fix(#208): Fable-review fixes — write-through @SQL dependsOn + R3/R5 fixtures + doc accuracy

An independent Fable-model review of the whole #208 stream found one MAJOR bug the two
prior Opus reviews missed, plus minor doc/coverage gaps. Fixes:

- [MAJOR] A write-through host (writable table + an @SQL read-view source, no derived
  fields — legal, since R4 only forbids origin.* under @SQL) has NO extends anchors, so
  collectSqlDependsOn returned [] — omitting the view's ONE certain dependency, the host's
  own table. A later column-altering ALTER on that table would then fail at apply (Pass 2c
  never drop+recreates the view around it). collectSqlDependsOn now also includes the
  host's own writable table for a write-through host (distinct from the deferred D7 case,
  where the missing dep is a JOINed table not declared in metadata). The write-through
  @SQL branch had zero coverage; a regression test now pins dependsOn == [host table].

- [MINOR] The ADR/CHANGELOG claimed all six rules were conformance-gated by shared
  fixtures; only R1/R2/R4 were. Added shared error-fixtures for R3 (empty @SQL →
  ERR_BAD_ATTR_VALUE) and R5 (@filter + @SQL → ERR_ORIGIN_UNDER_SQL_BODY) — R5 being the
  subtlest own-vs-resolving rule. Now R1–R5 (the five error rules) are cross-port gated;
  the R6 WARN stays per-port unit-tested (the corpus has no warn-fixture mechanism). Docs
  corrected to match, and the Java fail-fast-per-pass vs collect-all difference documented.

- [NIT] ADR-0043 now documents that @Unmanaged is effectively non-inheritable in the
  migrate lowering (both diff halves use own-source detection) — declare it on the
  concrete entity's own source.

All 5 ports green on the two new fixtures (TS conformance, Java ConformanceTest 470,
Python conformance, C# 501). codegen-ts 992 pass, typecheck clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NGQ7oSuNcjhsMHWwZzhBwr

Author: dmealing

CHANGELOG.md

@@ -14,7 +14,7 @@ Two mutually-exclusive `source.rdb` attributes express *who owns a DB object's D
 - **`@sql`** — a hand-written view body the tool **registers, fingerprints, and drift-checks but never authors or parses**. The value is the body inside `CREATE <kind> <name> AS …`. It lets a genuinely-irreducible view (recursive CTE, window function, set operation) carry an `extends`-bound identity/fields for row identity and shape *without* the tool mis-synthesizing a wrong base-table passthrough `SELECT` — the **suppression rule** classifies DDL-ownership *before* the derivation decision, closing a silent-wrong-synthesis hole. The `@sql` view rides the existing emit/fingerprint pipeline; a pre-existing unstamped view at its name is `replace-view`-blocked pending the one-time **`meta migrate --allow adopt-view`** adoption ceremony. `@sql` on a writable kind, combined with `@unmanaged`, empty, or combined with `origin.*`/`@filter` is a load error. v1 migrate lowering is `@kind: view` only (matview/proc → an actionable hard error).
 - **`@unmanaged: true`** — this DB object (a view **or a table**) is managed elsewhere (Flyway / a hand-migration owns its DDL). `meta migrate` never creates, drops, or drift-checks it (excluded from both the expected and the introspected-actual sides across the online, offline, D1, and `verify` paths); `meta verify --db` reports it as *external (declared)*. An inbound FK from a managed table still resolves the external table's physical name.
 
-**Registration + the six fail-closed loader-validation rules (R1–R6) ship in all five ports** (TS / C# / Java / Kotlin / Python), resolving `MetaSource` accessors following the `@role`/`effectiveKind` precedent (ADR-0039), conformance-gated by shared `fixtures/conformance/` error-fixtures — every port emits the same code per rule (`ERR_SQL_BODY_WITH_UNMANAGED` / `ERR_SQL_BODY_ON_WRITABLE_KIND` / `ERR_BAD_ATTR_VALUE` / `ERR_ORIGIN_UNDER_SQL_BODY` / `WARN_ORIGIN_UNDER_UNMANAGED`). All migrate/verify **lowering is TS-only** (ADR-0015). An `xhigh` review before merge caught a real offline-`migrate` DROP-for-external-table bug (the offline `planOffline` path did not thread the unmanaged-name set), fixed + regression-tested. Deferred follow-ups: `@dependsOn` for `@sql` views, the matview managed path, and opaque-body column-name verification. Designed in `docs/superpowers/specs/2026-07-17-issue-208-ddl-ownership-escape-valves-design.md`.
+**Registration + the six fail-closed loader-validation rules (R1–R6) ship in all five ports** (TS / C# / Java / Kotlin / Python), resolving `MetaSource` accessors following the `@role`/`effectiveKind` precedent (ADR-0039). The five **error** rules (R1–R5) are conformance-gated by shared `fixtures/conformance/` error-fixtures — every port emits the same code per rule (`ERR_SQL_BODY_WITH_UNMANAGED` / `ERR_SQL_BODY_ON_WRITABLE_KIND` / `ERR_BAD_ATTR_VALUE` / `ERR_ORIGIN_UNDER_SQL_BODY`); the R6 `WARN_ORIGIN_UNDER_UNMANAGED` is per-port unit-tested. All migrate/verify **lowering is TS-only** (ADR-0015). An `xhigh` review before merge caught a real offline-`migrate` DROP-for-external-table bug (the offline `planOffline` path did not thread the unmanaged-name set), fixed + regression-tested. Deferred follow-ups: `@dependsOn` for `@sql` views, the matview managed path, and opaque-body column-name verification. Designed in `docs/superpowers/specs/2026-07-17-issue-208-ddl-ownership-escape-valves-design.md`.
 
 ### #214 — entity read-view codegen READ half (all five ports)
 

fixtures/conformance/error-filter-with-sql-body/expected-errors.json

@@ -0,0 +1 @@
+[{ "code": "ERR_ORIGIN_UNDER_SQL_BODY" }]

fixtures/conformance/error-filter-with-sql-body/input/meta.demo.json

@@ -0,0 +1,36 @@
+{
+  "metadata.root": {
+    "package": "demo",
+    "children": [
+      {
+        "object.entity": {
+          "name": "Base",
+          "children": [
+            { "source.rdb": { "@table": "base" } },
+            { "field.long": { "name": "id" } },
+            { "field.string": { "name": "status" } },
+            { "identity.primary": { "name": "id", "@fields": "id" } }
+          ]
+        }
+      },
+      {
+        "object.projection": {
+          "name": "Bad",
+          "@filter": { "status": { "eq": "active" } },
+          "children": [
+            {
+              "source.rdb": {
+                "@kind": "view",
+                "@view": "v_bad",
+                "@sql": "SELECT id, status FROM base WHERE status = 'active'"
+              }
+            },
+            { "field.long": { "name": "id", "extends": "demo::Base.id" } },
+            { "field.string": { "name": "status", "extends": "demo::Base.status" } },
+            { "identity.primary": { "name": "id", "extends": "demo::Base.id" } }
+          ]
+        }
+      }
+    ]
+  }
+}

fixtures/conformance/error-filter-with-sql-body/providers.json

@@ -0,0 +1 @@
+["metaobjects-core-types","metaobjects-db"]

fixtures/conformance/error-sql-body-empty/expected-errors.json

@@ -0,0 +1 @@
+[{ "code": "ERR_BAD_ATTR_VALUE" }]

fixtures/conformance/error-sql-body-empty/input/meta.demo.json

@@ -0,0 +1,16 @@
+{
+  "metadata.root": {
+    "package": "demo",
+    "children": [
+      {
+        "object.projection": {
+          "name": "Bad",
+          "children": [
+            { "source.rdb": { "@kind": "view", "@view": "v_bad", "@sql": "" } },
+            { "field.long": { "name": "id" } }
+          ]
+        }
+      }
+    ]
+  }
+}

fixtures/conformance/error-sql-body-empty/providers.json

@@ -0,0 +1 @@
+["metaobjects-core-types","metaobjects-db"]

server/typescript/packages/codegen-ts/src/projection/build-projection-views.ts

@@ -207,8 +207,8 @@ function emitViewFor(
  *     fails safe to a gated drop+create instead of a wrong-but-confident OR REPLACE;
  *   - a pre-existing unstamped view at this name → `replace-view` blocked pending
  *     `migrate --allow adopt-view` (the one-time adoption ceremony).
- * `dependsOn` is derived from the host's extends-bound anchor entities (D7) — no
- * `@dependsOn` attr.
+ * `dependsOn` is derived from the host's own writable table (a write-through host) plus
+ * its extends-bound anchor entities (a projection, D7) — no `@dependsOn` attr.
  */
 function emitSqlView(
   host: MetaObject,
@@ -240,19 +240,36 @@ function emitSqlView(
 }
 
 /**
- * D7 — the physical tables an `@sql` view depends on, derived from the host's
- * extends-bound anchor entities (its OWN identity/field `superRef`s). The `extends`
- * bindings that already anchor the read model's shape ARE the dependency declaration;
- * no separate `@dependsOn` attr. Deduped, so a view anchored on one base yields one
- * table. migrate-ts uses this to drop+recreate the view around a column-altering change
- * on a source table (Postgres blocks ALTER on a column a view depends on).
+ * The physical tables an `@sql` view depends on. migrate-ts uses this to drop+recreate
+ * the view around a column-altering change on a source table (Postgres blocks ALTER on a
+ * column a view depends on). Two sources, no `@dependsOn` attr:
+ *
+ *   - A **write-through host** (a writable table source + an `@sql` read-view source)
+ *     reads from its OWN table — its one certain dependency. It has NO extends anchors
+ *     (an entity declares its own identity/fields), so without this its `@sql` view's
+ *     dependsOn would be empty and a column ALTER on the host table would fail at apply.
+ *   - A **projection** `@sql` view's dependencies are its extends-bound anchor tables
+ *     (D7 — the `extends` bindings that anchor the read model's shape ARE the dependency
+ *     declaration).
+ *
+ * Deduped. (A table the opaque body JOINs but neither hosts nor anchors is NOT tracked —
+ * the deferred `@dependsOn` escape, ADR-0043.)
  */
 function collectSqlDependsOn(
   host: MetaObject,
   root: MetaRoot,
   joinTables: Readonly<Record<string, string>>,
 ): string[] {
   const tables = new Set<string>();
+  // The write-through host's own writable table (keyed the way the diff keys descriptors).
+  const hasWritableSource = host.ownChildren().some(
+    (c) => c instanceof MetaSource && c.isWritable(),
+  );
+  if (hasWritableSource) {
+    const t = joinTables[host.name];
+    if (t !== undefined) tables.add(t);
+  }
+  // Extends-bound anchor tables (a projection's read-model base).
   for (const child of host.ownChildren()) {
     if (child.type !== TYPE_IDENTITY && child.type !== TYPE_FIELD) continue;
     const owner = refNamedOwner(child, root);

server/typescript/packages/codegen-ts/test/projection/build-projection-views.test.ts

@@ -253,6 +253,40 @@ describe("buildProjectionViews — #208 @sql / @unmanaged DDL-ownership escape v
     expect(views.find((vv) => vv.name === "v_node_tree")).toBeUndefined();
   });
 
+  test("a write-through entity's @sql replica view depends on the host's OWN table", async () => {
+    // A write-through host (writable table + an @sql read-view, no derived fields) has NO
+    // extends anchors, so collectSqlDependsOn would otherwise return [] — omitting the
+    // view's one certain dependency (the host table), which makes a later column ALTER on
+    // that table fail at apply (Pass 2c never drop+recreates the view around it).
+    const root = await load([
+      {
+        "object.entity": {
+          name: "Program",
+          children: [
+            { "source.rdb": { "@role": "primary", "@table": "programs" } },
+            {
+              "source.rdb": {
+                "@role": "replica",
+                "@kind": "view",
+                "@view": "v_programs_ranked",
+                "@sql": "SELECT id, name, rank() OVER (ORDER BY id) AS r FROM programs",
+              },
+            },
+            { "field.long": { name: "id" } },
+            { "field.string": { name: "name" } },
+            { "identity.primary": { name: "pk", "@fields": "id" } },
+          ],
+        },
+      },
+    ]);
+    const views = buildProjectionViews(root, { dialect: "postgres", columnNamingStrategy: "snake_case" });
+    const v = views.find((vv) => vv.name === "v_programs_ranked");
+    expect(v).toBeDefined();
+    expect(v!.sql).toContain("rank() OVER"); // verbatim @sql body
+    expect(v!.dependsOn).toEqual(["programs"]); // the host's own table, not []
+    expect(v!.columns).toBeUndefined();
+  });
+
   test("@sql on a non-view kind (materializedView) hard-errors at migrate lowering (D4)", async () => {
     // @sql is legal-in-vocabulary on any read-only kind (5-port registration is stable),
     // but v1 TS migrate lowering accepts it only on @kind: view — matview needs genuinely

spec/decisions/ADR-0043-ddl-ownership-escape-valves.md

@@ -36,7 +36,7 @@ An `@sql`- or `@unmanaged`-marked read source **suppresses derivation-classifica
 
 ### 4. Cross-port scope split
 
-- **All five ports** (TS / C# / Java / Kotlin / Python): register the two attrs on `source.rdb`; resolving `MetaSource` accessors (`sqlBody`/`isUnmanaged` etc., following the `@role`/`effectiveKind` *resolving* precedent — **not** the `@dbColumnType` own-only exception, ADR-0039); and the six fail-closed loader-validation rules (§5), conformance-gated by shared `fixtures/conformance/` error-fixtures.
+- **All five ports** (TS / C# / Java / Kotlin / Python): register the two attrs on `source.rdb`; resolving `MetaSource` accessors (`sqlBody`/`isUnmanaged` etc., following the `@role`/`effectiveKind` *resolving* precedent — **not** the `@dbColumnType` own-only exception, ADR-0039); and the six fail-closed loader-validation rules (§5). The five **error** rules (R1–R5) are conformance-gated by shared `fixtures/conformance/` error-fixtures (every port emits the same code per rule); the R6 **WARN** is per-port unit-tested (the conformance corpus has no warn-fixture mechanism). Java's loader is fail-fast-per-pass (throws on the first violation) versus TS/C#/Python's collect-all — a pre-existing loader-architecture difference, invisible to the single-violation conformance fixtures.
 - **TS-only** (ADR-0015 — schema is TS-owned): all migrate/verify *lowering* — the `@sql` verbatim-emit + fingerprint + adopt-view ceremony, and the `@unmanaged` skip + act-side silencing.
 
 ### 5. Loader validation — six fail-closed rules (cross-port)
@@ -64,6 +64,7 @@ The R4-error / R6-warn asymmetry is deliberate: `@sql` is a second body (two sou
 - **Documented adopter caveats (not errors):**
   - An FK *from a managed table into an `@unmanaged` table* has no migration-**ordering** guarantee versus the external tool — the external object must exist before the managed FK is applied.
   - An `@unmanaged` view is **not** drop/recreated around a managed dependency's column-altering `ALTER` — the tool has no body for an external view and cannot recreate it; Postgres blocking the `ALTER` is the adopter's signal to coordinate.
+  - `@unmanaged` is effectively **non-inheritable** in the migrate lowering: both the expected-side skip and the act-side name-set use own-source detection (so the two halves agree — no split-brain where a table is not created yet is still proposed for drop). Declare `@unmanaged` on the concrete entity's *own* `source.rdb`, not on an `extends` parent's.
 - **Deferred follow-ups (filed on the roadmap):**
   - **`@dependsOn` for `@sql` views** — a `@sql` view's `dependsOn` is derived from `extends`-bound anchors only, so a table the opaque body JOINs but does not surface as a bound column is not tracked for auto-recreate around a column `ALTER` (§11 YAGNI — defer the explicit `@dependsOn` attr until an adopter hits it).
   - **The matview managed path** — `@sql` on `@kind: materializedView` needs `pg_matviews` introspection + COMMENT-on-matview plumbing + a REFRESH story.