docs: add TODOs 0194-0196 — directory-scoped policy, cross-field rules, duplicate names

[edochi]

Specs only. No behaviour changes.

Three related gaps found while reviewing how mdvs scopes validation. All three trace to the same root: every rule in mdvs.toml hangs off exactly one [[fields.field]], so anything cross-cutting — directory policy, cross-field conditions, per-directory meaning — has nowhere to live.

TODO-0194 — directory-scoped schema policy (high)

A frontmatter field declared in no [[fields.field]] entry is never a violation. check reports it as informational and exits 0, in both auto-update and --no-update modes:

Checked 2 files — no violations, 1 new field(s)
EXIT: 0

Two mechanisms: validate.rs iterates declared fields rather than the keys present in a file, and to_canonical.rs emits the root schema with additionalProperties: true.

Also records what auto-update actually does, measured — re-inference only ever adds fields; it never widens an existing field's type or relaxes its constraints:

Scenario	auto-update	--no-update
Brand-new undeclared field	written into mdvs.toml, exit 0	listed under "New fields", exit 0
Value violating existing categories	exit 1	exit 1
Wrong type on existing field	exit 1	exit 1

Proposes a [[scope]] section with path / frozen / ignore, where path = "**" makes the whole-repo case fall out of the same mechanism. Open questions on precedence and on [fields].ignore's future are recorded rather than settled.

TODO-0195 — cross-field rules (medium)

Conditional requiredness — "closed_date is required when status is closed" — via dependentRequired (presence-based) or if/then (value-based). Argues conditional-disallowed is not optional: required-when alone is a footgun, since nothing then stops closed_date appearing on an open item.

Part B records the Rust-style variant-type idea and corrects a common assumption: the file format is not the obstacle. YAML and TOML both express tagged unions (externally- and internally-tagged are just serde's enum representations). The real blockers are three deliberate mdvs decisions — the oneOf reject list, the fixed Arrow Struct in storage, and inference. Concludes the flat encoding via Part A captures most of the value at a fraction of the cost.

depends_on: [194] — both need the same container, so it should be designed once.

TODO-0196 — duplicate field names (high)

A live bug, not just a missing feature. Two [[fields.field]] entries sharing a name are accepted silently and the last one wins:

status │ Wrong type  │ type Integer               │ blog/post.md (got String)
status │ Not allowed │ allowed in ["projects/**"] │ blog/post.md

Both violations are artifacts of the collapse — the blog/** declaration was discarded. Cause is collect() into a HashMap keyed by the bare name (validate.rs:43, and the same shape in field_meta.rs). None of the nine existing invariants covers it; invariant 8 catches shape conflicts, not two declarations of the same leaf.

Fix is invariant 10 — reject duplicates at config load. Self-contained and worth doing independent of the other two.