[matt-edmondson]

Fixes #55

What was wrong

RequirementRuleCompiler.SelectDeserializationConstructor looked only at type.GetConstructors(), which returns public constructors only. System.Text.Json 8.0 and later also honour [JsonConstructor] on a private or internal constructor, which is the usual shape of an immutable model. For such a type:

• Its get-only properties never counted as constructor-bound, so the holder was never claimed.
• Each decorated child was then validated on its own.
• Violations lost their path prefix: Tuning instead of Child.Tuning.
• Only the first failing child was reported: B.Tuning never appeared next to A.Tuning.

Fix

• SelectDeserializationConstructor now also searches non-public instance constructors for [JsonConstructor], but only when the running System.Text.Json honours them.
• That is decided by a one-time runtime probe, NonPublicJsonConstructorSupport. It deserializes a private type whose only constructor is a private [JsonConstructor]. The library uses no conditional compilation, so a runtime check is the only option. net7.0's in-box System.Text.Json ignores such constructors, so it keeps the old public-only behaviour.
• The probe uses the existing FieldAwareProbeOptions, which carry an explicit DefaultJsonTypeInfoResolver, so it does not depend on reflection being enabled by default.
• The method's remarks, which called this a known divergence, are rewritten. CLAUDE.md is updated to match.

Tests

Three new tests in EligibilityTests, as the issue's acceptance criteria ask:

• A class with a private [JsonConstructor] reports Child.Tuning.
• A class with an internal two-parameter [JsonConstructor] reports both A.Tuning and B.Tuning in one exception.
• A struct with a private [JsonConstructor] reports Child.Tuning.

Results:

• Before the fix: all three fail as the issue describes. Two return ["Tuning"] instead of ["Child.Tuning"], and one returns ["Tuning"] instead of ["A.Tuning", "B.Tuning"].
• After the fix: all three pass. The full suite passes 278/278 on the net10.0 leg.
• Not run here: the net9.0 and net8.0 legs (this container has only the .NET 10 runtime), and the net7.0 path where the probe answers false. CI runs net10.0, net9.0 and net8.0.
• Release build: all six library target frameworks build clean.

This touches the same method that #44 changed earlier, through #71 (constructor chosen from the deserialized type). That change is already on main, and this one builds on it.

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud