@metaobjectsdev/sdk 0.23.2 → 0.24.0

package/agent-context/skills/metaobjects-audit/SKILL.md

@@ -61,6 +61,16 @@ code behind a grep hit; a "duplicate" validator's *divergence* is the finding.
   dataclasses shadowing a generated shape. Diff field-by-field; the divergence is the bug.
 - [ ] **D. Prompt pillar.** Every LLM prompt-construction site (see § Prompt anti-patterns).
 - [ ] **E. Owned generators & scaffold-and-own** (see § Owned-codegen assessment).
+- [ ] **E2. Capability ledger — `requirement.*`** (see `references/requirements.md` and the
+  Requirement axis of the capability checklist). The one axis whose hunt is hand-written
+  PROSE rather than hand-written code: a `CAPABILITIES.md`, a README features table, a
+  conventions doc, a known-and-tolerated gap recorded as a TODO, or a rule that exists only
+  as a comment above the field it governs. Prose goes stale in silence; `@implementedBy` is
+  a reference the loader resolves, so a rename that invalidates the claim is caught.
+  **Entirely opt-in — an absent ledger is NOT a defect** (object coverage is a warning by
+  design, and a real estate reports most of itself unclaimed on day one). Score the prose
+  it would replace, and prefer ONE concrete claim an author can check over a
+  whole-estate migration.
 - [ ] **F. Drift-gate adoption.** Is `meta verify` wired into CI / pre-commit? Which
   subverbs (`--codegen` / `--templates` / `--db`)? Committed-codegen freshness gate?
   Advisories heeded? Routine `--no-verify` bypass? Loader `ERR_*` / warnings addressed?
@@ -292,7 +302,7 @@ Per finding: `file:line` → what → generated-equivalent exists? → recommend
 5. **Runtime schema patching** (`ALTER TABLE … ADD COLUMN IF NOT EXISTS`, `_ensure_schema()`) — N schema owners.
 6. **N declarations of one shape** — same entity as Drizzle table + Zod schema + Pydantic model + hand dataclass; target is 1 + N generated.
 7. **`own*()` accessor read of an effective property** (ADR-0039) — `ownAttr` / `ownFields` / `own_children` / bare Python `attr(` / `getMetaAttr(name, false)` / native `IsArray` used to read a value or iterate members outside the sanctioned subclass-emit / own-serializer / `@dbColumnType` cases → silently drops `extends`-inherited values. A **correctness defect** (axis G2), not advisory.
-8. **Hand-written `CREATE VIEW` / read-only SQL standing in for a projection or entity read-view (view-necessity test).** Grep migrations, checked-in `.sql`, and repository/query code for `CREATE [OR REPLACE] [MATERIALIZED] VIEW`, and for hand-rolled read-only queries that mirror a read model — a pure-`SELECT` repository/service method with joins or `GROUP BY` feeding a DTO, or a raw-SQL escape (`db.execute(sql…)`, `FromSqlRaw`, a JPA @Query with hand-written SQL). For each, run the **necessity test** — can origins express this shape? A column is derivable when it is (a) a base-entity or relationship-joined column → `origin.passthrough` (`@from` / `@via`), (b) a count/sum/avg/min/max over related rows → `origin.aggregate` (`@agg` / `@of` / `@via`), or an `EXISTS` / `array_agg` → `origin.aggregate` `any` / `all` / `collect` — any of them optionally row-scoped with `@filter`, (c) a child collection → `origin.collection` (`@via`), (d) a computed scalar / **non-aggregate expression column** → `origin.computed` (`@expr`, #195), (e) one related row's column picked by an ordering — an **argmax / `DISTINCT ON … ORDER BY` / correlated `ORDER BY … LIMIT 1`** → `origin.first` (`@of` / `@via` / `@orderBy`, #195), or (f) a column borrowed via `extends` — and the joins follow declared relationships / `identity.reference` FKs.
+8. **Hand-written `CREATE VIEW` / read-only SQL standing in for a projection or entity read-view (view-necessity test).** Grep migrations, checked-in `.sql`, and repository/query code for `CREATE [OR REPLACE] [MATERIALIZED] VIEW`, and for hand-rolled read-only queries that mirror a read model — a pure-`SELECT` repository/service method with joins or `GROUP BY` feeding a DTO, or a raw-SQL escape (`db.execute(sql…)`, `FromSqlRaw`, a JPA @Query with hand-written SQL). For each, run the **necessity test** — can origins express this shape? A column is derivable when it is (a) a base-entity or relationship-joined column → `origin.passthrough` (`@from` / `@via`), (b) a count/sum/avg/min/max over related rows → `origin.aggregate` (`@agg` / `@of` / `@via`), or an `EXISTS` / `array_agg` → `origin.aggregate` `any` / `all` / `collect` — any of them optionally row-scoped with `@filter`, (d) a computed scalar / **non-aggregate expression column** → `origin.computed` (`@expr`, #195), (e) one related row's column picked by an ordering — an **argmax / `DISTINCT ON … ORDER BY` / correlated `ORDER BY … LIMIT 1`** → `origin.first` (`@of` / `@via` / `@orderBy`, #195), or (f) a column borrowed via `extends` — and the joins follow declared relationships / `identity.reference` FKs.
    - **Entity-shaped (`SELECT own.* + derived`) → an entity read-view, NOT a projection (#214).** The single most common legacy view is an entity's OWN columns plus a joined/derived extra (`SELECT o.*, c.name AS customer_name`). This is the `Order` **entity with a read route**, not an exposure contract — route it to an **entity read-view**: keep the writable `@role: primary` `@kind: table` source and add a **non-primary `@role: replica` `@kind: view`** source, declaring only the *extra* as a derived `origin.*` field on the entity (the own field set already covers `o.*`). Reads route to the replica view, writes to the table. Reach for a **projection** instead only when the view renames base columns or **row-filters** (`WHERE status='active'`, soft-delete) — the latter is a projection with an object-level `@filter` (#207) that lowers to the outer `WHERE`.
    - **Exposure contract, expressible → CODEGEN CANDIDATE (high):** a subset / renamed / versioned / multi-base read model → convert to an `object.projection` with a read-only `source.rdb` `@kind: view` child, let `meta migrate` emit the `CREATE VIEW`, and consume the generated read-only query — the hand-written view is a second source of truth for a derivable shape. Parity-gate: the generated view returns row-identical results before the hand-written SQL is deleted.
    - **Not expressible → carry it in `@sql` or `@unmanaged`, never a hand-edited migration (#208, ADR-0043).** When a NAMED irreducible construct blocks origin authoring — recursive CTE, window function / `OVER`, `UNION` / `INTERSECT` / `EXCEPT`, lateral join — the body still belongs in the metadata: carry the hand-written SQL in the `source.rdb` **`@sql`** escape — a read-only-`@kind` body the tool REGISTERS, fingerprints, and drift-checks (adopt a pre-existing view with `meta migrate --allow adopt-view`); `@sql` forbids `origin.*` children (two sources of truth). A DB object whose DDL is owned **entirely elsewhere** (Flyway / a hand-migration) → mark its source **`@unmanaged: true`** (legal on any `@kind` incl. `table`); `meta migrate` never creates/drops/drift-checks it and `verify --db` reports it as external. `@sql` and `@unmanaged` are mutually exclusive. **Only a view left *undeclared*** — neither modeled, nor `@sql`, nor `@unmanaged` — is truly *unmanaged*, invisible to `meta verify --db`, so this audit is the only gate that sees it. "It's an aggregation" is NOT an irreducibility justification (plain count/sum/avg/min/max rollups are `origin.aggregate`); nor is a `DISTINCT ON` pick-one-row (`origin.first`) or a non-aggregate expression column (`origin.computed`).
@@ -332,15 +342,17 @@ Per finding: `file:line` → what → generated-equivalent exists? → recommend
 - Inline prompt strings (triple-quoted / template-literal constants in service code).
 - Untyped payloads (`str.format(**dict)` / f-strings / ad-hoc dicts) — payload should be a declared
   shape: an `object.value` (caller-supplied fields; `origin.passthrough` only — FR-015 parameter
-  lineage) or, when fields derive by `aggregate` / `collection` / `computed` / `first`, a
+  lineage) or, when fields derive by `aggregate` / `computed` / `first`, a
   **sourceless `object.projection`** carrying those origins (#210 — assembly origins on an
   `object.value` fail load with `ERR_SUBTYPE_RULE_VIOLATION`; `@payloadRef` accepts the sourceless
   projection).
 - Silent-degradation hack (`try/except KeyError` or `?? ''` around formatting) — flag every instance.
-- Hand-rolled output parsing (regex / XML / ad-hoc JSON) vs declared `template.output` +
-  generated `parse*` / `safeParse*` / `extract*` parser — **generated in all five ports**
-  (Java's generated `<Name>Parser` owns the Jackson `readValue`); flag a hand-rolled parser
-  in a **non-generated** file where a `template.output` node exists.
+- Hand-rolled output parsing (regex / XML / ad-hoc JSON) vs a declared **responding
+  `template.prompt`** (one carrying `@responseRef`) + generated `parse*` / `safeParse*` /
+  `extract*` parser — **generated in all five ports** (Java's generated `<Name>Parser` owns
+  the Jackson `readValue`); flag a hand-rolled parser in a **non-generated** file where a
+  responding `template.prompt` exists. ADR-0052: a `template.output` is outbound only and
+  generates no parser, so it is not the node to look for here.
 - Engine-side formatting breaking byte-identical render (prompt-cache exact-prefix hits
   depend on byte-stability).
 - `template.toolcall` candidates: LLM tool schemas hand-defined per call vs modeled
@@ -467,7 +479,8 @@ The audit never edits code. Pattern: **dry-run → review the diff → apply**.
   leading-wildcard gating — do NOT flag the absence of those in a non-TS port.
 - **Output-parser codegen** ships in **all five ports** — Java's `SpringOutputParserGenerator`
   *generates* the `<Name>Parser` (the Jackson `readValue` lives inside that generated file). A
-  hand-rolled parser in a **non-generated** file where a `template.output` node exists IS a finding.
+  hand-rolled parser in a **non-generated** file where a **responding `template.prompt`**
+  (`@responseRef`) exists IS a finding. Per ADR-0052 a `template.output` emits no parser.
 - **Python** still hand-wires the FastAPI router + repository impl around a generated
   `APIRouter`; relationship / non-`table` source-kind / `field.object flattened` codegen is partial.
 - **C#** has no ObjectManager runtime tier (EF Core is the runtime) — hand services over the generated `DbContext` are expected.

package/agent-context/skills/metaobjects-audit/references/capability-checklist.md

@@ -50,8 +50,11 @@ classify it (using the classification scheme in `SKILL.md`) and route the cutove
 - **`field.map`** (`@valueType`) — hunt ad-hoc open-keyed key/value bags stuffed into a jsonb
   column by hand.
 - **Common field attrs** — `@column` (hand column-name mapping), `@default` (hand default
-  assignment), `@required` (hand presence checks), `@unique` (hand uniqueness), `@readOnly`
-  (hand write-guards), `@filterable` / `@sortable` (hand filter/sort allowlists),
+  assignment), `@required` (hand presence checks), `@unique` (hand uniqueness),
+  `@mutability` (hand write-guards: `readOnly` for a column the DB/replication owns,
+  `writeOnce` for one set at create and never changed — hunt hand-written
+  "cannot be modified after creation" checks), `@filterable` / `@sortable`
+  (hand filter/sort allowlists),
   `@dbColumnType` (hand native-type override), `@example` / `@instruction` (hand prompt
   hints), `@xmlText` (hand XML-text mapping). The `@db.indexed` attr suppresses the
   *`@filterable`-without-index* Loader warning (you assert the column is indexed by other
@@ -67,7 +70,7 @@ classify it (using the classification scheme in `SKILL.md`) and route the cutove
 - **`@kind` = `view` / `materializedView`** — hunt hand-written SQL views where an authored
   read-only source belongs. Apply the **view-necessity test** (SKILL.md, drift signature 8): a
   hand-written `CREATE VIEW` (or read-only SQL mirroring a read model) is a CODEGEN CANDIDATE when
-  its shape is expressible via `origin.passthrough` / `origin.aggregate` / `origin.collection` /
+  its shape is expressible via `origin.passthrough` / `origin.aggregate` /
   `origin.computed` / `origin.first` + `extends`. Route by shape: an entity's OWN columns plus an
   extra (`SELECT o.*, …`) → an **entity read-view** (#214: a `@role: replica` view beside the
   writable `table`); a subset / renamed / row-filtered exposure → an `object.projection` (row-scope
@@ -132,8 +135,6 @@ classify it (using the classification scheme in `SKILL.md`) and route the cutove
   subqueries or in-app rollups a derived aggregate field models.
 - **`origin.passthrough`** (`@from`, `@via`, `@convert`) — hunt denormalized-by-hand copied fields
   that a passthrough origin pulls across a relationship.
-- **`origin.collection`** (`@via`) — hunt hand-assembled child-collection loading a collection
-  origin derives.
 - **`origin.computed`** (`@expr` — a closed `attr.expression` grammar) — hunt a hand-computed derived
   scalar (a formula over other fields) a computed origin models.
 - **`origin.first`** (`@of`, `@via`, `@orderBy`, `@filter`; `@orderBy` REQUIRED) — hunt a hand
@@ -171,17 +172,26 @@ soft-delete / status / type view it models.
 
 ## Template — `template.*` (prompt pillar)
 
-- **`template.prompt`** (`@payloadRef`, `@textRef`, `@responseRef`, `@requiredSlots`,
-  `@requiredTags`, `@maxTokens`, `@maxChars`, `@format`, `@model`) — hunt prompt strings
-  assembled inline in services, payloads built ad-hoc, output parsing without a typed
-  `@responseRef`, or token/char budgets enforced by hand.
-- **`template.output`** (`@kind` = `document` | `email`; `@subjectRef`, `@htmlBodyRef`,
-  `@textBodyRef`, `@promptStyle`, `@requiredTags`) — hunt hand-built document/email rendering +
-  hand-written parse-on-receipt the output template + generated render helper/parser cover.
-  (`@promptStyle` — the FR-010 output-format presentation — is on `template.output` ONLY;
-  authoring it on `template.prompt` fails load with `ERR_UNKNOWN_ATTR`.)
-- **`template.toolcall`** (`@toolName`, `@payloadRef`) — hunt hand-declared LLM tool schemas
-  a modeled tool call describes.
+**A template subtype's axis is DIRECTION** (ADR-0052): `template.prompt` owns everything about
+talking to a model — both the request and the reply — while `template.output` renders an
+artifact for a person or a file and generates **no parser**.
+
+- **`template.prompt`** (`@payloadRef`, `@textRef`, `@responseRef`, `@responseFormat`,
+  `@promptStyle`, `@requiredSlots`, `@requiredTags`, `@maxTokens`, `@maxChars`, `@format`,
+  `@model`) — hunt prompt strings assembled inline in services, payloads built ad-hoc,
+  token/char budgets enforced by hand, and **hand-written parse-on-receipt**: a prompt
+  declaring `@responseRef` owns the inbound half, so the strict parser, the tolerant
+  `extract` mapper and the FR-010 output-format fragment are all generated from it.
+  (`@promptStyle` — the FR-010 output-format presentation, `guide` / `inline` /
+  `exampleOnly` — is on `template.prompt` ONLY; authoring it on `template.output` fails load
+  with `ERR_UNKNOWN_ATTR`.)
+- **`template.output`** (`@kind` = `document` | `email`; `@textRef`, `@subjectRef`,
+  `@htmlBodyRef`, `@textBodyRef`, `@payloadRef`, `@format`, `@maxChars`, `@requiredTags`) —
+  **outbound only.** Hunt hand-built document/email rendering the output template + generated
+  render helper cover. It parses nothing: a parser here would be reading back text the system
+  just rendered and sent.
+- **`template.toolcall`** (`@toolName`, `@payloadRef`, `@maxTokens`) — hunt hand-declared LLM
+  tool schemas a modeled tool call describes.
 - **`template.base`** — abstract base.
 
 ## Attr — `attr.*`
@@ -200,6 +210,40 @@ soft-delete / status / type view it models.
   generator would own. Apply the ADR-0037 ordered test before proposing; advisory (VOCAB
   CANDIDATE); see SKILL.md axis I "New-vocabulary OPPORTUNITY".
 
+## Requirement — `requirement.*` (capability ledger)
+
+The only axis here whose hunt is not "hand-written code the metadata describes" but
+**hand-written PROSE that claims something about the code and nothing checks.** Two
+subtypes with opposite polarity: `requirement.functional` fails when NOTHING implements it
+(existence); `requirement.architectural` fails when something VIOLATES it (universality).
+
+- `requirement.functional` — `@statement`, `@status`, `@level`, `@counterexample` — hunt a
+  `CAPABILITIES.md`, a features table in a README, a `docs/status/` tree, or a spreadsheet
+  that lists what the system does and how done each item is. Prose goes stale silently; a
+  declared requirement is a node the loader resolves and `meta verify` reports on.
+- `requirement.architectural` — `@statement`, `@status`, `@counterexample`, optional `@level` —
+  hunt a conventions doc, a lint rule with no enforcement, or an ADR whose ruling is
+  restated in review comments ("we always do X"). `@level` is optional here on purpose:
+  absent keeps the flat object-independent form, present opts into a taxonomy.
+- `@implementedBy` — hunt the mapping from "capability" to "the code that provides it"
+  living only in someone's head, a wiki table, or a comment. This is the load-bearing
+  attribute: it is a REFERENCE the loader resolves, so a rename or deletion that
+  invalidates the claim is caught, where prose would not be.
+  - **L4 binds an object; L5 binds one MEMBER of it, as a dotted `pkg::Owner.member` path.**
+    Mismatches are errors at both levels (`ERR_REQUIREMENT_L5_NOT_MEMBER` /
+    `ERR_REQUIREMENT_L4_NOT_OBJECT`) and the fix is to move the entry to the other level,
+    not to change the ref. Reach for L5 for a rule about ONE column — the kind currently
+    recorded only as a comment above a field.
+- `@disposition` (`accepted` / `deferred`) + `@trackedBy` — hunt a known-and-tolerated gap
+  recorded as a TODO, or a ticket number in a comment. **ABSENT disposition means UNDECIDED**,
+  which is the point: a gap nobody has ruled on reads differently from one deliberately
+  accepted.
+- **CALIBRATION — entirely opt-in and warning-only where it counts.** A project declaring no
+  `requirement.*` nodes sees no diagnostics at all, and object coverage ("entities claimed
+  by nothing") ships as a WARNING deliberately — a real estate carrying one requirement will
+  report most of itself unclaimed on day one. Do NOT score an absent ledger as a defect;
+  score the hand-written prose it would replace.
+
 ## Common documentation attrs (any node)
 
 - `@description`, `@title`, `@summary`, `@notes`, `@deprecated`, `@replacedBy`, `@seeAlso`,
@@ -222,8 +266,10 @@ soft-delete / status / type view it models.
     is **generated in all five ports** (api-contract corpus, both lanes) — **flag hand-rolled
     filter parsing anywhere.** Only the richer surface (`?search=`, explicit
     `filter[or][N]` / `filter[and][N]` combinators, leading-wildcard gating) is TS-only.
-    Output-parser codegen also ships in **all five ports** — Java's `SpringOutputParserGenerator`
-    *generates* the parser (the Jackson `readValue` lives inside that generated file). **Python**
+    Output-parser codegen also ships in **all five ports**, keyed on a **responding
+    `template.prompt`** (`@responseRef`), never on a `template.output` (ADR-0052) — Java's
+    `SpringOutputParserGenerator` *generates* the parser (the Jackson `readValue` lives inside
+    that generated file). **Python**
     still hand-wires the FastAPI router around a generated `APIRouter` (relationship /
     non-`table` source-kind / flattened-object codegen is partial). **C#** has no
     ObjectManager runtime tier (EF Core *is* the runtime) — hand services over the generated

package/agent-context/skills/metaobjects-audit/references/csharp.md

@@ -104,4 +104,5 @@ version across these packages is an intra-port skew finding.
   TS-only — do NOT flag its absence in C#.
 - **Output-parser codegen ships in C#.** `output-parser` / `extractor` / `render-helper`
   generators are available (`dotnet meta gen --generators output-parser`). Absence of
-  wired output parsers where `template.output` nodes exist IS a finding.
+  wired output parsers where a **responding `template.prompt`** (`@responseRef`) exists IS a
+  finding. ADR-0052: a `template.output` is outbound only and generates no parser.

package/agent-context/skills/metaobjects-audit/references/java.md

@@ -49,7 +49,7 @@ plugin `<configuration>` — that is the source of truth for which generators ru
 | Hand-written `@RestController` on a CRUD entity | `SpringControllerGenerator` should own this; trust the `pom.xml` `<generators>` configuration, not stale docs |
 | `interface <Entity>Repository` with no `@generated` comment | `SpringRepositoryGenerator` emits the stub; compare field by field |
 | `// keep in sync with` / `// mirrors the` | second-source-of-truth comment — always a finding |
-| `ObjectMapper.readValue(` outside a `*Parser.java` file | check if a `template.output` node exists — output-parser codegen ships in Java |
+| `ObjectMapper.readValue(` outside a `*Parser.java` file | check if a responding `template.prompt` (`@responseRef`) exists — output-parser codegen ships in Java |
 | `LIMIT ?` / `OFFSET ?` assembled by hand | generated CRUD routes handle pagination; OMDB `getObjects` accepts `QueryOptions` |
 
 ---
@@ -92,7 +92,8 @@ versioning — **do not flag it** (only intra-port skew matters).
   *generates* the typed `<Name>Parser` class; the Jackson `readValue` call lives inside that
   generated file. It is NOT a defect to see Jackson deserialization in a generated `*Parser.java`
   file. **Do not flag Jackson `readValue` calls in generated `*Parser.java` files.** DO flag a
-  hand-rolled parser in a *non*-generated file where a `template.output` node exists.
+  hand-rolled parser in a *non*-generated file where a responding `template.prompt`
+  (`@responseRef`) exists — per ADR-0052 a `template.output` emits no parser.
 - **Core filter-operator codegen ships in Java — do NOT treat it as deferred.**
   `SpringControllerGenerator` generates the `?filter[field][op]=value` grammar (all 9 operators
   `eq/ne/gt/gte/lt/lte/in/like/isNull`): it parses via the runtime `FilterParser`, validates

package/agent-context/skills/metaobjects-audit/references/kotlin.md

@@ -101,7 +101,8 @@ cross-port versioning — **do not flag it** (only intra-port skew matters).
   `KotlinOutputParserGenerator` generates the typed parser class AND its deserialization body
   (a kotlinx `Json.decodeFromString` call inside the generated file — kotlinx, not Jackson: the
   #187 Jackson move was jsonb-codec-only, prompt payloads/parsers stay on kotlinx). Only flag
-  a hand-rolled parser in a NON-generated file where a `template.output` node exists.
+  a hand-rolled parser in a NON-generated file where a responding `template.prompt`
+  (`@responseRef`) exists — per ADR-0052 a `template.output` emits no parser.
 - **Core filter-operator codegen ships in Kotlin — do NOT treat it as deferred.**
   `KotlinSpringControllerGenerator` generates the `?filter[field][op]=value` grammar (all 9
   operators `eq/ne/gt/gte/lt/lte/in/like/isNull`) validated against the generated filter allowlist

package/agent-context/skills/metaobjects-audit/references/requirements.md

@@ -10,14 +10,13 @@ effort re-deriving what a green run already proves.
 ## What verify has already proven (do not re-check by hand)
 
 Links sit at or below the L4 floor, nesting agrees with levels, `@status` values are legal,
-references resolve (with dangling allowed on `abandoned`/`superseded`), and named
-`@verifiedBy` tests exist and are not skipped.
+and references resolve (with dangling allowed on `planned`, whose nodes do not exist yet).
 
 ## What only a human or an agent reading the code can catch
 
 **1. Statuses that are false.** The highest-value finding in the whole dimension. A
 requirement marked `live` whose implementation was gutted; one marked `partial` that is now
-complete; one marked `abandoned` whose code is demonstrably still running. Sample the claims
+complete; one marked `planned` that was quietly built months ago. Sample the claims
 and read the nodes. `status` is the only payload with controlled evidence behind it — the
 resurrection protection rides entirely on it being true.
 
@@ -49,7 +48,7 @@ should be simplified rather than defended.
   coverage is explicitly rejected — plumbing members are covered by architectural
   requirements with high fan-out. L5 exists so a member claim *can* be made where it means
   something, never so every member must carry one.
-- **Dangling links on `abandoned` / `superseded`.** Correct, and load-bearing.
+- **Dangling links on `planned`.** Correct — the plan precedes the nodes.
 - **A project with no requirements at all.** The feature is opt-in by declaration; absence is
   not a finding.
 

package/agent-context/skills/metaobjects-audit/references/typescript.md

@@ -107,7 +107,7 @@ via `metamodelVersion` (see the Phase 0 cross-language consistency item).
 TypeScript is the reference implementation — it ships the full feature set:
 
 - Filter-operator codegen: **complete** — the core `?filter[field][op]` grammar (all 9 operators `eq/ne/gt/gte/lt/lte/in/like/isNull`, `<Entity>FilterAllowlist`) generates in every port; TS additionally ships the richer surface (`?search=`, `filter[or][N]` / `filter[and][N]` combinators, leading-wildcard gating).
-- Output-parser codegen: **complete** (`outputParser()` generator; `parse*`/`safeParse*`/`extract*` per `template.output`).
+- Output-parser codegen: **complete** (`outputParser()` generator; `parse*`/`safeParse*`/`extract*` emitted as `<Name>.response.ts` per **responding `template.prompt`** — one carrying `@responseRef`; ADR-0052).
 - ObjectManager: **complete** (`@metaobjectsdev/runtime-ts`; `kyselyDriver` / `inMemoryDriver`).
 - Schema migrate / `meta verify --db`: **complete** (TS owns the shared migrate engine — ADR-0015).
 - D1 dialect: **TS-only by design** — `dialect: "d1"` in `metaobjects.config.ts` targets Cloudflare D1 via the Wrangler CLI layout. Do NOT recommend porting D1 support to other languages.

package/agent-context/skills/metaobjects-authoring/SKILL.md

@@ -781,7 +781,7 @@ second identity declaration, and re-stating every passthrough column — for no
 A derived read model that IS an independent exposure is an **`object.projection`**
 (FR-024): its fields `extends` entity fields (`extends: "Author.id"` — dotted
 child traversal, package only on the root segment) and/or carry `origin.*`
-children (`passthrough` / `aggregate` / `collection` / `computed` / `first`)
+children (`passthrough` / `aggregate` / `computed` / `first`)
 declaring assembly; its identity passes through via `extends` (`identity.primary:
 { name: id, extends: "Author.id" }`); it is read-only by construction and the
 declared field set IS the exposure (fail-closed). Give it a read-only `source.rdb`
@@ -789,6 +789,31 @@ declared field set IS the exposure (fail-closed). Give it a read-only `source.rd
 projection detection + view DDL off that read-only source, so without it `meta gen`
 emits nothing for the projection.
 
+**The borrowed key may be ANY unique key — including a composite, and including the
+entity's `identity.secondary`.** The single-field `extends: "Author.id"` above is the
+common case, not the limit. Both of these are legal:
+
+```yaml
+# Composite primary → composite primary. @fields is COMPUTED from the local
+# pass-through fields, so it is optional here (declare it and it must agree).
+- identity.primary: { name: pk, extends: "Order.pk" }      # Order.pk = [tenant, ref]
+
+# A read model keyed on the entity's BUSINESS key, never surfacing its surrogate id.
+# Account has both: identity.primary pk (auto-increment id) AND identity.secondary
+# byCode (tenant + code). The view exposes tenant + code and borrows byCode.
+- identity.primary: { name: pk, extends: "Account.byCode" }
+```
+
+The rule is **uniqueness, not nomination**: ADR-0040 put uniqueness in the type, so
+`identity.primary` and `identity.secondary` are both unique keys and either can back a
+projection's key. `identity.reference` cannot — a foreign key is not unique, so
+`identity.primary extends: "Account.ownerRef"` is `ERR_EXTENDS_TARGET_MISMATCH`.
+
+Key correspondence still holds in every case: every field named by the borrowed identity's
+`@fields` needs a local field `extends`-ing that entity field, or the load fails with
+`ERR_IDENTITY_KEY_MISMATCH` — the identity cannot claim a pass-through the fields do not
+make.
+
 **A CONCRETE projection declares its OWN source — never inherits one.** A
 projection may `extends` another projection to reuse shape, but the child must
 declare its own `source.rdb`; inheriting the parent's is
@@ -982,7 +1007,7 @@ Reach for it when the project needs to answer any of:
 
 - **"Why is this field here?"** — an L5 requirement binds a claim to a specific member. Authoring these exhaustively is what surfaces columns nothing reads and vocabularies nobody documented.
 - **"What is broken but known?"** — `@status: partial` plus `@disposition: accepted | deferred`. Absent disposition means *undecided*, and `meta verify` counts those: the gaps nobody has ruled on.
-- **"What did we build and then retire?"** — `@status: abandoned` is the one status where a dangling `@implementedBy` is *correct*, so the record survives the deletion.
+- **"What did we say we would build and have not?"** — `@status: planned` is the one status where a dangling `@implementedBy` is *correct*, because the entry precedes the nodes.
 - **"What have we committed to build?"** — `@status: planned`. Its references may dangle, and it never counts toward object coverage.
 - **"Which ticket covers this?"** — `@trackedBy`.
 
@@ -995,7 +1020,7 @@ If the project declares any `requirement.*` node, `references/requirements.md` i
     name: everyStoredRowIsAddressable
     status: live
     statement: Every persisted row declares the identity by which it is addressed.
-    violation: A row that can be inserted but never pointed at.
+    counterexample: A row that can be inserted but never pointed at.
     implementedBy: [acme::shop::Order]
 ```
 

package/agent-context/skills/metaobjects-authoring/references/requirements.md

@@ -4,24 +4,23 @@ Capabilities are **metadata**, declared in `metaobjects/` beside the entities th
 describe. Read the existing requirement nodes before designing anything. Two rules matter
 more than the rest.
 
-**1. When you retire something, record it — at that moment.** Set the requirement's
-`status` to `abandoned` (built, then deliberately dropped) or `superseded` (something else
-does it now — name it in `supersededBy`), in the same change that removes the code.
+**1. A requirement is PRESCRIPTIVE — it states what should be true, never what happened.**
+So when a capability is retired, **delete its requirement** in the same change that removes
+the code. `status` is `planned | live | partial`; there is no member meaning "we used to do
+this", because every one of those three describes something meant to be true now or soon.
 
-This is the one thing a requirement does that the rest of the model cannot. Given a brief
-matching a retired feature, agents reading only the model proposed **reviving** it 24 times
-out of 24, each believing it was reusing. A retired feature is *more* attractive than a
-live one: purpose-built for exactly the request, never complicated by production.
+What a deleted entry leaves behind is a diff, which is the right home for it. If something
+about the retirement is worth carrying forward — why it went, what replaced it — put that in
+`notes` on the entry that survives, where a reader looking at today's model will find it.
 
-Leaving a dangling `implementedBy` on an `abandoned` or `superseded` requirement is
-**correct** — those nodes are supposed to be gone, and `verify` allows it deliberately. On
-`live` or `partial` the same dangling reference is an error: the model moved and the
-requirement went stale.
+Leaving a dangling `implementedBy` is **correct only on `planned`**: the entry precedes the
+nodes. On `live` or `partial` the same dangling reference is an error — the model moved and
+the requirement went stale.
 
 **2. When you add an entity, claim it.** Every `object.entity` should appear in some
 requirement's `implementedBy`, or `verify` says so.
 
-**Every requirement states its violation.** One sentence: what breaking it looks like.
+**Every requirement states its counterexample.** One sentence: what breaking it looks like.
 *"Every entity has a uuid primary key"* is violable — point at one with a composite string
 key. *"Things are persisted"* is not, and is a description rather than a requirement. Same
 rule kills *"the system is reliable"*. If you cannot say what breaking it looks like,
@@ -33,7 +32,7 @@ decide the split before writing any of them:
 
 - `title` — a short **noun-phrase** label (`name` is an identifier; this is what an index shows)
 - `statement` — **the claim**. This IS the description of what the requirement is
-- `violation` — **the counterexample** that makes the claim checkable
+- `counterexample` — **what would falsify the claim**, which is what makes it checkable
 - `description` — **the scope**: what the claim covers, what it deliberately does not, and
   which sibling entry owns the rest
 - `notes` — **the evidence**: how you know the `status` is true — citations, vocabularies, the
@@ -52,6 +51,32 @@ service — these never reference the model. **L4** binds a declared top-level n
 validator, identity, or a template's child. `implementedBy` above L4 is an error.
 Regrouping *moves* a node; it does not edit a parent string.
 
+**Write an L5 ref as a dotted `pkg::Owner.member` path** — the level and the shape of the
+ref must agree, and this is the single easiest thing to get wrong:
+
+```yaml
+# L4 binds the OBJECT
+level: 4
+implementedBy: ["acme::orders::Order"]
+
+# L5 binds ONE MEMBER of it — dotted owner.member, not the object
+level: 5
+implementedBy: ["acme::orders::Order.placedAt"]
+```
+
+Both mismatches are caught and they are symmetric: an L5 whose ref names an object is
+`ERR_REQUIREMENT_L5_NOT_MEMBER`, an L4 whose ref names a member is
+`ERR_REQUIREMENT_L4_NOT_OBJECT`. **In both cases the fix is to move the entry to the other
+level, not to rewrite the ref** — the ref is usually right and the level is usually the
+mistake. The instinct that produces the error is reaching for the object a rule is *about*;
+what L5 wants is the member the rule is *carried by*. Copying an L4 block and changing only
+`level: 5` produces exactly this failure.
+
+Reach for L5 when the statement is about ONE column and its entity's own requirement could
+not express it — "this lifecycle is `resolvedAt IS NULL` and never `status`", "this id is
+nullable, which is why the parent is `partial`". Do NOT use L5 for a blanket rule that
+happens to touch many fields; that is an architectural requirement.
+
 Claim your prompts. A `template.prompt` is a model node realising a capability exactly as
 an entity is, and it is the node whose retirement is hardest to see later — a removed
 prompt leaves no table behind. A prompt estate with no requirement entries is the same
@@ -82,8 +107,9 @@ usually one nobody read carefully. Then say what was DECIDED, which is a separat
 - **absent** — undecided, and that is a real state. `verify` counts these, because
   *"which gaps has nobody ruled on?"* is the question a review exists to answer.
 
-A `partial` nobody intends to finish is usually `abandoned` — built then deliberately
-retired, the one status where a dangling reference is correct.
+A `partial` nobody intends to finish is `partial` + `@disposition: accepted` — the gap is
+understood and deliberately not being closed. If the capability itself is gone, delete the
+requirement instead.
 
 **`status: planned` locks in work you have not started.** Its references may dangle (write
 the requirement before the entity), and it never counts toward object coverage — otherwise
@@ -96,22 +122,22 @@ ambition rather than work.
     level: 3
     status: live
     statement: "Scene pacing follows story beats"
-    violation: "A scene that advances on a clock rather than on the story"
+    counterexample: "A scene that advances on a clock rather than on the story"
     children:
       - requirement.functional:
-          name: TurnTimer
+          name: BeatProgression
           level: 4
-          status: abandoned          # retired deliberately -- do NOT revive
-          statement: "Pacing was driven by a per-turn wall-clock timer"
-          violation: "Pacing driven by elapsed time instead of beat completion"
-          supersededBy: BeatProgression
-          implementedBy: ["game::turn::TurnTimer"]   # gone, and that is the point
+          status: planned            # not built yet -- refs may dangle
+          statement: "A scene advances when its beat completes"
+          counterexample: "A scene that advances with its beat unresolved"
+          trackedBy: ["acme/game#412"]
+          implementedBy: ["game::turn::BeatProgression"]   # does not exist YET
 
 - requirement.architectural:
     name: UuidPrimaryKeys
     status: live
     statement: "Every entity has a uuid primary key"
-    violation: "An entity keyed by a composite string"
+    counterexample: "An entity keyed by a composite string"
     implementedBy: ["game::turn::Turn", "game::world::Location"]
 ```
 

package/agent-context/skills/metaobjects-codegen/SKILL.md

@@ -61,8 +61,9 @@ name** (kebab-case) that surfaces in diagnostics — reference generators by tha
 name, never by inlining what they emit. Typical generators cover: the entity
 type/model, the DB table/schema, query/finder helpers, REST routes, client
 form/grid/hook artifacts, filter + sort allowlists, payload value-objects, and
-`template.output` parsers. You enable the subset your project needs; an abstract
-entity never emits instance/write artifacts regardless.
+parsers for a responding `template.prompt` (one carrying `@responseRef`). You
+enable the subset your project needs; an abstract entity never emits
+instance/write artifacts regardless.
 
 Per-entity opt-outs exist (e.g. skipping client-side artifacts for a given
 entity) and are set as attributes on the entity in metadata, not in code.
@@ -103,7 +104,7 @@ the data access too.
   `origin.aggregate` (`@agg` `count`/`sum`/`avg`/`min`/`max`, plus the #195
   `any`/`all` predicate quantifiers over a `@filter` and `collect` array-rollup with
   optional `@distinct`/`@orderBy`; any aggregate may be row-scoped with `@filter`),
-  `origin.collection` (a nested array), `origin.computed` (a row-level `@expr`), and
+  `origin.computed` (a row-level `@expr`), and
   `origin.first` (one related row's column along `@via`/`@of`/`@orderBy`) — **and a
   read-only `source.rdb` `@kind: view` child** (codegen detects a projection by that
   read-only source, not by the subtype alone — omit it and nothing is generated).

package/agent-context/skills/metaobjects-codegen/references/csharp.md

@@ -45,8 +45,8 @@ or run the default set. Output lands under `--namespace` in `--output-dir`.
 | `routes` | `<Entity>Routes.cs` — ASP.NET **Minimal API** CRUD per writable entity (`source.rdb @kind="table"`) on the cross-port REST contract (`?filter[field][op]=`, `?sort=field:asc`, `?limit`/`?offset`, `?withCount=1` envelope, 400/404 envelopes). A TPH base emits polymorphic `GET /<base>(+/{id})` + a per-subtype CRUD set at `/<base>/<discriminatorValue lowercased>` (create injects the discriminator, cross-subtype get/update/delete → 404). |
 | `filter-allowlist` | per-entity `<Entity>FilterAllowlist` (FR-009 — the server-side field+operator allowlist the routes validate against). |
 | `callable` | `<Entity>.callable.g.cs` — an FR-015 calling method for a `source.rdb @kind="storedProc"|"tableFunction"`, via EF `FromSqlInterpolated` (args from the `@parameterRef` value object in declaration order). |
-| `payload` | `<Payload>.payload.cs` — the strict typed payload `record` (+ any nested element records) per `template.output` `@payloadRef` (an `object.value`) that the parser/extractor bind to. |
-| `output-parser` / `extractor` / `output-prompt` / `render-helper` | the `template.output` prompt-pillar artifacts — the strict parser, the tolerant `extract`, the **output-format prompt fragment** (`output-prompt`; presentation via `@promptStyle: guide`/`inline`/`exampleOnly`), and the typed render helper. See the **prompts** reference. |
+| `payload` | `<Payload>.payload.cs` — the strict typed payload `record` (+ any nested element records) per `template.prompt` `@payloadRef` / `@responseRef` (each an `object.value`): `@payloadRef` types the REQUEST, `@responseRef` the REPLY the parser/extractor bind to. |
+| `output-parser` / `extractor` / `output-prompt` / `render-helper` | the prompt-pillar artifacts for a **responding `template.prompt`** — one carrying `@responseRef` (ADR-0052: these tiers are INBOUND; `template.output` is outbound only and emits no parser). The strict parser, the tolerant `extract`, the **output-format prompt fragment** (`output-prompt`; presentation via `@promptStyle: guide`/`inline`/`exampleOnly`), and the typed render helper. See the **prompts** reference. |
 | `template` | the generic Mustache `templateGenerator()` primitive. |
 
 Metadata lives under `metaobjects/` (or wherever you point `--metadata-dir`) in the

package/agent-context/skills/metaobjects-codegen/references/java.md

@@ -101,8 +101,8 @@ separate `metaobjects-codegen-base` module instead.)
 | `SpringRepositoryGenerator` | `<Entity>Repository.java` — a hand-stubbed `interface` the consumer implements with their persistence layer (Spring Data JPA / jOOQ / JDBC). For a TPH base the interface is polymorphic + per-subtype-scoped (`listByType`/`findByIdAndType`/`createWithType`/`updateByIdAndType`/`deleteByIdAndType`) over the single table; subtype entities emit no own controller/DTO/repository — they fold into the base. |
 | `SpringValueObjectGenerator` | a Java 21 `record` per `object.value` reached through a `field.object @storage: jsonb` column (single or `@isArray`, transitively through nested VOs) — the typed component the Jackson jsonb codec serializes to/from (carries jakarta validation, unlike a plain payload record). Program D typed-jsonb VOs. |
 | `SpringPayloadGenerator` | a Java 21 `record` per `template` payload VO |
-| `SpringOutputParserGenerator` | the `template.output` strict parser-on-receipt (see the prompts reference) |
-| `SpringOutputPromptGenerator` | the FR-010 output-format prompt fragment for a `template.output` (presentation via `@promptStyle: guide`/`inline`/`exampleOnly`) |
+| `SpringOutputParserGenerator` | the strict parser-on-receipt for a **responding `template.prompt`** — one carrying `@responseRef` (ADR-0052: INBOUND; a `template.output` emits no parser). See the prompts reference. |
+| `SpringOutputPromptGenerator` | the FR-010 output-format prompt fragment for a responding `template.prompt` (presentation via `@promptStyle: guide`/`inline`/`exampleOnly`) |
 | `SpringRenderHelperGenerator` | the typed render helper for a `template.prompt` payload |
 | `LlmTraceHelperGenerator` | `<Entity>TraceHelper.java` per concrete entity — the LLM-trace helper |
 | `SpringFilterAllowlistGenerator` | per-entity filter allowlist |
@@ -114,7 +114,7 @@ separate `metaobjects-codegen-base` module instead.)
 only). Its `CREATE VIEW` DDL is emitted by the Node `meta migrate` from the
 projection's `origin.*` children — `origin.passthrough`, `origin.aggregate` (`@agg`
 `count`/`sum`/`avg`/`min`/`max`, plus the #195 `any`/`all` quantifiers over a `@filter`
-and `collect` array-rollup with `@distinct`/`@orderBy`), `origin.collection`,
+and `collect` array-rollup with `@distinct`/`@orderBy`),
 `origin.computed` (`@expr`), `origin.first`; an object-level `@filter` scopes the whole
 view's rows (#207 — lowers to the outer `WHERE`). Never hand-author the view SQL for a
 shape origins can express (an unmodeled view is unmanaged and drifts silently); carry a

package/agent-context/skills/metaobjects-codegen/references/kotlin.md

@@ -114,9 +114,9 @@ All live in `metaobjects-codegen-kotlin` under
 | `KotlinSpringControllerGenerator` | `<Entity>Controller.kt` — Spring `@RestController`, five CRUD endpoints on the cross-port REST contract, for writable entities (`source.rdb` `@kind="table"`). A TPH `@discriminator` base emits ONE controller: polymorphic `GET /<base>(+/{id})` plus a per-subtype CRUD set at `/<base>/<discriminatorValue lowercased>` — create injects the discriminator from the URL (never the body); get/update/delete are scoped to the subtype (cross-subtype → 404); the discriminator is immutable. |
 | `KotlinRepositoryGenerator` | `<Entity>RepositoryBase.kt` — an `open class` consumer persistence seam per writable entity (the Kotlin peer of Java's `SpringRepositoryGenerator`, but with method bodies). Carries the #203 `@autoSet` CRUD stamping: `onCreate` columns stamped once at insert, `onUpdate` columns re-stamped on every write, both excluded from the caller-supplied set. |
 | `KotlinPayloadGenerator` | `<Template>Payload.kt` — `@Serializable` payload data class from a template's `@payloadRef` |
-| `KotlinOutputParserGenerator` | the `template.output` strict parser-on-receipt (see the prompts reference) |
-| `KotlinExtractorGenerator` | the FR-010 tolerant `extract` mapper for a `template.output` (all-nullable mirror → strict payload) |
-| `KotlinOutputPromptGenerator` | the FR-010 output-format prompt fragment for a `template.output` (presentation via `@promptStyle: guide`/`inline`/`exampleOnly`) |
+| `KotlinOutputParserGenerator` | the strict parser-on-receipt for a **responding `template.prompt`** — one carrying `@responseRef` (ADR-0052: INBOUND; a `template.output` emits no parser). See the prompts reference. |
+| `KotlinExtractorGenerator` | the FR-010 tolerant `extract` mapper for a responding `template.prompt` (all-nullable mirror → strict payload) |
+| `KotlinOutputPromptGenerator` | the FR-010 output-format prompt fragment for a responding `template.prompt` (presentation via `@promptStyle: guide`/`inline`/`exampleOnly`) |
 | `KotlinRenderHelperGenerator` | the typed render helper for a `template.prompt` payload |
 | `KotlinValidatorGenerator` | `MetadataStartupValidator.kt` + `ExposedTableValidator.kt` (once per project) |
 | `KotlinSpringConfigGenerator` | `MetadataExposedConfig.kt` — `@Configuration` wiring `Database.connect()` + the startup validator (once per project) |
@@ -129,7 +129,7 @@ wrapper (same column mapping, no write path). The `CREATE VIEW` DDL is emitted b
 Node `meta migrate` from the projection's `origin.*` children — `origin.passthrough`,
 `origin.aggregate` (`@agg` `count`/`sum`/`avg`/`min`/`max`, plus the #195 `any`/`all`
 quantifiers over a `@filter` and `collect` array-rollup with `@distinct`/`@orderBy`),
-`origin.collection`, `origin.computed` (`@expr`), `origin.first`; an object-level
+`origin.computed` (`@expr`), `origin.first`; an object-level
 `@filter` scopes the whole view's rows (#207 — lowers to the outer `WHERE`). Never
 hand-author the view SQL for a shape origins can express (an unmodeled view is unmanaged
 and drifts silently); carry a genuinely irreducible body (recursive CTE, window function,

package/agent-context/skills/metaobjects-codegen/references/python.md

@@ -50,13 +50,13 @@ a renamed physical column).
 | `entity` | one **Pydantic model** per `object.entity` / projection (the `entity-model` generator): typed fields from the metadata, nullability from `@required`, `@maxLength`/validators, enum fields → a Python `Enum`. This is the typed data model. A TPH concrete subtype (`@discriminatorValue`) pins the inherited `@discriminator` field to a `Literal[...]` so the model rejects a foreign-subtype tag. |
 | `routes` | a **FastAPI `APIRouter`** per writable entity (`source.rdb @kind="table"`) on the cross-port REST contract (`?filter[field][op]=`, `?sort=field:asc`, `?limit`/`?offset`, `?withCount=1` envelope, 400/404 envelopes). The router declares a repository **`Protocol`** you implement and inject. A TPH `@discriminator` base emits ONE polymorphic router: `GET /<base>(+/{id})` plus a per-subtype CRUD set at `/<base>/<discriminatorValue lowercased>` — create injects the discriminator from the URL (never the body); get/update/delete scoped to the subtype (cross-subtype → 404); discriminator immutable. Its repository `Protocol` is subtype-keyed (`subtype=None` for the polymorphic base) so your implementation applies the single-table discriminator scope. |
 | `filter-allowlist` | per-entity filter allowlist (FR-009 — the server-side field+operator allowlist the routes validate against). |
-| `payload` / `output-parser` / `output-prompt` / `extractor` / `render-helper` / `trace-helper` | the `template.output` prompt-pillar artifacts — the payload VO, the strict parser, the **output-format prompt fragment** (`output-prompt`; presentation via `@promptStyle: guide`/`inline`/`exampleOnly`), the tolerant `extract`, the typed render helper, and the LLM-trace helper. See the **prompts** reference. |
+| `payload` / `output-parser` / `output-prompt` / `extractor` / `render-helper` / `trace-helper` | the prompt-pillar artifacts for a **responding `template.prompt`** — one carrying `@responseRef` (ADR-0052: these tiers are INBOUND; `template.output` is outbound only and emits no parser). The payload VO, the strict parser (`<template>_response_parser`), the **output-format prompt fragment** (`<template>_response_format`; presentation via `@promptStyle: guide`/`inline`/`exampleOnly`), the tolerant `extract`, the typed render helper, and the LLM-trace helper. See the **prompts** reference. |
 | `template` | the generic Mustache `template` primitive. |
 
 **Projections + entity read-views.** An `object.projection` (read-only `source.rdb`
 `@kind: view` child) gets a read-only Pydantic model from the `entity` generator; its
 `CREATE VIEW` DDL is emitted by the Node `meta migrate` from the projection's `origin.*`
-children (`passthrough` / `aggregate` / `collection` / `computed` / `first`) — never
+children (`passthrough` / `aggregate` / `computed` / `first`) — never
 hand-write the view SQL for a shape origins can express. An `object.entity` that adds a
 `@role: replica` `@kind: view` source alongside its writable `table` is a write-through
 **entity read-view** (#214): the generated read model carries the derived `origin.*`

package/agent-context/skills/metaobjects-codegen/references/typescript.md

@@ -78,7 +78,7 @@ From `@metaobjectsdev/codegen-ts/generators` (server-side, framework-neutral):
 | `routesFile()` | `<Entity>.routes.ts` — Fastify CRUD routes on the cross-port REST contract. `routesFileHono()` is the Hono/Workers variant. A TPH `@discriminator` base mounts polymorphic `GET /<base>(+/:id)` plus a per-subtype CRUD set at `<basePath>/<discriminatorValue lowercased>` — create omits the discriminator (the URL names the subtype; the runtime injects it); get/update/delete scoped to the subtype (cross-subtype → 404); discriminator immutable via the runtime `discriminator` option. |
 | `barrel()` | `index.ts` re-exporting each `<Entity>.ts` (one-shot, not per-entity) |
 | `promptRender()` | `render<Name>()` per `template.prompt` |
-| `outputParser()` | `<Name>.output.ts` (`parse*` / `safeParse*`) per `template.output` |
+| `outputParser()` | `<Name>.response.ts` (`parse*` / `safeParse*`) per **responding `template.prompt`** — one carrying `@responseRef` (ADR-0052: this tier is INBOUND; `template.output` is outbound only and emits nothing here). Siblings: `outputPrompt()` → `<Name>.responseFormat.ts` (the FR-010 output-format fragment, presentation via `@promptStyle`), `extractor()` → `<Name>.extractor.ts` (the tolerant `extract` mapper). |
 | `callableFile()` | `<Entity>.callable.ts` — an FR-015 `call<Entity>` wrapper for a `source.rdb` `@kind: storedProc`/`tableFunction` (args from the `@parameterRef` value object, in declaration order) |
 
 **Projections (read-only views).** For an `object.projection` (a read-only `source.rdb`
@@ -87,8 +87,8 @@ finder (no create/update/delete). The `CREATE VIEW` DDL is generated by `meta mi
 from the projection's `origin.*` children — `origin.passthrough` (a forwarded column),
 `origin.aggregate` (`@agg` `count`/`sum`/`avg`/`min`/`max`, plus the #195 `any`/`all`
 predicate quantifiers over a `@filter` and `collect` array-rollup with optional
-`@distinct`/`@orderBy`; any aggregate row-scoped with `@filter`), `origin.collection` (a
-nested array), `origin.computed` (a row-level `@expr`), `origin.first` (one related row's
+`@distinct`/`@orderBy`; any aggregate row-scoped with `@filter`),
+`origin.computed` (a row-level `@expr`), `origin.first` (one related row's
 column along `@via`/`@of`/`@orderBy`). An object-level `@filter` on the projection scopes
 the whole view's rows (#207 — lowers to the outer `WHERE`, the metadata-managed
 soft-delete/status view). **Never hand-write the view SQL** for a shape origins can