fix: cross-port deferred-followups — filterable drift, payload subType, attr-name dots

Closes the substantive items deferred from the prior pre-merge gate (see
merge 738e07f's body). Three new conformance fixtures lock the behavior so
the drift can't silently come back.

Fixtures:
- loader-filterable-on-db-indexed-no-warning — @filterable + @db.indexed
  on a field exempts the no-index warning (parity with TS validation-passes
  + Python _validate_filterable_has_index).
- warning-filterable-inherited-without-index — abstract base declares
  @filterable email with no covering identity; concrete child inherits the
  field; warning fires on both (parity with TS effective-iteration).
- error-template-payload-ref-not-value — template.prompt @payloadRef
  targeting object.entity (not object.value) emits ERR_INVALID_TEMPLATE
  (parity with FR-004 R2; Java + Python already correct, TS + C# now match).

Java fix — warnFilterableWithoutIndex was own-only and ignored @db.indexed:
- ValidationPhase.checkFilterableFields now iterates effective fields and
  effective identities (`getChildren(..., true)`), matching TS reference
  (validation-passes.ts:140). Without this, a concrete entity inheriting
  a @filterable field via BaseEntity is silently skipped.
- Adds ATTR_DB_INDEXED constant + the explicit @db.indexed exemption check
  (validation-passes.ts:155).

Java fix — validateName rejected dotted attr names:
- MetaData.validateName now permits dotted attr names (e.g., @db.indexed,
  @db.column) and FQN-qualified attr names (@pkg::name::attr) when the
  type is "attr". TS + Python already accept these; Java's stricter
  pattern was a real cross-port drift that surfaced when the @db.indexed
  fixture was added. Other types (object/field/etc.) keep their strict
  identifier pattern unchanged.

TS + C# fix — template @payloadRef required tightening to object.value:
- validation-passes.ts + ValidationPasses.cs now require c.subType ===
  OBJECT_SUBTYPE_VALUE in the payload lookup. Error message updated to
  "does not resolve to an object.value at root" matching Python's wording.
  FR-004 R2 is unambiguous (payload must be object.value); Java + Python
  already enforced this.

Verification:
- Java metadata module: 647/647 green
- TS metadata package: 1219/1219 green
- Python conformance: 88/88 green
- C# all 4 projects: 535/535 green

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dmealing

fixtures/conformance/error-template-payload-ref-not-value/expected-errors.json

@@ -0,0 +1,3 @@
+[
+  { "code": "ERR_INVALID_TEMPLATE" }
+]

fixtures/conformance/error-template-payload-ref-not-value/input/meta.template.json

@@ -0,0 +1,24 @@
+{
+  "metadata.root": {
+    "package": "acme::ai",
+    "children": [
+      {
+        "object.entity": {
+          "name": "Npc",
+          "children": [
+            { "field.string": { "name": "name" } },
+            { "identity.primary": { "@fields": "name" } }
+          ]
+        }
+      },
+      {
+        "template.prompt": {
+          "name": "npcTurn",
+          "@payloadRef": "Npc",
+          "@textRef": "npc/turn",
+          "@format": "xml"
+        }
+      }
+    ]
+  }
+}

fixtures/conformance/loader-filterable-on-db-indexed-no-warning/expected.json

@@ -0,0 +1,33 @@
+{
+  "metadata.root": {
+    "package": "acme",
+    "children": [
+      {
+        "object.entity": {
+          "name": "Subscriber",
+          "children": [
+            {
+              "field.long": {
+                "name": "id"
+              }
+            },
+            {
+              "field.string": {
+                "name": "email",
+                "@db.indexed": true,
+                "@filterable": true
+              }
+            },
+            {
+              "identity.primary": {
+                "@fields": [
+                  "id"
+                ]
+              }
+            }
+          ]
+        }
+      }
+    ]
+  }
+}

fixtures/conformance/loader-filterable-on-db-indexed-no-warning/input/meta.subscriber.json

@@ -0,0 +1,23 @@
+{
+  "metadata.root": {
+    "package": "acme",
+    "children": [
+      {
+        "object.entity": {
+          "name": "Subscriber",
+          "children": [
+            { "field.long": { "name": "id" } },
+            {
+              "field.string": {
+                "name": "email",
+                "@filterable": true,
+                "@db.indexed": true
+              }
+            },
+            { "identity.primary": { "@fields": "id" } }
+          ]
+        }
+      }
+    ]
+  }
+}

fixtures/conformance/warning-filterable-inherited-without-index/expected-warnings.json

@@ -0,0 +1,4 @@
+[
+  "[filterable-without-index] field \"BaseEntity.email\" has @filterable: true but is not part of any identity. Filtering on this field will sequential-scan. Add @db.indexed: true to the field (when supported), or remove @filterable: true.",
+  "[filterable-without-index] field \"Subscriber.email\" has @filterable: true but is not part of any identity. Filtering on this field will sequential-scan. Add @db.indexed: true to the field (when supported), or remove @filterable: true."
+]

fixtures/conformance/warning-filterable-inherited-without-index/expected.json

@@ -0,0 +1,39 @@
+{
+  "metadata.root": {
+    "package": "acme",
+    "children": [
+      {
+        "object.entity": {
+          "name": "BaseEntity",
+          "abstract": true,
+          "children": [
+            {
+              "field.long": {
+                "name": "id"
+              }
+            },
+            {
+              "field.string": {
+                "name": "email",
+                "@filterable": true
+              }
+            },
+            {
+              "identity.primary": {
+                "@fields": [
+                  "id"
+                ]
+              }
+            }
+          ]
+        }
+      },
+      {
+        "object.entity": {
+          "name": "Subscriber",
+          "extends": "BaseEntity"
+        }
+      }
+    ]
+  }
+}

fixtures/conformance/warning-filterable-inherited-without-index/input/meta.subscriber.json

@@ -0,0 +1,29 @@
+{
+  "metadata.root": {
+    "package": "acme",
+    "children": [
+      {
+        "object.entity": {
+          "name": "BaseEntity",
+          "abstract": true,
+          "children": [
+            { "field.long": { "name": "id" } },
+            {
+              "field.string": {
+                "name": "email",
+                "@filterable": true
+              }
+            },
+            { "identity.primary": { "@fields": "id" } }
+          ]
+        }
+      },
+      {
+        "object.entity": {
+          "name": "Subscriber",
+          "extends": "BaseEntity"
+        }
+      }
+    ]
+  }
+}

server/csharp/MetaObjects/Loader/ValidationPasses.cs

@@ -887,10 +887,10 @@ public static IReadOnlyList<MetaError> ValidateTemplatePayloadRefs(MetaData root
 
             var payload = root.OwnChildren()
                 .FirstOrDefault(c => c.Type == TYPE_OBJECT && c.Name == payloadRef);
-            if (payload is null)
+            if (payload is null || payload.SubType != OBJECT_SUBTYPE_VALUE)
             {
                 errors.Add(new MetaError(
-                    $"template \"{tmpl.Name}\" @payloadRef \"{payloadRef}\" does not resolve to a known object in this model",
+                    $"template \"{tmpl.Name}\" @payloadRef \"{payloadRef}\" does not resolve to an object.value at root",
                     ErrorCode.ERR_INVALID_TEMPLATE));
                 continue;
             }

server/java/metadata/src/main/java/com/metaobjects/MetaData.java

@@ -354,6 +354,26 @@ public MetaData(String type, String subType, String name ) {
      * Validate MetaData name during construction
      */
     private void validateName(String name) {
+        // Attributes may use dotted names to namespace persistence-concern
+        // attrs from core attrs (e.g., @db.indexed, @db.column). TS + Python
+        // accept these; the cross-port contract requires Java match. Also
+        // accept FQN-qualified attr names (`pkg::name::attr` form) which the
+        // loader synthesises for cross-package attr lookups.
+        if ("attr".equals(type)) {
+            if (name.contains("::")) {
+                for (String part : name.split("::")) {
+                    if (!part.matches("^[a-zA-Z][a-zA-Z0-9_.]*$")) {
+                        throw new IllegalArgumentException(
+                            "Invalid attr name part '" + part + "' in '" + name
+                                + "': must follow pattern ^[a-zA-Z][a-zA-Z0-9_.]*$");
+                    }
+                }
+            } else if (!name.matches("^[a-zA-Z][a-zA-Z0-9_.]*$")) {
+                throw new IllegalArgumentException(
+                    "Invalid attr name '" + name + "': must follow pattern ^[a-zA-Z][a-zA-Z0-9_.]*$");
+            }
+            return;
+        }
         // Loaders and views can have more flexible naming (allow hyphens). Views
         // also accept package-qualified names because the loader synthesises
         // FQNs like `pkg::Entity::currency1` for unnamed children.

server/java/metadata/src/main/java/com/metaobjects/loader/ValidationPhase.java

@@ -784,6 +784,7 @@ private static void validateIdentityNode(MetaIdentity identity) {
     // =========================================================================
 
     private static final String ATTR_FILTERABLE = "filterable";
+    private static final String ATTR_DB_INDEXED = "db.indexed";
 
     private static final java.util.Set<String> OPS_FOR_BOOLEAN =
         java.util.Set.of("eq", "ne", "isNull");
@@ -933,24 +934,38 @@ static void warnFilterableWithoutIndex(MetaRoot root, MetaDataLoader loader) {
     }
 
     private static void checkFilterableFields(MetaObject obj, MetaDataLoader loader) {
-        List<MetaField> indexedFieldNames = obj.getChildren(MetaField.class, false);
+        // Use effective (includes inherited via extends:/super:) so a child
+        // entity inheriting a @filterable field via BaseEntity is also gated.
+        // Mirrors TS validation-passes.ts:140 (`const effective = obj.children()`).
+        List<MetaField> fields = obj.getChildren(MetaField.class, true);
         java.util.Set<String> indexed = new java.util.HashSet<>();
-        for (MetaData child : obj.getChildren(MetaData.class, false)) {
+        for (MetaData child : obj.getChildren(MetaData.class, true)) {
             if (!(child instanceof MetaIdentity)) continue;
             MetaIdentity identity = (MetaIdentity) child;
             if (!identity.hasMetaAttr(MetaIdentity.ATTR_FIELDS, false)) continue;
             Object raw = identity.getMetaAttr(MetaIdentity.ATTR_FIELDS, false).getValue();
             collectIdentityFields(raw, indexed);
         }
 
-        for (MetaField field : indexedFieldNames) {
+        for (MetaField field : fields) {
             if (!field.hasMetaAttr(ATTR_FILTERABLE, false)) continue;
             Object v = field.getMetaAttr(ATTR_FILTERABLE, false).getValue();
             boolean filterable =
                 (v instanceof Boolean) ? (Boolean) v
                 : (v instanceof String) ? "true".equalsIgnoreCase((String) v)
                 : false;
             if (!filterable) continue;
+            // @db.indexed: true is an explicit escape hatch — author asserts a
+            // backing index exists (or will, when supported). Mirrors TS
+            // validation-passes.ts:155.
+            if (field.hasMetaAttr(ATTR_DB_INDEXED, false)) {
+                Object iv = field.getMetaAttr(ATTR_DB_INDEXED, false).getValue();
+                boolean dbIndexed =
+                    (iv instanceof Boolean) ? (Boolean) iv
+                    : (iv instanceof String) ? "true".equalsIgnoreCase((String) iv)
+                    : false;
+                if (dbIndexed) continue;
+            }
             if (indexed.contains(field.getShortName())) continue;
             String objName = obj.getShortName() != null ? obj.getShortName() : obj.getName();
             loader.addWarning(