@@ -72,6 +72,71 @@ integration cases generated with an explicit `--out <dir>/docs` while `verify --
 the config default, and passed only because the two coincided. Sixteen cases failed the moment
 they stopped. They now take the config path, which is what the gate reads.
 
+### Fixed — the Python nudge was blind to the 1.0 cut it exists to catch
+
+`agent_context_staleness` on the Python port dropped the leading MAJOR from both of its
+version coordinates, borrowing the Java port's rationale verbatim. That rationale is
+explicitly "a fact peculiar to the JVM": Maven Central carries a historical major of
+npm-major + 7, so `7.24.1` and `0.24.1` genuinely name one release and the coordinate must
+ignore the major to see it. Nothing of the kind is true here — `generatedBy` is stamped by
+the Node CLI (an npm version), `installed_metaobjects_version()` reads the PyPI distribution
+version, and npm and PyPI share the major by policy.
+
+So `1.0.0` and `2.0.0` compared EQUAL, and — the live case — a Python install upgraded to
+`1.0.0` whose agent context was scaffolded at `0.25.0` got **no advisory at all**: the
+ordering helper compared `(25, 0)` against `(0, 0)`, concluded the 0.25.0 context was NEWER
+than the 1.0.0 install, and took the publish-what-changed exemption. That is the single
+upgrade the whole feature exists to catch, and every Python adopter would have hit it the
+moment 1.0 shipped. The "known bound" the docstring owned — a `0.24.x` context against a
+`1.0.0` install reading as ahead — was also not the "suppressed once" it claimed: nothing
+changes the state, so the suppression was permanent.
+
+Both coordinates now carry the major, and the ordering coordinate is DERIVED from the
+equality one rather than parsed by a second regex — differential-checked over 11k inputs as
+identical on orderability and on `(minor, patch)`. The PEP 440 spelling equivalence
+(`1.0.0rc5` == `1.0.0-rc.5`) and the publish-what-changed exemption are unchanged; the
+exemption now applies across majors too, which is correct, since the canonical scaffolder is
+npm and a genuinely newer stamp must still not nudge.
+
+### Removed — the sdk's `.meta` path helpers, and a README example that could only throw
+
+`recordPath` and `resolveMetaRoot` are gone, finishing the removal that took the forge memory
+record schemas and their storage layer. `recordPath` built `<metaRoot>/memory/<type>/<id>.json`
+— the layout of exactly that deleted store. `resolveMetaRoot` walked up for a `.meta`
+directory, which `meta init` does not scaffold and this package's own test asserts is NOT
+created.
+
+Its only caller anywhere was the sdk README's usage example, which was wrong twice: it would
+throw `no .meta directory found` before reaching `loadConfig`, and `loadConfig` reads
+`<dir>/config.json` while a project's config lives under `.metaobjects/`. The example now
+shows `resolveCollection` — the documented single authority for locating a project — feeding
+`loadMemory`, and was verified by running it verbatim against a freshly `meta init`-ed
+project rather than by reading it.
+
+Also corrected: a comment in `sdk/src/index.ts` claimed the removed storage layer "had no
+test at all". The same commit that wrote that sentence deleted `sdk/test/storage.test.ts`,
+217 lines of it.
+
+### Fixed — three rules that had a second, unexercised spelling
+
+- The authored-`<type>.base` refusal was written twice, in the JSON and YAML arms of
+  `meta upgrade`'s rewriter, with a byte-identical `why` and migration path. The DETECTION
+  legitimately differs (JSON key ranges vs YAML node spans) and stays per-arm; the verdict an
+  adopter reads is one decision and now has one source, with only the line number supplied
+  per arm.
+- `mavenVersion` inlined `Number(major) + MAVEN_MAJOR_OFFSET` instead of calling `mavenMajor`
+  — in the very file that exists because that offset had four doors and two of them were
+  wrong. It made a fifth, and left `mavenMajor` with **no production caller at all**: an
+  exported rule exercised only by its own unit test, sitting beside a copy of itself that
+  every release actually ran.
+- `release-verify.mjs` reassembled `VERSION` from the captures of the match it had just made
+  on `VERSION`, giving the RC suffix a second hand-written spelling to get wrong. It passes
+  the string through.
+- Python's `gen_state_dir_for` re-derived `Path(metadata_dir).resolve().parent` rather than
+  calling `project_root_for`, whose own docstring already claimed the former "is anchored
+  here". The manifest KEY and the manifest LOCATION have to agree on where the project is, or
+  a lookup finds nothing and every file reads as "not ours".
+
 ### Fixed — four checks that could not fire, and the duplication behind two of them
 
 Each of these was GREEN and each was inert. They came out of the review pass over the RC
 
@@ -47,5 +47,9 @@ export function mavenVersion(npmVersion) {
   const s = String(npmVersion);
   const m = /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(s);
   if (!m) throw new Error(`maven-coordinate: "${s}" is not a three-part version`);
-  return `${Number(m[1]) + MAVEN_MAJOR_OFFSET}.${m[2]}.${m[3]}${m[4] ?? ""}`;
+  // Through `mavenMajor`, not `Number(m[1]) + MAVEN_MAJOR_OFFSET` again. This file exists
+  // because the offset had four doors and two were wrong; inlining it here made a fifth,
+  // and left `mavenMajor` with no production caller at all — an exported rule whose only
+  // exercise was its own unit test, beside a copy of itself that every release actually ran.
+  return `${mavenMajor(s)}.${m[2]}.${m[3]}${m[4] ?? ""}`;
 }
@@ -45,7 +45,10 @@ const parts = VERSION?.match(/^(\d+)\.(\d+)\.(\d+)(?:-rc\.(\d+))?$/);
 const IS_RC = Boolean(parts?.[4]);
 const PYPI_VERSION = parts && `${parts[1]}.${parts[2]}.${parts[3]}${IS_RC ? `rc${parts[4]}` : ""}`;
 const MVN = args.find((a) => a.startsWith("--maven="))?.slice("--maven=".length)
-  ?? (parts && mavenVersion(`${parts[1]}.${parts[2]}.${parts[3]}${IS_RC ? `-rc.${parts[4]}` : ""}`));
+  // `VERSION` itself, not its captures reassembled: `parts` came from matching VERSION
+  // against that exact grammar, so the reconstruction could only ever equal what it was
+  // built from — while giving the RC suffix a second, hand-written spelling to get wrong.
+  ?? (parts && mavenVersion(VERSION));
 
 // A pre-release is published to `next` and must NOT move `latest` — checking `latest`
 // against an RC would fail every correct RC cut, and the mistake it is really guarding
 
@@ -80,8 +80,6 @@ def from_json(data: dict[str, object]) -> "Manifest":
 # The sentinel a port stamps when it cannot resolve its own installed version.
 _UNRESOLVED_VERSION = "0.0.0"
 
-_RELEASE_RE = re.compile(r"^(\d+)\.(\d+)\.(\d+)$")
-
 #: A release with an optional PRE-RELEASE segment, in either spelling one ecosystem uses.
 #: npm/NuGet/Maven write ``1.0.0-rc.5``; PEP 440 writes ``1.0.0rc5``. Both are the SAME
 #: release, and comparing their SPELLINGS is what made the nudge unsatisfiable — see
@@ -104,13 +102,19 @@ def from_json(data: dict[str, object]) -> "Manifest":
 }
 
 
-def _release_coordinate(version: object) -> tuple[int, int, str, int] | None:
-    """``(minor, patch, pre_label, pre_number)`` for a version in ANY ecosystem spelling.
+def _release_coordinate(version: object) -> tuple[int, int, int, str, int] | None:
+    """``(major, minor, patch, pre_label, pre_number)`` for a version in ANY ecosystem
+    spelling.
 
-    The MAJOR is dropped for the same reason ``_release_series`` drops it: it is a
-    per-registry constant, not information (npm/PyPI/NuGet ship ``<M>.<m>.<p>`` and Maven
-    Central the same ``<m>.<p>`` on a major seven higher). ``minor.patch`` plus the
-    pre-release IS the shared release coordinate.
+    The MAJOR is INFORMATION on this port, and both helpers here used to drop it. That
+    reduction is correct on the JVM and only there: Maven Central carries a historical
+    major of npm-major + 7 by design, so ``7.24.1`` and ``0.24.1`` genuinely name one
+    release and the coordinate must ignore the major to see it. Nothing of the kind holds
+    here — ``generatedBy`` is stamped by the Node CLI (an npm version) and
+    :func:`installed_metaobjects_version` reads the PyPI distribution version, and npm and
+    PyPI share the major by policy. Dropping it made ``1.0.0`` and ``2.0.0`` compare EQUAL,
+    and made a ``0.25.0``-stamped context read as NEWER than a ``1.0.0`` install — so the
+    1.0 upgrade, the single upgrade this advisory exists to catch, produced no nudge.
 
     The pre-release label is lower-cased and its separators dropped, so ``-rc.5``,
     ``rc5`` and ``-RC5`` all reduce to ``("rc", 5)``. A final release sorts ABOVE every
@@ -133,7 +137,13 @@ def _release_coordinate(version: object) -> tuple[int, int, str, int] | None:
     number = int(m.group(5)) if m.group(5) is not None else 0
     # A FINAL release is newer than every pre-release of the same number. "~" sorts above
     # every ASCII letter, so the sentinel does that with plain tuple comparison.
-    return (int(m.group(2)), int(m.group(3)), label if label else "~", number)
+    return (
+        int(m.group(1)),
+        int(m.group(2)),
+        int(m.group(3)),
+        label if label else "~",
+        number,
+    )
 
 
 def _same_release(generated_by: object, current_version: str) -> bool:
@@ -156,28 +166,26 @@ def _same_release(generated_by: object, current_version: str) -> bool:
     return stamped is not None and stamped == installed
 
 
-def _release_series(version: object) -> tuple[int, int] | None:
-    """Ordered release coordinate ``(minor, patch)``, or ``None`` when not orderable.
+def _release_series(version: object) -> tuple[int, int, int] | None:
+    """Ordered release coordinate ``(major, minor, patch)``, or ``None`` when not orderable.
 
-    The MAJOR is deliberately dropped. It is a per-registry constant, not information:
-    npm/PyPI/NuGet ship ``0.<m>.<p>`` and Maven Central the same ``<m>.<p>`` on its
-    historical major ``7``, so minor.patch IS the shared release coordinate across all
-    four ports.
+    Derived from :func:`_release_coordinate` rather than parsed again. These two functions
+    used to answer the same grammar with two different regexes — differential-checked
+    identical over 200k inputs, which is the good outcome of a coin flip, not a guarantee.
+    The ordering coordinate simply IS the equality coordinate restricted to FINAL releases,
+    and saying so in code means the two cannot drift apart.
 
     ``None`` means "not orderable, so nudge", and deliberately covers prereleases
-    (``0.24.5-rc.1``), build metadata (``0.24.5+abc``) and the ``0.0.0`` sentinel. Each
-    must keep nudging: an RC-scaffolded context against a final release is still worth
-    refreshing, and an unknown install must never assert "in sync".
+    (``0.24.5-rc.1``, ``1.0.0rc5``), build metadata (``0.24.5+abc``) and the ``0.0.0``
+    sentinel. Each must keep nudging: an RC-scaffolded context against a final release is
+    still worth refreshing, and an unknown install must never assert "in sync".
     """
-    if not isinstance(version, str):
-        return None
-    v = version.strip()
-    if v == _UNRESOLVED_VERSION:
-        return None
-    m = _RELEASE_RE.match(v)
-    if m is None:
+    coord = _release_coordinate(version)
+    # A pre-release carries a real label; a final carries the "~" sentinel. Only finals are
+    # orderable here, which is what the previous release-only regex enforced by construction.
+    if coord is None or coord[3] != "~":
         return None
-    return int(m.group(2)), int(m.group(3))
+    return coord[0], coord[1], coord[2]
 
 
 def _context_is_ahead_of_install(generated_by: object, current_version: str) -> bool:
 
@@ -470,12 +470,17 @@ def _generate(
 def gen_state_dir_for(metadata_dir: str) -> str:
     """Where a project's codegen hash manifest lives.
 
-    Anchored on the project — the metadata dir's parent, i.e. the directory holding
-    ``metaobjects/`` — never on ``Path.cwd()``, which is whatever directory the process
-    happens to sit in and would scatter ``.metaobjects/`` into any package that merely
-    runs a generator.
+    Anchored on the project — never on ``Path.cwd()``, which is whatever directory the
+    process happens to sit in and would scatter ``.metaobjects/`` into any package that
+    merely runs a generator.
+
+    It resolves the project through :func:`project_root_for` rather than repeating
+    ``Path(metadata_dir).resolve().parent``. That function's own docstring already claimed
+    this one "is anchored here" while the code spelled the rule out a second time, and the
+    manifest key and the manifest LOCATION have to agree on where the project is or a
+    lookup finds nothing and every file reads as "not ours".
     """
-    return str(Path(metadata_dir).resolve().parent / ".metaobjects" / ".gen-state")
+    return str(project_root_for(metadata_dir) / ".metaobjects" / ".gen-state")
 
 
 #: The conventional declarative-template-spec file (SP-1 §4), discovered when
 
@@ -142,3 +142,59 @@ def test_the_unresolved_sentinel_is_never_canonicalized_into_agreement() -> None
     # the one case where both sides genuinely say the same unknown thing.)
     assert agent_context_staleness({"generatedBy": "0.0.0"}, "1.0.0rc5") is not None
     assert agent_context_staleness({"generatedBy": "1.0.0-rc.5"}, "0.0.0") is not None
+
+
+# ── the MAJOR is information on THIS port ────────────────────────────────────
+# Both helpers dropped the leading major, borrowing the Java port's rationale verbatim.
+# That rationale is explicitly "a fact peculiar to the JVM": Maven Central carries a
+# historical major of npm-major + 7, so `7.24.1` and `0.24.1` ARE one release and the
+# coordinate has to drop the major to compare them.
+#
+# Nothing of the kind is true here. `generatedBy` is stamped by the Node CLI (npm) and
+# `installed_metaobjects_version()` reads the PyPI distribution version — and npm and PyPI
+# share the major by policy (both go to 1.0.0 at the cut). So on this port the major is
+# real information, and dropping it made the nudge assert agreement across a whole major.
+
+
+def test_a_context_a_MAJOR_behind_is_not_in_sync() -> None:
+    # `1.0.0` vs `2.0.0` reduced to the same (0, 0) coordinate and read as one release.
+    assert agent_context_staleness({"generatedBy": "1.0.0"}, "2.0.0") is not None
+    assert agent_context_staleness({"generatedBy": "0.25.0"}, "1.25.0") is not None
+
+
+def test_the_1_0_cut_itself_nudges_a_0_x_context() -> None:
+    # The live case at the cut, and the reason this is not hypothetical: a Python install
+    # upgraded to 1.0.0 whose agent context was scaffolded at 0.25.0 got NO advisory at
+    # all. `_context_is_ahead_of_install` compared (25, 0) against (0, 0), concluded the
+    # 0.25.0 context was NEWER than the 1.0.0 install, and suppressed the nudge — on the
+    # single upgrade the whole feature exists to catch.
+    msg = agent_context_staleness(
+        {"version": 1, "servers": ["python"], "clients": [], "files": {"a": "h"}, "generatedBy": "0.25.0"},
+        "1.0.0",
+    )
+    assert msg is not None
+    assert "0.25.0" in msg
+
+
+def test_a_context_a_MAJOR_ahead_is_still_silent() -> None:
+    # The publish-what-changed exemption is unchanged and still applies WITHIN and ACROSS
+    # majors: the canonical scaffolder is npm, so a stamp genuinely newer than this port's
+    # install is correct and must not nudge.
+    assert agent_context_staleness({"generatedBy": "1.0.0"}, "0.25.0") is None
+
+
+def test_same_release_and_same_series_agree_on_finals() -> None:
+    # The two helpers parsed the same grammar with two different regexes. They must not be
+    # able to disagree: the ordering coordinate is the equality coordinate restricted to
+    # FINAL releases, so a final that compares equal must also compare not-ahead either way.
+    from metaobjects.agent_context.scaffold import (
+        _context_is_ahead_of_install,
+        _same_release,
+    )
+
+    for v in ("0.24.5", "1.0.0", "10.2.30"):
+        assert _same_release(v, v) is True
+        assert _context_is_ahead_of_install(v, v) is False
+    # and a prerelease is "not orderable" to BOTH, so it keeps nudging
+    for v in ("1.0.0-rc.5", "1.0.0rc5", "0.24.5+abc", "0.0.0", "nope"):
+        assert _context_is_ahead_of_install(v, "1.0.0") is False
@@ -42,6 +42,7 @@ import {
   type RetiredEntry,
 } from "../retired-vocabulary.js";
 import type { RewriteChange, RewriteRefusal, RewriteOpts, RewriteResult } from "../vocabulary-rewrite.js";
+import { authoredBaseRefusal } from "../vocabulary-rewrite.js";
 
 /**
  * A rewrite result that can also report "I could not read this file".
@@ -304,24 +305,13 @@ export function rewriteYamlDocument(source: string, opts: RewriteOpts = {}): Yam
         if (`${entry.type}.${entry.subType}` !== key) continue;
         refusals.push({ ...note(entry), subject: key, line: lineOf(span.keyStart) });
       }
-      // The SAME rule as the JSON arm: an authored `<type>.base` is a load error, not a
-      // retirement, and `meta upgrade` must not answer "nothing to rewrite" about it. Kept
-      // beside its sibling rather than in one shared pass because these two rewriters walk
-      // different structures — the shared thing is `RewriteOpts.abstractAnchorTypes`, which
-      // both read, so neither can be given a different answer to the same question.
-      const dot = key.lastIndexOf(".");
-      if (dot >= 0
-        && key.slice(dot + 1) === "base"
-        && (opts.abstractAnchorTypes ?? []).includes(key.slice(0, dot))) {
-        refusals.push({
-          since: "1.0.0",
-          why:
-            `"${key}" may not be authored — every "base" subtype is an abstract registry ` +
-            "anchor that concrete subtypes inherit from, with no runtime semantics of its own.",
-          migration: "docs/features/migrations/base-subtypes-are-not-authorable.md",
-          subject: key,
-          line: lineOf(span.keyStart),
-        });
+      // The SAME verdict as the JSON arm, from the SAME function. The two rewriters walk
+      // different structures — JSON key ranges vs YAML node spans — so the DETECTION stays
+      // per-arm, but the refusal an adopter reads is one decision and now has one source.
+      // Only the line number is this arm's own.
+      const baseRefusal = authoredBaseRefusal(key, opts.abstractAnchorTypes);
+      if (baseRefusal !== undefined) {
+        refusals.push({ ...baseRefusal, line: lineOf(span.keyStart) });
       }
       return;
     }