spec: a cross-model parent roll-up may declare capacity and balance

[delchev]

Reference implementation: eclipse-dirigible/dirigible#7416 (issue eclipse-dirigible/dirigible#7410).

versions/1.2.md currently states that capacity / balance / status remain local-only on a cross-model parent. Two of those three are arithmetic on the parent's own numeric columns - the capacity is read, the balance is written alongside the sum - and the overdraw check they install belongs to the child, which is local on that direction. Keeping them out means both sides of an n:m allocation can never be guarded: the module that owns the link rows guards the parent it owns and is forced into hand-written code for the other, which is how a payment of 100 gets applied 100 twice.

The amended normative paragraph:

• field, capacity and balance are all validated against the owner's model at generation time;
• a cross-model balance with no capacity MUST be refused (the balance is defined as capacity - sum, so alone it names a column nothing fills);
• the capacity MUST be enforced on the child's own write path with the same refusal a same-model roll-up emits;
• status remains local-only - it moves the parent through the owner's own status values.

Site PR: IntentFile/intentfile.github.io#(see companion).