Make internal/compiler validation IR-native (finish manifest→IR migration)

[cssbruno]

Background

The manifest→IR migration (PR #144) made internal/gwdkir, internal/gwdkast, and internal/contractscan fully manifest-free, migrated buildgen render helpers to IR, and moved shared leaf value types into internal/source. The remaining large coupling is internal/compiler, which still validates the manifest model (~980 manifest.* references across ~30 validator files).

This issue tracks the final phase: making compiler validation IR-native so the CLI can build IR once and validate it directly, removing the AST → manifest → validate → IR detour.

Why this is a redesign, not a mechanical swap

This was investigated and deliberately deferred from PR #144 because a naive flip to compiler.ValidateProgram(ir) silently drops two validations. IR lowering is lossy for standalone-endpoint validation:

In internal/gwdkanalysis/ir_builder.go addStandaloneEndpoint:

• endpoint.Kind (raw "act"/"action"/"api") is collapsed into the 2-value gwdkir.EndpointKind — but validateStandaloneEndpoints (internal/compiler/routes.go) branches on the raw "act"/"action" strings.
• endpoint.RouteSpan and endpoint.RouteParams are dropped — the validators use them for precise diagnostic spans and route-param checks.
• endpoint.Method is normalized via endpointMethod(...) defaulting — but validateStandaloneEndpoints checks the raw method to emit "Go action endpoint uses unsupported method; actions currently require POST".

compiler.ManifestFromIR also does not populate manifest.Endpoints at all, so validateRouteMethodConflicts and validateStandaloneEndpoints would not run in an IR-validated path.

Net: flipping cmd/gowdk/build.go:43 and internal/lang/tools.go from ValidateManifest(app) to ValidateProgram(ir) today would lose real diagnostics.

Required work

1. Enrich gwdkir.Endpoint to carry what the endpoint validators need: RouteSpan, RouteParams ([]source.NamedSpan), and either the raw kind/method or a faithful mapping that preserves the validator's decisions. Update addStandaloneEndpoint to populate them losslessly.
2. Port the validators (validateStandaloneEndpoints, validateRouteMethodConflicts, then the broader set in validate*.go) to read gwdkir types. The IR model types already mirror manifest 1:1 for Page/Component/Layout/Blocks, so most validators are field-name swaps — but each must be verified.
3. Differential guard: add tests asserting ValidateProgram(ir) produces a byte-identical ValidationErrors set to ValidateManifest(manifest) across a fixture corpus, during a parallel-existence window, to prove zero diagnostic drift before flipping callers.
4. Flip orchestration: once equivalence is proven, switch cmd/gowdk/build.go, internal/lang/tools.go, and route_bindings.go to the IR path; ValidateManifest becomes a thin adapter or is removed.
5. Keep public manifest JSON (internal/manifest/json.go) until separately deprecated.

Acceptance

• internal/compiler no longer imports internal/manifest for the model types (public-JSON aside), verified via go list -deps.
• No diagnostic regressions (differential corpus green; full scripts/test-go-modules.sh green).
• CLI build path validates IR directly with no separate manifest threading.

References

• Plan: .llm/plans/manifest-to-ir-migration.md (Pending section)
• Architecture: docs/engineering/architecture.md ("Compatibility Records", migration-order step 4)
• Prior work: PR refactor: manifest→IR migration — extract internal/source, decouple gwdkir, migrate buildgen #144

[cssbruno]

Phase 1 in progress — PR #146.

Done in #146 (the part that was actually blocking):

• The IR is no longer lossy for standalone Go endpoints — new gwdkir.GoEndpoint preserves the raw declaration (kind/method/spans), and ManifestFromIR reconstructs manifest.Endpoints from it. validateStandaloneEndpoints / validateRouteMethodConflicts now run on the IR path.
• A differential test proves ValidateProgram(BuildIR(app)) ≡ ValidateManifest(app) byte-for-byte across valid/invalid programs (kept as a permanent guard).
• The CLI build path validates the IR directly.

Still open (the bulk):

• Rewrite the ~30 validator bodies to read gwdkir types directly instead of via the ManifestFromIR adapter, so internal/compiler drops the manifest model import (~980 refs).
• Remove the residual build-path double-validation (CLI + buildgen).
• Flip the lang report commands (check/sitemap/manifest).
• Keep public manifest JSON until separately deprecated.

[cssbruno]

Phase 2 — PR #171. This covers everything still open here:

• The ~30 validator bodies now read gwdkir types directly; ValidateProgram runs with no manifest intermediary and ManifestFromIR/ValidateManifest are deleted. The validator test corpus kept its manifest fixtures and lowers them through the production BuildIR path, so the diagnostic expectations pinned the rewrite byte-for-byte (no differential drift).
• Endpoint discovery and backend binding are IR-native (DiscoverGoEndpoints / BindBackendHandlers on *gwdkir.Program); CLI and lang report commands (check/sitemap/manifest) build IR once and validate it directly.
• Residual build-path double-validation removed (buildgen.BuildFromValidatedIR for the CLI; defensive validation kept for other callers).
• Public manifest JSON untouched: lang mirrors discovery/binding results back onto the parsed manifest; CLI report + build output verified byte-identical against main across six examples.

Acceptance status: internal/compiler no longer imports internal/manifest for the model (verified via go list); full test suite green (one pre-existing macOS-local cmd/gowdk failure unrelated to this change, also fails on main).

If #171 lands, this issue's acceptance is met and it can close — the remaining migration work (appgen/lang/lsp residue, AST→IR backbone, JSON deprecation) is tracked in .llm/plans/manifest-to-ir-migration.md steps 4–5.