One project, from the first question to a defensible answer.

Several answers in one expression. Most survey tools compare one answer with a fixed value; a QML condition can combine as many answers as the rule needs. And they need not come first in the file: the engine builds a dependency graph from every condition and asks each question only after everything it depends on, so the question below could be written above its four inputs. A genuine loop — A depends on B and B on A — is refused, with the items named.

precondition:
  - predicate: "q1.outcome + q4.outcome > q7.outcome * q6.outcome"

Count as you go. Each statement adds its “Disagree” to a counter; after three, a follow-up block asks why.

codeInit: |
  negatives = 0
# on each statement
codeBlock: |
  if q1.outcome == 3:
      negatives = negatives + 1
# on the follow-up block
precondition:
  - predicate: "negatives >= 3"

Answers that must agree with each other. Nobody has driven longer than they could have held a licence, and a day still has 24 hours:

postcondition:   # on q_drive
  - predicate: "q_drive.outcome <= q_age.outcome - 17"
    hint: "That is longer than you could have held a licence"
postcondition:   # on q_commute
  - predicate: "q_sleep.outcome + q_work.outcome + q_commute.outcome <= 24"

Eligibility rules with real arithmetic. Lung-cancer screening questions only for people aged 50–80 with at least 20 pack-years (packs a day × years smoked):

precondition:
  - predicate: "q_age.outcome >= 50 and q_age.outcome <= 80
                and q_cigs.outcome * q_years.outcome >= 400"

Each is checked like any other condition. Make one impossible — answer ranges where Q1 + Q4 can never exceed Q7 × Q6, an age range that leaves no room for the driving years, minimums that add up to more than 24 hours, too few cigarettes ever to reach 20 pack-years — and the questionnaire is refused before anyone answers it.

Refused at publication: a question no answer can reach, an answer check no answer can satisfy, a condition naming an answer no question produces, a circular dependency, and content that does not load.

Shown as a warning: dead code that only builds up along one path, hygiene findings (a variable written and never read, a duplicated bound), and conditions outside what the solver can decide, which are reported as coverage gaps rather than counted as proven.

Everything is checked against the questionnaire’s formal model, three ways: each item on its own, the whole questionnaire at once, and along every path. The validation hierarchy

• Offered per campaign, with the organiser’s own introduction and consent text
• Real controls in the chat, driven by the same verified flow as the web survey
• The assistant cannot record, change or skip an answer
• Completion is reported by mode, so channels can be compared

• Single — one survey, one persona
• Campaign — the full flow: preparation, execution, analysis
• Mass fill — bulk synthetic data

In the heaviest mode each respondent is a unique persona, and a Claude model answers question by question with the persona, its demographics and the answers so far. The simulated respondent never sees the Research Paper, so it cannot answer toward what the researcher hopes to find.