@@ -0,0 +1,124 @@
+# provider-composition conformance
+
+Five registry/provider error codes are Tier-1 cross-port invariants that the
+existing `fixtures/conformance/error-*` corpus **cannot** reach: that corpus is
+metadata-input → error, but these codes are triggered by *how providers are
+composed and sealed*, not by any metadata document. This small corpus gates them
+cross-port.
+
+| Code | Trigger |
+|------|---------|
+| `ERR_PROVIDER_DUPLICATE_ID` | Two providers in a composition report the same `id`. |
+| `ERR_PROVIDER_MISSING_DEPENDENCY` | A provider declares a dependency id absent from the set. |
+| `ERR_PROVIDER_DEPENDENCY_CYCLE` | Providers form a dependency cycle (topo-sort cannot proceed). |
+| `ERR_PROVIDER_ATTR_CONFLICT` | A provider `extend`s a type, redefining an attr another provider already declared. |
+| `ERR_REGISTRY_SEALED` | A registration is attempted against a registry sealed after bootstrap (ADR-0023). |
+
+## Corpus shape
+
+One JSON manifest per scenario (`<code>.json`). Each manifest is:
+
+```jsonc
+{
+  "description": "human-readable — what the scenario exercises",
+  "providers": ["<named-provider-id>", ...],   // composed in listed order
+  "expectedError": "ERR_PROVIDER_DUPLICATE_ID", // the code the port must surface
+  "sealThenRegister": "<named-provider-id>"      // OPTIONAL — see "registry-sealed"
+}
+```
+
+Each port's runner:
+
+1. Reads a manifest.
+2. Maps each name in `providers` to that port's **canonical named provider** (see below).
+3. Composes a registry from them (the port's `composeRegistry` equivalent).
+4. For the ordinary scenarios: the compose call itself throws — assert the caught
+   error's stable `.code` equals `expectedError`.
+5. For the `registry-sealed` scenario (manifest carries `sealThenRegister`): compose
+   succeeds, then the runner `seal()`s the resulting registry and runs the named
+   `sealThenRegister` provider's `registerTypes` against the **sealed** registry —
+   that mutation must throw `expectedError`.
+
+Every port MUST supply the same canonical named-provider set (below) so a manifest's
+`providers` list resolves identically everywhere. The named providers are **test-only**
+— they live in each port's conformance test code, never in shipped metamodel providers.
+
+## Canonical named-provider set
+
+Each entry: `id`, `dependencies`, and what `registerTypes` does. Ports implement
+them idiomatically but with **identical id / dependencies / registration behavior**.
+
+### `duplicate-x`
+- **id:** `"duplicate-x"`
+- **dependencies:** none
+- **registerTypes:** no-op.
+
+### `duplicate-x-clone`
+- **id:** `"duplicate-x"` — *deliberately the same id as `duplicate-x`* (the map key
+  used to look it up is `duplicate-x-clone`, but the provider's reported `.id` is
+  `duplicate-x`, so the collision surfaces at compose time).
+- **dependencies:** none
+- **registerTypes:** no-op.
+
+Composing `["duplicate-x", "duplicate-x-clone"]` → `ERR_PROVIDER_DUPLICATE_ID`.
+
+### `depends-on-missing`
+- **id:** `"depends-on-missing"`
+- **dependencies:** `["does-not-exist"]` — an id no provider in the set supplies.
+- **registerTypes:** no-op.
+
+Composing `["depends-on-missing"]` → `ERR_PROVIDER_MISSING_DEPENDENCY`.
+
+### `cycle-a`
+- **id:** `"cycle-a"`
+- **dependencies:** `["cycle-b"]`
+- **registerTypes:** no-op.
+
+### `cycle-b`
+- **id:** `"cycle-b"`
+- **dependencies:** `["cycle-a"]`
+- **registerTypes:** no-op.
+
+Composing `["cycle-a", "cycle-b"]` → `ERR_PROVIDER_DEPENDENCY_CYCLE`.
+
+### `attr-conflict-base`
+- **id:** `"attr-conflict-base"`
+- **dependencies:** none
+- **registerTypes:** registers ONE test-only type/subtype (a fresh, otherwise-unused
+  pair) carrying a single string attr named `conflictAttr`. The type/subtype pair is
+  chosen so it does not collide with any real core type; it exists only to be extended
+  by `attr-conflict-clash`. A wildcard attr child-rule is fine. Concretely the TS
+  reference registers `template.compositionprobe` with attr `conflictAttr` (string);
+  other ports pick an equivalent fresh pair on a type their provider model already
+  supports registering.
+
+Composing `["attr-conflict-base"]` alone must **succeed** (it is also the base for the
+`registry-sealed` scenario).
+
+### `attr-conflict-clash`
+- **id:** `"attr-conflict-clash"`
+- **dependencies:** `["attr-conflict-base"]`
+- **registerTypes:** `extend`s the same test-only type/subtype that `attr-conflict-base`
+  registered, adding an attr **with the same name** (`conflictAttr`). The registry's
+  additive-extend path rejects redefining an already-declared attr.
+
+Composing `["attr-conflict-base", "attr-conflict-clash"]` → `ERR_PROVIDER_ATTR_CONFLICT`.
+
+### `seal-probe`
+- **id:** `"seal-probe"`
+- **dependencies:** none
+- **registerTypes:** attempts ONE mutating registration (e.g. register a fresh
+  test-only type, or `extend` an existing one, or `registerCommonAttrs`). Against a
+  sealed registry this must throw `ERR_REGISTRY_SEALED`. This provider is **only**
+  used via a manifest's `sealThenRegister` — never composed directly.
+
+## Notes
+
+- `ERR_REGISTRY_SEALED` is a **five-port** invariant here. It was previously exercised
+  in per-port unit tests only for TS / Python / C#; this corpus adds it to Java and
+  Kotlin (which shares the JVM metadata registry).
+- `attr-conflict` and `registry-sealed` are the two scenarios whose named providers
+  actually register/extend types. All the others use no-op providers, so their id /
+  dependencies wiring is the entire contract.
+- The `.code` read off a caught exception is the assertion surface — message text is
+  never compared (message wording is per-port).
@@ -0,0 +1,5 @@
+{
+  "description": "A provider extend redefines an attr another provider already declared on the same type.subType.",
+  "providers": ["attr-conflict-base", "attr-conflict-clash"],
+  "expectedError": "ERR_PROVIDER_ATTR_CONFLICT"
+}
@@ -0,0 +1,5 @@
+{
+  "description": "Two providers name each other as a dependency — the topological sort cannot proceed.",
+  "providers": ["cycle-a", "cycle-b"],
+  "expectedError": "ERR_PROVIDER_DEPENDENCY_CYCLE"
+}
@@ -0,0 +1,5 @@
+{
+  "description": "Two providers report the same id — composition rejects the duplicate.",
+  "providers": ["duplicate-x", "duplicate-x-clone"],
+  "expectedError": "ERR_PROVIDER_DUPLICATE_ID"
+}
@@ -0,0 +1,5 @@
+{
+  "description": "A provider declares a dependency id with no matching provider in the set.",
+  "providers": ["depends-on-missing"],
+  "expectedError": "ERR_PROVIDER_MISSING_DEPENDENCY"
+}
@@ -0,0 +1,6 @@
+{
+  "description": "Composing a valid provider set, sealing the registry, then attempting a further registration (ADR-0023). The runner composes the named providers, calls seal() on the resulting registry, then invokes the sealed-mutation probe provider's registerTypes against the sealed registry — which must throw ERR_REGISTRY_SEALED.",
+  "providers": ["attr-conflict-base"],
+  "sealThenRegister": "seal-probe",
+  "expectedError": "ERR_REGISTRY_SEALED"
+}
@@ -0,0 +1,166 @@
+// ProviderCompositionConformanceTests — C# port runner.
+//
+// Five registry/provider error codes are Tier-1 cross-port invariants that the
+// metadata-input -> error corpus cannot reach: they are triggered by HOW
+// providers are composed and sealed, not by any metadata document. This runner
+// gates them from the shared corpus at fixtures/provider-composition-conformance/.
+//
+// Each port supplies the SAME canonical named-provider set (see the corpus
+// README). A manifest names providers by id; the runner maps names -> provider
+// objects, composes, and asserts the surfaced Code. The registry-sealed scenario
+// composes, seals, then runs a probe provider's RegisterTypes against the sealed
+// registry.
+
+using System.Text.Json;
+using MetaObjects;
+using MetaObjects.Meta;
+using MetaObjects.Shared;
+using Xunit;
+
+namespace MetaObjects.Conformance.Tests;
+
+// --- Canonical named-provider set (test-only; identical id/deps/behavior cross-port) ---
+
+/// <summary>Registers a fresh test-only type carrying a single string attr.</summary>
+internal sealed class AttrConflictBaseProvider : IMetaDataTypeProvider
+{
+    public const string ConflictSubType = "compositionprobe";
+    public const string ConflictAttr = "conflictAttr";
+
+    public string Id => "attr-conflict-base";
+    public IReadOnlyList<string> Dependencies => System.Array.Empty<string>();
+
+    public void RegisterTypes(TypeRegistry registry)
+    {
+        registry.Register(new TypeDefinition(
+            typeId: new TypeId("template", ConflictSubType),
+            description: "Test-only — provider-composition conflict probe.",
+            childRules: new List<ChildRule>
+            {
+                new ChildRule(
+                    BaseTypes.TYPE_ATTR,
+                    Structural.CHILD_RULE_WILDCARD,
+                    Structural.CHILD_RULE_WILDCARD),
+            },
+            factory: (typeId, name) => new MetaTemplate(typeId, name),
+            attributes: new List<AttrSchema>
+            {
+                new AttrSchema(ConflictAttr, "string", Required: false, Description: "Conflict probe attr."),
+            }));
+    }
+}
+
+/// <summary>Extends the base's type, redefining the same attr name -> attr conflict.</summary>
+internal sealed class AttrConflictClashProvider : IMetaDataTypeProvider
+{
+    public string Id => "attr-conflict-clash";
+    public IReadOnlyList<string> Dependencies => new[] { "attr-conflict-base" };
+
+    public void RegisterTypes(TypeRegistry registry)
+    {
+        registry.Extend(
+            "template",
+            AttrConflictBaseProvider.ConflictSubType,
+            attributes: new List<AttrSchema>
+            {
+                new AttrSchema(AttrConflictBaseProvider.ConflictAttr, "string", Required: false, Description: "Redefined — collides."),
+            });
+    }
+}
+
+/// <summary>Attempts a mutating registration — throws against a sealed registry.</summary>
+internal sealed class SealProbeProvider : IMetaDataTypeProvider
+{
+    public string Id => "seal-probe";
+    public IReadOnlyList<string> Dependencies => System.Array.Empty<string>();
+
+    public void RegisterTypes(TypeRegistry registry)
+    {
+        registry.Register(new TypeDefinition(
+            typeId: new TypeId("template", "sealprobe"),
+            description: "Test-only — sealed-registry mutation probe.",
+            childRules: new List<ChildRule>(),
+            factory: (typeId, name) => new MetaTemplate(typeId, name),
+            attributes: new List<AttrSchema>()));
+    }
+}
+
+public sealed class ProviderCompositionConformanceTests
+{
+    private static readonly IReadOnlyDictionary<string, IMetaDataTypeProvider> Providers =
+        new Dictionary<string, IMetaDataTypeProvider>(System.StringComparer.Ordinal)
+        {
+            ["duplicate-x"]         = new NoopTestProvider("duplicate-x"),
+            // Same Id as duplicate-x — surfaces ERR_PROVIDER_DUPLICATE_ID at compose time.
+            ["duplicate-x-clone"]   = new NoopTestProvider("duplicate-x"),
+            ["depends-on-missing"]  = new NoopTestProvider("depends-on-missing", "does-not-exist"),
+            ["cycle-a"]             = new NoopTestProvider("cycle-a", "cycle-b"),
+            ["cycle-b"]             = new NoopTestProvider("cycle-b", "cycle-a"),
+            ["attr-conflict-base"]  = new AttrConflictBaseProvider(),
+            ["attr-conflict-clash"] = new AttrConflictClashProvider(),
+            ["seal-probe"]          = new SealProbeProvider(),
+        };
+
+    private sealed record Manifest(
+        string[] Providers,
+        string ExpectedError,
+        string? SealThenRegister);
+
+    private static string CorpusRootPath()
+    {
+        var env = System.Environment.GetEnvironmentVariable("METAOBJECTS_PROVIDER_COMPOSITION_CORPUS");
+        if (!string.IsNullOrEmpty(env) && Directory.Exists(env)) return env;
+
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir != null)
+        {
+            var candidate = Path.Combine(dir.FullName, "fixtures", "provider-composition-conformance");
+            if (Directory.Exists(candidate)) return candidate;
+            dir = dir.Parent;
+        }
+        throw new DirectoryNotFoundException(
+            "could not locate fixtures/provider-composition-conformance from " + AppContext.BaseDirectory);
+    }
+
+    public static IEnumerable<object[]> ManifestFiles()
+    {
+        foreach (var file in Directory.GetFiles(CorpusRootPath(), "*.json").OrderBy(f => f, System.StringComparer.Ordinal))
+            yield return new object[] { Path.GetFileName(file) };
+    }
+
+    private static IMetaDataTypeProvider Resolve(string id) =>
+        Providers.TryGetValue(id, out var p)
+            ? p
+            : throw new System.ArgumentException($"Unknown named provider \"{id}\" in provider-composition corpus");
+
+    [Fact]
+    public void CorpusIsNonEmpty()
+    {
+        Assert.NotEmpty(ManifestFiles());
+    }
+
+    [Theory]
+    [MemberData(nameof(ManifestFiles))]
+    public void ProviderComposition(string fileName)
+    {
+        var opts = new JsonSerializerOptions { PropertyNameCaseInsensitive = true };
+        var manifest = JsonSerializer.Deserialize<Manifest>(
+            File.ReadAllText(Path.Combine(CorpusRootPath(), fileName)), opts)!;
+        var resolved = manifest.Providers.Select(Resolve).ToList();
+
+        if (manifest.SealThenRegister != null)
+        {
+            // Compose (must succeed), seal, then run the probe against the sealed registry.
+            var registry = Provider.ComposeRegistry(resolved);
+            registry.Seal();
+            var probe = Resolve(manifest.SealThenRegister);
+            var sealedEx = Assert.Throws<MetaModelException>(() => probe.RegisterTypes(registry));
+            Assert.Equal(manifest.ExpectedError, sealedEx.Code.ToString());
+            return;
+        }
+
+        // Ordinary scenario: the compose call itself throws.
+        var ex = Assert.Throws<MetaModelException>(() => Provider.ComposeRegistry(resolved));
+        Assert.Equal(manifest.ExpectedError, ex.Code.ToString());
+    }
+}
@@ -442,8 +442,21 @@ private void addChildRequirement(ChildRequirement requirement) {
 
         ChildRequirement existing = childRequirements.get(key);
         if (existing != null && !existing.equals(requirement)) {
+            // A colliding ATTR child requirement is a provider redefining an attr
+            // another provider already declared on this type — the cross-port
+            // ERR_PROVIDER_ATTR_CONFLICT invariant (mirrors the TS/Python/C#
+            // registry.extend guard). Surface it with the stable code so the
+            // provider-composition conformance corpus can assert it. Non-attr
+            // child collisions keep the historical IllegalArgumentException.
+            if ("attr".equals(requirement.getExpectedType())) {
+                throw new com.metaobjects.MetaDataException(
+                    "Attribute '" + requirement.getName() + "' is already declared on this type "
+                        + "(a provider redefined an attr another provider already declared). "
+                        + "Existing: " + existing + ", New: " + requirement,
+                    com.metaobjects.ErrorCode.ERR_PROVIDER_ATTR_CONFLICT);
+            }
             throw new IllegalArgumentException(
-                "Child requirement already exists for key '" + key + 
+                "Child requirement already exists for key '" + key +
                 "'. Existing: " + existing + ", New: " + requirement
             );
         }