@@ -180,16 +180,24 @@ look." The attribute's heaviest use was this repository's own conformance corpus
 therefore also the only thing that exercises the three modes — so the corpus gained fixtures
 for `writeOnce`, which previously had no coverage at all.
 
-**Two real defects were caught by the api-contract corpus, not by unit tests**, and both are
-the same shape — the ADR-0045 rule that the OUTERMOST generated write artifact enforces the
-mode. Excluding `writeOnce` from the Python `<Entity>Patch` model was NOT enough: the
-generated FastAPI handler binds `dto: dict[str, Any]` (the raw body) and passes THAT to the
-repository, so the field still reached the row. (`@autoSet` survives this only because the
-router *overwrites* its key server-side; `writeOnce` has no server value to clobber.) The C#
-generated route had the twin: `SetAfterSaveBehavior(Ignore)` governs EF's save, but the merge
-loop assigns `entry.CurrentValues[target]` and the handler returns the in-memory entity, so a
-caller-supplied value was echoed in the RESPONSE. Both now strip at the route, vanilla and
-TPH.
+**THREE real defects were caught by the api-contract corpus, not by the unit tests that
+already passed** — and all three are the ADR-0045 rule biting: the OUTERMOST generated write
+artifact enforces the mode, and in three ports that artifact was not the one first fixed.
+
+1. **Python.** Excluding `writeOnce` from `<Entity>Patch` was NOT enough — the generated
+   FastAPI handler binds `dto: dict[str, Any]` (the RAW body), validates against the patch
+   model, then hands the raw dict to the repository, so the field still reached the row.
+   `@autoSet` survives this only because the router OVERWRITES its key server-side;
+   `writeOnce` has no server value to clobber. Now stripped in the router.
+2. **C#.** `SetAfterSaveBehavior(Ignore)` governs EF's SAVE, but the merge loop assigns
+   `entry.CurrentValues[target]` and the handler returns the in-memory entity — so a
+   caller-supplied value was echoed in the RESPONSE even where EF omitted the column from
+   the UPDATE. Now skipped in the merge loop, exactly as `@autoSet` is.
+3. **Kotlin — and this one is the 0.19.4 lesson landing exactly as predicted.** The vanilla
+   lane passed and the **TPH** lane did not: `KotlinTphPlan.subtypeSettableFields` is a
+   separate SSOT from the vanilla controller's `patchSettableFields`, and only the latter had
+   been taught the modes. Nothing but a TPH-flavoured scenario could have found it, which is
+   why the acceptance criteria demanded one.
 
 Metadata declaring no `@mutability` generates byte-identically to before, and an explicit
 `@mutability: "readWrite"` emits byte-identically to declaring nothing — pinned in TS and C#.
 
@@ -103,7 +103,9 @@ covering projections, entities, values, and parameter refs alike.
 Three coordinated breaking changes in one cut (#210 / #212):
 
 - A field hosted on an `object.value` may no longer carry an **assembly origin**
-  (`origin.aggregate` / `origin.computed` / `origin.collection` / `origin.first`)
+  (`origin.aggregate` / `origin.computed` / `origin.collection` / `origin.first` —
+  `origin.collection` was itself retired in `0.24.0`, see §8D, so on a current
+  release the rule reads as the three survivors)
   — `ERR_SUBTYPE_RULE_VIOLATION`. Re-host the payload as a **sourceless
   `object.projection`**; `@payloadRef`/`@responseRef` now accept one.
   `origin.passthrough` on a value (FR-015 parameter lineage) stays legal.
@@ -117,7 +119,50 @@ Three coordinated breaking changes in one cut (#210 / #212):
 - **Full mechanical rewrites for all three:**
   [value-assembly-origins-and-source-role-shrink.md](value-assembly-origins-and-source-role-shrink.md).
 
-## 8. Deprecated `codegen-ts/generators` export removed (at the 1.0 cut)
+## 8. The coordinated breaking batch (shipped `0.24.0` / Maven `7.24.0`)
+
+**Four vocabulary retirements in one release**, batched deliberately: under ADR-0023's sealed
+strict registry a retirement has no deprecation shim, so each is a migration you must
+perform, and two breaking MINORs back to back would mean two migrations for work budgeted as
+one. `metamodelVersion` moved `0.9` → `0.10`, once, covering all four.
+
+Each has its own guide with the exact loader error and a rewrite rule. In rough order of how
+likely you are to be affected:
+
+**8A. `@readOnly` → `@mutability`** —
+[readonly-to-mutability.md](readonly-to-mutability.md)
+
+`@mutability: readWrite | writeOnce | readOnly` replaces the boolean on every `field.*`
+subtype. `@readOnly: true` → `@mutability: "readOnly"`; `@readOnly: false` → delete it
+(`readWrite` is the default). The new middle mode is the point: **`writeOnce`** — settable on
+create, frozen after — which the boolean could not express, and which an assigned primary key
+has always wanted. Measured at **zero uses** across three adopting estates, so this is likely
+an empty migration.
+
+**8B. The requirement vocabulary becomes prescriptive-only** —
+[verified-by-retirement.md](verified-by-retirement.md)
+
+`@verifiedBy` and `@supersededBy` deregister (`ERR_UNKNOWN_ATTR`); `@status` shrinks to
+`planned | live | partial`, so `abandoned` and `superseded` fail `ERR_BAD_ATTR_VALUE`.
+Retiring a capability is now DELETION of its requirement. Only affects projects that declare
+`requirement.*` nodes at all.
+
+**8C. A template subtype's axis is DIRECTION** —
+[template-direction-outbound-vs-inbound.md](template-direction-outbound-vs-inbound.md)
+
+`@promptStyle` on a `template.output` fails the load; the inbound tier (parser, tolerant
+extractor, response-format fragment) belongs to a `template.prompt` carrying `@responseRef`,
+and emitted paths follow the direction.
+
+**8D. `origin.collection` retires to reserved-not-registered** —
+[origin-collection-retirement.md](origin-collection-retirement.md)
+
+Any use now fails `ERR_UNKNOWN_SUBTYPE`. It duplicated `origin.aggregate @agg: collect` on a
+smaller attr set and nothing ever dispatched on it, so deleting the child changes no
+generated output. A whole-object rollup returns additively with
+[#335](https://github.com/metaobjectsdev/metaobjects/issues/335).
+
+## 9. Deprecated `codegen-ts/generators` export removed (at the 1.0 cut)
 
 Importing the built-in generators from `@metaobjectsdev/codegen-ts/generators`
 (`entityFile` / `queriesFile` / `routesFile` / `barrel`) is **removed** at 1.0.
 
@@ -10,6 +10,7 @@
           { "field.long":       { "name": "id", "@filterable": true, "@sortable": true } },
           { "field.enum":       { "name": "type", "@values": ["Bridge", "Copay", "PriorAuth"], "@filterable": true } },
           { "field.string":     { "name": "reference", "@required": true, "@maxLength": 80, "@filterable": true, "@sortable": true } },
+          { "field.string":     { "name": "issuedCurrency", "@maxLength": 3, "@mutability": "writeOnce" } },
           { "field.timestamp":  { "name": "autoCreatedAt", "@autoSet": "onCreate" } },
           { "field.timestamp":  { "name": "autoUpdatedAt", "@autoSet": "onUpdate" } },
           { "identity.primary": { "name": "id", "@fields": "id", "@generation": "increment" } }
 
@@ -0,0 +1,53 @@
+name: tph-writeonce-patch-stripped
+description: >
+  FR-037 R1 / ADR-0045 (TPH leg) — `@mutability: "writeOnce"` is honored by the deployed
+  TPH per-subtype API surface, not merely by the vanilla one.
+
+  This scenario exists because TPH is a SEPARATE code path in every port — the 0.19.4
+  lesson, where @autoSet stamping was correct on the vanilla route and absent on the TPH
+  per-subtype route in three ports at once. Java has a distinct `settableFields` overload
+  for the per-subtype patch, C# a distinct `AppendTphSubtypeRoutes` merge, Python a distinct
+  TPH router branch, Kotlin a distinct TPH controller. Each of those was written to exclude
+  the mode; without this scenario none of them is GATED, and "written" is not "enforced".
+
+  `issuedCurrency` is declared on the TPH BASE (`Auth`), so every subtype inherits it — which
+  also exercises the resolving-accessor requirement (ADR-0039): a port reading the mode
+  own-only would see `readWrite` on every subtype and let the write through.
+
+  Seeded Bridge row 1 carries "USD". A PATCH on the per-subtype path carrying a NEW value
+  must return 200 with the stored value unchanged, while the ordinary readWrite field in the
+  same body IS applied — the pairing is what makes this about the MODE rather than about the
+  request being dropped wholesale.
+requests:
+  - id: r1
+    method: PATCH
+    path: /api/auths/bridge/1
+    body:
+      reference: "REF-1-writeOnce"
+      issuedCurrency: "JPY"
+    expect:
+      status: 200
+      body:
+        row:
+          id: 1
+          # The readWrite sibling IS applied...
+          reference: "REF-1-writeOnce"
+          # ...while the inherited writeOnce column keeps its created value. 200, not 400.
+          issuedCurrency: "USD"
+  - id: r2
+    method: PATCH
+    path: /api/auths/bridge/1
+    body:
+      # A readWrite field rides along deliberately — see the vanilla
+      # writeonce-patch-stripped scenario for why (the empty-PATCH contract is not
+      # settled cross-port, and settling it is not this scenario's business).
+      reference: "REF-1-null-probe"
+      issuedCurrency: null
+    expect:
+      status: 200
+      body:
+        row:
+          id: 1
+          reference: "REF-1-null-probe"
+          # Clearing is a write, so the FR-035 present-null path must not reach it either.
+          issuedCurrency: "USD"
@@ -1,7 +1,7 @@
 {
   "auths": [
-    { "id": 1, "type": "Bridge",    "reference": "REF-1", "quantity": 5,        "copayAmount": null, "approver": null,        "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" },
-    { "id": 2, "type": "Copay",     "reference": "REF-2", "quantity": null,     "copayAmount": "12.50", "approver": null,        "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" },
-    { "id": 3, "type": "PriorAuth", "reference": "REF-3", "quantity": null,     "copayAmount": null, "approver": "Dr. Smith", "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" }
+    { "id": 1, "type": "Bridge",    "reference": "REF-1", "quantity": 5,        "copayAmount": null, "approver": null,        "issuedCurrency": "USD", "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" },
+    { "id": 2, "type": "Copay",     "reference": "REF-2", "quantity": null,     "copayAmount": "12.50", "approver": null,        "issuedCurrency": "GBP", "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" },
+    { "id": 3, "type": "PriorAuth", "reference": "REF-3", "quantity": null,     "copayAmount": null, "approver": "Dr. Smith", "issuedCurrency": "EUR", "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" }
   ]
 }
@@ -34,6 +34,9 @@ internal static class TphFixture
           "quantity" INTEGER,
           "copayAmount" NUMERIC(10,2),
           "approver" VARCHAR(80),
+          -- FR-037 R1: the @mutability "writeOnce" column, declared on the TPH BASE so
+          -- every subtype inherits it.
+          "issuedCurrency" VARCHAR(3),
           "autoCreatedAt" TIMESTAMPTZ,
           "autoUpdatedAt" TIMESTAMPTZ,
           CONSTRAINT "auths_pkey" PRIMARY KEY ("id"),
@@ -42,7 +45,7 @@ internal static class TphFixture
         """;
 
     private static readonly string[] Cols =
-        { "id", "type", "reference", "quantity", "copayAmount", "approver", "autoCreatedAt", "autoUpdatedAt" };
+        { "id", "type", "reference", "quantity", "copayAmount", "approver", "issuedCurrency", "autoCreatedAt", "autoUpdatedAt" };
 
     /// <summary>Create the single `auths` table on a fresh container.</summary>
     public static async Task ProvisionSchemaAsync(string connString)
 
@@ -36,6 +36,10 @@ internal sealed class TphReferenceServer : IAsyncDisposable
     };
 
     // Every column the `auths` table carries (base + every subtype-only column).
+    // FR-037 R1: `issuedCurrency` is @mutability "writeOnce" — it is DELIBERATELY absent
+    // from this caller-settable projection, so a presented value is STRIPPED on PATCH
+    // rather than rejected (the same treatment autoCreatedAt/autoUpdatedAt get by being
+    // absent here). It IS written on create, explicitly, below. Do NOT add it here.
     private static readonly string[] AllCols = { "id", "type", "reference", "quantity", "copayAmount", "approver" };
 
     private readonly PostgresContainer _pg;
@@ -266,6 +270,11 @@ private async Task DispatchAsync(HttpListenerContext ctx)
         // body-driven loop above never sets them from the request). A fresh row's
         // autoUpdatedAt therefore equals its autoCreatedAt.
         var autoNow = DateTimeOffset.UtcNow;
+        // FR-037 R1: writeOnce IS bound on create — settable exactly once.
+        if (body is not null && body.TryGetPropertyValue("issuedCurrency", out var __ic) && __ic is not null)
+        {
+            cols.Add("issuedCurrency"); vals.Add(__ic.GetValue<string>());
+        }
         cols.Add("autoCreatedAt"); vals.Add(autoNow);
         cols.Add("autoUpdatedAt"); vals.Add(autoNow);
 
 
@@ -131,7 +131,14 @@ object KotlinTphPlan {
             it is ObjectField || it is MapField || KotlinTypeMapper.isJsonbOpenBag(it)
         }.filter {
             it.name != pk && it.name != discField &&
-                !KotlinGenUtil.isAutoSetField(it)   // #203/ADR-0045: server-owned; controller stamps it
+                !KotlinGenUtil.isAutoSetField(it) &&  // #203/ADR-0045: server-owned; controller stamps it
+                // FR-037 R1: both non-readWrite @mutability modes leave the PATCH settable set —
+                // readOnly is never written, writeOnce is frozen after create. Stated HERE and not
+                // only in the vanilla controller's patchSettableFields because TPH is a SEPARATE
+                // code path (the 0.19.4 lesson), and this is its SSOT: the per-subtype patch shape,
+                // the <Sub>Validation shape and the settable-name list all read it.
+                !KotlinGenUtil.isReadOnlyMutability(it) &&
+                !KotlinGenUtil.isWriteOnceMutability(it)
         }
     }
 
 
@@ -152,6 +152,9 @@ class GeneratedTphControllerHarness(
                 authTable.insert { stmt ->
                     stmt[columnFor("type")] = enumValueFor(r["type"] as String)
                     stmt[columnFor("reference")] = r["reference"] as String?
+                    // FR-037 R1: the @mutability "writeOnce" column (declared on the TPH base),
+                    // seeded verbatim so a later PATCH is observed to leave it alone.
+                    stmt[columnFor("issuedCurrency")] = r["issuedCurrency"] as String?
                     stmt[columnFor("autoCreatedAt")] = parseSeedInstant(r["autoCreatedAt"] as String)
                     stmt[columnFor("autoUpdatedAt")] = parseSeedInstant(r["autoUpdatedAt"] as String)
                     stmt[columnFor("quantity")] = (r["quantity"] as? Number)?.toInt()
 
@@ -156,8 +156,10 @@ public Instant deserialize(JsonParser p, DeserializationContext ctx)
         // ADR-0045 (#203/#229): the DTO record now carries the two @autoSet timestamp columns
         // (autoCreatedAt onCreate, autoUpdatedAt onUpdate) right after the base's own scalars, in
         // declared order — before the folded-in subtype-only columns.
+        // FR-037 R1 adds `issuedCurrency` (@mutability "writeOnce") on the BASE, so it lands
+        // among the base's own scalars in declared order, before the @autoSet pair.
         this.dtoCtor = dtoClass.getDeclaredConstructor(
-            Long.class, authTypeClass, String.class, Instant.class, Instant.class,
+            Long.class, authTypeClass, String.class, String.class, Instant.class, Instant.class,
             Integer.class, BigDecimal.class, String.class);
         Class<?> repoInterface = classLoader.loadClass(REPO_FQCN);
         this.controllerCtor = classLoader.loadClass(CONTROLLER_FQCN)
@@ -216,6 +218,8 @@ private Object dtoFromRow(Map<String, Object> row) throws Exception {
         Long id = row.get("id") == null ? null : ((Number) row.get("id")).longValue();
         String type = (String) row.get("type");
         String reference = (String) row.get("reference");
+        // FR-037 R1: the @mutability "writeOnce" column, seeded verbatim.
+        String issuedCurrency = (String) row.get("issuedCurrency");
         Object autoCreatedRaw = row.get("autoCreatedAt");
         Instant autoCreatedAt = autoCreatedRaw == null ? null : parseInstant(String.valueOf(autoCreatedRaw));
         Object autoUpdatedRaw = row.get("autoUpdatedAt");
@@ -228,7 +232,8 @@ private Object dtoFromRow(Map<String, Object> row) throws Exception {
         @SuppressWarnings({ "unchecked", "rawtypes" })
         Object typeEnum = type == null ? null : Enum.valueOf((Class) authTypeClass, type);
         return dtoCtor.newInstance(
-            id, typeEnum, reference, autoCreatedAt, autoUpdatedAt, quantity, copayAmount, approver);
+            id, typeEnum, reference, issuedCurrency, autoCreatedAt, autoUpdatedAt,
+            quantity, copayAmount, approver);
     }
 
     /**
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"auths": [`
`3`		`- { "id": 1, "type": "Bridge", "reference": "REF-1", "quantity": 5, "copayAmount": null, "approver": null, "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" },`
`4`		`- { "id": 2, "type": "Copay", "reference": "REF-2", "quantity": null, "copayAmount": "12.50", "approver": null, "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" },`
`5`		`- { "id": 3, "type": "PriorAuth", "reference": "REF-3", "quantity": null, "copayAmount": null, "approver": "Dr. Smith", "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" }`
	`3`	`+ { "id": 1, "type": "Bridge", "reference": "REF-1", "quantity": 5, "copayAmount": null, "approver": null, "issuedCurrency": "USD", "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" },`
	`4`	`+ { "id": 2, "type": "Copay", "reference": "REF-2", "quantity": null, "copayAmount": "12.50", "approver": null, "issuedCurrency": "GBP", "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" },`
	`5`	`+ { "id": 3, "type": "PriorAuth", "reference": "REF-3", "quantity": null, "copayAmount": null, "approver": "Dr. Smith", "issuedCurrency": "EUR", "autoCreatedAt": "2000-01-01T00:00:00", "autoUpdatedAt": "2000-01-01T00:00:00" }`
`6`	`6`	`]`
`7`	`7`	`}`