test(metamodel): pin the @mutability tightening order in the three ports that never had one

`@mutability` is ranked by `indexOf` over a per-port `MUTABILITY_MODES` list —
declaration order IS the tightening order — and only TypeScript pinned that
order. The shared corpus could not stand in for the missing pins: its
inheritance fixtures pair `readOnly` with `readWrite`, the two ENDPOINTS, so a
full reversal is caught while a reorder that moves ONLY `writeOnce` is
invisible. Every port's declaration is currently correct; this is a missing
gate, not a live bug.

Closes the behavioural half cross-port with a corpus fixture whose downgrade
runs through the middle mode, and the structural half with an order pin in each
port that reads the array. Each new gate was proved by breaking the order and
watching it go red — under the break the EXISTING fixture still passed while
this one failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhpswkF1NvwxhFWMmdAT15

Author: dmealing

fixtures/conformance/error-field-mutability-downgrade-writeonce/expected-errors.json

@@ -0,0 +1,15 @@
+{
+  "errors": [
+    {
+      "code": "ERR_MUTABILITY_DOWNGRADE",
+      "source": {
+        "format": "json",
+        "files": [
+          "meta.demo.json"
+        ],
+        "jsonPath": "$['metadata.root'].children[1]['object.entity'].children[2]['field.string']"
+      }
+    }
+  ],
+  "warnings": []
+}

fixtures/conformance/error-field-mutability-downgrade-writeonce/input/meta.demo.json

@@ -0,0 +1,51 @@
+{
+  "metadata.root": {
+    "package": "demo",
+    "children": [
+      {
+        "object.entity": {
+          "name": "BaseEntity",
+          "abstract": true,
+          "children": [
+            {
+              "field.string": {
+                "name": "issuedCurrency",
+                "@mutability": "readOnly"
+              }
+            }
+          ]
+        }
+      },
+      {
+        "object.entity": {
+          "name": "Loosener",
+          "extends": "demo::BaseEntity",
+          "children": [
+            {
+              "source.rdb": {
+                "@table": "looseners"
+              }
+            },
+            {
+              "field.long": {
+                "name": "id"
+              }
+            },
+            {
+              "field.string": {
+                "name": "issuedCurrency",
+                "@mutability": "writeOnce"
+              }
+            },
+            {
+              "identity.primary": {
+                "name": "id",
+                "@fields": "id"
+              }
+            }
+          ]
+        }
+      }
+    ]
+  }
+}

fixtures/conformance/error-field-mutability-downgrade-writeonce/providers.json

@@ -0,0 +1 @@
+["metaobjects-core-types","metaobjects-db"]

server/csharp/MetaObjects.Conformance.Tests/Fr037MutabilityOrderTests.cs

@@ -0,0 +1,57 @@
+// FR-037 R1 — the @mutability tightening order is load-bearing, so it is pinned.
+//
+// ValidationPasses.MutabilityRank() is an INDEX comparison over
+// FieldConstants.MUTABILITY_MODES ("declaration order IS the tightening order", as the
+// constant's own doc comment says), so reordering that array silently inverts "may only
+// tighten" with nothing to catch it.
+//
+// The shared conformance corpus cannot stand in for this. Its inheritance fixtures pair
+// only readOnly with readWrite — the two ENDPOINTS — so a full reversal is caught but a
+// reorder that moves ONLY writeOnce is not. The corpus fixture
+// error-field-mutability-downgrade-writeonce closes the behavioural half cross-port; this
+// closes the structural half in the port whose rank function reads the array.
+//
+// Mirrors the TypeScript pin (metadata/test/fr037-field-mutability.test.ts), which was the
+// only such pin in any port until now.
+
+using MetaObjects.Core.Field;
+using Xunit;
+
+namespace MetaObjects.Conformance.Tests;
+
+public class Fr037MutabilityOrderTests
+{
+    [Fact]
+    public void DeclarationOrderIsTheTighteningOrder()
+    {
+        // Loosest first. The downgrade rule is rank(child) >= rank(parent), so this
+        // order IS the rule.
+        Assert.Equal(
+            new[] { "readWrite", "writeOnce", "readOnly" },
+            FieldConstants.MUTABILITY_MODES);
+    }
+
+    [Fact]
+    public void ModeSpellings()
+    {
+        // The wire spellings travel cross-port; a typo here is a silent divergence.
+        Assert.Equal("readWrite", FieldConstants.MUTABILITY_READ_WRITE);
+        Assert.Equal("writeOnce", FieldConstants.MUTABILITY_WRITE_ONCE);
+        Assert.Equal("readOnly", FieldConstants.MUTABILITY_READ_ONLY);
+    }
+
+    /// <summary>
+    /// The specific relationship the corpus never exercises. Stated as an explicit rank
+    /// comparison rather than inferred from the array above, so a future change that keeps
+    /// the array's CONTENTS but alters how rank is derived still fails here.
+    /// </summary>
+    [Fact]
+    public void WriteOnceRanksBetweenTheTwoEndpoints()
+    {
+        int readWrite = System.Array.IndexOf(FieldConstants.MUTABILITY_MODES, FieldConstants.MUTABILITY_READ_WRITE);
+        int writeOnce = System.Array.IndexOf(FieldConstants.MUTABILITY_MODES, FieldConstants.MUTABILITY_WRITE_ONCE);
+        int readOnly = System.Array.IndexOf(FieldConstants.MUTABILITY_MODES, FieldConstants.MUTABILITY_READ_ONLY);
+        Assert.True(readWrite < writeOnce, "readWrite must rank looser than writeOnce");
+        Assert.True(writeOnce < readOnly, "writeOnce must rank looser than readOnly");
+    }
+}

server/java/metadata/src/test/java/com/metaobjects/field/FieldMutabilityOrderTest.java

@@ -0,0 +1,60 @@
+package com.metaobjects.field;
+
+import org.junit.Test;
+
+import java.util.Arrays;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * FR-037 R1 — the {@code @mutability} tightening order is load-bearing, so it is pinned.
+ *
+ * <p>{@code ValidationPhase.mutabilityRank()} is an INDEX comparison over
+ * {@link MetaField#MUTABILITY_MODES} ("declaration order IS the tightening order", as the
+ * constant's own javadoc says), so reordering that list silently inverts "may only tighten"
+ * with nothing to catch it. Kotlin inherits this same constant through the JVM loader, so
+ * this pin covers both JVM ports.
+ *
+ * <p>The shared conformance corpus cannot stand in for this. Its inheritance fixtures pair
+ * only {@code readOnly} with {@code readWrite} — the two ENDPOINTS — so a full reversal is
+ * caught but a reorder that moves ONLY {@code writeOnce} is not.
+ * {@code error-field-mutability-downgrade-writeonce} closes the behavioural half cross-port;
+ * this closes the structural half in the port whose rank function reads the list.
+ *
+ * <p>Mirrors the TypeScript pin (metadata/test/fr037-field-mutability.test.ts), which was the
+ * only such pin in any port until now.
+ */
+public class FieldMutabilityOrderTest {
+
+    @Test
+    public void declarationOrderIsTheTighteningOrder() {
+        // Loosest first. The downgrade rule is rank(child) >= rank(parent), so this
+        // order IS the rule.
+        assertEquals(
+                Arrays.asList("readWrite", "writeOnce", "readOnly"),
+                MetaField.MUTABILITY_MODES);
+    }
+
+    @Test
+    public void modeSpellings() {
+        // The wire spellings travel cross-port; a typo here is a silent divergence.
+        assertEquals("readWrite", MetaField.MUTABILITY_READ_WRITE);
+        assertEquals("writeOnce", MetaField.MUTABILITY_WRITE_ONCE);
+        assertEquals("readOnly", MetaField.MUTABILITY_READ_ONLY);
+    }
+
+    /**
+     * The specific relationship the corpus never exercises. Stated as an explicit rank
+     * comparison rather than inferred from the list above, so a future change that keeps the
+     * list's CONTENTS but alters how rank is derived still fails here.
+     */
+    @Test
+    public void writeOnceRanksBetweenTheTwoEndpoints() {
+        int readWrite = MetaField.MUTABILITY_MODES.indexOf(MetaField.MUTABILITY_READ_WRITE);
+        int writeOnce = MetaField.MUTABILITY_MODES.indexOf(MetaField.MUTABILITY_WRITE_ONCE);
+        int readOnly = MetaField.MUTABILITY_MODES.indexOf(MetaField.MUTABILITY_READ_ONLY);
+        assertTrue("readWrite must rank looser than writeOnce", readWrite < writeOnce);
+        assertTrue("writeOnce must rank looser than readOnly", writeOnce < readOnly);
+    }
+}

server/python/tests/loader/test_field_mutability_order.py

@@ -0,0 +1,46 @@
+"""FR-037 R1 — the ``@mutability`` tightening order is load-bearing, so it is pinned.
+
+``_rank()`` in ``loader/validate_field_mutability.py`` is an INDEX comparison over
+``MUTABILITY_MODES`` ("declaration order IS the order", as its own docstring says), so
+reordering that tuple silently inverts "may only tighten" with nothing to catch it.
+
+The shared conformance corpus cannot stand in for this pin. Its inheritance fixtures pair
+only ``readOnly`` with ``readWrite`` — the two ENDPOINTS — so a full reversal is caught but
+a reorder that moves ONLY ``writeOnce`` is not. ``error-field-mutability-downgrade-writeonce``
+closes the behavioural half cross-port; this closes the structural half in the port whose
+rank function reads the tuple.
+
+Mirrors the TypeScript pin (``metadata/test/fr037-field-mutability.test.ts`` — "declaration
+order IS the tightening order"), which was the only such pin in any port until now.
+"""
+
+from metaobjects.meta.core.field.field_constants import (
+    MUTABILITY_MODES,
+    MUTABILITY_READ_ONLY,
+    MUTABILITY_READ_WRITE,
+    MUTABILITY_WRITE_ONCE,
+)
+
+
+def test_mutability_modes_declaration_order_is_the_tightening_order() -> None:
+    # Loosest first. The downgrade rule is `rank(child) >= rank(parent)`, so this
+    # order is the rule.
+    assert tuple(MUTABILITY_MODES) == ("readWrite", "writeOnce", "readOnly")
+
+
+def test_mutability_mode_spellings() -> None:
+    # The wire spellings travel cross-port; a typo here is a silent divergence.
+    assert MUTABILITY_READ_WRITE == "readWrite"
+    assert MUTABILITY_WRITE_ONCE == "writeOnce"
+    assert MUTABILITY_READ_ONLY == "readOnly"
+
+
+def test_write_once_ranks_between_the_two_endpoints() -> None:
+    """The specific relationship the corpus never exercises.
+
+    Stated as an explicit rank comparison rather than inferred from the tuple above, so
+    that a future change which keeps the tuple's CONTENTS but alters how rank is derived
+    still fails here.
+    """
+    rank = list(MUTABILITY_MODES).index
+    assert rank(MUTABILITY_READ_WRITE) < rank(MUTABILITY_WRITE_ONCE) < rank(MUTABILITY_READ_ONLY)