Module loader 

Schema loader — reads on-disk schema directories (or in-memory YAML) into validated Schema values with edge_weights resolved.

Three validation layers coordinate here:

1. Structural (serde + deny_unknown_fields) — handled by the deserialize.
2. Semantic (this module) — cross-field rules listed in SchemaLoadError.
3. Editor (JSON Schemas) — generated by emit_json_schemas, consumed by schema authors via # yaml-language-server: $schema=....

Structs

HeadingKeyViolation

One (type, key, heading, derived_key) tuple in a SchemaLoadError::SectionHeadingMismatch refusal.

Enums

MetadataPolarityFormat

The metadata-field polarity generation of a sealed package — decided by the presence of the package’s format marker (schema-format.json), never by heuristics over the document body.

SchemaLoadError

Constants

SCHEMA_FORMAT_MARKER_CONTENT

The marker file’s canonical content.

SCHEMA_FORMAT_MARKER_FILE

The format-marker file name sealed alongside a schema package on the genuinely sealed surfaces — the __MEMSTEAD ref, published .mem archives (the export carries it, the archive validator admits it, the archive loader honors it), and new builtin version directories. Presence ⇒ MetadataPolarityFormat::RequiredOptIn; absence ⇒ legacy. Content is informative JSON; presence is the contract.

Functions

check_reserved_metadata_keys

Author/install-path check: refuse a schema whose types declare an engine-reserved metadata-field key (type / mem / id). Reads the raw pre-merge declaration list the loader records (TypeDefinition::declared_metadata_keys) so the engine-injected base fields never false-positive.

check_section_formats

Refuse a schema whose section-format declarations are defective — the install / strict-validation half of the loader-honesty rule. Same posture as check_reserved_metadata_keys: install and strict validation call this and refuse (naming EVERY problem of the first defective section); boot and sealed-schema loads must NOT — the recorded format_problems surface as health findings instead, and the defective declaration is never enforced.

check_section_heading_roundtrip

Refuse a schema in which any declared section’s heading does not derive back to that section’s declared key. Collects every offending (type, key, heading, derived_key) tuple — a schema with one good and one bad section is refused whole, and the author sees the complete list in one round.

load_schema_from_dir

Load a schema from a directory containing schema.yaml and types/*.yaml.

load_schema_from_memory

Load a schema from in-memory YAML strings — legacy sealed semantics (an absent required/optional key means required). Use load_schema_from_memory_with_format when the caller knows the package’s format generation from its marker.

load_schema_from_memory_with_format

Load a schema from in-memory YAML strings with an explicit metadata-polarity format generation (from the sealed package’s format marker).

load_sealed_package

Load a sealed schema package from its (relative-path, bytes) file list — the shape every sealed surface carries: a published .mem archive’s .memstead/schema/ tree, the git-branch __MEMSTEAD:schemas/<name>@<version>/ tree, a built-in version directory. Paths are package-relative (schema.yaml, types/<stem>.yaml, schema-format.json); anything else is ignored.

reserved_metadata_field_keys

Engine-invariant metadata-field keys reserved against schema use — the entity’s identity/discriminator triple. type is the engine-set frontmatter discriminator; mem and id are the entity’s structural identity, owned by the engine’s id grammar and mount routing. One reservation, one behaviour: no installable schema may declare any of them (see check_reserved_metadata_keys), and the engine write paths refuse them as caller-supplied metadata.

reserved_section_keys

Engine-invariant section keys reserved against schema use. The parser’s auto-managed ## Relationships section is the only entry today.

validate_schema_name

Author-time access to the schema-name shape rule — the same check the loader runs on a manifest’s name:. Exposed so scaffolding tooling (memstead schema new) can refuse a bad name up front with the loader’s own reason string instead of a drifting copy of the grammar.

with_format_marker

Append the format marker to a package’s file list if absent — the seal-path helper every installer runs so sealed copies carry their generation.