model

One architectural-principle lint rule (LANG.md §9 — the C4 facade/boundary principles). `code` is its stable identifier (`PDS-ARCH-001`); `slug` is the filename of the article documenting it under the published principles base URL. Every firing is a `Warning` — a violation advises rather than invalidates — so the rule carries no severity of its own.

LANG.md §9 — architectural-principle lints over the resolved graph. Beyond §8.2 visibility (which a `public` component still satisfies), these advise on C4 structure: a cross-module call SHOULD reach a container/system's published face, not an internal `component` (Facade/Gateway); the module dependency graph SHOULD stay acyclic; a cross-system call SHOULD couple to the other system's boundary, not its containers. Each firing is a `Warning` stamped with the rule's `code` and `codeDescription` (its article URL); the model stays valid.

Projects the parsed, resolved workspace into the architecture graph: structural nodes plus edges from `for` parents, body calls, triggers, and `from` provenance, with a sequence trace recorded per disclosed body. A pure projection — no I/O — so the emit crate and a future salsa/LSP layer can both adopt it.

Caret resolution — the engine every cursor feature shares (`lsp_core` hover, definition, references, rename; the IDE's symbol actions). Tokenizes the active source, finds the identifier under the offset, and resolves it across the workspace and its externals: a node or data FQN, a `self.`/member access, or a local reference. Token-level, so it survives a partial parse.

Static analysis (LANG.md §2.2, §2.3, §2.4, §3.3, §3.4, §3.5, §4, §5.1, §5.2, §6, §7, §8): builds the symbol tables, then runs the well-formedness checks. Every entry returns a `syntax::Diagnostic[]`; well-formed input yields an empty one. Checks are conservative — each rule fires only when the violation is certain.

Context-aware completion (the model-native producer `lsp_core` maps to LSP items): candidates at a caret offset resolved across the workspace and its externals — members after `.`, a module's public symbols after `::`, the built-in macros after `#[`, types in type position, else keywords and symbols.

One `constant`'s FQN paired with its declared primitive type name (§3.6, ADR-039), so inference resolves a `module::NAME` reference to its type.

§8.2 — cross-module visibility resolution. Walks each module's qualified references — `for` parents, type annotations (field, parameter, return, and generic-argument types), feature targets, body call targets, value-position union-variant references, and the member named after a call target's FQN — and against the global FQN index enforces: a reference from module A to a node in module B resolves only if that node is `public`. A private target or a dangling cross-module FQN is a diagnostic. Same-module references are the single-module checks' business and are skipped here.

One field of a `data` record or union-variant record: its name and rendered type.

The disclosed shape of a `data` node (§3.4, §3.5): a record of fields, a discriminated union of variants, or an undisclosed black box. Carried on a `data` `GraphNode` so the entity (ER) view draws the rows without re-reading source.

One variant of a `data` union (§3.5): its name and, for a record variant, its fields.

Why parsing a manifest's `[dependencies]` table or a `pds.lock` failed: the offending entry and a human-readable message. Malformed TOML, an unknown key, or more than one of tag/rev/branch on one dependency (§8.3).

One dependency module's in-memory form: its FQN *within* the dependency workspace (path relative to that workspace root) and its source. The resolver prefixes it with the dependency name.

A `[dependencies]` entry as written in `pds.toml` (§8.3): a git URL with at most one of tag/rev/branch and an in-repo sub-path, or a local sibling path. Empty strings stand for the absent options.

§8.3 — the dependency resolver. Parses a manifest's `[dependencies]` and a `pds.lock`, then maps each direct dependency to its dependency-name-prefixed modules — the externals the checker binds for cross-workspace resolution. The single source of the slug→name→`dep::module` mapping, shared by the native loader (`project`) and the WASM bridge (`ide`). Pure: fetching and disk are the caller's job.

A typed, directed relationship between two graph node FQNs. `source` is the wire field `from` — `from` is a PseudoScript keyword, so the model renames it. Either endpoint may name a node not present as a `GraphNode` — a synthesised trigger initiator, or a target that does not resolve. `label` is the method name for `Call`, otherwise empty. `span` is the source range that produced the edge — the call site for a `Call` — so an architectural lint can point its diagnostic at the offending call; the empty span when the edge is synthesised.

What relationship a graph edge expresses (LANG.md §9.1): a `for` parent link, a body call (label = method), a synthesised trigger initiator edge, or a `from` provenance link.

§5.2 / §8.1 — feature checks. A feature's `for` target MUST resolve to a node, not a type or module; a target this single-module model cannot see is left to cross-module resolution. Feature names occupy their own module namespace, so a repeated name is a collision (checked once per module).

A union's fieldless variant names, keyed by the union's bare name (§3.5). Fieldless variants do not hoist a symbol — they are addressed `module::Union::Variant` (ADR-032) — so they index under their union.

The foldable regions of a module: every multi-line disclosed declaration and statement block, and doc-comment runs.

The resolved architecture graph: every node and typed edge across all C4 levels, plus feature scenarios. The single source every view projects from — enough to extract any view without re-reading source. Per-callable sequence traces (`Step[]`) are held alongside, keyed by the owning callable's FQN.

One node in the resolved graph — a structural declaration, a `data` type, or a callable. Carries its FQN, simple name, kind, enclosing-node FQN (`for` parent, owning node, or empty at top level), declaring module, visibility, name span, any trigger macros (callables only), the call signature (callables only), the disclosed shape (`data` only), and lifted `///` documentation.

Local-binding type inference, for inlay hints and hover. Assignments are untyped (`x = expr`); this infers each binding's type from its right-hand side — a call's return type, a field access, a `from` expression, or a literal. Best-effort: an un-typeable expression yields nothing rather than a guess.

A parsed `pds.lock` (§8.4): the pinned dependency graph. A black box here — its shape is the lockfile's concern, not the model's.

§2.4 / ADR-015 — macro targeting. Every built-in macro (`onevent`, `schedule`, `http`, `manual`) targets callables; on any structural declaration it is a wrong-target error, and an unrecognised macro is unknown. An `#[onevent(E)]` handler MUST have exactly one parameter whose type matches the event type.

A member reachable through `.` from a node or `data` owner: its name, kind, definition span, one-line signature detail (`run(name: string): uuid`), value type (a field's type or a callable's return type), the ordered parameter types (empty for a field — their count is the call arity, ADR-022), the `///` summary (absent for a field — the grammar has no field doc), and whether it is `public` (callables only; gates cross-module member completion, §8.2). Powers member completion, arity checks, and go-to-definition.

What kind of member is reachable through `.` from an owner: a node's callable (§5.1) or a `data` record field (§3.4).

`crates/pseudoscript-model`. AST to one resolved graph; static checks (resolution, visibility, Result flow, return coverage); the §8.3 dependency resolver; and the LSP analysis primitives (completion, folding, semantic tokens, inference). WASM-safe.

One workspace module's diagnostics, attributed to its FQN. Every span lies in that module's own source, so a tool with the FQN-to-file mapping publishes each list against the right file.

One module's parsed AST, resolved symbol table, and FQN, as held by a `Workspace`.

A node's documentation, lifted from its `///` block (LANG.md §2.1): the summary (compact-diagram text), the extended description (tooltip text), and its tags (` `, including the `#`), in source order.

What kind of model element a `GraphNode` is. Adds `Callable` to the structural kinds: structural declarations, `data` types (including hoisted union variants), and callables all become nodes.

A content-addressable package identity: its source, resolved revision, and in-repo path. Drives the `pds_modules/` slug a git package materialises into.

§4 / ADR-010 — C4 parent-kind well-formedness. A `for` parent links a node to its enclosing level, and the levels MUST nest: a `container` parents a `system`, a `component` parents a `container`. A parent of the wrong kind is a diagnostic (`container `X` parent `Y` is not a system`). A bare parent that names no same-module node is unresolved (§8.1); a qualified parent this single-module model cannot see is left to cross-module resolution.

§2.3 / ADR-012 — reserved-word identifiers. A declared identifier MUST NOT be a reserved word: a keyword, a primitive type name, or `Result`/`Option`. Covers every name a module declares — `data`, node, callable, field, parameter, variant, and feature names — so `data string` or a parameter named `Result` is a diagnostic.

The outcome of resolving a cross-module reference (LANG.md §8.2): the FQN names a public symbol, a private one reached from another module, or nothing.

One resolved caret hit: the clicked identifier's span, the defining module and the definition's span there, the resolved graph FQN (a member resolves to `owner::member` — the key `emit`'s symbol projection uses), a Markdown title line, and the doc summary or signature detail shown under it.

Resolves a module's declarations into a symbol table (LANG.md §8). FQNs are file-derived: a single `.pds` file is one module, named by its `//!` path. Holds two namespaces — type names and node names share the symbol table, while feature names live in a separate namespace the `Checks` enforce — plus the member, fieldless-variant, and constant-type indexes. The LSP reuses the table for hover and go-to-definition.

§6 — flow-sensitive `Result` / `Option` typestate. Each binding carries a state (`Unknown`, `Ok`/`Err` for a `Result`, `Some`/`None` for an `Option`), narrowed on entering the branches of `if (r.isErr)` / `if (r.isOk)` / `if (o.isNone)` / `if (o.isSome)`. Reading `.value` while known-`Err` or known-`None`, or `.error` while known-`Ok`, is a model error. The env is cloned per branch so narrowing does not leak; an `if` whose guarded arm diverges narrows the fall-through to the inverse state (`Ok`<->`Err`, `Some`<->`None`).

ADR-016 — return coverage. A disclosed non-void callable MUST return on every path. A `return` makes a block diverge; an `if`/`else` diverges only when both arms do; `for`/`while` bodies and bare expressions never guarantee a return. An explicit `void` and a parse-recovered missing return type (ADR-040) both mean void.

A resolved revision selector — at most one of these (§8.3); `Default` is the remote's default-branch HEAD.

A `feature` BDD scenario attached to its target node (LANG.md §5.2, §9.3): its name, the canonicalised target FQN (as written if it does not resolve), the declaring module's FQN, the span of the feature name (a host's go-to-definition target), lifted `///` documentation, and the ordered given/when/then steps. Steps are prose, not resolved, so a scenario adds no edges; it renders as a card on its target node's doc page.

One step of a `Scenario` (LANG.md §5.2): a keyword (`given`/`when`/`then`/ `and`/`but`) and its prose, with the string literal's quotes stripped.

AST-aware semantic colouring: each identifier classified by its declared role (node→namespace, `data`→class, callable→method, parameter, call segment), the spans `lsp_core` delta-encodes for the editor.

One parameter of a callable signature: its name and rendered type.

A callable node's signature (§5.1): its ordered parameters and rendered return type. Carried on a callable `GraphNode` so the sequence and symbol views can show the call shape without re-reading source.

The resolved source of a dependency (ADR-026): a fetched git repository at a revision and in-repo sub-path, or a local sibling workspace read from disk.

One step in a callable's ordered sequence trace (LANG.md §7, §9.2). Calls in a chained expression are emitted left-to-right; control flow becomes `Alt`/ `Loop` frames whose bodies are nested step lists, in §7 evaluation order.

One declared, addressable node in a module namespace: the bare name, its FQN (`module::Ledger`), its declaration kind, whether it is `public` (§8.2), and the span of its name.

The lowercase declaration keyword a `Symbol` names. Drives the parent-kind and macro-target diagnostics, which embed it as prose. `Constant` is a top-level primitive value (§3.6, ADR-039).

One module's resolved symbol table (LANG.md §8): its FQN plus the declared nodes, the members reachable through `.`, the fieldless-variant index (ADR-032), and the constant-type index (ADR-039). The `Resolver` produces it; the `Workspace` indexes and the `Checks` consume it.

A trigger macro on a callable (LANG.md §2.4): the macro that makes the callable a diagram entry point and synthesises an inbound initiator edge. Each variant maps to a synthesised initiator node (`event:<FQN>`, `scheduler`, `client`, `caller`).

§3.3 / §8.1 — type-reference resolution. Every named type in a declaration — a field, parameter, or return type, and each generic argument — MUST resolve. A bare name that resolves to nothing is reported as unresolved; a name that resolves to a declared type or node MUST be written by its full FQN (`module::Name`), so an unqualified declared-type annotation is rejected. Built-in types (the primitives, `Result`, `Option`) stay bare.

§3.5 / ADR-006 — union variant collision. A top-level `data Name` followed by an inline variant `| Name { ... }` hoisting the same name is a collision. Bare variants reference existing data and never collide.

Whether a node is `public` (cross-module addressable) or module-private (LANG.md §8.2).

The resolved set of modules keyed by FQN (LANG.md §8). Built once per workspace from `(fqn, parsed module)` pairs; owns the per-module models and a global FQN-to-`Symbol` index for cross-module resolution.

One `.pds` module of a workspace: its caller-supplied FQN (the loader derives it from the file path relative to `pds.toml`, LANG.md §8.1) and its source text. This crate stays pure over in-memory modules; it never touches the filesystem.