fix(ownir): bind sourceLine to exactly the paths load() checks

Three review findings on 9f909c7. All three real, and the middle one is
mine — the schema edit was a blanket search-and-replace and it overshot.

1. `sourceColumn` refused `null`. `load()` accepts `column: null`
   (`_check_column` returns early on None) and §4.2 says so in the same
   commit, so the schema contradicted both. Now
   `["integer", "null"]`; `minimum`/`maximum` only constrain numbers, so
   real values keep their bounds. Pre-existing, but §4.2 made it visible.

2. `resourceRecord.line` and every `flowOp.line` were bound to
   `sourceLine` — the two paths §4.2 documents, in this same PR, as
   validated NOWHERE by `load()`. Binding them makes a producer
   schema-invalid on documents the door accepts, which is the same
   cross-consumer mismatch this change exists to remove, pointing the
   other way. Ten sites reverted to unrestricted integers.

3. `services[].ctor_line` was NOT bound, and `load()` does check it, so a
   schema-valid document could fail at the door. The blanket replace
   matched `"line"` and this key is `ctor_line`. Now bound.

Both directions are defects, and this file shipped one of each. So the
test no longer spot-checks four numbers — it asserts the whole binding
map:

  bound   service.line, service.ctor_line, site.line, effect.line,
          binding.line, param.line, protocolEvent.line
  unbound resourceRecord.line, flowOp.line

with the reason attached to each side: bound because `load()` checks it,
unbound because §4.2 records that it does not. A stale entry fails too —
a def that no longer has the key stops being evidence.

Three mutations, all caught: binding `flowOp.line`, unbinding
`ctor_line`, and reverting `sourceColumn` to integer-only.

Also: the first attempt at this fix round-tripped the schema through
`json.dumps` and produced a 604-line reformat for a 12-line change. Redone
as text edits. A diff nobody can read is not a small change however few
things it means to say.

Refs #250, #259.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CJF7MBi1ijU5m9cJVWgQsM

Author: claude

spec/ownir.schema.json

@@ -48,7 +48,7 @@
   "$defs": {
     "sourceColumn": {
       "description": "1-based source column of the SAME node `line` anchors on. Optional and additive, so OWNIR_VERSION stays 0 (spec/OwnIR.md §2): a producer that does not report one omits it and no consumer substitutes a value — not 0, not 1, and never recovered by re-reading the source line. Rides to SARIF as region.startColumn, where the OwnAudit occurrence anchor reads it (Own.NET#317).",
-      "type": "integer",
+      "type": ["integer", "null"],
       "minimum": 1,
       "maximum": 9223372036854775807
     },
@@ -108,7 +108,7 @@
       "description": "One owned-resource record (spec/OwnIR.md §4). An unreleased record is OWN001 at `line`; a released one nets balanced and stays silent.",
       "type": "object",
       "properties": {
-        "line": { "$ref": "#/$defs/sourceLine" },
+        "line": { "type": "integer" },
         "column": { "$ref": "#/$defs/sourceColumn" },
         "event": {
           "description": "The event/handle identifier for this owned resource (e.g. `bus.CustomerChanged`, `_timer.Tick`); carried into the finding message and rendered output.",
@@ -190,7 +190,7 @@
           "description": "A new owned local (Let+Acquire); kind:\"pool\" tags it a pooled buffer.",
           "properties": {
             "op": { "const": "acquire" },
-            "line": { "$ref": "#/$defs/sourceLine" },
+            "line": { "type": "integer" },
             "column": { "$ref": "#/$defs/sourceColumn" },
             "var": { "type": "string" },
             "kind": { "type": "string", "enum": ["pool"] }
@@ -202,7 +202,7 @@
           "description": "Release of the local's handle.",
           "properties": {
             "op": { "const": "release" },
-            "line": { "$ref": "#/$defs/sourceLine" },
+            "line": { "type": "integer" },
             "column": { "$ref": "#/$defs/sourceColumn" },
             "var": { "type": "string" }
           },
@@ -213,7 +213,7 @@
           "description": "Use of the handle.",
           "properties": {
             "op": { "const": "use" },
-            "line": { "$ref": "#/$defs/sourceLine" },
+            "line": { "type": "integer" },
             "column": { "$ref": "#/$defs/sourceColumn" },
             "var": { "type": "string" }
           },
@@ -224,7 +224,7 @@
           "description": "Overspan (POOL005: a full-length view of a pooled buffer).",
           "properties": {
             "op": { "const": "overspan" },
-            "line": { "$ref": "#/$defs/sourceLine" },
+            "line": { "type": "integer" },
             "column": { "$ref": "#/$defs/sourceColumn" },
             "var": { "type": "string" }
           },
@@ -235,7 +235,7 @@
           "description": "Ownership transfer out; `var` optional (a bare return).",
           "properties": {
             "op": { "const": "return" },
-            "line": { "$ref": "#/$defs/sourceLine" },
+            "line": { "type": "integer" },
             "column": { "$ref": "#/$defs/sourceColumn" },
             "var": { "type": "string" }
           },
@@ -246,7 +246,7 @@
           "description": "A new owning handle joined to `src`'s alias set (wrap/adopt, D5.4).",
           "properties": {
             "op": { "const": "alias_join" },
-            "line": { "$ref": "#/$defs/sourceLine" },
+            "line": { "type": "integer" },
             "column": { "$ref": "#/$defs/sourceColumn" },
             "var": { "type": "string" },
             "src": { "type": "string" }
@@ -258,7 +258,7 @@
           "description": "A Call checked against the callee's contract; a fresh-returning callee mints an acquire for `result` (D5.2). An optional `sig` (the callee's canonical parameter-type list, same format as a function record's `sig`) resolves the call against that overload's own summary; absent or unmatched, the name-merged summary applies (stage 2 fallback — degraded, never a wrong overload).",
           "properties": {
             "op": { "const": "call" },
-            "line": { "$ref": "#/$defs/sourceLine" },
+            "line": { "type": "integer" },
             "column": { "$ref": "#/$defs/sourceColumn" },
             "callee": { "type": "string" },
             "sig": { "type": "string" },
@@ -272,7 +272,7 @@
           "description": "An If with both branches lowered.",
           "properties": {
             "op": { "const": "if" },
-            "line": { "$ref": "#/$defs/sourceLine" },
+            "line": { "type": "integer" },
             "column": { "$ref": "#/$defs/sourceColumn" },
             "then": { "type": "array", "items": { "$ref": "#/$defs/flowOp" } },
             "else": { "type": "array", "items": { "$ref": "#/$defs/flowOp" } }
@@ -284,7 +284,7 @@
           "description": "A While — a back-edge the core's worklist fixpoint converges over (A1).",
           "properties": {
             "op": { "const": "while" },
-            "line": { "$ref": "#/$defs/sourceLine" },
+            "line": { "type": "integer" },
             "column": { "$ref": "#/$defs/sourceColumn" },
             "body": { "type": "array", "items": { "$ref": "#/$defs/flowOp" } }
           },
@@ -304,7 +304,7 @@
         "file": { "type": "string" },
         "line": { "$ref": "#/$defs/sourceLine" },
         "ctor_file": { "type": "string" },
-        "ctor_line": { "type": "integer" },
+        "ctor_line": { "$ref": "#/$defs/sourceLine" },
         "ctor_type": { "type": "string" },
         "root_resolve_sites": { "type": "array", "items": { "$ref": "#/$defs/site" } },
         "scope_cached": { "type": "array", "items": { "type": "string" } },

tests/test_ownir_defensive_limits.py

@@ -173,14 +173,66 @@ def run() -> int:
         ("sourceLine", "maximum", SPEC_INT64_MAX),
         ("sourceColumn", "minimum", 1),
         ("sourceColumn", "maximum", SPEC_INT64_MAX),
+        # `column: null` is accepted by `load()`, so the schema must permit it.
+        # `minimum`/`maximum` only constrain numbers, so the bounds above still
+        # apply to real values.
+        ("sourceColumn", "type", ["integer", "null"]),
     ):
         actual = defs.get(name, {}).get(key)
         if actual != expected:
             failures += _fail(
                 f"spec/ownir.schema.json $defs.{name}.{key} is {actual!r}, "
-                f"expected {expected} — the schema and `load()` must state the "
+                f"expected {expected!r} — the schema and `load()` must state the "
                 f"same bound or a producer can satisfy one and fail the other")
 
+    # …and the schema binds `sourceLine` on EXACTLY the paths `load()` checks.
+    #
+    # Both directions are defects and both were shipped in the first attempt at
+    # this file. Binding a path the loader ignores makes a producer schema-
+    # invalid while the door accepts it; leaving a checked path unbound makes it
+    # schema-valid while the door refuses it. A blanket search-and-replace over
+    # `"line"` did the first to `resourceRecord` and `flowOp` — the two paths
+    # §4.2 documents as unvalidated — and the second to `ctor_line`, whose key
+    # simply differs.
+    #
+    # So the map is asserted as a map, not spot-checked.
+    BOUND = {"service": ["line", "ctor_line"], "site": ["line"],
+             "effect": ["line"], "binding": ["line"], "param": ["line"],
+             "protocolEvent": ["line"]}
+    UNBOUND = {"resourceRecord": ["line"], "flowOp": ["line"]}
+
+    def _line_refs(node: Any, key: str, out: list[Any]) -> None:
+        if isinstance(node, dict):
+            for k, v in node.items():
+                if k == key and isinstance(v, dict):
+                    out.append(v.get("$ref") or v.get("type"))
+                else:
+                    _line_refs(v, key, out)
+        elif isinstance(node, list):
+            for v in node:
+                _line_refs(v, key, out)
+
+    for group, expect_bound in ((BOUND, True), (UNBOUND, False)):
+        for def_name, keys in group.items():
+            for key in keys:
+                found: list[Any] = []
+                _line_refs(defs.get(def_name, {}), key, found)
+                if not found:
+                    failures += _fail(
+                        f"$defs.{def_name} has no {key!r} — the binding map is "
+                        f"stale, which means it is no longer evidence")
+                for ref in found:
+                    is_bound = ref == "#/$defs/sourceLine"
+                    if is_bound != expect_bound:
+                        want = ("$ref sourceLine" if expect_bound
+                                else "an unrestricted integer")
+                        why = ("`load()` checks this path"
+                               if expect_bound else
+                               "`load()` does NOT check this path (§4.2)")
+                        failures += _fail(
+                            f"$defs.{def_name}.{key} is {ref!r}, expected "
+                            f"{want} — {why}")
+
     # ---- line: the full signed-64 range, and one step outside each end -----
     for label, build in LINE_PATHS:
         for value, expect_reject in ((INT64_MIN, False), (0, False),