fix: review findings on owned-copy tooling

eject --undo: Python de-duplicates names, TS refuses a never-ejected name like the other ports.
gen: the TS stock-copy notice cannot abort a run, the strict hint prints only for ERR_UNKNOWN_ATTR,
C# gen --strict has its own hint and loads once, the C# notice catches any failure.
init --with-docs says so when metaobjects.config.ts already exists.
Python apiPrefix is limited to path characters so it cannot break the generated router.

Author: dmealing

server/csharp/MetaObjects.Cli.Tests/GenUnknownAttrWarningTests.cs

@@ -55,7 +55,8 @@ public void Strict_gen_rejects_an_unknown_attribute_before_writing_anything()
         var run = OwnedRunner.Run(_tmp, ["entity"], "gen", MetaDir, "--out", OutDir, "--namespace", "Acme", "--strict");
         Assert.Equal(1, run.ExitCode);
         Assert.Contains("ERR_UNKNOWN_ATTR", run.Stderr);
-        Assert.Contains("hint: " + VerifyCommand.UNKNOWN_ATTR_HINT, run.Stderr);
+        Assert.Contains("hint: " + CodegenCli.GenStrictHint, run.Stderr);
+        Assert.DoesNotContain("verify --lax", run.Stderr);
         Assert.False(Directory.Exists(OutDir) && Directory.EnumerateFiles(OutDir, "*", SearchOption.AllDirectories).Any());
     }
 

server/csharp/MetaObjects.Cli/Program.cs

@@ -144,7 +144,7 @@ static int RunGen(string[] rest)
     // Advisory: owned copies identical to the shipped generators carry nothing of the adopter's.
     // One line on stderr, free when there are none; never changes the exit code.
     try { if (OwnedCopy.IdenticalNotice(projectRoot) is { } notice) Console.Error.WriteLine(notice); }
-    catch (Exception e) when (e is IOException or UnauthorizedAccessException) { }
+    catch (Exception) { /* advisory only: never fail a gen over the notice */ }
 
     // Advisory: nudge a re-scaffold if the copied-in agent context predates this build.
     // Never throws, never changes the exit code (a missing/corrupt manifest is ignored).

server/csharp/MetaObjects.Codegen/CodegenCli.cs

@@ -113,6 +113,14 @@ public static void ReportFailure(GenOutcome outcome, string command)
         "arbitrary author-supplied properties into an `attr.properties` bag, OR run " +
         "'dotnet meta verify --lax' to keep the legacy open-attr load.";
 
+    /// <summary>The hint <c>gen --strict</c> prints after an ERR_UNKNOWN_ATTR: <c>gen</c>'s own way out is
+    /// to drop the flag, not <c>verify --lax</c> (ADR-0023).</summary>
+    public const string GenStrictHint =
+        "gen --strict loads strictly, as verify does (ADR-0023): an unregistered or typo'd @attr is " +
+        "ERR_UNKNOWN_ATTR and nothing was written. To fix: register the attr on a metadata provider, " +
+        "OR move arbitrary author-supplied properties into an `attr.properties` bag, " +
+        "OR drop --strict.";
+
     /// <summary>Trailing advice after <c>gen</c>'s unknown-attribute warnings. Without <c>--strict</c>
     /// <c>gen</c> loads leniently; <c>gen --strict</c> and <c>verify</c> are the strict doors (ADR-0023).</summary>
     public const string UnknownAttrGenAdvice =
@@ -735,20 +743,25 @@ private static int RunGenArgs(string[] rest, IReadOnlyList<IGenerator> declared)
 
         // ADR-0023: gen loads leniently; name what `verify` would reject instead of staying silent.
         // With --strict it loads as verify does and refuses before any file is written.
+        LoadResult genLoad;
         if (a.Strict)
         {
-            var strictLoad = meta.Load(strict: true);
-            if (strictLoad.Errors.Count > 0)
+            genLoad = meta.Load(strict: true);
+            if (genLoad.Errors.Count > 0)
             {
-                foreach (var e in strictLoad.Errors) Console.Error.WriteLine($"  load error: {e.Code}: {e.Message}");
-                if (strictLoad.Errors.Any(e => e.Code == ErrorCode.ERR_UNKNOWN_ATTR))
-                    Console.Error.WriteLine($"  hint: {UnknownAttrHint}");
+                foreach (var e in genLoad.Errors) Console.Error.WriteLine($"  load error: {e.Code}: {e.Message}");
+                if (genLoad.Errors.Any(e => e.Code == ErrorCode.ERR_UNKNOWN_ATTR))
+                    Console.Error.WriteLine($"  hint: {GenStrictHint}");
                 Console.Error.WriteLine($"{GenCommandName}: FAILED (metadata did not load cleanly; --strict)");
                 return 1;
             }
         }
-        else WarnUnknownAttrs(meta);
-        var outcome = RunGen(meta.Load(), a.OutDir, a.Namespace, a.EmitAbstractShapes, suite, projectRoot, a.Baseline,
+        else
+        {
+            WarnUnknownAttrs(meta);
+            genLoad = meta.Load();
+        }
+        var outcome = RunGen(genLoad, a.OutDir, a.Namespace, a.EmitAbstractShapes, suite, projectRoot, a.Baseline,
             includeNames: declared.Any(g => g.Name == "names"),
             // Only a run of the whole declared list can tell a stale file from one the
             // narrowing left out.

server/python/src/metaobjects/codegen/eject.py

@@ -125,6 +125,7 @@ class EjectResult:
 
 def eject(names: list[str], root: Path, *, force: bool = False) -> EjectResult:
     """Copy each named generator. Every name is checked before any file is written."""
+    names = list(dict.fromkeys(names))
     known = {e.name: e for e in ejectable()}
     unknown = [n for n in names if n not in known]
     if unknown:
@@ -195,6 +196,7 @@ def undo(names: list[str], root: Path, *, force: bool = False) -> EjectResult:
     removed. The config is never edited: the entry that points back at the shipped generator
     is printed instead. A companion runtime copy goes only when it matches the package and
     no remaining owned generator reads it."""
+    names = list(dict.fromkeys(names))
     known = {e.name: e for e in ejectable()}
     unknown = [n for n in names if n not in known]
     if unknown:

server/python/src/metaobjects/codegen/project_config.py

@@ -44,6 +44,10 @@
 #: followed the rc.3 guide and added it gets the naming-migration message, not "unknown key".
 _REMOVED_COLUMN_NAMING_KEY = "columnNaming"
 
+#: A mount path the generated router can carry verbatim inside a string literal: a leading
+#: ``/`` then path characters only, so a quote or backslash cannot break the emitted source.
+_API_PREFIX_RE = re.compile(r"/[A-Za-z0-9._/-]*")
+
 #: Every key this loader reads at the top level, and the ONLY ones it accepts.
 #: ``metaobjects-config.schema.json`` declares ``additionalProperties: false``, so the
 #: shipped schema has always said an unknown key is invalid; naming the set here is what
@@ -465,10 +469,11 @@ def load_project_config(path: Path) -> ProjectConfig:
         raise ConfigError(f"{path}: 'templates' must be a non-empty string (a directory path).")
 
     api_prefix = raw.get("apiPrefix", DEFAULT_API_PREFIX)
-    if not isinstance(api_prefix, str) or (api_prefix and not api_prefix.startswith("/")):
+    if not isinstance(api_prefix, str) or (api_prefix and not _API_PREFIX_RE.fullmatch(api_prefix)):
         raise ConfigError(
             f"{path}: 'apiPrefix' must be \"\" (mount at the root) or a path starting with "
-            f"'/', e.g. \"/api\" or \"/v1\"; got {api_prefix!r}."
+            f"'/' made of letters, digits, '.', '_', '-' and '/', e.g. \"/api\" or \"/v1\"; "
+            f"got {api_prefix!r}."
         )
     api_prefix = api_prefix.rstrip("/")
 

server/python/tests/codegen/test_cli_init.py

@@ -58,3 +58,12 @@ def test_api_prefix_must_be_empty_or_a_path(tmp_path: Path, capsys) -> None:
     cfg.write_text(cfg.read_text() + "apiPrefix: v1\n")
     assert main(["gen", "--config", str(cfg)]) != 0
     assert "apiPrefix" in capsys.readouterr().err
+
+
+def test_api_prefix_with_a_quote_or_backslash_is_refused(tmp_path: Path, capsys) -> None:
+    # The prefix is written into the generated router's source, so it may only hold path characters.
+    assert main(["init", "--root", str(tmp_path)]) == 0
+    cfg = tmp_path / "metaobjects.config.yaml"
+    cfg.write_text(cfg.read_text() + "apiPrefix: '/v1\"x'\n")
+    assert main(["gen", "--config", str(cfg)]) != 0
+    assert "apiPrefix" in capsys.readouterr().err

server/python/tests/codegen/test_eject_undo.py

@@ -135,3 +135,11 @@ def test_gen_without_owned_copies_prints_no_notice(tmp_path: Path, capsys) -> No
     cfg = _gen_cfg(tmp_path, "entity")
     assert main(["gen", "--config", str(cfg)]) == 0
     assert "identical to the shipped" not in capsys.readouterr().err
+
+
+def test_undo_with_a_repeated_name_removes_it_once(tmp_path: Path, monkeypatch, capsys) -> None:
+    monkeypatch.chdir(tmp_path)
+    assert main(["eject", "entity"]) == 0
+    capsys.readouterr()
+    assert main(["eject", "--undo", "entity", "entity"]) == 0
+    assert not (tmp_path / GEN / "entity.py").exists()

server/typescript/packages/cli/src/commands/eject.ts

@@ -684,10 +684,13 @@ async function undoCommand(names: readonly string[], force: boolean, cwd: string
   const named = names.length > 0;
   const targets = named ? owned.filter((r) => names.includes(r.name)) : owned.filter(isStockRow);
   const kept: UndoKept[] = [];
-  for (const n of names) {
-    if (!owned.some((r) => r.name === n)) {
-      kept.push({ name: n, path: `${OWNED_GENERATORS_DIR}/${n}.ts`, reason: "not ejected — nothing to undo" });
-    }
+  const notOwned = names.filter((n) => !owned.some((r) => r.name === n));
+  if (notOwned.length > 0) {
+    log.error(
+      `not an owned copy (nothing at ${OWNED_GENERATORS_DIR}/): ${notOwned.join(", ")}. Nothing was removed. ` +
+        "Run `meta eject --list` to see what you own.",
+    );
+    return 2;
   }
   const refused = named && !force ? targets.filter((r) => !isStockRow(r)) : [];
   if (refused.length > 0) {

server/typescript/packages/cli/src/commands/gen.ts

@@ -21,7 +21,7 @@ import type { WriteStatus } from "@metaobjectsdev/codegen-ts";
 import { packageOfResolutionKey } from "@metaobjectsdev/metadata";
 import type { MetaRoot } from "@metaobjectsdev/metadata";
 import type { Collection } from "@metaobjectsdev/sdk";
-import { reportLoadError } from "../lib/load-error.js";
+import { describeLoadError, reportLoadError } from "../lib/load-error.js";
 import { STRICT_GEN_HINT, UNKNOWN_ATTR_GEN_ADVICE, unknownAttrWarnings } from "../lib/unknown-attr-warnings.js";
 import { stockCopyNotice } from "./eject.js";
 import {
@@ -146,7 +146,7 @@ export async function genCommand(args: string[], cwd: string, fmt: OutputFormat
   advise(warnIfManifestIgnored(projectRoot));
   // Owned generator copies that are the shipped reference, unchanged: they miss every later fix.
   // Says nothing when the project owns none, and never affects the exit code.
-  const stockNotice = await stockCopyNotice(projectRoot);
+  const stockNotice = await stockCopyNotice(projectRoot).catch(() => undefined);
   if (stockNotice !== undefined) { log.warn(stockNotice); advise(stockNotice); }
 
   // ADR-0034 Amendment 9: the config IS the list. With none there is nothing to generate,
@@ -196,7 +196,11 @@ export async function genCommand(args: string[], cwd: string, fmt: OutputFormat
     metadata = await loadMemory(genCollection.configDir, flags.strict ? { ...loadOptions, strict: true } : loadOptions);
   } catch (err) {
     reportLoadError(log, "failed to load metadata", err);
-    if (flags.strict) log.error(STRICT_GEN_HINT);
+    // The hint explains the strict-only rejection (an undeclared attribute); any other load
+    // failure is not something `--strict` caused, so it gets no hint.
+    if (flags.strict && describeLoadError(err).code === "ERR_UNKNOWN_ATTR") {
+      log.error(STRICT_GEN_HINT);
+    }
     return 1;
   }
 

server/typescript/packages/cli/src/commands/init.ts

@@ -695,6 +695,11 @@ export async function init(opts: InitOptions): Promise<InitResult> {
   if (!(await fileExists(forgeConfigPath))) {
     await writeFile(forgeConfigPath, buildMetaobjectsConfigBody(opts.d1 ? "d1" : "sqlite", opts.withDocs === true), "utf8");
     result.created.push("metaobjects.config.ts");
+  } else if (opts.withDocs === true) {
+    result.warnings.push(
+      "--with-docs: metaobjects.config.ts already exists and was left alone. To write the docs, add " +
+        "`docsFile()` and `apiDocsFile()` from @metaobjectsdev/codegen-ts/generators to its `generators` list.",
+    );
   }
 
   // Scaffold a minimal root .gitignore ONLY when the project has none — never