',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      const lists = moduleScreenBlocks(model, m).filter((b) => /listview/i.test(b.screenType) && b.entity !== undefined)
      if (lists.length === 0) {
        return { findings: [finding('DM-024', DIM, 'ok', moduleScope(m), 'Aucune SmartListView en portée — pas de pattern de filtre à anticiper.')] }
      }
      const byName = new Map(m.entities.map((e) => [fold(e.name), e]))
      const byCode = new Map(m.entities.map((e) => [fold(e.code), e]))
      const HINT_RE = /\((?:[^)]*\b(?:select|date-range|daterange|boolean|bool|enum)\b[^)]*)\)/i
      const missing = new Map<string, string[]>()
      let checked = 0
      for (const b of lists) {
        const e = byName.get(fold(b.entity!)) ?? byCode.get(fold(b.entity!))
        if (!e) continue
        const states = new Set(stateAttrsOf(e).map((a) => fold(a.name)))
        const fks = new Set(e.relations.map((r) => fold(r.fk)))
        const targets = new Set(e.relations.map((r) => fold(r.targetEntity)))
        const leading = new Set(e.indexes.map((i) => fold(i.fields[0] ?? '')))
        const coded = e.codePatternRaw !== null
        for (const f of b.filters) {
          const token = f.split(/[\s(]/)[0] ?? ''
          if (!/^[A-Za-z][A-Za-z0-9]*$/.test(token)) continue
          const n = fold(token)
          const attr = e.attributes.find((a) => fold(a.name) === n)
          if (!attr || attr.computed !== null) continue
          if (fks.has(n) || targets.has(n) || /id$/.test(n)) continue
          if (coded && n === 'code') continue
          if (!HINT_RE.test(f) && !states.has(n)) continue
          checked++
          if (leading.has(n)) continue
          const key = `${e.name}.${attr.name}`
          missing.set(key, [...(missing.get(key) ?? []), b.code])
        }
      }
      const evidence = [...missing.entries()].map(([k, scrs]) => `${k} ← filtre de ${[...new Set(scrs)].join(', ')} — déclarer \`(${k.split('.')[1]})\` (ou un composite qui commence par lui)`)
      return {
        findings: [
          evidence.length > 0
            ? finding('DM-024', DIM, 'warn', moduleScope(m), 'Colonne(s) filtrée(s) par une liste sans index déclaré qui commence par elle — anticiper l’index dans **Index** (conseil, jamais un blocage).', evidence)
            : finding('DM-024', DIM, 'ok', moduleScope(m), `${checked} colonne(s) de filtre couverte(s) par un index déclaré (ou une FK, indexée par EF).`),
        ],
      }
    },
  },
  // ---------------------------------------------------------------------------
  // DM-029..032 — the business TEST DATASET (`jeu-de-test.md`, the second seed
  // tier: dev / test / qual, never prod). Engine = lib/ba-test-data-check —
  // the SAME function `create-test-data/cli/derive-test-data --mode check`
  // runs; the CLI is the corrector's inventory, these rules are the verdict.
  // v1 severities are `warn` at most: the dataset is OPTIONAL, and an err
  // would flip every existing project's pre-dev GO to NO-GO.
  // ---------------------------------------------------------------------------
  {
    // DM-029 — the dataset the clients forget. A module whose entities are
    // business rows (not reference tables with Valeurs initiales) and that
    // carries no jeu-de-test.md — or one leaving business entities without a
    // block — cannot be exercised once deployed: nothing populates it in
    // test/qual, and the BA simulator has nothing but noise to show.
    id: 'DM-029',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ module }) {
      const m = module!
      const file = testDataFileOf(m)
      const business = m.entities.filter((e) => !isLookupClassification(e.classification) && e.initialValues === null)
      if (business.length === 0) {
        return { findings: [finding('DM-029', DIM, 'ok', moduleScope(m), `Aucune entité métier hors référentiel — jeu de test sans objet${m.testDataExists ? '' : ' (non fourni, optionnel)'}.`)] }
      }
      if (!m.testDataExists || m.testData === null) {
        return { findings: [finding(
          'DM-029', DIM, 'warn', moduleScope(m),
          `${business.length} entité(s) métier sans jeu de test (${TEST_DATA_FILE} absent) : rien ne peuplera test/qual, et un aperçu ne peut que l’inventer — /ba-create-test-data (optionnel, 5-8 lignes fictives par entité).`,
          business.map((e) => e.name), undefined, { file },
        )] }
      }
      const covered = new Set(m.testData.sets.map((s) => s.entity.toLowerCase()))
      const missing = business.filter((e) => !covered.has(e.name.toLowerCase())).map((e) => e.name)
      if (missing.length > 0) {
        return { findings: [finding(
          'DM-029', DIM, 'warn', moduleScope(m),
          `${missing.length} entité(s) métier sans bloc JT- dans ${TEST_DATA_FILE} — rien ne les peuplera en test/qual.`,
          missing, undefined, { file },
        )] }
      }
      return { findings: [finding('DM-029', DIM, 'ok', moduleScope(m), `${m.testData.sets.length} bloc(s) de jeu de test couvrent les ${business.length} entité(s) métier.`, undefined, undefined, { file })] }
    },
  },
  {
    // DM-030 — the dataset is COHERENT with the model it exercises: columns
    // are attributes or FK relations, the key is there and unique, required
    // cells filled, enums verbatim, uniques unique, dates real, coded entities
    // never hand a Code, and every FK cell resolves WHERE THE RELATION SAYS
    // (this module's blocks, the cited module's blocks, the target's Valeurs
    // initiales, an actor for a User). An unresolved citation names the OWNER
    // module — the rows it must provide.
    id: 'DM-030',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      const file = testDataFileOf(m)
      if (!m.testDataExists) {
        return { findings: [finding('DM-030', DIM, 'ok', moduleScope(m), `${TEST_DATA_FILE} non fourni (optionnel) — rien à vérifier.`)] }
      }
      const report = testDataReportOf(model, m)
      // DM-031/032 own their issue classes; `row-count` is the CLI's volume ADVICE, not an incoherence.
      const issues = report.issues.filter((i) => i.code !== 'duplicate-initial-values' && i.code !== 'flow-status-missing' && i.code !== 'row-count')
      if (issues.length === 0) {
        return { findings: [finding('DM-030', DIM, 'ok', moduleScope(m), `${report.totals.sets} bloc(s), ${report.totals.rows} ligne(s) — cohérent avec le MCD, les acteurs et les jeux cités.`, undefined, undefined, { file })] }
      }
      const errs = issues.filter((i) => i.severity === 'err').length
      return { findings: [finding(
        'DM-030', DIM, 'warn', moduleScope(m),
        `${issues.length} incohérence(s) dans ${TEST_DATA_FILE} (${errs} bloquante(s) pour le seed, ${report.totals.unresolvedRefs} référence(s) non résolue(s)) — corriger le fichier, ou le jeu du module PROPRIÉTAIRE cité.`,
        issues.slice(0, 25).map((i) => i.message), undefined, { file },
      )] }
    },
  },
  {
    // DM-031 — a reference table's rows ARE its Valeurs initiales (setup tier,
    // every environment). A JT- block on such an entity is a second truth:
    // the two would diverge, and the seed would upsert the same rows twice.
    id: 'DM-031',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      const file = testDataFileOf(m)
      if (!m.testDataExists) {
        return { findings: [finding('DM-031', DIM, 'ok', moduleScope(m), `${TEST_DATA_FILE} non fourni (optionnel) — rien à vérifier.`)] }
      }
      const dup = testDataReportOf(model, m).issues.filter((i) => i.code === 'duplicate-initial-values')
      if (dup.length === 0) {
        return { findings: [finding('DM-031', DIM, 'ok', moduleScope(m), 'Aucun bloc de jeu de test sur une table à Valeurs initiales.', undefined, undefined, { file })] }
      }
      return { findings: [finding(
        'DM-031', DIM, 'warn', moduleScope(m),
        `${dup.length} bloc(s) de jeu de test sur une entité portant **Valeurs initiales** — celles-ci SONT ses lignes (palier setup, tous environnements) ; retirer le bloc.`,
        dup.map((i) => i.message), undefined, { file },
      )] }
    },
  },
  {
    // DM-032 — every status a Flow rule reaches is carried by at least one
    // row: a dataset that never shows an « Archivé » client cannot exercise
    // the archive transition, in the simulator or in test.
    id: 'DM-032',
    dimension: DIM,
    scope: 'module',
    kind: 'mechanical',
    evaluate({ model, module }) {
      const m = module!
      const file = testDataFileOf(m)
      if (!m.testDataExists) {
        return { findings: [finding('DM-032', DIM, 'ok', moduleScope(m), `${TEST_DATA_FILE} non fourni (optionnel) — rien à vérifier.`)] }
      }
      const missing = testDataReportOf(model, m).issues.filter((i) => i.code === 'flow-status-missing')
      if (missing.length === 0) {
        return { findings: [finding('DM-032', DIM, 'ok', moduleScope(m), 'Chaque statut atteint par un Flow est porté par au moins une ligne (ou aucun Flow en portée).', undefined, undefined, { file })] }
      }
      return { findings: [finding(
        'DM-032', DIM, 'warn', moduleScope(m),
        `${missing.length} statut(s) atteint(s) par une règle Flow qu’aucune ligne du jeu ne porte — la transition ne peut être ni montrée ni testée.`,
        missing.map((i) => i.message), undefined, { file },
      )] }
    },
  },
]

// ---------------------------------------------------------------------------
// DM-029..032 helpers — ONE engine run per module, shared by the four rules.
// ---------------------------------------------------------------------------

const testDataReports = new WeakMap<ModuleModel, DeriveTestDataReport>()

function testDataFileOf(m: ModuleModel): string {
  return `${m.app}/${m.module}/${TEST_DATA_FILE}`
}

function testDataReportOf(model: CorpusModel, m: ModuleModel): DeriveTestDataReport {
  const cached = testDataReports.get(m)
  if (cached) return cached
  const app = model.apps.find((a) => a.app === m.app)
  const report = deriveTestData({
    app: m.app,
    module: m.module,
    mode: 'check',
    modules: model.testDataUniverse ?? new Map(),
    graph: model.graph,
    rules: m.rules,
    actors: app?.actors ?? [],
    file: m.testDataExists ? testDataFileOf(m) : null,
    warnings: [],
  })
  testDataReports.set(m, report)
  return report
}