fix: PUT on a writable entity 404s on two TS mounts and is undocumented in three ports

The cross-port REST contract (FR-008) makes the update verb reachable via BOTH
PATCH and PUT, routed to one handler. Every port's generated controller serves
both, and the Drizzle Fastify mount has registered both by default for some
time. Two `@metaobjectsdev/runtime-ts` mounts had not caught up:

- The Hono mount registered PATCH alone unless `updateMethod` said otherwise,
  so a PUT the contract promises fell through to Hono's plain-text 404.
- The ObjectManager Fastify mount did the same.

Neither api-contract lane runs those mounts, which is how it survived; it is the
blind spot the Hono error-code defect sat in. Both now mount both verbs by
default, with `updateMethod` kept as the explicit single-verb restriction. Its
doc comment in all three flavors claimed a "patch" default that the Drizzle
mount had stopped honouring, and the agent-context reference taught the same
thing; both now say what the code does.

API docs moved with it. TypeScript (Fastify and Hono), Java and Kotlin
documented PATCH only for a writable entity while C# and Python documented
both, so an adopter or an agent reading `meta docs --agent` was told an
address the server answers did not exist. Each builder now emits a PUT row
beside PATCH. The Java and Kotlin accuracy tests, which check every documented
verb against the emitted Spring mapping, count it; the TS accuracy gate already
checked the verb against the full-CRUD mount.

Found while working the handoff's note that Java api-docs lacked PUT. That note
named one port; the gap was three ports' docs and two runtime mounts.

Tests: new Hono and ObjectManager-Fastify PUT tests went red first (Hono
answered its plain-text 404) and pass now. codegen-ts 1702, runtime-ts 473,
sdk 324, codegen-spring 307, codegen-kotlin 394, all green.
`scripts/ci-local.sh --quick` 36/36.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: dmealing

CHANGELOG.md

@@ -223,6 +223,29 @@ edit (two registered `description` strings) and was ruled a hold, as 1.0.4's was
 
 ### Fixed
 
+- **TypeScript: two `@metaobjectsdev/runtime-ts` writable mounts answered `PUT` with a 404.**
+  The cross-port REST contract (FR-008) makes the update verb reachable via BOTH `PATCH`
+  and `PUT`, routed to one handler, and every other port's controller maps both. The
+  Drizzle Fastify mount already registered both by default; the **Hono** mount and the
+  ObjectManager **Fastify** mount registered `PATCH` alone unless `updateMethod` said
+  otherwise, so a `PUT` the contract promises fell through to the framework's own 404.
+  Neither api-contract lane runs those mounts, which is how it survived — the same blind
+  spot the Hono error-code defect sat in. Both now mount both verbs by default. **Additive,
+  nothing to do on upgrade:** `updateMethod: "patch"` or `"put"` still restricts the update
+  verb to exactly the one it names, and now says so in its doc comment rather than claiming
+  a `"patch"` default that the Drizzle mount had not honoured for some time. One case is
+  not silent: a consumer that registered its OWN `PUT` handler at `<path>/:id` beside the
+  ObjectManager Fastify mount now gets Fastify's duplicate-route error at startup — pass
+  `updateMethod: "patch"` to keep that handler.
+
+- **API docs: TypeScript, Java and Kotlin did not document `PUT` on a writable entity.** The
+  generated update route serves `PATCH` and `PUT` from one handler in all five ports; C#
+  and Python documented both, the other three documented `PATCH` only, so an adopter (or
+  an agent reading `meta docs --agent`) was told an address the server answers did not
+  exist. Each builder now emits a `PUT` row beside `PATCH`, and the accuracy tests that
+  check every documented verb against the emitted routes count it. **Generated docs gain
+  one REST row per writable entity**; nothing else in the output moves.
+
 - **Java: a database constraint violation answered a bare 500 instead of the cross-port
   `409 {"error":"constraint_violation","constraint":"unique"|"foreign_key"}`.** The generated
   CRUD routes had no try/catch around their writes at all, so a driver failure reached Spring's

agent-context/skills/metaobjects-runtime-ui/references/typescript.md

@@ -205,8 +205,9 @@ mountGetRoute({ ...opts });                            // a single verb
 
 `CrudRoutesOptions` = `{ fastify, path, db, table, insertSchema, updateSchema }`
 plus `expose?` (limit verbs), `routeOptions?` (Fastify hooks — e.g.
-`{ preHandler: requireAuthHook }` for auth), and `updateMethod?` (`"patch"` default
-/ `"put"`). So **mount the standard verbs with these helpers and hand-write only the
+`{ preHandler: requireAuthHook }` for auth), and `updateMethod?` (`"patch"` or
+`"put"` restricts update to that one verb; absent mounts both, as the cross-port
+contract requires). So **mount the standard verbs with these helpers and hand-write only the
 custom routes** (HTML pages, nested resources, computed fields) — calling the
 generated query helpers, and a projection's generated query for derived/aggregate
 data. Generate the data layer; hand-write only what's genuinely custom.

fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-runtime-ui/references/typescript.md

@@ -205,8 +205,9 @@ mountGetRoute({ ...opts });                            // a single verb
 
 `CrudRoutesOptions` = `{ fastify, path, db, table, insertSchema, updateSchema }`
 plus `expose?` (limit verbs), `routeOptions?` (Fastify hooks — e.g.
-`{ preHandler: requireAuthHook }` for auth), and `updateMethod?` (`"patch"` default
-/ `"put"`). So **mount the standard verbs with these helpers and hand-write only the
+`{ preHandler: requireAuthHook }` for auth), and `updateMethod?` (`"patch"` or
+`"put"` restricts update to that one verb; absent mounts both, as the cross-port
+contract requires). So **mount the standard verbs with these helpers and hand-write only the
 custom routes** (HTML pages, nested resources, computed fields) — calling the
 generated query helpers, and a projection's generated query for derived/aggregate
 data. Generate the data layer; hand-write only what's genuinely custom.

fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-runtime-ui/references/typescript.md

@@ -205,8 +205,9 @@ mountGetRoute({ ...opts });                            // a single verb
 
 `CrudRoutesOptions` = `{ fastify, path, db, table, insertSchema, updateSchema }`
 plus `expose?` (limit verbs), `routeOptions?` (Fastify hooks — e.g.
-`{ preHandler: requireAuthHook }` for auth), and `updateMethod?` (`"patch"` default
-/ `"put"`). So **mount the standard verbs with these helpers and hand-write only the
+`{ preHandler: requireAuthHook }` for auth), and `updateMethod?` (`"patch"` or
+`"put"` restricts update to that one verb; absent mounts both, as the cross-port
+contract requires). So **mount the standard verbs with these helpers and hand-write only the
 custom routes** (HTML pages, nested resources, computed fields) — calling the
 generated query helpers, and a projection's generated query for derived/aggregate
 data. Generate the data layer; hand-write only what's genuinely custom.

server/java/codegen-kotlin/src/main/kotlin/com/metaobjects/generator/kotlin/apidocs/KotlinApiModelBuilder.kt

@@ -313,6 +313,8 @@ class KotlinApiModelBuilder {
         rest("GET $base/{id}", "fetch one by id")
         rest("POST $base", "create")
         rest("PATCH $base/{id}", "update")
+        // One handler serves both verbs (`method = [PATCH, PUT]` in the emitted controller).
+        rest("PUT $base/{id}", "update (PUT alias)")
         rest("DELETE $base/{id}", "delete")
         // FR-018 M:N traversal — GET /<source-plural>/{id}/<relation>.
         for (nav in KotlinM2mSupport.resolve(obj, loader)) {

server/java/codegen-kotlin/src/test/kotlin/com/metaobjects/codegen/kotlin/apidocs/KotlinApiDocsAccuracyKtTest.kt

@@ -244,15 +244,16 @@ class KotlinApiDocsAccuracyKtTest {
             restChecked++
         }
         // 5 CRUD verbs + 1 M:N traversal (tags).
-        assertEquals(6, restChecked, "expected 6 REST symbols on Author (5 CRUD + 1 M:N)")
+        // Update is documented under BOTH verbs it answers, PATCH and PUT.
+        assertEquals(7, restChecked, "expected 7 REST symbols on Author (5 CRUD, update as PATCH + PUT, + 1 M:N)")
     }
 
     /** The exact Spring mapping the Kotlin controller emits for a verb + sub-path. */
     private fun mappingFor(verb: String, sub: String): String = when (verb) {
         "GET" -> if (sub.isEmpty()) "@GetMapping\n" else "@GetMapping(\"$sub\")"
         "POST" -> "@PostMapping\n"
         "DELETE" -> "@DeleteMapping(\"$sub\")"
-        "PATCH" -> "@RequestMapping(value = [\"$sub\"], method = [RequestMethod.PATCH, RequestMethod.PUT])"
+        "PATCH", "PUT" -> "@RequestMapping(value = [\"$sub\"], method = [RequestMethod.PATCH, RequestMethod.PUT])"
         else -> throw AssertionError("unexpected REST verb: $verb")
     }
 

server/java/codegen-spring/src/main/java/com/metaobjects/generator/apidocs/JavaApiModelBuilder.java

@@ -227,6 +227,8 @@ private void addRestSymbols(List<ApiSymbol> symbols, MetaObject obj,
         addRest(symbols, controllerFqn, "GET " + base + "/{id}", "fetch one by id");
         addRest(symbols, controllerFqn, "POST " + base, "create");
         addRest(symbols, controllerFqn, "PATCH " + base + "/{id}", "update");
+        // One handler serves both verbs (`method = { PATCH, PUT }` in the emitted controller).
+        addRest(symbols, controllerFqn, "PUT " + base + "/{id}", "update (PUT alias)");
         addRest(symbols, controllerFqn, "DELETE " + base + "/{id}", "delete");
         for (SpringM2mSupport.M2mNav nav : SpringM2mSupport.resolve(obj, loader)) {
             addRest(symbols, controllerFqn,

server/java/codegen-spring/src/test/java/com/metaobjects/generator/apidocs/JavaApiDocsAccuracyTest.java

@@ -204,8 +204,10 @@ public void everyRestSymbolMapsToARealControllerMapping() {
                 controller.contains(expectedMapping));
             restChecked++;
         }
-        // The fixture's Author yields the 5 CRUD verbs + 1 M:N traversal.
-        assertEquals("expected 6 REST symbols on Author (5 CRUD + 1 M:N)", 6, restChecked);
+        // The fixture's Author yields the 5 CRUD verbs — update documented under BOTH verbs it
+        // answers, PATCH and PUT — + 1 M:N traversal.
+        assertEquals("expected 7 REST symbols on Author (5 CRUD, update as PATCH + PUT, + 1 M:N)",
+            7, restChecked);
     }
 
     /** The exact Spring mapping annotation the controller emits for a verb + sub-path. */
@@ -219,6 +221,7 @@ private static String mappingFor(String verb, String sub) {
             case "DELETE":
                 return "@DeleteMapping(\"" + sub + "\")";
             case "PATCH":
+            case "PUT":
                 // PATCH + PUT share one composed @RequestMapping with method={PATCH, PUT}.
                 return "@RequestMapping(value = \"" + sub
                     + "\", method = { RequestMethod.PATCH, RequestMethod.PUT })";

server/java/codegen-spring/src/test/java/com/metaobjects/generator/apidocs/JavaApiModelBuilderTest.java

@@ -91,6 +91,7 @@ public void enumeratesTheJavaSdkSurface() throws Exception {
         assertTrue("REST POST", hasName(author, ApiSymbolKind.REST, "POST /api/authors"));
         assertTrue("REST GET by id", hasName(author, ApiSymbolKind.REST, "GET /api/authors/{id}"));
         assertTrue("REST PATCH", hasName(author, ApiSymbolKind.REST, "PATCH /api/authors/{id}"));
+        assertTrue("REST PUT", hasName(author, ApiSymbolKind.REST, "PUT /api/authors/{id}"));
         assertTrue("REST DELETE", hasName(author, ApiSymbolKind.REST, "DELETE /api/authors/{id}"));
         assertTrue("REST M:N traversal", hasName(author, ApiSymbolKind.REST, "GET /api/authors/{id}/tags"));
         assertTrue("FILTER AuthorFilterAllowlist", has(author, ApiSymbolKind.FILTER, "AuthorFilterAllowlist"));

server/typescript/packages/codegen-ts/src/generators/api-model.ts

@@ -635,6 +635,7 @@ function restSymbols(
     symbols.push(
       ep("POST", path, `Create a ${name} (body validated by ${name}InsertSchema).`, createShape),
       ep("PATCH", `${path}/:id`, `Partially update a ${name} by id (body validated by ${name}UpdateSchema).`, updateShape),
+      ep("PUT", `${path}/:id`, `PUT alias of PATCH — the same handler and partial body (validated by ${name}UpdateSchema).`, updateShape),
       ep("DELETE", `${path}/:id`, `Delete a ${name} by id.`),
     );
   }
@@ -840,6 +841,7 @@ function restHonoSymbols(
     symbols.push(
       ep("POST", path, `[Hono] Create a ${name} (body validated by ${name}InsertSchema).`, createShape),
       ep("PATCH", `${path}/:id`, `[Hono] Partially update a ${name} by id (body validated by ${name}UpdateSchema).`, updateShape),
+      ep("PUT", `${path}/:id`, `[Hono] PUT alias of PATCH — the same handler and partial body (validated by ${name}UpdateSchema).`, updateShape),
       ep("DELETE", `${path}/:id`, `[Hono] Delete a ${name} by id.`),
     );
   }