fix: three review findings — a too-broad widening, a case-folding hole, a tense

Review of the preceding two commits found three defects in them.

1. The `expectError: true` widening was too broad, and weakened six cases to buy
one. `true` had a stronger meaning than the README's wording admitted, and all
three coded ports implemented it identically: "raises the port's coded metadata
error; WHICH code is unpinned". The type was pinned. Relaxing the whole arm to
bare Exception/`Throwable` so the symlink cycle could raise a native
IOException also relaxed `sources-must-be-an-array-not-an-object` and its five
siblings, which would now PASS on a raw NullReferenceException / NPE /
TypeError — a crash scoring as a correct rejection. The allowance is now scoped
to the single case that needs it via a new optional `errorIsNative`, the coded
type is required everywhere else, and the README says which of the two `true`
pins (the type) and which it does not (the code). TypeScript is unaffected and
stays loose: it propagates the raw parser error, which is why the code is
unpinned in the first place.

2. The cycle guard's ancestor set compared `StringComparer.Ordinal` while
`RealPath` necessarily mixes spellings — a non-link segment keeps the caller's
casing via `GetFullPath`, a resolved link comes back in the filesystem's
canonical casing. On a case-insensitive volume `MODEL/loop -> model` therefore
walked straight past the guard, back down to the kernel ELOOP floor that the new
immediacy test claims to have removed — and this is the one port whose
enumeration SWALLOWS ELOOP, so there is no backstop under it. Now Ordinal on
Linux (where `Model` and `model` are genuinely different directories and folding
would reject a valid tree) and case-insensitive elsewhere.

3. `--print-only` suppressed the writes but not the past-tense reporting, so a
dry run announced `wired @.metaobjects/AGENTS.md into CLAUDE.md` and `refreshed
version written to <path>.new` for edits it had not made. Worse than the silent
write it replaced: it names a side effect on a file the user owns, which they can
go look for and will not find. All three messages are future-tense under a dry
run, pinned by a test asserting no past-tense form survives.

That test caught its own fix at first: `\bcreated with\b` also matches the
CORRECT "(would be created with …)". Anchored.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: dmealing

fixtures/source-resolution-conformance/README.md

@@ -11,7 +11,7 @@ are read, `scope` filters what is emitted from them.
 ## Shape
 
 ```
-cases.json   # { cases: [{ name, tree, symlinks?, config, resolveFrom?, expectFiles?, expectError? }] }
+cases.json   # { cases: [{ name, tree, symlinks?, config, resolveFrom?, expectFiles?, expectError?, errorIsNative? }] }
 README.md
 ```
 
@@ -78,10 +78,26 @@ README.md
   `resolveFrom`), compared as an **UNORDERED SET**. See "Order is
   deliberately not pinned" below.
 - **`expectError`** — either a STRING error code the resolution must fail with
-  exactly, or the literal `true` meaning "must raise, but which error/code is
-  deliberately not pinned across ports" (see "Also deliberately NOT pinned:
-  the malformed-config error code" below for why the latter form exists).
-  Exactly one of `expectFiles` / `expectError` is present per case.
+  exactly, or the literal `true` meaning "must raise the port's own coded
+  metadata error, but WHICH code is deliberately not pinned across ports" (see
+  "Also deliberately NOT pinned: the malformed-config error code" below for why
+  the latter form exists). Exactly one of `expectFiles` / `expectError` is
+  present per case. Note what `true` still pins in a port that HAS a coded error
+  type: the type. Java, C# and Python all require `MetaDataException` /
+  `MetaModelException` / `ParseError` on this arm, so a malformed config that
+  crashes with a raw `NullPointerException` fails the case rather than passing
+  it. (TypeScript alone cannot: it propagates the raw parser error, which is the
+  whole reason the code is unpinned.)
+- **`errorIsNative`** — OPTIONAL boolean, only meaningful beside
+  `expectError: true`. Means the failure surfaces as a PLATFORM-native error
+  rather than the port's coded metadata error, so the type requirement above is
+  lifted for this case alone. Exactly one case sets it:
+  `a-symlink-cycle-is-an-error`, where the raise comes from the filesystem walk
+  (`IOException` in C#, `FileSystemLoopException` in Java, `SymlinkLoopError` in
+  Python) and never passes through a coded-error constructor. It exists so that
+  admitting that one case did not silently relax the other six `true` cases from
+  "a coded parse failure" to "anything at all" — which is precisely what a blanket
+  widening of the runners does, and did.
 
 ## Semantics pinned here
 

fixtures/source-resolution-conformance/cases.json

@@ -272,7 +272,8 @@
       },
       "symlinks": { "model/loop": "model" },
       "config": { "schema_version": 1, "sources": [{ "path": "model" }] },
-      "expectError": true
+      "expectError": true,
+      "errorIsNative": true
     }
   ]
 }

server/csharp/MetaObjects.Conformance.Tests/SourceResolutionConformanceTests.cs

@@ -27,14 +27,20 @@ private sealed record Case(
         // count silently goes stale; the structural description above does not.)
         string ResolveFrom,
         string[]? ExpectFiles,
-        // A JSON string pins the exact error code raised; JSON `true` pins only
-        // that resolution RAISES — the malformed-config error code is
-        // deliberately not pinned cross-port (see the corpus README).
+        // A JSON string pins the exact error code raised; JSON `true` leaves the
+        // CODE unpinned but still requires the port's coded MetaModelException —
+        // the malformed-config error code is deliberately not pinned cross-port
+        // (see the corpus README), the TYPE is.
         JsonElement? ExpectError,
         // Optional: linkPath -> targetPath, both project-root-relative, materialized
         // AFTER `Tree` (I1 — a symlinked source root, or a symlinked subdirectory
         // inside a walked tree).
-        Dictionary<string, string> Symlinks);
+        Dictionary<string, string> Symlinks,
+        // Optional: this case's failure surfaces as a PLATFORM-native error rather
+        // than a coded MetaModelException, so the type requirement above is lifted
+        // for it alone (the symlink-cycle case, whose raise comes from the
+        // filesystem walk and never reaches a coded-error constructor).
+        bool ErrorIsNative);
 
     public static TheoryData<string> CaseNames()
     {
@@ -78,7 +84,8 @@ private static List<Case> LoadCases()
                 foreach (var p in sl.EnumerateObject()) symlinks[p.Name] = p.Value.GetString()!;
             }
 
-            cases.Add(new Case(el.GetProperty("name").GetString()!, tree, cfg, resolveFrom, expectFiles, expectError, symlinks));
+            bool errorIsNative = el.TryGetProperty("errorIsNative", out var ein) && ein.GetBoolean();
+            cases.Add(new Case(el.GetProperty("name").GetString()!, tree, cfg, resolveFrom, expectFiles, expectError, symlinks, errorIsNative));
         }
         return cases;
     }
@@ -127,19 +134,21 @@ public void ResolvesTheSameFileSet(string name)
 
             if (c.ExpectError is not null)
             {
-                // `true` pins only that resolution RAISES — deliberately not which type,
-                // so the assertion is on Exception. Narrowing it to MetaModelException
-                // would silently re-pin the very thing the corpus refuses to pin, and did:
-                // the symlink-cycle guard raises IOException (the natural type, and the
-                // one Java's FileSystemLoopException also derives from), which this
-                // runner scored as a FAILURE even though the port behaved correctly.
-                // A string still pins the exact code, and that arm requires the richer
-                // type — see the ExpectError field doc above.
+                // A string pins the exact code. `true` leaves the CODE unpinned but
+                // still requires MetaModelException — a malformed config that crashes
+                // with a raw NullReferenceException must FAIL this case, not pass it.
+                // `ErrorIsNative` lifts only the type requirement, for the one case
+                // whose raise comes from the filesystem walk (IOException) and never
+                // reaches a coded-error constructor; widening the whole arm instead
+                // would quietly relax the six malformed-config cases to "anything".
                 var ex = Assert.ThrowsAny<Exception>(() => SourceResolver.ResolveCollection(invokeDir));
-                if (c.ExpectError.Value.ValueKind == JsonValueKind.String)
+                if (!c.ErrorIsNative)
                 {
                     var coded = Assert.IsAssignableFrom<MetaModelException>(ex);
-                    Assert.Equal(c.ExpectError.Value.GetString(), coded.Code.ToString());
+                    if (c.ExpectError.Value.ValueKind == JsonValueKind.String)
+                    {
+                        Assert.Equal(c.ExpectError.Value.GetString(), coded.Code.ToString());
+                    }
                 }
                 return;
             }

server/csharp/MetaObjects/Loader/DirectorySource.cs

@@ -63,9 +63,27 @@ public DirectorySource(string directory, Options? opts = null)
     /// by full path (ordinal). The sort happens on the full path so that nested
     /// directory traversal is also deterministic.
     /// </summary>
+    /// <summary>
+    /// How two resolved directory paths are compared when deciding "is this an
+    /// ancestor I have already walked".
+    /// </summary>
+    /// <remarks>
+    /// Ordinal on Linux, where the filesystem genuinely distinguishes <c>Model</c> from
+    /// <c>model</c> and case-folding would REJECT a valid tree. Case-insensitive
+    /// elsewhere, because <see cref="RealPath"/> necessarily mixes spellings — a
+    /// non-link segment keeps whatever casing the caller wrote (via
+    /// <see cref="Path.GetFullPath(string)"/>) while a resolved link comes back in the
+    /// filesystem's own canonical casing — so on a case-insensitive volume an ordinal
+    /// compare lets <c>MODEL/loop -> model</c> slip past the guard. Slipping past is not
+    /// benign here: this is the one port whose enumeration SWALLOWS the kernel's ELOOP,
+    /// so there is no backstop underneath it.
+    /// </remarks>
+    private static readonly StringComparer PathComparer =
+        OperatingSystem.IsLinux() ? StringComparer.Ordinal : StringComparer.OrdinalIgnoreCase;
+
     public IEnumerable<FileSource> Expand()
     {
-        IEnumerable<string> files = Collect(Directory, new HashSet<string>(StringComparer.Ordinal))
+        IEnumerable<string> files = Collect(Directory, new HashSet<string>(PathComparer))
             .Where(p => _supportedExtensions.Contains(Path.GetExtension(p)));
 
         if (Opts.ExcludePending)
@@ -123,7 +141,7 @@ private IEnumerable<string> Collect(string directory, HashSet<string> ancestors)
             throw new IOException(
                 $"symlink loop detected while expanding metadata directory: {directory} revisits {real}");
 
-        var nextAncestors = new HashSet<string>(ancestors, StringComparer.Ordinal) { real };
+        var nextAncestors = new HashSet<string>(ancestors, PathComparer) { real };
 
         // Sorted so traversal is deterministic across filesystems, matching the
         // full-path ordinal sort Expand() applies to the result.

server/java/metadata/src/test/java/com/metaobjects/config/SourceResolutionConformanceTest.java

@@ -73,12 +73,18 @@ public class SourceResolutionConformanceTest {
      */
     /**
      * {@code expectError}: a JSON string pins the exact error code raised; JSON
-     * {@code true} pins only that resolution RAISES — the malformed-config error
-     * code is deliberately not pinned cross-port (see the corpus README).
+     * {@code true} leaves the CODE unpinned but still requires the port's coded
+     * {@link MetaDataException} — the malformed-config error code is deliberately
+     * not pinned cross-port (see the corpus README), the TYPE is.
+     *
+     * <p>{@code errorIsNative}: this case's failure surfaces as a PLATFORM-native
+     * error rather than a coded exception, lifting the type requirement for it
+     * alone — the symlink-cycle case, whose raise comes from the filesystem walk
+     * ({@code FileSystemLoopException}) and never reaches a coded-error constructor.
      */
     private record Case(String name, Map<String, String> tree, JsonObject config,
                          String resolveFrom, List<String> expectFiles, JsonElement expectError,
-                         Map<String, String> symlinks) {}
+                         Map<String, String> symlinks, boolean errorIsNative) {}
 
     /** Package-private (not private): shared with {@link SourceResolutionCorpusNotEmptyTest},
      *  which needs to locate the same committed corpus file without a second definition
@@ -143,7 +149,9 @@ public static Collection<Object[]> cases() throws IOException {
                 }
             }
 
-            rows.add(new Object[]{name, new Case(name, tree, config, resolveFrom, expectFiles, expectError, symlinks)});
+            boolean errorIsNative = c.has("errorIsNative") && c.get("errorIsNative").getAsBoolean();
+
+            rows.add(new Object[]{name, new Case(name, tree, config, resolveFrom, expectFiles, expectError, symlinks, errorIsNative)});
         }
         return rows;
     }
@@ -199,19 +207,24 @@ public void resolvesTheSameFileSet() throws IOException {
                     SourceResolver.resolveCollection(invokeDir);
                     fail("expected " + testCase.expectError() + " for case " + testCase.name());
                 } catch (Exception e) {
-                    // `true` pins only that it RAISES, so the catch is on Exception.
-                    // Narrowing it to MetaDataException silently re-pinned the very thing
-                    // the corpus refuses to pin: the symlink-cycle guard surfaces a
-                    // FileSystemLoopException, which escaped this catch and failed the
-                    // case even though the port behaved exactly as the contract requires.
+                    // The catch is on Exception so a native raise can reach the body at
+                    // all; the TYPE requirement is asserted here rather than by the catch
+                    // clause. `true` leaves the CODE unpinned but still demands
+                    // MetaDataException — a malformed config that crashes with a raw NPE
+                    // must FAIL this case, not pass it. `errorIsNative` lifts that for the
+                    // one case whose raise comes from the filesystem walk
+                    // (FileSystemLoopException) and never reaches a coded-error
+                    // constructor; widening the whole arm instead would quietly relax the
+                    // six malformed-config cases to "anything at all".
                     // (`fail` above throws AssertionError, an Error — so it still escapes.)
-                    // A string still pins the exact code, and that arm needs the coded type.
-                    if (codePinned) {
-                        assertTrue("case " + testCase.name() + " pins code " + expected.getAsString()
-                                        + " so it must raise MetaDataException, got " + e,
+                    if (!testCase.errorIsNative()) {
+                        assertTrue("case " + testCase.name()
+                                        + " must raise MetaDataException, got " + e,
                                 e instanceof MetaDataException);
-                        assertEquals(expected.getAsString(),
-                                ((MetaDataException) e).getCode().orElseThrow().name());
+                        if (codePinned) {
+                            assertEquals(expected.getAsString(),
+                                    ((MetaDataException) e).getCode().orElseThrow().name());
+                        }
                     }
                 }
                 return;

server/python/tests/conformance/test_source_resolution_conformance.py

@@ -68,14 +68,16 @@ def test_source_resolution_conformance(case: dict, tmp_path: Path) -> None:
     resolve_from = _materialize(case, tmp_path)
 
     if "expectError" in case:
-        # `True` pins only that resolution RAISES, so the expected type is
-        # Exception. Catching ParseError instead silently re-pinned the very
-        # thing the corpus refuses to pin, and did: the symlink-cycle guard
-        # raises SymlinkLoopError, which this runner scored as a FAILURE even
-        # though the port behaved exactly as the contract requires. A string
-        # still pins the exact code, and that arm needs the coded type.
+        # A string pins the exact code. `True` leaves the CODE unpinned but still
+        # requires ParseError — a malformed config that crashes with a raw
+        # TypeError must fail this case, not pass it. `errorIsNative` lifts only
+        # the type requirement, for the one case whose raise comes from the
+        # filesystem walk (SymlinkLoopError) and never reaches a coded-error
+        # constructor; widening the whole arm instead would quietly relax the six
+        # malformed-config cases from "a coded parse failure" to "anything".
         expected = case["expectError"]
-        with pytest.raises(ParseError if isinstance(expected, str) else Exception) as e:
+        expected_type = Exception if case.get("errorIsNative") else ParseError
+        with pytest.raises(expected_type) as e:
             resolve_collection(resolve_from)
         if isinstance(expected, str):
             assert e.value.code.value == expected

server/typescript/packages/cli/src/commands/init.ts

@@ -269,7 +269,14 @@ async function writeAgentContext(opts: InitOptions, result: InitResult): Promise
       await writeFile(abs, c.contents, "utf8");
     }
     result.created.push(c.newPath);
-    result.warnings.push(`${c.path} appears hand-edited; refreshed version written to ${c.newPath}`);
+    // Past tense only when it actually happened — a dry run that reports "written
+    // to <path>.new" is claiming an edit-preserving side effect the user can go
+    // look for and will not find.
+    result.warnings.push(
+      dryRun
+        ? `${c.path} appears hand-edited; refreshed version would be written to ${c.newPath}`
+        : `${c.path} appears hand-edited; refreshed version written to ${c.newPath}`,
+    );
   }
   if (!dryRun) {
     const manifestAbs = join(opts.cwd, AGENT_CONTEXT_MANIFEST_PATH);
@@ -295,7 +302,11 @@ async function wireRootMemory(cwd: string, result: InitResult, dryRun = false):
   // If neither root memory file exists, create CLAUDE.md (Claude Code's canonical) with the import.
   if (!claudeExists && !agentsExists) {
     if (!dryRun) await writeFile(claudePath, `# Project memory\n\n${ROOT_IMPORT_LINE}\n`, "utf8");
-    result.created.push("CLAUDE.md (created with MetaObjects @import)");
+    result.created.push(
+      dryRun
+        ? "CLAUDE.md (would be created with MetaObjects @import)"
+        : "CLAUDE.md (created with MetaObjects @import)",
+    );
     return;
   }
   // Otherwise append the import to whichever exist (idempotent — never double-add).
@@ -304,7 +315,14 @@ async function wireRootMemory(cwd: string, result: InitResult, dryRun = false):
     const body = await readFile(path, "utf8");
     if (body.includes(ROOT_IMPORT_LINE)) continue;
     if (!dryRun) await writeFile(path, `${body.replace(/\n*$/, "\n")}\n${ROOT_IMPORT_LINE}\n`, "utf8");
-    result.warnings.push(`wired ${ROOT_IMPORT_LINE} into ${path.endsWith("AGENTS.md") ? "AGENTS.md" : "CLAUDE.md"} so the MetaObjects context loads`);
+    // Past tense only when it actually happened — this one mutates a file the user
+    // owns, so a dry run reporting it as done is the most misleading of the three.
+    const target = path.endsWith("AGENTS.md") ? "AGENTS.md" : "CLAUDE.md";
+    result.warnings.push(
+      dryRun
+        ? `would wire ${ROOT_IMPORT_LINE} into ${target} so the MetaObjects context loads`
+        : `wired ${ROOT_IMPORT_LINE} into ${target} so the MetaObjects context loads`,
+    );
   }
 }
 

server/typescript/packages/cli/test/unit/init-docs-only.test.ts

@@ -49,6 +49,18 @@ describe("init() --docs-only", () => {
 
     // ...and the directory is untouched.
     expect(readdirSync(cwd)).toEqual([]);
+
+    // Nothing reports in the PAST tense. A dry run claiming it "created" a root
+    // CLAUDE.md or "wired" an @import names a side effect on a file the user owns,
+    // which they can go look for and will not find — a more expensive lie than the
+    // silent write, because it reads as a completed action.
+    // Anchored, not `\bcreated with\b` — that also matches the CORRECT "(would be
+    // created with …)" and the assertion fails on its own fix.
+    const past = [...planned.created, ...planned.warnings].filter(
+      (m) => m.includes("(created with") || /^wired /.test(m) || m.includes("version written to"),
+    );
+    expect(past).toEqual([]);
+    expect(planned.created).toContain("CLAUDE.md (would be created with MetaObjects @import)");
   });
 
   test("--refresh-docs --print-only writes nothing", async () => {

server/typescript/packages/sdk/test/source-resolution-conformance.test.ts

@@ -19,6 +19,12 @@ interface Case {
    *  resolution RAISES — the malformed-config error code is deliberately not
    *  pinned cross-port (see the corpus README). */
   readonly expectError?: string | true;
+  /** Optional: the failure surfaces as a PLATFORM-native error rather than a coded
+   *  one, lifting the coded-TYPE requirement for this case. Java/C#/Python honour
+   *  it; TypeScript has nothing to lift — it propagates the raw parser error, which
+   *  is why the code is unpinned here in the first place — so it is unread. Declared
+   *  anyway so this interface stays a faithful mirror of the case schema. */
+  readonly errorIsNative?: boolean;
   /** Optional: linkPath -> targetPath, both project-root-relative, materialized
    *  AFTER `tree` (I1 — a symlinked source root, or a symlinked subdirectory
    *  inside a walked tree). */