fix(library): iam/db shipped four indexes with one name, so it could not migrate

`libraries: ["iam/db"]` on 1.0.4 dies on the first `meta migrate`:

  ERR_DUPLICATE_SQL_NAME: "uqKey" <- index "uqKey" on table "iam_group_type"
  + index "uqKey" on table "iam_group" + ... "iam_role" + ... "iam_permission"

Four entities each named their `identity.secondary` `uqKey`. That is unambiguous
per entity and wrong per database, which is the scope index names actually have.
They are now uqGroupTypeKey / uqGroupKey / uqRoleKey / uqPermissionKey. No adopter
can be holding the old schema: the migrate that would have created it is the one
that failed. Found by following docs/features/libraries.md end to end on published
1.0.4 in an empty project.

The gate that let it ship: `shipped-library-verify` loaded each library and ran
the requirement checks over it, and neither of those builds a schema. It now also
builds a sqlite and a postgres schema for every db layer and asserts index names
are distinct. It fails on both dialects without the rename.

Also corrects the doc claim the same run disproved: opting into a core layer adds
"zero tables and zero generated code". Zero tables is right; the entity generator,
where it is wired, emits a type-only module per library entity — 10 of them for
`["iam"]` — which the very next paragraph already said.

The spec's worked example carried the same four `uqKey` lines; renamed there too,
so the next library copied from it does not inherit the collision.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: dmealing

CHANGELOG.md

@@ -48,6 +48,15 @@ edit (two registered `description` strings) and was ruled a hold, as 1.0.4's was
   recorded writing (`.gen-state/.hashes.json`) is now reported as ordinary stale output with
   the `meta gen` remedy. An edited one, or one with no recorded hash, is still convicted as
   before.
+- **`libraries: ["iam/db"]` could not migrate at all.** The library named four
+  `identity.secondary` nodes `uqKey` — legal metadata, and unambiguous per entity, but
+  index names are unique per DATABASE, so the first `meta migrate` in any project that
+  opted in died on `ERR_DUPLICATE_SQL_NAME` before writing a table. They are now
+  `uqGroupTypeKey`, `uqGroupKey`, `uqRoleKey` and `uqPermissionKey`. Nobody can have
+  applied the old schema, because the migrate that would have created it is the one
+  that failed. The shipped-library gate now builds a sqlite AND a postgres schema for
+  every library db layer and asserts index names are distinct — loading and verifying,
+  which is all it did before, never build a schema.
 - **A requirement whose implementing member was renamed no longer says to qualify the object.**
   Rename `dueDate` in the model and a live claim on `app::Task.dueDate` failed with
   `ERR_REQUIREMENT_DANGLING_REF`, then added *"An object named "Task" exists in: app::Task.

docs/features/libraries.md

@@ -31,8 +31,10 @@ A library ships its **core model**, its **DB persistence** and (where it has one
 contract that already shipped.** `meta migrate` skips an object with no writable source
 and codegen emits no route, queries, hooks, grid or form for one (both citing #248:
 persistability derives from source presence, never from the object subtype). So
-`libraries: ["iam"]` adds **zero tables and zero generated code**. The design is
-present and resolvable; the schema is a second, separate decision.
+`libraries: ["iam"]` adds **zero tables, and no persistence, API or client code**. The
+design is present and resolvable; the schema is a second, separate decision. The entity
+generator, if you have wired it, does emit one type-only module per library entity —
+which is the next paragraph, and the whole of what the core layer costs you.
 
 A sourceless object still gets a type-only interface, so `extends` and references work
 against it from day one.

docs/superpowers/specs/2026-09-13-fr-043-feature-and-nfr-packages-design.md

@@ -589,7 +589,7 @@ metadata:
           - field.string: { name: name, required: true, maxLength: 120 }
           - field.string: { name: description, maxLength: 500 }
           - identity.primary:   { name: pk, fields: [id], generation: uuid }
-          - identity.secondary: { name: uqKey, fields: [key] }
+          - identity.secondary: { name: uqGroupTypeKey, fields: [key] }
 
     - object.entity:
         name: Group
@@ -602,7 +602,7 @@ metadata:
           - field.string: { name: name, required: true, maxLength: 120, filterable: true }
           - field.string: { name: description, maxLength: 500 }
           - identity.primary:   { name: pk, fields: [id], generation: uuid }
-          - identity.secondary: { name: uqKey, fields: [key] }
+          - identity.secondary: { name: uqGroupKey, fields: [key] }
           - identity.reference: { name: fkGroupType, fields: [groupTypeId], references: GroupType, onDelete: restrict }
           - identity.reference: { name: fkParent,    fields: [parentId],    references: Group,     onDelete: restrict }
           - index.lookup: { name: ixParent, fields: [parentId] }
@@ -617,7 +617,7 @@ metadata:
           - field.string: { name: description, maxLength: 500 }
           - field.uuid:   { name: groupTypeId, description: "When set, this role may be held only within groups of this type; absent means grantable anywhere." }
           - identity.primary:   { name: pk, fields: [id], generation: uuid }
-          - identity.secondary: { name: uqKey, fields: [key] }
+          - identity.secondary: { name: uqRoleKey, fields: [key] }
           - identity.reference: { name: fkGroupType, fields: [groupTypeId], references: GroupType, onDelete: restrict }
           - relationship.association: { name: permissions, objectRef: Permission, cardinality: many, through: RolePermission }
 
@@ -629,7 +629,7 @@ metadata:
           - field.string: { name: key, required: true, maxLength: 128, description: "Stable <resource>:<action> key the application checks against." }
           - field.string: { name: description, maxLength: 500 }
           - identity.primary:   { name: pk, fields: [id], generation: uuid }
-          - identity.secondary: { name: uqKey, fields: [key] }
+          - identity.secondary: { name: uqPermissionKey, fields: [key] }
 
     # ---- grant surface: every grant is a row, addressed by its participants ----
 

library/iam/model.yaml

@@ -64,7 +64,7 @@ metadata:
           - field.string: { name: name, required: true, maxLength: 120 }
           - field.string: { name: description, maxLength: 500 }
           - identity.primary:   { name: pk, fields: [id], generation: uuid }
-          - identity.secondary: { name: uqKey, fields: [key] }
+          - identity.secondary: { name: uqGroupTypeKey, fields: [key] }
 
     - object.entity:
         name: Group
@@ -78,7 +78,7 @@ metadata:
           - field.string: { name: name, required: true, maxLength: 120 }
           - field.string: { name: description, maxLength: 500 }
           - identity.primary:   { name: pk, fields: [id], generation: uuid }
-          - identity.secondary: { name: uqKey, fields: [key] }
+          - identity.secondary: { name: uqGroupKey, fields: [key] }
           - identity.reference: { name: fkGroupType, fields: [groupTypeId], references: GroupType, onDelete: restrict }
           - identity.reference: { name: fkParent,    fields: [parentId],    references: Group,     onDelete: restrict }
 
@@ -92,7 +92,7 @@ metadata:
           - field.string: { name: description, maxLength: 500 }
           - field.uuid:   { name: groupTypeId, description: "When set, this role may be held only within groups of this type; absent means grantable anywhere." }
           - identity.primary:   { name: pk, fields: [id], generation: uuid }
-          - identity.secondary: { name: uqKey, fields: [key] }
+          - identity.secondary: { name: uqRoleKey, fields: [key] }
           - identity.reference: { name: fkGroupType, fields: [groupTypeId], references: GroupType, onDelete: restrict }
           - relationship.association: { name: permissions, objectRef: Permission, cardinality: many, through: RolePermission }
 
@@ -104,7 +104,7 @@ metadata:
           - field.string: { name: key, required: true, maxLength: 128, description: "Stable <resource>:<action> key the application checks against." }
           - field.string: { name: description, maxLength: 500 }
           - identity.primary:   { name: pk, fields: [id], generation: uuid }
-          - identity.secondary: { name: uqKey, fields: [key] }
+          - identity.secondary: { name: uqPermissionKey, fields: [key] }
 
     # ---- grant surface: every grant is a row, addressed by its participants ----
     #

server/csharp/MetaObjects/Library/EmbeddedLibrary.cs

@@ -23,6 +23,7 @@ import {
   checkRequirements, summariseRequirements, scanRequirements,
 } from "../src/lib/requirement-check.js";
 import { lintRequirements } from "../src/lib/requirement-lint.js";
+import { buildExpectedSchema } from "@metaobjectsdev/migrate-ts";
 
 const TOKENS = knownLibraryTokens();
 
@@ -84,3 +85,34 @@ describe("every shipped library verifies standalone (FR-043 §8 item 2)", () =>
     });
   }
 });
+
+// A library's DB layer has to produce a SCHEMA, not just load and verify. `iam/db`
+// shipped in 1.0.4 naming four `identity.secondary` nodes `uqKey` — legal metadata,
+// and legal per-entity — but index names are unique per DATABASE, so the first
+// `meta migrate` in any project that opted in died on ERR_DUPLICATE_SQL_NAME before
+// writing a table. The gates above could not see it: loading and verifying never
+// build a schema. Both dialects, because the collision is in the shared naming pass.
+describe("every shipped library's db layer builds a schema (both dialects)", () => {
+  const DB_TOKENS = TOKENS.filter((t) => t.includes("/db"));
+
+  test("there is a db layer to gate", () => {
+    expect(DB_TOKENS.length).toBeGreaterThan(0);
+    expect(DB_TOKENS).toContain("iam/db");
+  });
+
+  for (const token of DB_TOKENS) {
+    for (const dialect of ["sqlite", "postgres"] as const) {
+      test(`\`${token}\` builds a ${dialect} schema with no duplicate SQL name`, async () => {
+        const result = await new MetaDataLoader({ strict: true }).load(librarySources([token]));
+        expect(result.errors, `${token} errors`).toEqual([]);
+        const snapshot = buildExpectedSchema(result.root, { dialect });
+        expect(snapshot.tables.length).toBeGreaterThan(0);
+        // State the invariant the engine enforces, so a regression names itself here
+        // rather than in an adopter's first migrate.
+        const indexNames = snapshot.tables.flatMap((t) => (t.indexes ?? []).map((i) => i.name));
+        expect(new Set(indexNames).size, `duplicate index name in ${token}: ${indexNames.join(", ")}`)
+          .toBe(indexNames.length);
+      });
+    }
+  }
+});