[Sad Catapella N4][Data integrity] PlaneRecord and CSV reader accept negative plane coordinates; direct records also accept fractional coordinates #44

Audit basis

Normalization Batch 4 at f784c95e3049483f87466150ffc5764375fa631d. Confirmed API/schema validation gap; no tests run. Focused on plane identity, not channel coercion (already #38).

Evidence

• PlaneRecord.__post_init__ lines 59–70 only replaces None z/t with zero. It never validates integer type or nonnegative coordinate, even though the documented contract states zero-based coordinates.
• make_plane_id() lines 136–146 directly formats arbitrary supplied coordinates.
• _record() lines 308–316 parses z=int(...), t=int(...) without nonnegative validation; -1 is accepted. The CSV reader refuses an empty coordinate but not negative values (test).
• group_key lines 70–74 uses the supplied time value as part of normalized-group identity, so invalid coordinates propagate to the science grouping.

Reproducers

PlaneRecord('control/r1/a.tif','control','r1','single',histogram,z=-1,t=1.5) constructs and produces a noncanonical plane_id. Writing a record with z=-1 then reading it back also passes the current integer parser and preserves negative coordinate. This represents an impossible zero-based image position rather than a valid microscopy plane.

Fix / acceptance

Validate z and t as genuine nonnegative integral indices (allow NumPy integer types, explicitly reject booleans/fractions/strings according to documented public construction policy); preserve None→0 only for documented absent axes. Reject negative integers in the CSV reader with CsvFormatError naming row and column; direct construction should raise immediately. Do not silently truncate or clamp. Add z/t=-1, booleans, fractions, NaN, large valid positions, None, and ordinary round trips; ensure time-key stability across conversions. Consider extending checks to blank/invalid identity labels as a separate explicit contract decision, not silently inventing them. No Numba opportunity.