[Sad Catapella N3][Scientific integrity] Parameter deserialization does not verify normalization_scope against requested settings #37

Baseline and classification

Batch 3 at f784c95e3049483f87466150ffc5764375fa631d. Confirmed missing metadata check, but compatibility behavior is not prohibited by the current from_columns docstring (which only promises method validation); consider this a scientific-contract strengthening proposal rather than claiming a historical regression. No package tests executed.

Evidence

• Parameters.from_columns lines 254–311 explicitly requires four metadata columns, validates that normalization_method matches settings.method_name, then returns the row's arbitrary normalization_scope and group. It does not compare normalization_scope to settings.scope or validate the scope against supported values.
• NormalizationSettings.scope validation does refuse unsupported scopes at construction, but this check is bypassed for the deserialized parameter metadata.
• Contract §4.1 assigns different scientific sampling populations to image, patch, and biological_repeat scopes. Fitting tests exercise the matching-scope case, not contradictory scopes.

Counterexample

Create row = Parameters('z-score','image','image-A',True,(10.0,),(2.0,)).to_columns(); then Parameters.from_columns(row, NormalizationSettings(method='zscore',scope='biological_repeat')) succeeds and returns image-scope parameters even though caller supplied biological-repeat settings. An unsupported text scope such as experiment also passes as a row scope.

Impact

Using fitted parameters for a scientifically different unit of analysis can silently change all normalized pixel values, with no exception at the deserialization boundary. Application itself is intentionally scope-agnostic, so the reader is the appropriate enforcement point if this contract is adopted.

Fix / decision

Validate normalization_scope == settings.scope by default and require an explicit separate override for intentional cross-scope reuse, if needed. Refuse unknown scopes with allowed choices. Consider an optional expected group/identity check at the calling-brick boundary rather than fabricating one here. Add matching/different scope, empty/unknown scope, changing group and per-time-point tests. Keep backward compatibility explicit. No Numba relevance.