metaobjects 0.16.0__tar.gz → 0.18.0__tar.gz

{metaobjects-0.16.0 → metaobjects-0.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metaobjects
-Version: 0.16.0
+Version: 0.18.0
 Summary: Cross-language metadata standard: declare typed entities once, generate idiomatic drift-checked code across languages — Python port.
 Project-URL: Homepage, https://metaobjects.dev
 Project-URL: Repository, https://github.com/metaobjectsdev/metaobjects

{metaobjects-0.16.0 → metaobjects-0.18.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "metaobjects"
-version = "0.16.0"
+version = "0.18.0"
 description = "Cross-language metadata standard: declare typed entities once, generate idiomatic drift-checked code across languages — Python port."
 readme = "README.md"
 requires-python = ">=3.11"

{metaobjects-0.16.0 → metaobjects-0.18.0}/src/metaobjects/codegen/generators/entity_model.py

@@ -14,7 +14,14 @@ from metaobjects.meta.core.identity.identity_constants import (
     IDENTITY_ATTR_GENERATION,
 )
 from metaobjects.meta.core.validator import validator_constants as vc
-from metaobjects.shared.base_types import TYPE_VALIDATOR
+from metaobjects.meta.persistence.origin.origin_constants import (
+    AGG_ALL,
+    AGG_ANY,
+    AGG_COLLECT,
+    ORIGIN_ATTR_AGG,
+    ORIGIN_SUBTYPE_AGGREGATE,
+)
+from metaobjects.shared.base_types import TYPE_ORIGIN, TYPE_VALIDATOR
 from metaobjects.shared.separators import PACKAGE_SEP
 from metaobjects.codegen.config import GenConfig
 from metaobjects.codegen.constants import generated_header
@@ -221,6 +228,22 @@ def _type_expr_for_field(
     return type_expr, enum_type_name
 
 
+def origin_guaranteed_non_null(field: MetaField) -> bool:
+    """#195 — a field derived by an origin.aggregate ``@agg:any|all|collect`` is
+    COALESCE-guaranteed non-null in the synthesized view (any→false, all→true,
+    collect→[]), so its read type is non-null even when the field is not ``@required``.
+    origin.first is deliberately NOT here — an empty related set selects no row (→ null);
+    origin.computed nullability is expression-dependent, so it stays the conservative
+    nullable default. Mirrors the TS originGuaranteedNonNull."""
+    # ADR-0039 sanctioned own — origin.* never inherits (ADR-0029), so own is correct.
+    for child in field.own_children():
+        if child.type == TYPE_ORIGIN and child.sub_type == ORIGIN_SUBTYPE_AGGREGATE:
+            agg = child.attr(ORIGIN_ATTR_AGG)  # ADR-0039 own — origin attr
+            if agg in (AGG_ANY, AGG_ALL, AGG_COLLECT):
+                return True
+    return False
+
+
 def _field_line(field: MetaField, imports: set[str], config: GenConfig) -> tuple[str, bool]:
     """Return (source line, uses_field). Collects required imports into *imports*."""
     type_expr, enum_type_name = _type_expr_for_field(field, imports, config)
@@ -243,15 +266,20 @@ def _field_line(field: MetaField, imports: set[str], config: GenConfig) -> tuple
     else:
         default_expr = None
 
-    # A field is Optional only when it is neither required nor carries a @default.
-    annotation = type_expr if (required or has_default) else f"{type_expr} | None"
+    # #195 — a field derived by an origin.aggregate any|all|collect always COALESCEs
+    # to a value (any→false, all→true, collect→[]), so its read type is mandatory
+    # non-null exactly like a @required field (no `| None`, no default). origin.first /
+    # origin.computed stay the conservative nullable default.
+    mandatory = required or origin_guaranteed_non_null(field)
+    # A field is Optional only when it is neither mandatory nor carries a @default.
+    annotation = type_expr if (mandatory or has_default) else f"{type_expr} | None"
     if has_default and uses_field:
         assignment = f" = Field(default={default_expr}, {', '.join(parts)})"
     elif has_default:
         assignment = f" = {default_expr}"
-    elif required and uses_field:
+    elif mandatory and uses_field:
         assignment = f" = Field({', '.join(parts)})"
-    elif required:
+    elif mandatory:
         assignment = ""
     elif uses_field:
         assignment = f" = Field(default=None, {', '.join(parts)})"
@@ -468,6 +496,8 @@ class EntityModelGenerator:
                 continue  # FR-036 #2 — a server-generated PK is never in the create body
             if f.attrs().get(fc.FIELD_ATTR_READ_ONLY) is True:
                 continue  # FR-013 — a read-only column is DB/owner-written, not create input
+            if f.is_derived():
+                continue  # FR-024 §7 (#214) — a derived (origin.*) field is view-computed, not create input
             line, used = _create_field_line(f, imports, cfg)
             uses_field = uses_field or used
             lines.append(line)
@@ -501,6 +531,8 @@ class EntityModelGenerator:
         for f in entity.fields():
             if f.name in pk_fields:
                 continue  # FR-036 #4 — the PK is route-authoritative, never patched
+            if f.is_derived():
+                continue  # FR-024 §7 (#214) — a derived (origin.*) field is view-computed, never patched
             line, used = _patch_field_line(f, imports, cfg)
             uses_field = uses_field or used
             lines.append(line)

{metaobjects-0.16.0 → metaobjects-0.18.0}/src/metaobjects/codegen/generators/filter_allowlist_generator.py

@@ -250,7 +250,12 @@ class FilterAllowlistGenerator:
         src = _primary_source_rdb(entity)
         if src is None:
             return None
-        if src.effective_kind() != SOURCE_KIND_TABLE:
+        # FR-024 §7 (#214): a write-through entity read-view is writable and its generated
+        # router imports this allowlist — so it MUST be emitted for write-through regardless of
+        # source declaration order (matching the router gate; else a view-source-first
+        # write-through router imports a never-generated module and FastAPI startup crashes). A
+        # projection (read-only source only) is not write-through, so it still skips.
+        if not entity.is_write_through() and src.effective_kind() != SOURCE_KIND_TABLE:
             return None
 
         short_name = entity.name

{metaobjects-0.16.0 → metaobjects-0.18.0}/src/metaobjects/codegen/generators/router_generator.py

@@ -645,7 +645,12 @@ class RouterGenerator:
         src = _primary_source_rdb(entity)
         if src is None:
             return None
-        if src.effective_kind() != SOURCE_KIND_TABLE:
+        # FR-024 §7 (#214): a write-through entity read-view is writable (owns a table
+        # source) and MUST emit its CRUD router regardless of source declaration order —
+        # the first-source gate below would wrongly skip a view-source-first write-through
+        # entity. Reads route to the replica view in the ObjectManager (not here). A
+        # projection (read-only source only) is not write-through, so it still skips.
+        if not entity.is_write_through() and src.effective_kind() != SOURCE_KIND_TABLE:
             return None
 
         # FR-017 TPH: a discriminator base emits a polymorphic collection at the base

{metaobjects-0.16.0 → metaobjects-0.18.0}/src/metaobjects/core_types.py

@@ -6,6 +6,7 @@ from .attr_class_map import attr_class_for
 from .meta.core.attr import meta_attr as _attr  # noqa: F401
 from .meta.core.attr.attr_constants import (
     ATTR_SUBTYPE_BOOLEAN,
+    ATTR_SUBTYPE_EXPRESSION,
     ATTR_SUBTYPE_FILTER,
     ATTR_SUBTYPE_INT,
     ATTR_SUBTYPE_STRING,
@@ -55,6 +56,7 @@ from .meta.core.object.meta_object import MetaObject
 from .meta.core.object.object_constants import (
     OBJECT_ATTR_DISCRIMINATOR,
     OBJECT_ATTR_DISCRIMINATOR_VALUE,
+    OBJECT_PROJECTION_ATTR_FILTER,
     OBJECT_SUBTYPE_ENTITY,
     OBJECT_SUBTYPE_PROJECTION,
     OBJECT_SUBTYPES,
@@ -77,12 +79,17 @@ from .meta.persistence.origin.meta_origin import MetaOrigin
 from .meta.persistence.origin.origin_constants import (
     ORIGIN_ATTR_AGG,
     ORIGIN_ATTR_CONVERT,
+    ORIGIN_ATTR_DISTINCT,
+    ORIGIN_ATTR_EXPR,
     ORIGIN_ATTR_FILTER,
     ORIGIN_ATTR_FROM,
     ORIGIN_ATTR_OF,
+    ORIGIN_ATTR_ORDER_BY,
     ORIGIN_ATTR_VIA,
     ORIGIN_SUBTYPE_AGGREGATE,
     ORIGIN_SUBTYPE_COLLECTION,
+    ORIGIN_SUBTYPE_COMPUTED,
+    ORIGIN_SUBTYPE_FIRST,
     ORIGIN_SUBTYPE_PASSTHROUGH,
 )
 from .meta.template.meta_template import MetaTemplate
@@ -96,7 +103,9 @@ from .meta.persistence.source.source_constants import (
     SOURCE_ATTR_PROC,
     SOURCE_ATTR_ROLE,
     SOURCE_ATTR_SCHEMA,
+    SOURCE_ATTR_SQL,
     SOURCE_ATTR_TABLE,
+    SOURCE_ATTR_UNMANAGED,
     SOURCE_ATTR_VIEW,
     SOURCE_RDB_KINDS,
     SOURCE_ROLES,
@@ -253,6 +262,26 @@ for _obj_sub in OBJECT_SUBTYPES:
         )
     )
 
+# #207 — object.projection carries an optional row-scope @filter (a portable
+# attr.filter object — the SAME attr subtype as origin.aggregate's @filter) that
+# lowers to a view-level SQL WHERE. The object loop above registered every subtype
+# with the shared discriminator attrs; append @filter to the projection def
+# (mirrors the field.currency enrichment below, and the TS object provider, where
+# object.json's projection block declares the filter attr child). The strict
+# per-subtype attr scoping (apply_spec_descriptions) then keeps @filter on
+# projection and prunes the shared discriminator attrs — object.json's projection
+# block declares ONLY @filter.
+for _def in core_provider._defs:  # noqa: SLF001 (provider build-time enrichment)
+    if _def.type == TYPE_OBJECT and _def.sub_type == OBJECT_SUBTYPE_PROJECTION:
+        _def.attrs.append(
+            AttrSchema(
+                name=OBJECT_PROJECTION_ATTR_FILTER,
+                value_type=ATTR_SUBTYPE_FILTER,
+                required=False,
+            )
+        )
+        break
+
 # field.* (one factory, data_type by subtype)
 # Note: FIELD_SUBTYPE_ENUM is excluded from FIELD_SUBTYPES; it is registered
 # separately below with its required @values AttrSchema (sharing these child rules).
@@ -591,6 +620,9 @@ core_provider.add(
                 allowed_values=SOURCE_ROLES,
             ),
             AttrSchema(name=SOURCE_ATTR_SCHEMA, value_type=ATTR_SUBTYPE_STRING, required=False),
+            # FR-024/#208 escape valves — registration only, no validation/lowering here.
+            AttrSchema(name=SOURCE_ATTR_SQL, value_type=ATTR_SUBTYPE_STRING, required=False),
+            AttrSchema(name=SOURCE_ATTR_UNMANAGED, value_type=ATTR_SUBTYPE_BOOLEAN, required=False),
             # FR-015 — @parameterRef: input-shape object.value for proc/table-function sources.
             AttrSchema(
                 name=SOURCE_ATTR_PARAMETER_REF,
@@ -628,13 +660,13 @@ core_provider.add(
     )
 )
 
-# origin.aggregate — @agg + @of required; @agg has allowed values.
-# FR-024 (ADR-0029): @via flipped REQUIRED → OPTIONAL — it is inferable when
-# exactly one single-hop relationship reaches the @of entity (the inference
-# PASS itself is Phase-E validation parity). The cross-port manifest still
-# records the pre-flip required:true via the registry_manifest FR024_PENDING
-# required-override until the atomic all-ports manifest flip.
-_AGG_ALLOWED = ("count", "sum", "avg", "min", "max")
+# origin.aggregate — @agg required; @of/@via/@distinct/@orderBy optional.
+# FR-024 (ADR-0029): @via is inferable when exactly one single-hop relationship
+# reaches the @of entity. #195: @of relaxed to optional (any/all forbid it, the
+# rest require it) — presence is enforced per-@agg in the origin validation pass;
+# @agg vocabulary extended with any/all (predicate quantifiers) + collect (array
+# rollup); @distinct (collect set-semantics) + @orderBy (element/row ordering) added.
+_AGG_ALLOWED = ("count", "sum", "avg", "min", "max", "any", "all", "collect")
 core_provider.add(
     TypeDefinition(
         type=TYPE_ORIGIN,
@@ -647,8 +679,41 @@ core_provider.add(
                 required=True,
                 allowed_values=_AGG_ALLOWED,
             ),
+            AttrSchema(name=ORIGIN_ATTR_OF, value_type=ATTR_SUBTYPE_STRING, required=False),
+            AttrSchema(name=ORIGIN_ATTR_VIA, value_type=ATTR_SUBTYPE_STRING, required=False),
+            AttrSchema(name=ORIGIN_ATTR_FILTER, value_type=ATTR_SUBTYPE_FILTER, required=False),
+            AttrSchema(name=ORIGIN_ATTR_DISTINCT, value_type=ATTR_SUBTYPE_BOOLEAN, required=False),
+            AttrSchema(name=ORIGIN_ATTR_ORDER_BY, value_type=ATTR_SUBTYPE_STRING, required=False, is_array=True),
+        ],
+        child_rules=[ChildRule(TYPE_ATTR, "*")],
+    )
+)
+
+# origin.computed (#195) — a row-level value from the base entity's own fields
+# via a structured @expr tree (attr.expression). No related rows / @via.
+core_provider.add(
+    TypeDefinition(
+        type=TYPE_ORIGIN,
+        sub_type=ORIGIN_SUBTYPE_COMPUTED,
+        factory=MetaOrigin,
+        attrs=[
+            AttrSchema(name=ORIGIN_ATTR_EXPR, value_type=ATTR_SUBTYPE_EXPRESSION, required=True),
+        ],
+        child_rules=[ChildRule(TYPE_ATTR, "*")],
+    )
+)
+
+# origin.first (#195) — the single related row selected by @orderBy along @via,
+# projecting @of. @of + @orderBy required; @via + @filter optional.
+core_provider.add(
+    TypeDefinition(
+        type=TYPE_ORIGIN,
+        sub_type=ORIGIN_SUBTYPE_FIRST,
+        factory=MetaOrigin,
+        attrs=[
             AttrSchema(name=ORIGIN_ATTR_OF, value_type=ATTR_SUBTYPE_STRING, required=True),
             AttrSchema(name=ORIGIN_ATTR_VIA, value_type=ATTR_SUBTYPE_STRING, required=False),
+            AttrSchema(name=ORIGIN_ATTR_ORDER_BY, value_type=ATTR_SUBTYPE_STRING, required=True, is_array=True),
             AttrSchema(name=ORIGIN_ATTR_FILTER, value_type=ATTR_SUBTYPE_FILTER, required=False),
         ],
         child_rules=[ChildRule(TYPE_ATTR, "*")],

{metaobjects-0.16.0 → metaobjects-0.18.0}/src/metaobjects/errors.py

@@ -60,6 +60,13 @@ class ErrorCode(str, Enum):
     # is to-one at every hop (you meant passthrough).
     ERR_AMBIGUOUS_PATH = "ERR_AMBIGUOUS_PATH"
     ERR_ORIGIN_CARDINALITY = "ERR_ORIGIN_CARDINALITY"
+    # #195 — origin.computed @expr validation. ERR_UNKNOWN_EXPR_NODE: the expression
+    # tree contains a node whose kind/op/fn is not in the closed grammar (fail-closed
+    # per ADR-0023). ERR_COMPUTED_TYPE_MISMATCH: the @expr tree's inferred root type
+    # does not equal the carrying field's declared field.<subType> (a computed column's
+    # type is DERIVED from its expression, never asserted — no @convert escape).
+    ERR_UNKNOWN_EXPR_NODE = "ERR_UNKNOWN_EXPR_NODE"
+    ERR_COMPUTED_TYPE_MISMATCH = "ERR_COMPUTED_TYPE_MISMATCH"
     # FR-024 B6 — extends/origin agreement + derived-field providability. Vocabulary-
     # only here until FR-024 Phase E (the Python loader does not run these checks yet):
     # ERR_EXTENDS_ORIGIN_MISMATCH — a field's entity-nested extends (shape lineage)
@@ -156,6 +163,20 @@ class ErrorCode(str, Enum):
     # the validate()-time structural enforcement is the next sub-step).
     ERR_CHILD_NOT_ALLOWED = "ERR_CHILD_NOT_ALLOWED"
     ERR_INVALID_METAMODEL_CONSTRAINT = "ERR_INVALID_METAMODEL_CONSTRAINT"
+    # #208 — DDL-ownership escape valves (source.rdb @sql / @unmanaged).
+    # ERR_SQL_BODY_WITH_UNMANAGED: @sql AND @unmanaged declared on the SAME
+    # source — the two mutually exclusive non-default DDL-ownership states.
+    # ERR_SQL_BODY_ON_WRITABLE_KIND: @sql set on a writable @kind ("table", the
+    # default) — @sql is legal only on a read-only kind; a writable table is
+    # either fully modeled or @unmanaged, never opaque-bodied.
+    # ERR_ORIGIN_UNDER_SQL_BODY: an origin.*-bearing (derived) own field, or an
+    # object.projection @filter (#207), under an @sql host — two sources of
+    # truth for the same body. (R6's WARN_ORIGIN_UNDER_UNMANAGED sibling — an
+    # origin.*-bearing field under an @unmanaged host — is a warning, not an
+    # error code; it lives in the envelope-warnings channel.)
+    ERR_SQL_BODY_WITH_UNMANAGED = "ERR_SQL_BODY_WITH_UNMANAGED"
+    ERR_SQL_BODY_ON_WRITABLE_KIND = "ERR_SQL_BODY_ON_WRITABLE_KIND"
+    ERR_ORIGIN_UNDER_SQL_BODY = "ERR_ORIGIN_UNDER_SQL_BODY"
     ERR_UNKNOWN = "ERR_UNKNOWN"
 
 

metaobjects-0.18.0/src/metaobjects/loader/validate_source_escapes.py

@@ -0,0 +1,205 @@
+"""#208 — DDL-ownership escape valves loader validation (source.rdb @sql / @unmanaged).
+
+Sibling of validate_source_parameter_ref.py / validate_source_physical_names.py.
+
+#208 gives source.rdb two mutually exclusive, non-default DDL-ownership
+markers: ``@sql`` (a hand-written body the tool registers/fingerprints/drift-
+checks but never authors) and ``@unmanaged`` (this object's DDL is owned
+elsewhere — the tool never touches it). This pass enforces the six
+fail-closed rules from the design doc (§5):
+
+    R1  @sql AND @unmanaged on the SAME source          -> ERR_SQL_BODY_WITH_UNMANAGED
+    R2  @sql on a writable @kind ("table", the default)  -> ERR_SQL_BODY_ON_WRITABLE_KIND
+    R3  @sql present but empty / whitespace-only         -> ERR_BAD_ATTR_VALUE
+    R4  origin.*-bearing field under an @sql host         -> ERR_ORIGIN_UNDER_SQL_BODY
+    R5  object.projection @filter (#207) + @sql host      -> ERR_ORIGIN_UNDER_SQL_BODY
+    R6  origin.*-bearing field under an @unmanaged host    -> WARN_ORIGIN_UNDER_UNMANAGED
+
+R1-R3 are per-source (declaration-layer). R4-R6 are per-host-object: a host
+with ANY own source.rdb carrying @sql/@unmanaged is judged against its own
+fields (and, for R5, its own @filter). The asymmetry between R4 (hard error)
+and R6 (warn) is deliberate (design doc §5.6): @sql is a second body (two
+sources of truth for the SAME data); @unmanaged acts on nothing, so a
+documented-but-unacted-on lineage is benign.
+
+Mirrors the TS reference
+``packages/typescript/packages/metadata/src/persistence/source/validate-source-escapes.ts``.
+"""
+from __future__ import annotations
+
+from ..errors import ErrorCode, MetaError
+from ..meta.core.field.meta_field import MetaField
+from ..meta.core.object.object_constants import (
+    OBJECT_PROJECTION_ATTR_FILTER,
+    OBJECT_SUBTYPE_PROJECTION,
+)
+from ..meta.meta_data import MetaData
+from ..meta.persistence.source.meta_source import MetaSource
+from ..meta.persistence.source.source_constants import (
+    SOURCE_ATTR_SQL,
+    SOURCE_SUBTYPE_RDB,
+)
+from ..shared.base_types import TYPE_FIELD, TYPE_OBJECT, TYPE_SOURCE
+from ..source.error_source import LoaderWarning
+
+WARN_ORIGIN_UNDER_UNMANAGED = "WARN_ORIGIN_UNDER_UNMANAGED"
+
+
+def validate_source_escapes(
+    root: MetaData,
+    errors: list[MetaError],
+    envelope_warnings: list[LoaderWarning] | None = None,
+    legacy_warnings: list[str] | None = None,
+) -> None:
+    """Run the #208 R1-R6 @sql / @unmanaged DDL-ownership validation.
+
+    ``envelope_warnings`` collects the FR5c-style envelope warning
+    (``WARN_ORIGIN_UNDER_UNMANAGED``, R6). ``legacy_warnings`` mirrors the
+    cross-port string warnings channel — populated with the same code string
+    so the legacy ``warnings: list[str]`` consumers see something too.
+    """
+    # ADR-0039 sanctioned own: root has no super (children()==own_children()),
+    # and every object is declared at the root level (mirrors the TS
+    # reference's root.children() walk).
+    for obj in root.own_children():
+        if obj.type != TYPE_OBJECT:
+            continue
+
+        # ADR-0039 sanctioned own: declaration-layer source iteration (mirrors
+        # validate_source_parameter_ref / _validate_one_primary_source):
+        # R1-R3 judge markers DECLARED on this object's own sources.
+        sources = [
+            c
+            for c in obj.own_children()
+            if c.type == TYPE_SOURCE
+            and c.sub_type == SOURCE_SUBTYPE_RDB
+            and isinstance(c, MetaSource)
+        ]
+
+        has_sql_host = False
+        has_unmanaged_host = False
+
+        for source in sources:
+            # ADR-0039: resolving — @sql/@unmanaged are inheritable (follow
+            # the @role/effective_kind precedent — sources are inheritable,
+            # NOT the @dbColumnType own-only exception).
+            sql_set = source.sql_body() is not None
+            unmanaged_set = source.is_unmanaged()
+
+            # R1 — contradictory DDL owners on the same source.
+            if sql_set and unmanaged_set:
+                errors.append(
+                    MetaError(
+                        f'source.rdb on object "{obj.name}" declares both @sql and '
+                        "@unmanaged — these are the mutually exclusive non-default "
+                        "states of one DDL-ownership axis (an author-supplied body "
+                        'contradicts "someone else owns this DDL")',
+                        ErrorCode.ERR_SQL_BODY_WITH_UNMANAGED,
+                        envelope=source.source,
+                    )
+                )
+
+            # R2 — @sql on a writable kind would bypass the column-diff
+            # machinery; tables are fully modeled or @unmanaged, never
+            # opaque-bodied.
+            if sql_set and source.is_writable():
+                errors.append(
+                    MetaError(
+                        f'source.rdb on object "{obj.name}" declares @sql with a '
+                        f'writable @kind ("{source.effective_kind()}") — @sql is '
+                        "legal only on a read-only kind (view/materializedView/"
+                        "storedProc/tableFunction); a writable table is either "
+                        "fully modeled or marked @unmanaged, never opaque-bodied",
+                        ErrorCode.ERR_SQL_BODY_ON_WRITABLE_KIND,
+                        envelope=source.source,
+                    )
+                )
+
+            # R3 — @sql present but empty/whitespace. MUST read the raw attr,
+            # not the sql_body() accessor: sql_body() already narrows an
+            # empty string to None, which would make a present-but-empty
+            # @sql indistinguishable from an absent one.
+            raw_sql = source.get_meta_attr(SOURCE_ATTR_SQL)
+            if raw_sql is not None and (
+                not isinstance(raw_sql, str) or raw_sql.strip() == ""
+            ):
+                errors.append(
+                    MetaError(
+                        f'source.rdb on object "{obj.name}" sets @sql to an '
+                        "empty/whitespace-only value; @sql requires a non-empty "
+                        "SQL body",
+                        ErrorCode.ERR_BAD_ATTR_VALUE,
+                        envelope=source.source,
+                    )
+                )
+
+            if sql_set:
+                has_sql_host = True
+            if unmanaged_set:
+                has_unmanaged_host = True
+
+        if not has_sql_host and not has_unmanaged_host:
+            continue
+
+        # R4 / R6 — origin.*-bearing (derived) own fields under an @sql /
+        # @unmanaged host. ADR-0039: own — origin.* never inherits
+        # (ADR-0029), so is_derived() is own-only by policy (mirrors
+        # _validate_derived_field_providability). @sql (hard error) takes
+        # priority over @unmanaged (warn) when a host happens to declare
+        # both markers across different sources.
+        for child in obj.own_children():
+            if child.type != TYPE_FIELD or not isinstance(child, MetaField):
+                continue
+            if not child.is_derived():
+                continue
+            if has_sql_host:
+                errors.append(
+                    MetaError(
+                        f'field "{obj.name}.{child.name}" carries an origin.* '
+                        f'(derived) child, but "{obj.name}" has a read source '
+                        "carrying @sql — the synthesized derivation and the "
+                        "author's verbatim SQL are two sources of truth for the "
+                        "same body",
+                        ErrorCode.ERR_ORIGIN_UNDER_SQL_BODY,
+                        envelope=child.source,
+                    )
+                )
+            else:
+                msg = (
+                    f'field "{obj.name}.{child.name}" carries an origin.* '
+                    f'(derived) child, but "{obj.name}" has a source marked '
+                    "@unmanaged — the tool never touches this object's DDL, so "
+                    "the derivation is documented lineage only (not acted on); "
+                    "this is informational, not an error"
+                )
+                if envelope_warnings is not None:
+                    envelope_warnings.append(
+                        LoaderWarning(
+                            code=WARN_ORIGIN_UNDER_UNMANAGED,
+                            message=msg,
+                            source=child.source,
+                        )
+                    )
+                if legacy_warnings is not None:
+                    legacy_warnings.append(WARN_ORIGIN_UNDER_UNMANAGED)
+
+        # R5 — a projection's row-scope @filter (#207) lowers to the outer
+        # WHERE of a TOOL-SYNTHESIZED body; with @sql the author owns the
+        # body (and its WHERE), so wrapping it is deferred cleverness
+        # (design doc D5) — reject.
+        if has_sql_host and obj.sub_type == OBJECT_SUBTYPE_PROJECTION:
+            # ADR-0039: own — the @filter is declared locally on this
+            # projection (mirrors _validate_projection_filter).
+            filter_value = obj.attr(OBJECT_PROJECTION_ATTR_FILTER)
+            if filter_value is not None:
+                errors.append(
+                    MetaError(
+                        f'projection "{obj.name}" declares both @filter and an '
+                        "@sql read source — a view-level @filter lowers to the "
+                        "outer WHERE of a synthesized body; with @sql the author "
+                        "owns the body (and its WHERE), so the two cannot be "
+                        "combined",
+                        ErrorCode.ERR_ORIGIN_UNDER_SQL_BODY,
+                        envelope=obj.source,
+                    )
+                )