@@ -5,15 +5,19 @@
 // hashes identically on every port.
 //
 // The KEYS deliberately do not match across ports, and a manifest is NOT portable
-// between them. TS keys by path relative to the PROJECT ROOT because it supports
-// multiple output targets; C# and Python key relative to their single out dir. An
-// earlier version of this comment claimed a conformance fixture could compare two
-// ports' manifests directly — it cannot, and the claim was never true.
+// between them. TS and Python key by path relative to the PROJECT ROOT (TS because it
+// supports multiple output targets; Python because its manifest is ANCHORED on the
+// project, so an out-dir-relative key made two runs with different --out collide on one
+// entry). C# alone still keys relative to its single out dir. An earlier version of this
+// comment claimed a conformance fixture could compare two ports' manifests directly — it
+// cannot, and the claim was never true.
 //
 // One consequence worth knowing: because the key here is out-dir-relative, running gen
 // twice with different out dirs against ONE gen-state dir collides two distinct files
-// onto one key. Point each out dir at its own gen-state dir, or use the TS toolchain,
-// which is project-rooted and does not have the ambiguity.
+// onto one key — and the advice this comment used to give ("point each out dir at its own
+// gen-state dir") is not followable, because the gen-state dir is DERIVED from the project,
+// not configured. C# has the same latent ambiguity Python just fixed; closing it here means
+// the same re-key plus a legacy-key fallback, and it is not done yet.
 //
 // This file is meant to be COMMITTED. It is one hash per generated path — small and
 // reviewable — where a full snapshot of previously-generated content would be a second
 
@@ -1055,6 +1055,21 @@ def _relative_set(root: Path) -> dict[str, str]:
     return files
 
 
+def _out_prefix(out_dir: str, project_root: Path) -> str:
+    """The out dir, relative to the project — the translation between this diff's
+    out-dir-relative keys and the manifest's project-relative ones.
+
+    BOTH SIDES RESOLVED, and that is the whole content of this function. `project_root`
+    arrives resolved; relpath from a resolved anchor to an unresolved path is not the
+    path between the two directories, and under a directory symlink it walks OUT of the
+    project. Every lookup then misses, `is_ours` is false for every file, and the gate
+    prints a clean verdict over stale output — silent in the direction that matters.
+    It is written once here rather than at each of the three call sites, because three
+    spellings of one translation is how they came to disagree in the first place.
+    """
+    return os.path.relpath(Path(out_dir).resolve(), project_root)
+
+
 def _is_ours_for(gen_state_dir: str | None, out_prefix: str = ""):
     """Jurisdiction predicate for the ``extra`` verdict: did WE write this path?
 
@@ -1226,7 +1241,7 @@ def _verify_codegen(args: argparse.Namespace) -> int:
     project_root = project_root_for(args.metadata_dir)
     return _diff_report(
         expected, committed, gen_state_dir_for(args.metadata_dir),
-        os.path.relpath(Path(args.out).resolve(), project_root),
+        _out_prefix(args.out, project_root),
     )
 
 
@@ -1283,7 +1298,7 @@ def _verify_codegen_neutral_fallback(args: argparse.Namespace) -> int:
     # must be built from that, not from args.metadata_dir (None here by definition).
     return _diff_report(
         expected, committed, str(root_dir.resolve() / ".metaobjects" / ".gen-state"),
-        os.path.relpath(Path(args.out).resolve(), root_dir.resolve()),
+        _out_prefix(args.out, root_dir.resolve()),
     )
 
 
@@ -1406,9 +1421,7 @@ def _verify_codegen_config(args: argparse.Namespace) -> int:
             # their identically-named files apart is the one anchored on the project.
             is_ours = _is_ours_for(
                 gen_state_dir_for(config.metadata_dir()),
-                os.path.relpath(
-                    Path(real_outdir).resolve(), project_root_for(config.metadata_dir())
-                ),
+                _out_prefix(real_outdir, project_root_for(config.metadata_dir())),
             )
             extra = sorted(k for k in committed if k not in expected and is_ours(k))
 
 
@@ -141,7 +141,20 @@ def run_gen(
         # two runs with different --out cannot collide on one key inside the single
         # manifest that is anchored on that project. `rel` rides along as the legacy
         # spelling so an existing manifest keeps working and converges on the new one.
-        key = os.path.relpath(full, config.project_root) if config.project_root else rel
+        # BOTH SIDES RESOLVED. `project_root` arrives resolved (project_root_for calls
+        # .resolve()) while `full` is built from the raw `out_dir`, and relpath between a
+        # resolved anchor and an unresolved path is not the path between the two
+        # directories — under a directory symlink it walks OUT of the project
+        # (`../link/gen/X.py`). Every key then points outside, `_is_ours_for` matches
+        # none of them, and `verify --codegen` prints `in sync (0 file(s))` over stale
+        # output. The pre-existing `relpath(full, out_dir)` was immune by accident: both
+        # sides came from the same unresolved string, so it was symmetric. Symmetry is
+        # the property, and resolving both is how it is kept deliberately.
+        key = (
+            os.path.relpath(os.path.realpath(full), config.project_root)
+            if config.project_root
+            else rel
+        )
         status = decide_and_write(
             full,
             content,
 
@@ -290,3 +290,57 @@ def test_config_mode_ignores_a_discovered_spec(tmp_path: Path) -> None:
     )
     assert main(["gen", "--config", str(cfg)]) == 0
     assert main(["verify", "--codegen", "--config", str(cfg)]) == 0
+
+
+# --- the `extra` verdict at the two rungs the flag-mode test cannot reach ------------
+#
+# Manifest keys are project-root-relative while this diff is keyed relative to `--out`;
+# `out_prefix` is what translates one into the other, and `_is_ours_for` needs it to find
+# the record proving we wrote a file. It is threaded at THREE call sites and only the
+# explicit-flag rung was gated (`test_verify_codegen_still_convicts_output_it_did_write`).
+#
+# The uncovered direction fails silently, which is why it needs its own case per rung: a
+# lookup that finds nothing makes every file "not ours", so `extra` empties and the gate
+# prints a CLEAN verdict over stale committed output. Both cases below were confirmed to
+# pass with `out_prefix` removed at their rung before they were written — i.e. the whole
+# Python codegen suite could not see it.
+
+
+def test_neutral_fallback_convicts_output_it_did_write(
+    tmp_path: Path, monkeypatch
+) -> None:
+    """The `.metaobjects/config.json` `sources` rung."""
+    model = tmp_path / "model"
+    model.mkdir()
+    (model / "meta.fitness.json").write_text(FITNESS.read_text())
+    d = tmp_path / ".metaobjects"
+    d.mkdir()
+    (d / "config.json").write_text(
+        '{"schema_version": 1, "sources": [{"path": "model"}]}'
+    )
+    monkeypatch.chdir(tmp_path)
+    assert main(["gen", "--out", "gen/models"]) == 0
+    assert (tmp_path / "gen/models/Program.py").exists()
+
+    # A regen no longer emits Program.py, but it IS committed and IS in the manifest —
+    # the definition of stale output.
+    (model / "meta.fitness.json").write_text(
+        '{"metadata.root": {"package": "fitness", "children": []}}'
+    )
+    assert main(["verify", "--codegen", "--out", "gen/models"]) == 1
+
+
+def test_config_mode_convicts_output_it_did_write(tmp_path: Path) -> None:
+    """The declarative `metaobjects.config.yaml` per-target rung — the one where the
+    prefix matters most, because every target has its own outDir and all of them share
+    ONE manifest."""
+    cfg = _project(tmp_path)
+    assert main(["gen", "--config", str(cfg)]) == 0
+    assert (tmp_path / "gen/models/Program.py").exists()
+
+    # Narrow `models` to one entity: Week.py stays committed and recorded while a fresh
+    # regen no longer emits it.
+    cfg.write_text(
+        TWO_TARGETS.replace("entities: [Program, Week]", "entities: [Program]")
+    )
+    assert main(["verify", "--codegen", "--config", str(cfg)]) == 1
@@ -126,5 +126,57 @@ def test_read_prefers_the_new_key_over_the_legacy_one(tmp_path: Path) -> None:
         json.dumps({"gen/names.py": "new", "names.py": "legacy"}), encoding="utf-8"
     )
     assert read_generated_hash(str(gen_state), "gen/names.py", "names.py") == "new"
-    # And the legacy key alone still answers, for a file not yet re-recorded.
-    assert read_generated_hash(str(gen_state), "gen/other.py", "other.py") is None
+    # The legacy key alone still answers, for a file not yet re-recorded under the new
+    # spelling: the new key is absent, so the fallback is what finds the record.
+    assert read_generated_hash(str(gen_state), "gen/not-yet-rekeyed.py", "names.py") == "legacy"
+    # A key present in NEITHER spelling stays unrecorded — the fallback must not become a
+    # way to say yes to a file nobody recorded.
+    assert read_generated_hash(str(gen_state), "gen/absent.py", "absent.py") is None
+
+
+def test_a_project_reached_through_a_symlink_keeps_its_jurisdiction(
+    tmp_path: Path, monkeypatch
+) -> None:
+    """The anchor and the path must be resolved on the SAME side.
+
+    ``project_root`` arrives resolved; ``full`` is built from the raw ``out_dir``. Relpath
+    between a resolved anchor and an unresolved path is not the path between the two
+    directories — under a directory symlink it walks OUT of the project, so every key
+    read ``../link/gen/X.py``, ``_is_ours_for`` matched none of them, and
+    ``verify --codegen`` printed ``in sync (0 file(s))`` over 68 genuinely stale files.
+
+    The spelling this replaced (``relpath(full, out_dir)``) was immune by ACCIDENT: both
+    sides came from one unresolved string, so it was symmetric. Symmetry is the property;
+    this pins it deliberately. ``/tmp`` is a symlink on macOS, so any project there hits
+    it directly.
+    """
+    real = tmp_path / "proj"
+    (real / "metaobjects").mkdir(parents=True)
+    fixture = (
+        Path(__file__).parents[4]
+        / "fixtures"
+        / "persistence-conformance"
+        / "canonical"
+        / "meta.fitness.json"
+    )
+    meta_file = real / "metaobjects" / "meta.fitness.json"
+    meta_file.write_text(fixture.read_text(), encoding="utf-8")
+    link = tmp_path / "link"
+    link.symlink_to(real, target_is_directory=True)
+
+    from metaobjects.cli import main
+
+    monkeypatch.chdir(tmp_path)
+    assert main(["gen", str(link / "metaobjects"), "--out", str(link / "gen")]) == 0
+
+    manifest = json.loads(
+        (real / ".metaobjects" / ".gen-state" / ".hashes.json").read_text(encoding="utf-8")
+    )
+    assert manifest, "gen recorded no manifest"
+    # Not one key escapes the project. A `../` key is the whole defect.
+    assert not any(k.startswith("..") for k in manifest), sorted(manifest)[:3]
+    assert all(k.startswith("gen/") for k in manifest), sorted(manifest)[:3]
+
+    # And the gate still convicts stale output reached through the link.
+    meta_file.write_text('{"metadata.root": {"package": "fitness", "children": []}}')
+    assert main(["verify", "--codegen", str(link / "metaobjects"), "--out", str(link / "gen")]) == 1