@@ -17,7 +17,7 @@ Equal weight — all four ship per-language today across the five ports (TS / C#
 
 ## Status
 
-_Last refreshed 2026-09-08._
+_Last refreshed 2026-09-09._
 
 **1.0 gating — the quiet period is RETIRED (2026-09-06).** `docs/1.0-readiness.md` §G3 no
 longer asks for "one coordinated release with no metamodel-breaking change." It measured a
@@ -37,7 +37,8 @@ in ADR-0035 **Amendment 3**. Do not reintroduce a waiting gate in any form.
 **Where the versions are.** `latest` on every registry is **`1.0.0`** (npm / PyPI / NuGet) ·
 **`8.0.0`** (Maven Central, aligned `minor.patch` on its historical major `7` — the Maven
 major is always **npm major + 7**, so 1.0.0 is 8.0.0). **1.0 is CUT**: the `1.0.0-rc.5`
-through `rc.8` candidates are superseded and their npm `next` tag is retired.
+through `rc.8` candidates are superseded, and npm's `next` tag was REPOINTED onto `1.0.0` —
+not deleted, because `dist-tag rm` 403s for every token we hold (`docs/RELEASING.md` §4).
 `metamodelVersion` reads **`1.0`**, frozen — C4 landed and G4 shipped it. Per-release detail
 lives in **`CHANGELOG.md`** — it is the log, and this file does not duplicate it.
 
 
@@ -93,11 +93,11 @@ first-week wedge plan — and `meta init` picks up from there.
 
 | Language | Status | Quickstart | Source |
 |---|---|---|---|
-| TypeScript | Published to npm at `1.0.0` (the `@metaobjectsdev/*` packages) | [`docs/ports/typescript.md`](docs/ports/typescript.md) | [`server/typescript/`](server/typescript/) · [`client/web/`](client/web/) |
-| Java | Loader + OMDB + render + Maven plugin all shipped; full conformance green | [`docs/ports/java.md`](docs/ports/java.md) | [`server/java/`](server/java/) |
-| Kotlin | Codegen tier on top of Java — 14 generators (entity, Exposed table, relations, repository, payload, output-parser, output-prompt, render-helper, extractor, filter-allowlist, validator, Spring config, storedProc, Spring controller); 24 / 24 persistence-conformance | [`docs/ports/kotlin.md`](docs/ports/kotlin.md) | [`server/java/codegen-kotlin/`](server/java/codegen-kotlin/) · [`server/java/metadata-ktx/`](server/java/metadata-ktx/) |
-| C# | Loader + conformance + EF Core codegen + render engine + `dotnet meta` CLI all shipped | [`docs/ports/csharp.md`](docs/ports/csharp.md) | [`server/csharp/`](server/csharp/) |
-| Python | Loader + conformance + render + entity-model codegen + ObjectManager runtime shipped; schema migrations are TS-owned (ADR-0015) | [`docs/ports/python.md`](docs/ports/python.md) | [`server/python/`](server/python/) |
+| TypeScript | **npm `1.0.0`** — the `@metaobjectsdev/*` packages | [`docs/ports/typescript.md`](docs/ports/typescript.md) | [`server/typescript/`](server/typescript/) · [`client/web/`](client/web/) |
+| Java | **Maven Central `8.0.0`** (`com.metaobjects:*` — the JVM major is npm major + 7) — loader + OMDB + render + Maven plugin all shipped; full conformance green | [`docs/ports/java.md`](docs/ports/java.md) | [`server/java/`](server/java/) |
+| Kotlin | **Maven Central `8.0.0`** — codegen tier on top of Java: 14 generators (entity, Exposed table, relations, repository, payload, output-parser, output-prompt, render-helper, extractor, filter-allowlist, validator, Spring config, storedProc, Spring controller); 24 / 24 persistence-conformance | [`docs/ports/kotlin.md`](docs/ports/kotlin.md) | [`server/java/codegen-kotlin/`](server/java/codegen-kotlin/) · [`server/java/metadata-ktx/`](server/java/metadata-ktx/) |
+| C# | **NuGet `1.0.0`** — loader + conformance + EF Core codegen + render engine + `dotnet meta` CLI all shipped | [`docs/ports/csharp.md`](docs/ports/csharp.md) | [`server/csharp/`](server/csharp/) |
+| Python | **PyPI `1.0.0`** — loader + conformance + render + entity-model codegen + ObjectManager runtime shipped; schema migrations are TS-owned (ADR-0015) | [`docs/ports/python.md`](docs/ports/python.md) | [`server/python/`](server/python/) |
 
 ## Capability matrix
 
 
@@ -31,7 +31,10 @@ by exactly one release.
 - [ ] `docs/ports/java.md` — Maven `<version>` + artifact list.
 - [ ] `docs/ports/kotlin.md` — Maven `<version>`.
 - [ ] `docs/ports/python.md` — PyPI version + `pip install`.
-- [ ] `docs/features/extending-with-providers.md` — the "parity status as of `<ver>`" marker.
+- [ ] `docs/features/extending-with-providers.md` — **no version edit any more.** Its
+      "Cross-port parity status" table reads `Shipped` for all five ports with no version
+      scope, so there is no "as of `<ver>`" marker left to refresh (checked at the 1.0 cut).
+      Re-add one here only if parity ever becomes version-scoped again.
 - [ ] `docs/RELEASING.md` / `docs/RELEASING-java.md` — the "currently `<ver>`" notes.
 - [ ] `.github/workflows/publish-*.yml` — **no version edits by design.** All four
       publish workflows read the version from the committed manifest
 
@@ -314,10 +314,24 @@ for (const rel of ["docs/llms/llms.txt", "docs/llms/llms-full.txt"]) {
 ok("the llms mirrors state this release");
 
 // ── 6. the tag the DEPLOY will resolve is the one being cut ──────────────────
-// The repo carries two tag lines and `sort -V` over a bare `v*` returns v7.20.12, which
-// has no examples/showcase at all. This mirrors deploy.yml's own filter, so a change to
-// either is caught here rather than on a deploy nobody is watching.
-const resolved = out(`git tag -l 'v0.*' | grep -E '^v0\\.[0-9]+\\.[0-9]+$' | sort -V | tail -1 || true`);
+// MIRRORS deploy.yml's own selector, so a change to either is caught here rather than on
+// a deploy nobody is watching. The repo carries two tag lines and `sort -V` over a bare
+// `v*` returns v7.20.12 — the JVM-only line, which has no examples/showcase at all.
+//
+// It matches deploy.yml by testing the property that DEFINES the npm line — a release tag
+// ships a `cli/package.json` versioned as the tag (v1.0.0 ships cli 1.0.0; v7.20.12 ships
+// cli 0.20.11) — and NOT a version prefix. This gate used to filter `v0.*`, which was true
+// until it wasn't: a prefix match does not fail when it goes stale, it silently selects the
+// newest tag of a frozen line and passes green forever. After the 1.0 cut it would have
+// resolved v0.25.0 at every future release, so the check could never fire again — the same
+// defect that kept the live site on 0.25.0 with every deploy step green. Nothing here needs
+// maintaining at the next major.
+const resolved = out(`git tag -l 'v*' | grep -E '^v[0-9]+\\.[0-9]+\\.[0-9]+$' | sort -rV || true`)
+  .split("\n").map((t) => t.trim()).filter(Boolean)
+  .find((t) => {
+    const pkg = out(`git show ${t}:server/typescript/packages/cli/package.json 2>/dev/null || true`);
+    try { return JSON.parse(pkg).version === t.slice(1); } catch { return false; }
+  }) ?? "";
 const wouldResolve = [resolved, tag].filter(Boolean).sort((a, b) =>
   a.localeCompare(b, undefined, { numeric: true })).at(-1);
 if (wouldResolve !== tag) {
 
@@ -71,8 +71,13 @@ type Spec = {
   manifest?: Partial<Coords>;
   /** Whole-file body for both mirrors. Defaults to one consistent with `payload`. */
   llms?: string;
-  /** Extra tags to create locally before the run (gate 6's tag line). */
+  /** Extra tags to create locally before the run (gate 6's tag line). Each is cut on its
+   *  own commit stamping `cli/package.json` at the tag's own version, because that
+   *  agreement is what identifies the npm release line. */
   tags?: string[];
+  /** Per-tag override of the stamped `cli` version, for a tag that must NOT read as the
+   *  npm line (the JVM `v7.20.12` ships cli `0.20.11`). */
+  tagCli?: Record<string, string>;
   /** Files the tree deliberately does NOT carry (gate 4 / gate 5). */
   omit?: string[];
   /** Verbatim overrides, applied last. */
@@ -164,7 +169,32 @@ function makeRepo(spec: Spec = {}): Fixture {
   git(work, "commit", "--quiet", "-m", "fixture");
   git(work, "remote", "add", "origin", origin);
   git(work, "push", "--quiet", "-u", "origin", "main");
-  for (const t of spec.tags ?? []) git(work, "tag", t);
+  // A prior release tag must name a tree that AGREES with it. The site deploy — and the
+  // gate that mirrors it — identifies the npm release line by the intrinsic property that
+  // a tag `vX.Y.Z` ships `cli/package.json` at X.Y.Z, NOT by a version prefix (a prefix
+  // goes stale silently at a major: `v0.*` kept resolving v0.25.0 after the 1.0 cut and
+  // passed green forever). Tagging every version at one commit made every tag disagree
+  // with itself, so the fixture gives each its own commit and returns to the release tree.
+  // `tagCli` overrides the stamped version for a tag that must NOT count as the npm line —
+  // the real `v7.20.12` is the JVM line and ships cli `0.20.11`, which is why it is skipped.
+  const cliRel = "server/typescript/packages/cli/package.json";
+  const cliPath = join(work, cliRel);
+  const releaseCli = readFileSync(cliPath, "utf8");
+  const tags = spec.tags ?? [];
+  for (const t of tags) {
+    const stamped = spec.tagCli?.[t] ?? t.replace(/^v/, "");
+    writeFileSync(cliPath,
+      `${JSON.stringify({ name: "@metaobjectsdev/cli", version: stamped }, null, 2)}\n`);
+    // --allow-empty: a tag naming the version being cut (gate 2's local-only case) stamps
+    // a value the tree already has, and "nothing to commit" is an error, not a no-op.
+    git(work, "commit", "--quiet", "-a", "--allow-empty", "-m", `prior release ${t}`);
+    git(work, "tag", t);
+  }
+  if (tags.length > 0) {
+    writeFileSync(cliPath, releaseCli);
+    git(work, "commit", "--quiet", "-a", "--allow-empty", "-m", "back to the release tree");
+    git(work, "push", "--quiet", "origin", "main");
+  }
   if (spec.breakOrigin === true) rmSync(origin, { recursive: true, force: true });
 
   return {
@@ -458,21 +488,39 @@ describe("finish-release gate 5: the llms mirrors state this release", () => {
 });
 
 describe("finish-release gate 6: the tag the deploy will resolve", () => {
-  // The deploy resolves `git tag -l 'v0.*' | grep -E '^v0\.[0-9]+\.[0-9]+$' | sort -V |
-  // tail -1`. This mirrors that filter, so a change to either is caught here rather than
-  // on a deploy nobody is watching — and the comparison is NUMERIC, which a plain string
-  // sort gets wrong at every ten-fold boundary.
+  // The deploy walks `git tag -l 'v*'` newest-first and takes the first tag whose
+  // `cli/package.json` is versioned AS the tag. This mirrors that selector, so a change to
+  // either is caught here rather than on a deploy nobody is watching — and the comparison
+  // is NUMERIC, which a plain string sort gets wrong at every ten-fold boundary.
+  //
+  // It deliberately does NOT mirror a version prefix. Both sides used to filter `v0.*`,
+  // which was true until the 1.0 cut and then silently resolved v0.25.0 forever: a prefix
+  // match selects a stale answer instead of failing, so the gate would have passed green
+  // at every future release while checking nothing.
   const cases: Array<{ existing: string[]; cutting: string; passes: boolean; why: string }> = [
     { existing: ["v0.9.0"], cutting: "0.10.0", passes: true, why: "0.10.0 is newer than 0.9.0" },
     { existing: ["v0.24.9"], cutting: "0.24.10", passes: true, why: "0.24.10 is newer than 0.24.9" },
     { existing: ["v0.10.0"], cutting: "0.9.0", passes: false, why: "0.9.0 is OLDER than 0.10.0" },
     { existing: ["v0.24.10"], cutting: "0.24.9", passes: false, why: "0.24.9 is OLDER than 0.24.10" },
+    // The two cases that a `v0.*` prefix filter gets WRONG, and the reason this suite could
+    // not catch the bug it shipped with: every case above lives on the 0.x line, where the
+    // prefix and the intrinsic property agree, so both selectors pass all of them. Once a
+    // 1.x tag exists the prefix stops seeing the newest release at all — it resolves the
+    // frozen v0.25.0 and waves through a tag the deploy will never resolve.
+    { existing: ["v0.25.0", "v1.1.0"], cutting: "1.0.1", passes: false,
+      why: "v1.1.0 outranks it — a v0.* filter would resolve v0.25.0 and pass" },
+    { existing: ["v0.25.0", "v1.0.0"], cutting: "1.0.1", passes: true,
+      why: "v1.0.0 is the newest on the npm line and 1.0.1 is newer still" },
   ];
   for (const c of cases) {
     test(`cutting v${c.cutting} over ${c.existing.join(",")} ${c.passes ? "passes" : "is refused"} — ${c.why}`, () => {
+      // The Maven major is npm major + 7, DERIVED — the literal `7.` this line used to
+      // carry is correct only while the npm line sits on 0.x, and the 1.x cases below
+      // would have failed the manifest-agreement gate for a reason that is not gate 6's.
+      const [maj, ...rest] = c.cutting.split(".");
       const coords: Coords = {
         npm: c.cutting, pypi: c.cutting, nuget: c.cutting,
-        maven: `7.${c.cutting.split(".").slice(1).join(".")}`,
+        maven: `${Number(maj) + 7}.${rest.join(".")}`,
       };
       const r = makeRepo({ payload: coords, manifest: coords, llms: llms(coords), tags: c.existing })
         .run(c.cutting, "--check");
@@ -487,9 +535,15 @@ describe("finish-release gate 6: the tag the deploy will resolve", () => {
   }
 
   // The repository carries two tag lines and a bare `v*` sort returns v7.20.12, a tree
-  // with no examples/showcase at all. The grep is what keeps the JVM line out.
+  // with no examples/showcase at all. What keeps the JVM line out is that its tree
+  // DISAGREES with it: the real v7.20.12 ships cli 0.20.11, not 7.20.12. That is a
+  // property of the tag itself, so it needs nothing maintained at the next major — unlike
+  // the prefix filter this replaced, which named the npm line by a digit that expired.
   test("the JVM tag line does not count as the newest tag", () => {
-    const r = makeRepo({ tags: ["v7.20.12", "v0.24.5"] }).run(RELEASE, "--check");
+    const r = makeRepo({
+      tags: ["v7.20.12", "v0.24.5"],
+      tagCli: { "v7.20.12": "0.20.11" },
+    }).run(RELEASE, "--check");
     expect(r.out).toContain(`the site deploy will resolve v${RELEASE}`);
     expect(r.code).toBe(0);
   });