Behavior Annex type conformance is disabled, so no type mismatch is reported 🤖

[lwrage]

Summary

AdaLikeDataTypeChecker.conformsTo returns true for every pair of types. Its whole body is commented out behind the
note "As type checking is not mature, we disable it", so no Behavior Annex check that compares two types can fail.

Observed: an external model that assigns a string to an integer-typed behavior variable, sends an integer on a
string-classified out event data port, adds a string to an integer, and compares an integer with a string is accepted
with zero diagnostics.

Inferred mechanism: every comparison routes through that method. Its own comment lists the affected checks, and each
one is reachable from AadlBaTypeChecker: assignment target against value, port send port against value, port dequeue
port against target, for/forall iterated values against the iterative variable, integer range bounds, and subprogram
call parameters. Two more are not in that list: getTopLevelType, which can therefore never return null, and the
operand-consistency guard at the top of checkDefinition.

Operator applicability is still checked, so this is not a total loss of type checking: and on a non-boolean, < on a
non-alphanumeric, and mod on a non-integer are still reported by checkDefinition after the disabled guard passes.
What is missing is agreement between the two types in every construct that pairs them.

Reproduction

package TypeMismatch
public
	with Base_Types;

	abstract mismatch
	features
		out_text: out event data port Base_Types::String;
	end mismatch;

	abstract implementation mismatch.i
	annex behavior_specification {**
		variables
			counter : Base_Types::Integer;
		states
			start : initial state;
			done : final state;
		transitions
			assign_wrong_type : start -[ ]-> done { counter := "text" };
			send_wrong_type : start -[ ]-> done { out_text!(42) };
			mixed_operands : start -[ ]-> done { counter := 1 + "text" };
			mixed_relation : start -[ ]-> done { counter := 1; if (counter < "text") counter := 2 end if };
	**};
	end mismatch.i;
end TypeMismatch;

Validated with the Behavior Annex validator registered (BehaviorAnnexInjectorProvider, as Issue3174Test and
CoveringSemanticTest do). The model has no AADL or Behavior Annex syntax errors and the resolver builds a complete
strict model; the issue count is 0.

Expected behavior

Each of the four transitions reports exactly one error naming the two types that disagree. AS5506/3 Rev A D.6 states the
assignment rule directly — "In an assignment action, the type of the value expression must match the type of the target"
— and D.7 requires operand consistency for the arithmetic and relational operators. assign_wrong_type and
mixed_operands are D.6/D.7 legality failures, send_wrong_type fails the D.5 port send obligation, and
mixed_relation fails D.7.

The substance of the work is not the one-line re-enable: turning conformsTo back on will surface diagnostics across the
checked-in corpus, including models/covering_semantic, models/covering_syntax, and the standard examples under
org.osate.ba/examples. Every model that starts reporting has to be triaged into "the model is wrong and the fixture
must change", "the rule is right but the message or location is wrong", and "the commented-out rule itself is wrong for
Rev A" — the last is likely for the fixed-point/universal-real and dimension clauses in the disabled body. The
characterization goldens under ba/org.osate.ba.tests/expected/diagnostics make that triage measurable.

Relevant code

• ba/org.osate.ba/src/org/osate/ba/analyzers/AdaLikeDataTypeChecker.java — conformsTo (line 71, returns true with
  the body commented out), getTopLevelType (line 127), and the guard in checkDefinition (line 143).
• ba/org.osate.ba/src/org/osate/ba/analyzers/AadlBaTypeChecker.java — the callers: checkAssignment (line 216),
  checkPortSend (line 240), checkInternalPortSend (line 260), checkPortDequeue (line 282), checkElementValues
  (line 329).
• ba/org.osate.ba.tests/models/issue3174/InternalPortTypes.aadl and
  Issue3174Test.internalEventWithoutDataCarriesNoValue already record the same dormancy for internal ports: that test
  asserts the two data-less-internal-event diagnostics and documents why the two wrong-typed transitions in the same
  model produce nothing.
• ba/doc/conformance.md overstates the current state in its D.6 row ("Type checks, conflicting assignments in action
  sets, and static minimum/maximum computation-time checks exist"), which is why none of the G or V findings covers this.

[lwrage]

What the standard prescribes, and what else is possible

Reference: AS5506/3 Rev. A, Annex D (July 2017), the document ba/doc/conformance.md cites, read through a textutil -convert txt extraction. Rules are cited by section and wording rather than by number, because the extraction drops Word's automatic numbering and the checker's D_6_L8-style names are AADL BA draft 0.94 numbers that do not line up with Rev. A.

One structural fact drives the rest: Annex D.5 has no legality rules at all — only consistency rules C1/C2 about Input_Time/Output_Time. Every type obligation in the annex lives in D.6 and D.7, plus typed nonterminals in the D.3/D.4/D.6/D.7 grammars.

1. Type checks the standard prescribes

The one explicit type-match rule (D.6 legality rules):

• "In an assignment action, the type of the value expression must match the type of the target."
• D.6 semantics restates it as consistency and fixes the type domain: "The types are represented by AADL data component classifiers. Basic types, such as integer, float, string, and Boolean, are defined in the Data Modeling Annex standard AADL package Base_Types. The corresponding literal values are acceptable values for those types." That last sentence is the only content the document supplies about the conformance relation itself — a literal is acceptable for its basic type.
• target := any is exempt: any denotes "any of the possible value determined by the data type".

Obligations that reach the assignment rule through D.5's runtime-service equivalences. D.5 defines p := v as Put_Value and p!(v) as Put_Value then Send_Output, both "assigns the data value v to the port variable of a data or event data port p"; D.6 semantics says communication actions "include implicit assignments". So the port-send type obligation is D.6's assignment rule applied through a D.5 equivalence, not a D.5 rule of its own. Dequeue does have its own D.6 legality rule: "expression p?(v) dequeues the next value from event or event data port p and assign it to v", and "a port name only accepts a one dimension array".

D.6 signature rule: "In a subprogram call, the parameter list must match the signature of the subprogram being called. In other words, for each feature of the subprogram being called (e.g. parameters, data accesses, ports) there must be a parameter label in the parameter list." Ordering is fixed by D.5 ("Ordering of actual parameters must be the same as the one of the parameter feature declarations"). Per-actual type matching follows from "match the signature" plus the implicit-assignment semantics; direction follows from the D.6 grammar's parameter_label ::= in_parameter_value_expression | out_parameter_target.

D.6 for/forall element typing (semantics, three cases): an integer range means the element identifier "is of type integer"; an input event data port means it is "of the same type as the data classifier of the port"; an array data component means it is "a reference to data components in the array". The optional explicit : data_unique_component_classifier_reference must therefore agree with the inferred type, and element_values must be one of those three forms.

D.7 legality rules — operator level, not operand agreement:

• Operands of logical operators must be boolean.
• Operands of relational operators "must be of a type that supports comparison".
• Operands of adding, multiplying and other numeric operators "must support numeric operations".
• "A value expression adopts the type of its top-level operator or single operand."
• Property references "should only be limited to properties without units, or with a time unit."
• "Behavior variables or data component references used in the right hand side of an assignment must have been initialized."

Note the exact force of the first three: each constrains the class of each operand's type, not agreement between the two operands. Agreement is nowhere spelled out. It comes from two other places: D.7 states "This expression language is derived from ISO/IEC 8652:1995(E), Ada95 Reference Manual §4.4" (Ada's predefined binary operators take both operands of the same type, with no implicit conversion), and "a value expression adopts the type of its top-level operator" is ill-defined for mixed operands. The ** exponent-is-a-natural rule that AdaLikeDataTypeChecker.checkDefinition implements has the same provenance — Ada, not an Annex D rule. This slightly sharpens the issue text above: D.7 does not literally state an operand-consistency rule; the Ada derivation clause supplies it.

Typed-syntax obligations — prescribed by nonterminal names, so legality obligations in the same sense the grammar is normative:

Construct	Obligation	Section
execute condition, if/elsif/while/do..until	logical_value_expression, so boolean	D.3, D.6
integer_range ::= integer_value .. integer_value	both bounds integer	D.7
array_index ::= [ integer_value ]	index integer; D.6 also limits a port name to one dimension	D.7, D.6
array_size ::= [ integer_value_constant ]	declared extent is an integer constant	D.3
behavior_time ::= integer_value unit_identifier	integer value; unit from Time_Units ("as defined by the Time_Units property type")	D.4, D.6
computation (min .. max)	min ≤ max, compared across time units	D.6
property fields	[integer_value] only for array properties, .field only for records, upper_bound/lower_bound only for ranges	D.7
local variables	"must be explicitly typed with a valid data component classifier"	D.3
integer values	"equivalent to Base_Types::Integer values as defined in the AADL Data Modeling Annex"	D.7

What the standard does not prescribe: the matching relation itself. There is no rule about classifier extension or refinement (data_type vs data_type.i), none about type-versus-implementation substitutability, none about numeric widening (integer to float), nothing about fixed point at all, and nothing about array conformance beyond the one-dimension port restriction. "Must match the type" is undefined except for the literal-acceptability sentence.

2. How that maps onto the disabled code

conformsTo has six call sites: AadlBaTypeChecker lines 233 (assignment), 249 (port send), 274 (internal port send), 291 (dequeue), 335 (integer-range bounds), 352 (for/forall element), plus the operand guard at AdaLikeDataTypeChecker:146 and getTopLevelType at AdaLikeDataTypeChecker:127.

Three corrections to the issue as filed:

• "subprogram parameters checking" in the disabled comment is stale. No such call site exists: checkBasicAction handles assignment, port send, internal port send, and dequeue, then returns true. Re-enabling conformsTo restores nothing for calls — the D.6 signature rule is unimplemented and belongs to Validate Behavior Annex communication actions and subprogram call signatures 🤖 #3181.
• The port-send and dequeue obligations are D.6, not D.5. D.5 has no legality rules; the obligations arrive through D.5's Put_Value/Next_Value equivalences and the D.6 assignment and p?(v) rules.
• The integer-range check will still be weaker than the rule after the re-enable. conformsTo(lower, upper, true) only requires the two bounds to agree with each other; nothing requires either to be INTEGER, and the grammar admits ReferenceExpression and property references as bounds (BehaviorAnnex.xtext:210-214). Two string bounds pass today and will still pass afterwards.

Prescribed and not gated on conformsTo, so unaffected by the re-enable: the D.6 signature rule (#3181); behavior_time values being integer; the D.7 unitless/time-unit property restriction (#3191); the D.7 initialization rule (#3190); array-index typing and index-count-versus-dimension; the one-dimension port array in p?(v); declaration-initializer typing. Already enforced elsewhere: boolean conditions via checkBooleanExpression/checkExecuteCondition; min ≤ max via D_6_L8_Check, which silently returns true for non-literal times; and the time-unit restriction on a behavior_time unit, which BehaviorAnnexScopeProvider:72 enforces by scoping the cross-reference to AADL_Project::Time_Units.

3. Other type checks that are possible

(a) Policy decisions forced by the standard leaving "match" open. The commented-out body already encodes three that no Rev. A rule prescribes:

• Case-insensitive qualified-name equality of classifiers. Case-insensitivity is correct; exact-name equality is a choice, and a strict one — it rejects every extension and type/implementation relationship. Concrete consequence in the document's own text: BA_example7 passes v : data_type.i to output : out parameter data_type. The alternative is to align with core AADL classifier matching and substitution (Classifier_Matching_Rule, Classifier_Substitution_Rule) rather than name identity.
• The FIXED/FLOAT exception, where a universal real literal (klass == null) conforms to a Fixed classifier. Defensible as an instance of "the corresponding literal values are acceptable values for those types", but the asymmetry means a Fixed variable never conforms to a Float one. Rev. A says nothing about fixed point; that is Data Modeling Annex territory.
• Array dimension equality. Only the one-dimension port restriction is prescribed. The callers already disagree with themselves: five sites pass hasToCheckDimension = true, and the for/forall site passes false precisely because element and array ranks differ by one.

A related open policy: what to do when Data_Representation is absent. AadlBaUtils.getDataRepresentation returns UNKNOWN for any classifier without the property, which in practice includes every Struct and Union, so struct-typed operands compare by classifier name alone; the disabled preliminaries treat UNKNOWN with a classifier as checkable but UNKNOWN without one as an error.

(b) Checks the existing machinery could support that no rule states, in rough order of value:

• Structural conformance from the Data Modeling Annex: compare Struct/Union by Element_Names/Base_Type, Enum by Enumerators, Array by Dimension and element Base_Type. DataRepresentation already declares ARRAY, ENUM, STRUCT, UNION, and ENUM_LITERAL; all are unreachable through conformance today.
• Numeric range and unit checks: a literal outside the target's Data_Model::Integer_Range/Real_Range; Measurement_Unit disagreement between operands (adding metres to feet); precision loss implied by Number_Representation. Warnings, not legality failures.
• Direction and category checks around ports, currently absent and independent of conformance: send on an incoming port, dequeue from a data port, p?/p'count on a port kind with no queue, a value on an event-port send. Represent Behavior Annex internal port actions correctly 🤖 #3174 fixed the internal-event analogue of the last one; the same shape applies to declared features.
• Extent checks using TypeHolder.dimension_sizes — mismatched extents, and static out-of-bounds indices. Unsound until Conform Behavior Annex expression precedence and grouping to AS5506/3 🤖 #3177 lands, since declared extents currently arrive as 0.
• p'updated typing as boolean once Support the Behavior Annex port updated value 🤖 #3171 adds the operator; p'count ⇒ INTEGER and p'fresh ⇒ BOOLEAN already exist in AadlBaUtils.getDataRepresentation(ValueVariable).
• Tightening = and !=: checkDefinition returns BOOLEAN for any operand pair, including structs, without testing comparison support. The standard's "a type that supports comparison" would justify restricting equality to comparable representations while ordering stays restricted to alphanumerics as it is now.
• Declaration-initializer conformance for behavior variables, plus the D.7 precedence rule that a declaration-time value overrides Initial_Value. checkBehaviorVariable currently only checks that the classifier resolved.

4. One triage item that can be banked now

local_result.status := 1 and := 0 in ba/org.osate.ba/examples/standard_examples/ba_example_007.aadl:92-93 assign integers to status : data Base_Types::Boolean (line 19). That is a genuine type error in the standard's own example 7, reproduced verbatim in the repository copy. So the "the model is wrong and the fixture must change" bucket predicted above is non-empty before the work starts, and its first member came from the document.

[lwrage]

Design plan for re-enabling type conformance

This settles the policy questions the issue leaves open, since AS5506/3 Rev. A never defines what "match" means for two types. Every choice below that the standard does not prescribe is marked as tool policy, so a later reader does not cite it as a Rev. A rule.

Prerequisites

This design assumes three fixes have landed, and #3199's branch bases on them rather than on current master:

• Support the Behavior Annex port updated value 🤖 #3171 (p'updated) — so the operator exists to be typed.
• Preserve Behavior Annex behavior-variable array extents during translation 🤖 #3176 (behavior-variable array extents) — so extents are real values rather than 0, which makes extent conformance and static index bounds sound.
• Conform Behavior Annex expression precedence and grouping to AS5506/3 🤖 #3177 (expression precedence and grouping) — operand pairing determines which two types reach checkDefinition, and therefore the text and location of every mismatch diagnostic. Triaging the corpus before Conform Behavior Annex expression precedence and grouping to AS5506/3 🤖 #3177 would move the goldens twice and invalidate the first triage.

Decisions

#	Decision	Choice	Basis
1	Classifier conformance	Case-insensitive equality of qualified names	Tool policy. Rev. A prescribes no relation. Rejects extension and type/implementation pairs that the document permits.
2	Numerics	Ada-strict	D.7: "derived from ISO/IEC 8652:1995(E), Ada95 Reference Manual §4.4". Equal representation for classifier-typed values; universal_integer literals to integer targets only; universal_real literals to float and fixed targets.
3	Gating	Report type errors, then still run the rules driver	A type error currently silences every D.3/D.4/D.6 finding in the same subclause.
4	Scope	Re-enable plus all prescribed checks the re-enable makes reachable	See the check list below.
5	UNKNOWN representation	Name equality, same as decision 1	Structs, unions and enums report Data_Representation = UNKNOWN; they match their own classifier and nothing else.
6	Severity	Errors immediately	The standard states these as legality rules.
7	Standard examples	Correct them, with a comment recording the document's defect	They ship to users; shipping examples that report errors is its own defect.
8	Array dimension	Rank always; extents when both are statically known	Tool policy. Rev. A's only array statement is the one-dimension port restriction.

Resulting code design

AdaLikeDataTypeChecker.conformsTo — restore the commented-out body close to verbatim, with comments recording why each clause is what it is.

Decisions 1, 2 and 5 all match what the disabled body already says. In particular the FIXED/FLOAT clause stays: it fires only when klass == null, so it is the Ada universal_real rule (a real literal is compatible with both floating and fixed types), not a widening exception. Deleting it would leave a Fixed-typed target unassignable from any literal, because BA has no fixed-point literal syntax. Conversely f := 0 on a Float target is an error under decision 2, exactly as F : Float := 0 is illegal in Ada.

Extent comparison is the one addition to the restored body. When dimensions are compared, compare per-dimension extents only where both are statically known; where either is unknown, compare rank alone. A declared size can be a property reference that no static analysis can evaluate, and rejecting those would be a false positive.

Gating — split checkTypes() rather than deleting the if in BehaviorAnnexValidator.checkBehaviorAnnex. Keep gating on resolution failure (checkResolvedModel, unresolved data classifiers, unresolved property associations): the rules driver walks the strict model and would risk NPEs over holders whose getElement() is null, which is the #3172 case. Stop gating on conformance mismatches only.

Cascade risk here is low: the expression walkers are already fully null-tolerant. checkRelation, checkSimpleExpression, checkTerm and checkFactor short-circuit on every null, so a mismatch deep in an expression yields one diagnostic rather than a cascade.

Checks the re-enable makes reachable, all in scope:

1. Integer-range bounds and for/forall element typing. Bounds become an explicit INTEGER test on each bound rather than a mutual-conformance call — today two String bounds would satisfy conformsTo(lower, upper) and still pass. Element typing follows D.6's three cases: integer range ⇒ INTEGER; input event data port ⇒ the port's data classifier; array ⇒ rank − 1, with the outer extent dropped and inner extents preserved. That replaces the hasToCheckDimension = false workaround at the for/forall call site.
2. D.6 signature match (Validate Behavior Annex communication actions and subprogram call signatures 🤖 #3181). Actual-to-formal count, order, direction (in ⇒ value expression, out ⇒ assignable target) and per-parameter type conformance for SubprogramCallAction. checkBasicAction returns true for it today.
3. behavior_time, array indices and declared extents. behavior_time values must be INTEGER (the unit is already constrained, since BehaviorAnnexScopeProvider scopes the cross-reference to AADL_Project::Time_Units). Array indices must be INTEGER, the index count must not exceed the classifier's rank, and with Preserve Behavior Annex behavior-variable array extents during translation 🤖 #3176 in place a constant index outside a known extent is reportable. D.3's array_size ::= [ integer_value_constant ] also becomes checkable: a declared size must be a positive integer constant.
4. D.7 property-reference units (Restrict Behavior Annex property references to allowed unit types 🤖 #3191). Restrict property references to properties that are unitless or carry a time unit.

p'updated typing needs no production change but has two registration points that must both be right in #3171, and a regression here guards them: the representation switch in AadlBaUtils.getDataRepresentation(ValueVariable) must return BOOLEAN, and the exclusion list in getTypeHolder(Value, ComponentClassifier) — currently !(v instanceof PortCountValue || v instanceof PortFreshValue) — must also exclude the updated value. Miss the second and p'updated on an Integer-classified port carries BOOLEAN representation and an Integer classifier, which then fails name comparison against Base_Types::Boolean with a nonsense message.

Two things #3177 makes correct rather than accidental, worth stating in the commit message because they look like coincidences:

• checkValueExpression folds the flat relation list left-to-right against logicalOperators.get(i - 1), which is exactly D.7's "for a sequence of operators of the same precedence level, the operators are associated with their operands in textual order from left to right". Today that fold runs over a list built from a tree where and outranks or, so the pairs it forms are not the ones the standard names.
• Parenthesized subexpressions already type-check: D.7's value ::= ( value_expression ) puts a group in a factor, and getType recurses through checkValueExpression for a nested ValueExpression. Once grouping survives translation, each group's type is the type of its own top-level operator, satisfying D.7's "a value expression adopts the type of its top-level operator or single operand" structurally.

The ** natural-exponent check also survives #3177's regrouping: with ** binding tighter than unary minus, -2 ** 2 leaves 2 ** 2 in the Factor, so factor.getSecondValue() still sees the literal exponent while the minus applies to the power's INTEGER result. Fragile-looking, so it gets a regression.

Open item to pin before implementing

Static index bounds need the array index convention pinned against core AADL (1-based, so valid indices are 1 .. size) before the check is written. If that cannot be established from AS5506C, the bounds check is dropped and index typing alone is kept; extent conformance does not depend on it.

Out of scope, with reasons

• Structural comparison of Struct/Union/Enum via Data_Model::Element_Names, Base_Type and Enumerators — a conformance relation the standard does not describe. Decision 5 compares names.
• Measurement_Unit agreement and Data_Model::Integer_Range/Real_Range bounds — worth having as warnings later, not prescribed anywhere.
• Port direction and category checks (send on an incoming port, dequeue from a data port, p?/p'count where there is no queue) — real gaps, but independent of conformance and belonging to Validate Behavior Annex communication actions and subprogram call signatures 🤖 #3181's neighbourhood.
• D.7 initialization (Enforce Behavior Annex variable initialization rules 🤖 #3190) — a definite-initialization dataflow analysis, not a conformance question.
• Short-circuit operators (Support Behavior Annex short-circuit logical operators 🤖 #3169) — no design impact when they land: D.7's boolean-operand rule is identical, so the LogicalOperator branch in checkDefinition covers them as soon as the enum gains the literals.

Issue and PR structure

Decision 4 puts five independently fixable defects on one branch, which departs from the one-defect-per-PR default, so the trail is kept explicit:

1. Three new issues to create, since regression class names need real numbers: (a) integer-range bounds and for/forall element typing; (b) behavior_time, array index and declared-extent typing; (c) a type error suppresses all legality and consistency checking — that last is its own observable defect, not a side effect of this one.
2. Commit sequence: six regression/fix pairs, each regression commit immediately preceding its fix, in dependency order — un-gating first, so later regressions can assert rule diagnostics alongside type diagnostics; then this issue; then the four check groups.
3. PR closes Behavior Annex type conformance is disabled, so no type mismatch is reported 🤖 #3199, Validate Behavior Annex communication actions and subprogram call signatures 🤖 #3181, Restrict Behavior Annex property references to allowed unit types 🤖 #3191 and the three new issues, and records the base dependency on Support the Behavior Annex port updated value 🤖 #3171, Preserve Behavior Annex behavior-variable array extents during translation 🤖 #3176 and Conform Behavior Annex expression precedence and grouping to AS5506/3 🤖 #3177.

Triage policy for the existing corpus

Every diagnostic that appears across models/covering_semantic, models/covering_syntax, models/characterization, the conformance fixtures and org.osate.ba/examples gets triaged into one of three dispositions, and the goldens under expected/diagnostics and expected/diagnostics-validated record the result:

• the model is wrong ⇒ correct the fixture, in the same PR;
• the rule is right, the message or location is wrong ⇒ fix the diagnostic;
• the rule is wrong for Rev. A ⇒ change the rule, and say which clause justifies it.

Known members of the first bucket before the work starts, both in ba/org.osate.ba/examples/standard_examples/ba_example_007.aadl, the document's own example 7: local_result.status := 1 and := 0 assign integers to status : data Base_Types::Boolean, and send_result!(local_result, v) passes v : data_type.i to output : out parameter data_type, which decision 1 rejects once the signature check exists. Both get corrected with a comment recording that the document's text is wrong there.

Residual risk

Decisions 1, 2 and 6 together produce the largest diagnostic surface of the options considered. Name equality rejects extension and type/implementation patterns that Rev. A permits — nothing in Annex D forbids them — so models that are legal by the document will now report errors, the example 7 call among them. That is a deliberate tool policy, and the G18 row of ba/doc/conformance.md will say so, so it is not later mistaken for a Rev. A rule. If it proves too strict against real models, the single point of change is the classifier comparison in conformsTo, which can move to AadlUtil.isSubClassifier without touching any call site.

[lwrage]

Correction to the design plan: split declarative and instance type checking

Re-enabling conformsTo must not make the source validator evaluate effective property values from the declarative classifier. Simple classifier-identity relationships, universal literal kinds, and other property-independent mismatches can be diagnosed declaratively.

Operator applicability, arrays, ranges, structural data types, and several planned checks derive facts from Data_Representation, Base_Type, Dimension, Integer_Range, or related property values. A contained association can override those values for one instance of a shared classifier, so those checks require an instance-model pass. The same applies to selecting a value for an element-prefixed property reference.

The #3191 unit-category restriction is a useful dividing example: the declared property type can be checked in source validation, while selected value and unit evaluation belongs to the instance pass. The umbrella implementation and regression plan should be split along this boundary, with paired instances and a contained override proving the instance-dependent cases.