schema: address eighth Copilot review round (plan 156)

Three review findings:

1. validate.go::claimedScopeMatches — the max-exceeded recovery
   used to fire for any already-claimed scope, including
   matchers with an unbounded `max == 0`. A non-contiguous
   occurrence of a `repeat: { min: 1 }` scope (no upper bound)
   was silently flagged as "exceeds allowed occurrences". Skip
   unbounded matchers in the helper so the diagnostic only
   fires when there really is a max to exceed. Test:
   TestPlan156_UnboundedRepeatDoesNotFlagAsExceeded.

2. parse_inline.go — revert the `closed: true` + empty
   `sections: []` relaxation from the previous round.
   `Schema.IsEmpty` ignores `Closed`, so an empty-sections
   closed schema is skipped by Validate entirely — the
   relaxation didn't actually enable the "forbid any top-level
   headings" use case. Restore the stricter check that
   requires a non-empty `sections:` list and document the
   IsEmpty rationale.

3. plan/156_schema-entry-unification.md — task 4 now notes
   explicitly that MDS020's file-schema check still routes
   through its legacy `parseSchema`/`parsedSchema` pipeline
   so the `{field}` heading/body sync feature survives. The
   new `parse_file.go` is exercised by schema-package tests
   and prepares the ground for the cutover in a follow-up
   plan; proto.md authors don't yet benefit from the new
   Matcher / fmvar / digits semantics.

https://claude.ai/code/session_012GGH62fZUzLuzP8T4ocGkJ

Author: claude

internal/schema/parse_inline.go

@@ -63,18 +63,16 @@ func ParseInline(raw map[string]any, source string) (*Schema, error) {
 	}
 
 	// schema-level `closed:` only makes sense when the schema also
-	// declares `sections:` — strictness has no scope to apply to
-	// when the kind only constrains front matter / filename. Plan
-	// 156 surfaces the mismatch at parse time. Key presence is the
-	// signal (not parsed length) so an explicit `sections: []`
-	// closed schema — useful for forbidding any top-level
-	// headings — stays expressible.
-	_, hasClosed := raw["closed"]
-	_, hasSections := raw["sections"]
-	if hasClosed && !hasSections {
+	// declares a non-empty `sections:` list — strictness has no
+	// scope to apply to when the kind only constrains front matter
+	// / filename, and `Schema.IsEmpty` ignores `Closed`, so an
+	// empty-sections closed schema would be skipped by Validate
+	// entirely. Plan 156 surfaces the mismatch at parse time.
+	if _, hasClosed := raw["closed"]; hasClosed && len(sch.Sections) == 0 {
 		return nil, fmt.Errorf(
 			"schema.closed: only valid on schemas that declare " +
-				"`sections:` — drop the key on a frontmatter-only kind")
+				"a non-empty `sections:` list — drop the key on a " +
+				"frontmatter-only kind or add at least one section")
 	}
 
 	if err := rejectUnknownTopKeys(raw); err != nil {

internal/schema/plan156_acceptance_test.go

@@ -459,6 +459,39 @@ func TestPlan156_OutOfOrderSequentialDiagFires(t *testing.T) {
 			"the unenforced-sequential diagnostic")
 }
 
+// TestPlan156_UnboundedRepeatDoesNotFlagAsExceeded regresses a
+// Copilot finding: claimedScopeMatches used to fire for any
+// claimed scope, including unbounded matchers (`max == 0`). A
+// later non-contiguous occurrence of a `repeat: { min: 1 }`
+// scope must NOT surface as "exceeds allowed occurrences" —
+// the matcher has no upper bound.
+func TestPlan156_UnboundedRepeatDoesNotFlagAsExceeded(t *testing.T) {
+	raw := map[string]any{
+		"sections": []any{
+			map[string]any{
+				"heading": map[string]any{
+					"regex":  "Step",
+					"repeat": map[string]any{"min": 1},
+				},
+			},
+			map[string]any{"heading": "Summary"},
+		},
+	}
+	sch, err := ParseInline(raw, "kind x")
+	require.NoError(t, err)
+	// Two Step sections sandwiching Summary. The second Step
+	// is non-contiguous; the unbounded matcher has no max to
+	// exceed.
+	doc := newDocFile(t, "doc.md",
+		"# T\n\n## Step\n\nx\n\n## Summary\n\ny\n\n## Step\n\nz\n")
+	diags := Validate(doc, sch, nil, false, makeDiagForTest)
+	for _, d := range diags {
+		assert.NotContains(t, d.Message, "exceeds scope",
+			"an unbounded repeat must not produce a max-exceeded "+
+				"diagnostic on a non-contiguous occurrence")
+	}
+}
+
 // TestPlan156_BroadMatcherYieldsBeforeMin regresses a Copilot
 // finding: a broad matcher (`.+`) with `repeat: { min: 2 }`
 // used to consume a later named scope's heading to satisfy its

internal/schema/validate.go

@@ -242,9 +242,13 @@ func handleLeftoverHeadings(
 }
 
 // claimedScopeMatches returns the index of the first already-claimed
-// non-slot, non-preamble scope whose matcher accepts dh, or -1 when
-// no claimed scope is a candidate. Used by handleLeftoverHeadings to
-// distinguish "max exceeded" from generic "unexpected".
+// non-slot, non-preamble scope whose matcher has a bounded `max`
+// AND accepts dh, or -1 when no such scope is a candidate. Used by
+// handleLeftoverHeadings to distinguish "max exceeded" from
+// generic "unexpected". Unbounded matchers (`max == 0`) are
+// excluded because they accept any number of occurrences — a
+// non-contiguous extra is a normal trailing leftover for them,
+// not a cardinality violation.
 func claimedScopeMatches(
 	scopes []Scope, dh DocHeading, claimed map[int]bool, docFM map[string]any,
 ) int {
@@ -255,6 +259,14 @@ func claimedScopeMatches(
 		if sc.Preamble || isSlotMatcher(sc.Matcher) {
 			continue
 		}
+		if sc.Matcher == nil {
+			continue
+		}
+		_, max := sc.Matcher.Repeat.Bounds()
+		if max == 0 {
+			// Unbounded — no max to exceed.
+			continue
+		}
 		if scopeMatchesHeading(sc, dh, docFM) {
 			return i
 		}

plan/156_schema-entry-unification.md

@@ -138,7 +138,13 @@ Files rewritten as part of implementation:
    `Matcher` (`regex: '.+'`, plus
    `repeat: { min: 0 }` for `...`). Keep
    `{n}` and `{field}` token expansion in
-   heading rows.
+   heading rows. (Scope note: MDS020's file-
+   schema check still routes through its
+   legacy `parseSchema`/`parsedSchema` pipeline
+   so the `{field}` heading/body sync feature
+   survives; this parser is exercised by the
+   schema-package tests and prepares the
+   ground for the cutover in a follow-up plan.)
 5. [x] Rewrite the validator in
    `internal/schema/validate.go` to match
    the heading sequence as a positional