The receiver contract at publish: whether the event a sender or a binding names is one the receiving document accepts (ADR-0008).

Two things in this package name an event another document's chart is expected to take. A binding names one in its event, and a <send> to the reserved execution target names one in its event and the receiving document in its document param (ADR-0006, section 1). When either name is one the receiving chart never listens for, nothing at run time refuses it: the event is delivered and recorded as delivered, and the receiver's step selects no transition (ADR-0008, decision 5). These functions find it before a chart or a configuration ships.

This package has no publish step and gains none here. A host calls these functions from its own - when it saves a revision, when it compiles a document in CI, when an author presses publish - and an editor calls them at edit time. The host decides whether a finding blocks the publish or only warns (ADR-0008, decision 6). They are pure over their arguments: a resolved StatifierRouter.Config.t/0, a compiled Statifier.Machine.t/0 and the host's lookup, which is the only call that reaches outside them. Nothing here adds a Statifier.Validator finding.

The lookup

The host supplies an arity-1 function from a receiving document id to one of three answers (ADR-0008, decision 2):

• {:ok, names} - the receiver declares these event names. An event is accepted when it is equal, as a string, to one of them. [] is a declaration that accepts nothing.
• {:ok, :undeclared, machine} - the receiver declares nothing, and machine is the chart a new execution of it would start on. Its contract is the engine's computed vocabulary: an event is accepted when Statifier.Chart.check_accepts(machine, [event]) answers unreachable: []. The package never matches descriptors itself.
• {:error, :not_published} - the receiver has no published chart.

Any other answer is the host's fault, and the function raises ArgumentError. The lookup takes no scope: the host builds it over the scope it is publishing into (ADR-0008, decision 2).

The reasons

A finding carries reason, which says which contract refused it (ADR-0008, decisions 2 and 4, and its 2026-09-23 Amendment):

• :undeclared - the receiver declares names and this is not one.
• :undeclared_by_computed_set - the receiver declares nothing, and no reachable transition of its chart matches this name.
• :not_published - the lookup answered {:error, :not_published}.
• :delay - the <send> writes delay or delayexpr. A delayed send to the execution target is never delivered, so the lookup is not asked. A binding has no delay and never carries this reason.

The route findings

check/3 also carries every <send> of the configuration's type that will never be handed to the route its literal target names, under :unregistered_routes, each entry %{route, location, reason} (ADR-0008's 2026-09-24 Amendment):

• :unregistered - the target names no registered route, or the send writes no target: StatifierRouter.Routes.unregistered/2's finding.
• :no_timer_queue - the target names a registered route, the send writes a literal delay, and the configuration has no :timer_queue, so StatifierRouter.SendHandler never queues it and refuses it, as {:no_timer_queue, send_id} once the route resolves. A send to the reserved execution target is never this finding; its delay is a :delay finding above.

The finding reasons are closed

reason/0, and so the three of them a binding_finding/0 carries, and route_reason/0 are closed sets (ADR-0008's 2026-09-24 Amendment). A host may match on them exhaustively. A new reason arrives only with a record that decides it, in a minor release whose changelog names it as breaking.

What cannot be checked

Only a literal can be judged. A send undeclared_events/3 selects but cannot judge is never a finding and never passed silently: it is reported under :unchecked as %{reason: reason, location: location}, the shape StatifierRouter.Routes.unregistered/2's own unchecked entries have (ADR-0008, decision 3). The reasons are :eventexpr, :no_event, :document_expr and :no_document; see unchecked/0. A delayed send that cannot be judged keeps its unchecked entry and is not a :delay finding. A send whose type or target is an expression is not selected here at all: StatifierRouter.Routes.unregistered/2 reports it, and check/3 carries that list once.

A configuration that gives a :bindings_resolver has no bindings check/3 can read, and check/3 never calls the resolver. Its report says so: the first :unchecked entry is %{reason: :bindings_resolver, location: nil}, the one entry with no location (see bindings_unchecked/0), so the report is never the one a clean pass answers (ADR-0008's 2026-09-26 Amendment).

An example

A parcel is scanned from depot to doorstep. The parcel document declares the two events its chart takes, and a third binding routes the depot's missing-parcel report as an event the parcel never declared:

iex> lookup = fn
...>   "parcel" -> {:ok, ["parcel.scanned", "parcel.delivered"]}
...>   _other -> {:error, :not_published}
...> end
iex> {:ok, lost} =
...>   StatifierRouter.Binding.new(
...>     id: "depot_lost",
...>     source: "depot_feed",
...>     match: "event.kind == 'lost'",
...>     key: "event.parcel_id",
...>     document: "parcel",
...>     event: "parcel.lost"
...>   )
iex> StatifierRouter.Contracts.undeclared_binding_events([lost], lookup)
[%{event: "parcel.lost", document: "parcel", binding_id: "depot_lost", reason: :undeclared}]