carry readOnly through compilation for the code generator

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ucym7qy7pFC1hbhoVHwJFX

src/database/object.rs

@@ -152,6 +152,18 @@ pub struct SchemaObject {
   #[serde(default)]
   #[serde(skip_serializing_if = "Option::is_none")]
   pub immutable: Option<bool>,
+  // readOnly = the CLIENT may not write it; the SERVER still may. Deliberately NOT
+  // enforced here (see validator/rules/object.rs, which rejects `immutable` on any
+  // request) — enforcing it would break legitimate server writers such as the
+  // Mercury feed matcher stamping `reconciliation_status`, or the rollup triggers
+  // that own `total_amount`/`amount_paid`. It is carried purely so it survives
+  // compilation and reaches the punc code generator, which turns it into a
+  // client-side immutable Reactor. Without this field the key was silently dropped
+  // at this boundary and ten authored declarations did nothing for months.
+  #[serde(default)]
+  #[serde(rename = "readOnly")]
+  #[serde(skip_serializing_if = "Option::is_none")]
+  pub read_only: Option<bool>,
 
   // Contains ALL structural fields perfectly flattened from the ENTIRE Database inheritance tree (e.g. `entity` fields like `id`) as well as local fields hidden inside conditional `cases` blocks.
   // This JSON exported array gives clients absolute deterministic visibility to O(1) validation and masking bounds without duplicating structural memory.