Phrasing of "It is erroneous" from LCS-2016-004 should be more precise
In section 5.6.2 LCS-2016-004 added the following sentence:
It is erroneous if, after a method completes, a data object internal to a protected type and a data object external to a protected type both have a reference either directly or through a series of references to the same object.
What does "it" refer to here? Presumably the standard is saying that the user's design or protected type method is erroneous (i.e. it's not an error a tool expected to detect). Every other use of "is erroneous" in the LRM specifies exactly what is erroneous and we should do the same here. I suggest following the third paragraph of 4.2.2.2 ("The execution of a subprogram is erroneous if its effect depends on ...") and change the above to:
The execution of a protected type method is erroneous if, after the method completes, a data object internal to a protected type and a data object external to a protected type both have a reference either directly or through a series of references to the same object.