feat(python): FR-013/014/015 loader validation passes (per-port fan-out)

Ports the three deferred validation passes from the TS reference into the
Python loader, clearing all 10 deferred error fixtures from the Python
conformance ledger.

- FR-013 validate_field_readonly.py — ERR_READONLY_ASSIGNED_PRIMARY,
  ERR_READONLY_DOWNGRADE, WARN_READONLY_VALUE_OBJECT.
- FR-014 validate_discriminator.py — ERR_DISCRIMINATOR_FIELD_NOT_FOUND,
  _VALUE_DUPLICATE, _VALUE_MISSING, _VALUE_TYPE_MISMATCH (4-pass: name
  resolution, value type-check, duplicate detection, missing-on-concrete).
- FR-015 validate_source_parameter_ref.py — ERR_PARAMETER_REF_ON_NON_CALLABLE_KIND
  (checked before resolution), _UNRESOLVED, _NOT_VALUE_OBJECT,
  _PASSTHROUGH_TYPE_MISMATCH.

Wired into run_validations after the FR-016 physical-name pass. Each mirrors
its TS counterpart's logic and error-code/envelope contract exactly (the
conformance corpus is the oracle). Attrs were already registered (positive
round-trips passed); this adds the validation logic.

Conformance: 152/152 green. (The codegen/integration test failures in the
local env are missing-dev-dep issues — ruff, pg8000 — not loader-related.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: dmealing

server/python/src/metaobjects/loader/validate_discriminator.py

@@ -0,0 +1,183 @@
+"""FR-014 — TPH discriminator cross-attribute rules.
+
+Codes (all errors):
+    * ``ERR_DISCRIMINATOR_FIELD_NOT_FOUND``     — ``@discriminator`` names a field
+      that does not exist on the entity (own or via extends chain).
+    * ``ERR_DISCRIMINATOR_VALUE_DUPLICATE``     — two subtypes of the same
+      ``@discriminator``-bearing root claim the same ``@discriminatorValue``.
+    * ``ERR_DISCRIMINATOR_VALUE_MISSING``       — a concrete (non-abstract) entity
+      extends a chain whose root carries ``@discriminator`` but lacks
+      ``@discriminatorValue``.
+    * ``ERR_DISCRIMINATOR_VALUE_TYPE_MISMATCH`` — ``@discriminatorValue`` cannot be
+      coerced to the discriminator field's subtype (enum: not in ``@values``;
+      integer-family: not numeric; string: always OK).
+
+Mirrors the TS reference
+``packages/metadata/src/core/object/validate-discriminator.ts``.
+"""
+from __future__ import annotations
+
+import re
+
+from ..errors import ErrorCode, MetaError
+from ..meta.meta_data import MetaData
+from ..meta.core.field.field_constants import (
+    FIELD_ATTR_VALUES,
+    FIELD_SUBTYPE_BYTE,
+    FIELD_SUBTYPE_ENUM,
+    FIELD_SUBTYPE_INT,
+    FIELD_SUBTYPE_LONG,
+    FIELD_SUBTYPE_SHORT,
+    FIELD_SUBTYPE_STRING,
+)
+from ..meta.core.object.object_constants import (
+    OBJECT_ATTR_DISCRIMINATOR,
+    OBJECT_ATTR_DISCRIMINATOR_VALUE,
+    OBJECT_SUBTYPE_ENTITY,
+)
+from ..shared.base_types import TYPE_FIELD, TYPE_OBJECT
+
+_NUMERIC_DISCRIMINATOR_SUBTYPES = frozenset(
+    {FIELD_SUBTYPE_INT, FIELD_SUBTYPE_LONG, FIELD_SUBTYPE_SHORT, FIELD_SUBTYPE_BYTE}
+)
+_INT_RE = re.compile(r"^-?\d+$")
+
+
+def _find_field_on_entity(entity: MetaData, name: str) -> MetaData | None:
+    """A field with ``name`` on ``entity`` — own first, then via extends chain."""
+    for child in entity.own_children():
+        if child.type == TYPE_FIELD and child.name == name:
+            return child
+    cursor = entity.super_data
+    while cursor is not None:
+        for child in cursor.own_children():
+            if child.type == TYPE_FIELD and child.name == name:
+                return child
+        cursor = cursor.super_data
+    return None
+
+
+def _find_discriminator_root(entity: MetaData) -> tuple[MetaData | None, str | None]:
+    """First ancestor (or self) carrying ``@discriminator``: (root, fieldName)."""
+    cursor: MetaData | None = entity
+    while cursor is not None:
+        v = cursor.attr(OBJECT_ATTR_DISCRIMINATOR)
+        if isinstance(v, str) and v != "":
+            return cursor, v
+        cursor = cursor.super_data
+    return None, None
+
+
+def validate_discriminator(root: MetaData, errors: list[MetaError]) -> None:
+    entities = [
+        c
+        for c in root.own_children()
+        if c.type == TYPE_OBJECT and c.sub_type == OBJECT_SUBTYPE_ENTITY
+    ]
+
+    # Pass 1: @discriminator name resolution (own + inherited fields).
+    for obj in entities:
+        disc = obj.attr(OBJECT_ATTR_DISCRIMINATOR)
+        if not isinstance(disc, str) or disc == "":
+            continue
+        if _find_field_on_entity(obj, disc) is None:
+            errors.append(
+                MetaError(
+                    f'object.entity "{obj.name}" @discriminator: "{disc}" does not '
+                    "name a field on this entity (checked own children and the "
+                    "extends chain)",
+                    ErrorCode.ERR_DISCRIMINATOR_FIELD_NOT_FOUND,
+                    envelope=obj.source,
+                )
+            )
+
+    # Pass 2: @discriminatorValue type-check + collect bindings per root.
+    bindings_by_root: list[tuple[MetaData, list[tuple[MetaData, str]]]] = []
+    _root_index: dict[int, list[tuple[MetaData, str]]] = {}
+
+    for obj in entities:
+        value = obj.attr(OBJECT_ATTR_DISCRIMINATOR_VALUE)
+        if not isinstance(value, str) or value == "":
+            continue
+
+        disc_root, field_name = _find_discriminator_root(obj)
+        if disc_root is None or field_name is None:
+            continue
+        field = _find_field_on_entity(disc_root, field_name)
+        if field is None:
+            continue  # root's own ERR_DISCRIMINATOR_FIELD_NOT_FOUND already fires
+
+        if field.sub_type == FIELD_SUBTYPE_ENUM:
+            enum_values = field.attr(FIELD_ATTR_VALUES)
+            members = [str(v) for v in enum_values] if isinstance(enum_values, (list, tuple)) else []
+            if value not in members:
+                errors.append(
+                    MetaError(
+                        f'object.entity "{obj.name}" @discriminatorValue: "{value}" '
+                        f'is not a member of the discriminator enum field '
+                        f'"{field_name}" @values [{", ".join(members)}]',
+                        ErrorCode.ERR_DISCRIMINATOR_VALUE_TYPE_MISMATCH,
+                        envelope=obj.source,
+                    )
+                )
+        elif field.sub_type in _NUMERIC_DISCRIMINATOR_SUBTYPES:
+            if _INT_RE.match(value) is None:
+                errors.append(
+                    MetaError(
+                        f'object.entity "{obj.name}" @discriminatorValue: "{value}" '
+                        f'does not coerce to numeric discriminator field '
+                        f'"{field_name}" (field.{field.sub_type})',
+                        ErrorCode.ERR_DISCRIMINATOR_VALUE_TYPE_MISMATCH,
+                        envelope=obj.source,
+                    )
+                )
+        elif field.sub_type != FIELD_SUBTYPE_STRING:
+            # Non-{enum, integer-family, string} discriminators accepted silently.
+            pass
+
+        existing = _root_index.get(id(disc_root))
+        if existing is None:
+            existing = []
+            _root_index[id(disc_root)] = existing
+            bindings_by_root.append((disc_root, existing))
+        existing.append((obj, value))
+
+    # Pass 3: ERR_DISCRIMINATOR_VALUE_DUPLICATE within each root's subtypes.
+    for _disc_root, bindings in bindings_by_root:
+        seen: dict[str, MetaData] = {}
+        for subtype, value in bindings:
+            prev = seen.get(value)
+            if prev is not None:
+                errors.append(
+                    MetaError(
+                        f'object.entity "{subtype.name}" @discriminatorValue: '
+                        f'"{value}" duplicates the value already claimed by '
+                        f'"{prev.name}"',
+                        ErrorCode.ERR_DISCRIMINATOR_VALUE_DUPLICATE,
+                        envelope=subtype.source,
+                    )
+                )
+            else:
+                seen[value] = subtype
+
+    # Pass 4: ERR_DISCRIMINATOR_VALUE_MISSING — every concrete entity that extends
+    # a @discriminator-bearing root must declare a value.
+    for obj in entities:
+        if obj.is_abstract is True:
+            continue
+        if isinstance(obj.attr(OBJECT_ATTR_DISCRIMINATOR_VALUE), str):
+            continue
+        if isinstance(obj.attr(OBJECT_ATTR_DISCRIMINATOR), str):
+            continue  # a root, not a subtype
+        disc_root, _ = _find_discriminator_root(obj)
+        if disc_root is None or disc_root is obj:
+            continue
+        errors.append(
+            MetaError(
+                f'object.entity "{obj.name}" extends the @discriminator-bearing '
+                f'root "{disc_root.name}" but is missing @discriminatorValue '
+                "(required on every concrete subtype)",
+                ErrorCode.ERR_DISCRIMINATOR_VALUE_MISSING,
+                envelope=obj.source,
+            )
+        )

server/python/src/metaobjects/loader/validate_field_readonly.py

@@ -0,0 +1,146 @@
+"""FR-013 — field-level ``@readOnly`` cross-attribute rules.
+
+Codes:
+    * ``ERR_READONLY_ASSIGNED_PRIMARY`` — ``@readOnly: true`` on a field that is
+      the target of an ``identity.primary`` with ``@generation: "assigned"``.
+      The application has no path to populate the identity value.
+    * ``ERR_READONLY_DOWNGRADE`` — a concrete subtype declares ``@readOnly:
+      false`` on a field whose extends-chain parent declares ``@readOnly: true``.
+      Read-only-ness can only be upgraded, never downgraded.
+    * ``WARN_READONLY_VALUE_OBJECT`` — ``@readOnly: true`` on a field child of an
+      ``object.value``. No persistence semantics apply; advisory only.
+
+Mirrors the TS reference
+``packages/metadata/src/core/field/validate-field-readonly.ts``.
+"""
+from __future__ import annotations
+
+from ..errors import ErrorCode, MetaError
+from ..meta.meta_data import MetaData
+from ..meta.core.field.field_constants import FIELD_ATTR_READ_ONLY
+from ..meta.core.identity.identity_constants import (
+    GENERATION_ASSIGNED,
+    IDENTITY_ATTR_FIELDS,
+    IDENTITY_ATTR_GENERATION,
+    IDENTITY_SUBTYPE_PRIMARY,
+)
+from ..meta.core.object.object_constants import OBJECT_SUBTYPE_VALUE
+from ..shared.base_types import TYPE_FIELD, TYPE_IDENTITY, TYPE_OBJECT
+from ..source.error_source import LoaderWarning
+
+WARN_READONLY_VALUE_OBJECT = "WARN_READONLY_VALUE_OBJECT"
+
+
+def _read_only_flag(field: MetaData) -> bool | None:
+    """The explicit ``@readOnly`` value (True/False) or None when absent."""
+    v = field.attr(FIELD_ATTR_READ_ONLY)
+    return v if isinstance(v, bool) else None
+
+
+def _inherited_field(obj: MetaData, name: str) -> MetaData | None:
+    """Walk the extends chain for a field with ``name``; return its declaring
+    node (own attrs intact) if found."""
+    cursor = obj.super_data
+    while cursor is not None:
+        for c in cursor.own_children():
+            if c.type == TYPE_FIELD and c.name == name:
+                return c
+        cursor = cursor.super_data
+    return None
+
+
+def _primary_assigned_field_names(obj: MetaData) -> set[str]:
+    """Names of fields participating in any ``identity.primary`` with
+    ``@generation: "assigned"`` on ``obj`` or its extends chain (effective)."""
+    out: set[str] = set()
+    for ident in obj.children():
+        if ident.type != TYPE_IDENTITY:
+            continue
+        if ident.sub_type != IDENTITY_SUBTYPE_PRIMARY:
+            continue
+        if ident.attr(IDENTITY_ATTR_GENERATION) != GENERATION_ASSIGNED:
+            continue
+        fields = ident.attr(IDENTITY_ATTR_FIELDS)
+        if isinstance(fields, (list, tuple)):
+            for f_name in fields:
+                if isinstance(f_name, str):
+                    out.add(f_name)
+        elif isinstance(fields, str):
+            out.add(fields)
+    return out
+
+
+def validate_field_readonly(
+    root: MetaData,
+    errors: list[MetaError],
+    envelope_warnings: list[LoaderWarning] | None = None,
+    legacy_warnings: list[str] | None = None,
+) -> None:
+    for obj in root.own_children():
+        if obj.type != TYPE_OBJECT:
+            continue
+        is_value_object = obj.sub_type == OBJECT_SUBTYPE_VALUE
+
+        # 1) WARN_READONLY_VALUE_OBJECT — any @readOnly field child of object.value.
+        if is_value_object:
+            for child in obj.own_children():
+                if child.type == TYPE_FIELD and _read_only_flag(child) is True:
+                    msg = (
+                        f'field "{child.name}" on object.value "{obj.name}" '
+                        "declares @readOnly: true; value-objects have no "
+                        "persistence semantics so the read-only contract is "
+                        "advisory (codegen may use it for record/struct treatment)."
+                    )
+                    if envelope_warnings is not None:
+                        envelope_warnings.append(
+                            LoaderWarning(
+                                code=WARN_READONLY_VALUE_OBJECT,
+                                message=msg,
+                                source=child.source,
+                            )
+                        )
+                    if legacy_warnings is not None:
+                        legacy_warnings.append(WARN_READONLY_VALUE_OBJECT)
+
+        # 2) ERR_READONLY_DOWNGRADE — read-only-ness can only be upgraded across
+        #    extends. Only the explicit own @readOnly: false case matters.
+        for own_field in obj.own_children():
+            if own_field.type != TYPE_FIELD:
+                continue
+            if _read_only_flag(own_field) is not False:
+                continue
+            inherited = _inherited_field(obj, own_field.name)
+            if inherited is not None and _read_only_flag(inherited) is True:
+                errors.append(
+                    MetaError(
+                        f'field "{own_field.name}" on "{obj.name}" sets @readOnly: '
+                        "false, but the extends-chain parent declares @readOnly: "
+                        "true. Read-only-ness can only be upgraded, not downgraded "
+                        "(FR-013).",
+                        ErrorCode.ERR_READONLY_DOWNGRADE,
+                        envelope=own_field.source,
+                    )
+                )
+
+        # 3) ERR_READONLY_ASSIGNED_PRIMARY — @readOnly: true on a field used in an
+        #    identity.primary whose @generation is "assigned" (effective tree).
+        if not is_value_object:
+            assigned = _primary_assigned_field_names(obj)
+            if assigned:
+                for field in obj.children():
+                    if field.type != TYPE_FIELD:
+                        continue
+                    if field.name not in assigned:
+                        continue
+                    if _read_only_flag(field) is not True:
+                        continue
+                    errors.append(
+                        MetaError(
+                            f'field "{field.name}" on "{obj.name}" is @readOnly: '
+                            "true AND the target of identity.primary with "
+                            '@generation: "assigned"; the application has no path '
+                            "to populate the identity value (FR-013).",
+                            ErrorCode.ERR_READONLY_ASSIGNED_PRIMARY,
+                            envelope=field.source,
+                        )
+                    )