diff --git a/AGENTS.md b/AGENTS.md
index 842c21e8b..71af89cbf 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -6,17 +6,17 @@ MetaObjects is a **cross-language metadata standard** for declaring typed entity
 
 The metamodel is the **durable spine**; generated code is the **disposable artifact**. Substrate is local-first: typed metadata lives in your repo, generated code is idiomatic per-language output with **no proprietary runtime**: the generated entity and model code imports nothing from MetaObjects at runtime, and the REST, prompt, client and runtime tiers import ordinary Apache-2.0 packages you can vendor, fork or replace. If `@metaobjectsdev/*` disappears tomorrow, you keep working code.
 
-**Core vs helpers (ADR-0034 Amendment 3, 2026-09-22).** Only the core is a product promise: the metamodel, loader, canonical format and registry; runtime metadata access (the `ObjectManager` and its drivers; the HTTP adapters that mount it on a web framework are helpers, 2026-09-24 ruling); schema migrations (`meta migrate`); the drift gates (`meta verify`); prompt render and the reply parser. Every generator that writes application code into an adopter's repo — routes, controllers, ORM wiring, DTOs, forms, grids, hooks, filter allowlists — is a **reference helper**: it must compile and pass its reference fixtures, and the adopter copies it with `meta eject` and owns the copy. Mechanical test: what the tool guarantees is core; what it writes into your repo is a helper. Every port can eject: `meta eject` (TypeScript), `metaobjects eject` (Python), `mvn metaobjects:eject` (Java/Kotlin), `dotnet meta eject` (C#). Not every generator ships a reference copy: `meta gen --list` marks the ones that do not `package-only` (in TypeScript: `callable`, `trace-helper`, `requirement-tests`, `template`, the docs tier and `shared-model`; ADR-0034 Amendment 3 correction, 2026-09-26). When you find a generator defect, fix the reference; do not describe it as a broken core guarantee.
+**Core vs helpers (ADR-0034 Amendment 3, 2026-09-22).** Only the core is a product promise: the metamodel, loader, canonical format and registry; runtime metadata access (the `ObjectManager` and its drivers; the HTTP adapters that mount it on a web framework are helpers, 2026-09-24 ruling); schema migrations (`meta migrate`); the drift gates (`meta verify`); prompt render and the reply parser. Every generator that writes application code into an adopter's repo — routes, controllers, ORM wiring, DTOs, forms, grids, hooks, filter allowlists — is a **reference helper**: it must compile and pass its reference fixtures, and the adopter copies it with `meta eject` and owns the copy. Mechanical test: what the tool guarantees is core; what it writes into your repo is a helper. Every port can eject: `meta eject` (TypeScript), `metaobjects eject` (Python), `mvn metaobjects:eject` (Java/Kotlin), `dotnet meta eject` (C#). Not every generator ships a reference copy: `meta gen --list` marks the ones that do not `package-only` (in TypeScript: `callable`, `trace-helper`, `template`, the docs tier and `shared-model`; ADR-0034 Amendment 3 correction, 2026-09-26). When you find a generator defect, fix the reference; do not describe it as a broken core guarantee.
 
 ## Six pillars
 
-The first four ship per-language today across the five ports (TS / C# / Java / Python / Kotlin), with cross-port conformance corpora verifying byte-identical behavior. The fifth ships its vocabulary in every port, its `meta verify` checks in the Node `meta` CLI, and its test scaffolding in TypeScript only. The sixth is content the other five compose, shipped as named opt-in artifacts:
+The first four ship per-language today across the five ports (TS / C# / Java / Python / Kotlin), with cross-port conformance corpora verifying byte-identical behavior. The fifth ships its vocabulary, its `verify` checks and a `requirement-tests` generator in every port, and its authoring lint in TypeScript only. The sixth is content the other five compose, shipped as named opt-in artifacts:
 
 1. **Codegen** *(reference helpers, not core — see "Core vs helpers" above; ejectable in every port)* — emit per-language code (Drizzle/Zod + Fastify for TS, EF Core + ASP.NET for C#, Spring REST + DTO + Repository for Java via `codegen-spring`, Pydantic + FastAPI for Python, KotlinPoet + Exposed + Spring for Kotlin via `codegen-kotlin`). Hand-edit-preserving regen via three-way merge.
 2. **Runtime metadata** — load metadata at runtime, drive behavior dynamically (CRUD, validation, relationships, dynamic admin UIs, LLM tool registration). On Kysely (TS), a DB-API 2 driver via ObjectManager (Python), modernized JDBC + Spring-tx via OMDB (Java), Exposed (Kotlin). **C# runtime metadata is on the roadmap** — its EF Core output is generated code, not a metadata-driven runtime; the runtime `MetaObjects` package depends only on YamlDotNet and ships no data access.
 3. **Drift detection** — `meta verify` catches divergence between code and metadata (covers entity codegen, prompt templates, output parsers, schema). Quality-of-life on top of codegen + runtime.
 4. **Prompt construction** — a prompt is code, not a string scattered across services. Declare a prompt's payload as a typed projection (payload bloat becomes a diff), keep its text external and provider-resolved, and render it deterministically: snapshot-testable, cache-stable (no whitespace change silently breaking exact-prefix prompt-cache hits), and drift-checked at build time so a renamed field can't degrade a prompt. Conformance-gated, so the guarantee holds in every language port. **Render + payload-VO codegen + `verify` + parser-on-receipt for a *responding* `template.prompt` — one carrying `@responseRef` (FR-006) — + the output-format prompt fragment & tolerant `extract` parser (FR-010) ship in all five ports today** (since 0.24.0 the whole inbound tier keys off `@responseRef`; a `template.output` is outbound-only and emits no parser — ADR-0052) — the library-side building blocks of the pillar are complete. The one remaining library-side piece is MCP exposure of declared prompts/tools (see `spec/roadmap.md`); the application-level consolidation (eval harness, end-to-end declared-prompt orchestration) and consumer adoption are exercised in adopter projects, not in this library repo. Designed in `docs/superpowers/specs/2026-05-22-fr-004-cross-language-prompt-construction-design.md`.
-5. **Requirements and testing** — declare what the software is supposed to *do* in the same model as the entities, so a capability claim is checkable instead of prose. The other four pillars keep the code honest about the *model*; this one asks whether the thing you said the software does is actually built — an absence no test can fail on, because a test exercises code that exists. `requirement.functional` (existence: `meta verify` WARNS when nothing implements it) and `requirement.architectural` (universality: `meta verify` FAILS a live policy applied to nothing, and does not check that each claimed node complies) are registered vocabulary in all five ports, with the loader enforcing the closed `@status` enum. `@implementedBy` is **resolved, not trusted** — it names a real member of the real model, so a claim whose implementation was renamed or deleted fails the build instead of going quietly stale. `meta verify` reports the ledger on every run (unresolved links, entities no claim covers, gaps recorded versus gaps nobody has ruled on) plus an authoring lint whose findings can never fail a build; `meta docs` renders it for humans and for agents. **The port split, stated exactly: the vocabulary loads and validates in all five ports; the `meta verify` checks run in the Node `meta` CLI only (no other port's CLI runs them — `docs/CONFORMANCE.md` "Split coverage"); `requirementTests()` — which scaffolds a test stub per claim — is TypeScript-only.** A green run proves referential integrity, never that a status is true or an implementation correct (`docs/features/requirements.md`, "What a green run does not prove"). A project that declares no `requirement.*` nodes sees no change at all. Note the standing carve-out: `agent-context/skills/metaobjects-fit-assessment/SKILL.md` deliberately does NOT treat `requirement.*` as an assessment axis — see the ruling in that file before "finishing the job" there.
+5. **Requirements and testing** — declare what the software is supposed to *do* in the same model as the entities, so a capability claim is checkable instead of prose. The other four pillars keep the code honest about the *model*; this one asks whether the thing you said the software does is actually built — an absence no test can fail on, because a test exercises code that exists. `requirement.functional` (existence: `meta verify` WARNS when nothing implements it) and `requirement.architectural` (universality: `meta verify` FAILS a live policy applied to nothing, and does not check that each claimed node complies) are registered vocabulary in all five ports, with the loader enforcing the closed `@status` enum. `@implementedBy` is **resolved, not trusted** — it names a real member of the real model, so a claim whose implementation was renamed or deleted fails the build instead of going quietly stale. `meta verify` reports the ledger on every run (unresolved links, entities no claim covers, gaps recorded versus gaps nobody has ruled on) plus an authoring lint whose findings can never fail a build; `meta docs` renders it for humans and for agents. **The port split, stated exactly: the vocabulary loads and validates in all five ports; the requirement gate runs in every port's `verify` (ADR-0057 — `docs/CONFORMANCE.md` "Split coverage"); every port ships an ejectable `requirement-tests` generator — which scaffolds a test per claim; the seven authoring-lint advisories are TypeScript-only.** A green run proves referential integrity, never that a status is true or an implementation correct (`docs/features/requirements.md`, "What a green run does not prove"). A project that declares no `requirement.*` nodes sees no change at all. Note the standing carve-out: `agent-context/skills/metaobjects-fit-assessment/SKILL.md` deliberately does NOT treat `requirement.*` as an assessment axis — see the ruling in that file before "finishing the job" there.
 
 6. **Libraries** — reusable declared design, shipped as metadata and opted into by name (`"libraries": ["iam"]` in `.metaobjects/config.json`). Not a sixth verb: a library is the **reuse unit that composes the other five** — entities, requirements, the generators its design implies, its runtime packages — as one named, opt-in, drift-gated artifact. What makes it a pillar rather than a folder of YAML is the fifth: without requirements a library is a schema snippet; with them it is design an adopter's build is held to, which is the same test the requirements pillar passes (*does it change what an agent can be checked against?*). **A library is LAYERED and its core layer is INERT** — the core declares no `source.rdb`, and a sourceless object generates nothing and migrates to nothing (#248), so `["iam"]` adds zero tables and zero generated code while making the design present and resolvable; `["iam", "iam/db"]` is the separate opt-in that proposes the schema. **Copy is the expected mode** (`meta eject <library>` — ADR-0034's ruling applied to metadata), and an ejected copy still named in `libraries` is refused at load (`ERR_LIBRARY_PACKAGE_COLLISION`) rather than merging asymmetrically. Object coverage activates on ADOPTER-authored requirements only, so a library cannot volunteer a project for a gate it did not ask for. `iam` (preview) and `ai` (stable) ship today; rows appear in `meta gen --list` beside the generators. See [docs/features/libraries.md](docs/features/libraries.md) and `docs/superpowers/specs/2026-09-13-fr-043-feature-and-nfr-packages-design.md`.
 
@@ -75,7 +75,7 @@ PyPI has had no product change since `0.25.0` — nothing is broken.
 - **Kotlin** — `codegen-kotlin` (KotlinPoet on JVM): entity + Exposed table + Spring controller + payload + relations + filter allowlist + validator + stored-proc + output-parser generators. `integration-tests-kotlin` runs the persistence-conformance corpus through Exposed against Testcontainers Postgres.
 
 **Cross-port conformance corpora** (every port runs the shared corpus):
-- Metamodel: `fixtures/conformance/` (364 fixtures; 26 shared corpora in total — per-corpus counts + the corpus x port matrix live in `docs/CONFORMANCE.md`). TS / C# / Java / Python all green.
+- Metamodel: `fixtures/conformance/` (364 fixtures; 28 shared corpora in total — per-corpus counts + the corpus x port matrix live in `docs/CONFORMANCE.md`). TS / C# / Java / Python all green.
 - Render: `fixtures/render-conformance/`. TS / C# / Java / Kotlin / Python byte-identical.
 - Persistence: `fixtures/persistence-conformance/`. **Query** scenarios run on every port (TS / C# / Java / Kotlin / Python), each provisioning its test DB by executing the committed, TS-produced `canonical/schema.postgres.sql` (Postgres only — Derby dropped for the cross-port query corpus, ADR-0015). The **migration** scenarios are exercised by **TS only** (TS owns schema migrations). **The corpus now gates WRITES, not just reads (SP-H):** an `op: roundtrip` scenario type INSERTs through each port's runtime/ORM write codec (NOT raw SQL), reads the row back, and asserts the wire-normalized value. The `AllTypes` entity (`roundtrip-all-types.yaml`) carries one field of **every** persistable `field.*` subtype — string/int/long/double/float/decimal/boolean/date/time/timestamp(+tz)/currency/enum/uuid/object — plus an **array-of-VO** `field.object @isArray @storage:jsonb` column (`labels`, written as 2-element / empty-`[]` / single-element arrays across the three rows) — so every subtype write+read (incl. the array-of-value-object jsonb codec) round-trips through every port against Testcontainers PG. (`field.byte`/`field.short`/`field.class` were cut as non-functional registration-only stubs — the matrix tracks only genuinely-supported subtypes; see `fixtures/registry-conformance/README.md` → "Per-subtype write-round-trip matrix".)
 - API-contract: `fixtures/api-contract-conformance/`. TS / C# / Java / Kotlin / Python all green — each port runs **two lanes**: a hand-rolled reference server AND its **generated** API artifact booted over HTTP (the deployed controller/routes; TS+C# full-stack vs Testcontainers PG, Java/Kotlin/Python generated controller + in-memory repo behind the consumer seam). The generated fan-out found 10 real deployment bugs golden snapshots missed. Three sub-corpora run the **generated lane only, on all five ports** — `write-through/`, `projection/` (F22: a view-only `object.projection` serves GET list + GET by id and answers every write verb with `405 {"error": "method_not_allowed"}`) and `report/` (FR-044: a view-backed `object.report` serves GET list, answers `POST` with that same `405`, and mounts no `/{id}` route). That is deliberate, not a gap: what is under test is whether a port's GENERATOR emits those routes, and a hand-rolled reference server would answer every scenario by construction. The `m2m/` sub-corpus also gates **TPH x M:N together** (base-declared, subtype-declared, abstract-mid-declared, a non-subtype source onto a subtype TARGET, and the cross-subtype source id answering `200 []`) — the two corpora were originally built disjoint (`tph/` had no relationships, `m2m/` no discriminators), which is precisely how that defect class survived.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 99a82eec5..499da1f26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,6 +41,78 @@ it until 1.1 ships._
   (`-Dmeta.verify.noFieldLint=true` in Maven) or `META_NO_FIELD_LINT=1`. In the Node `meta`
   it is the `fields` section of `--format json|toon`.
 
+- **The requirement gate runs in every port's `verify` (ADR-0057).** `metaobjects verify`
+  (Python), `mvn metaobjects:verify` (Java and Kotlin) and `dotnet meta verify` (C#) now run
+  the checks that `meta verify` runs over `requirement.*` nodes: on every run, with no
+  subverb, with the same codes, severities, requirement paths and message text, and the same
+  ledger summary line. The new `fixtures/requirement-check-conformance/` corpus (43 cases)
+  holds all of them to the TypeScript reference.
+
+  **A project with no `requirement.*` node sees no change in any port: no line printed, no
+  exit code changed. A project that DOES declare requirements and runs a Python, Java,
+  Kotlin or C# `verify` now gets diagnostics it did not get before, and its `verify` may
+  now fail** where it passed: on a dangling `@implementedBy` on a `live` or `partial`
+  requirement, a link above the L4 floor, a level or nesting error, a dangling
+  `@supersededBy`, or a live architectural requirement applied to nothing. Those were
+  already errors in `meta verify`; the other ports loaded the same ledger and said nothing.
+  The seven requirement authoring-lint advisories stay TypeScript-only. See
+  [docs/features/requirements.md](docs/features/requirements.md), "The gate in every port".
+
+  Metadata that does not load is not a project with no requirement, and the gate fails on
+  it. **Python: `metaobjects verify <dir> --out <dir>` with no `--generators` now exits 1 on
+  metadata the loader refuses, where it exited 0**, because that invocation loads nothing
+  else; the gate's load is strict unless `--lax`, so an unknown attribute counts. `dotnet
+  meta verify` likewise prints the load errors itself when no gate in its own process loaded
+  the model (`--codegen` handed off to an owned `codegen/` project, or given no `--out`).
+- **`--require-implementers`, in every port.** `WARN_REQUIREMENT_NOTHING_IMPLEMENTS` (a
+  `live` or `partial` functional requirement that nothing implements) stays a warning by
+  default. `meta verify --require-implementers`, `metaobjects verify --require-implementers`,
+  `dotnet meta verify --require-implementers`, `mvn metaobjects:verify
+  -Dmeta.verify.requireImplementers=true`, or `META_REQUIRE_IMPLEMENTERS=1` with any of
+  them, reports it as an error under the same code. No other warning changes severity.
+- **A `requirement-tests` generator in Python, Java, Kotlin and C#, ejectable in each.**
+  Python writes pytest, Java and Kotlin JUnit Jupiter, C# xUnit: one test per requirement
+  the filter selects (functional L4 and L5 by default), in one file per metamodel package
+  (an interface and a test class in the three compiled ports), rewritten whole on every
+  run. The project's code lives in a *witness* the generated test calls. A `live` or
+  `partial` requirement with no witness is a failing test that names the function to write;
+  a `planned` or `retired` one is skipped. Generated tests import their test framework and
+  nothing from MetaObjects. This is a reference helper and a recommended approach, not a
+  contract: `metaobjects eject requirement-tests`, `mvn metaobjects:eject
+  -Dnames=requirement-tests -Dport=java|kotlin` and `dotnet meta eject requirement-tests`
+  copy the generator with its default renderer, and the checks in `verify` are not
+  ejectable. What a ledger yields (each test's id, witness key, skip state and digest) is
+  the same in all five ports, pinned by the new
+  `fixtures/requirement-test-identity-conformance/` corpus (26 cases). Two limits: in
+  those four ports a package that loses its last requirement leaves its generated file
+  behind (`gen` does not remove it; the codegen drift gate reports it), and a witness for a
+  retired or deleted requirement stops compiling only in Kotlin, in Java when it carries
+  `@Override`, and in C# when it implements the member explicitly. See
+  [docs/features/requirements.md](docs/features/requirements.md), "Generated requirement
+  tests and witnesses".
+- **The same filter and uncovered-warning options on the generator in every port.** Each
+  port takes a predicate over one requirement view (`subType`, `level`, `status`, `path`,
+  `package`, `implementedByTypes`) that replaces the default selection, and a switch for
+  the warning that names what the filter left out: `filter` / `warnUncovered` in
+  TypeScript and in Python's `requirementTests` config block, `<filter>` /
+  `<warnUncovered>` generator args in Java and Kotlin, `Filter` / `WarnUncovered` in C#.
+  The warning has one text in every port and names requirement paths.
+- **TypeScript: `meta eject requirement-tests` works.** The generator now ships a reference
+  template, holding the generator and its default stub renderer in one file, so eject
+  copies it to `codegen/generators/requirement-tests.ts` instead of answering
+  `package-only`.
+- **TypeScript: `requirementTests({ grain })`, and the test identity on the renderer hook.**
+  `grain: "member"` emits one stub per distinct `@implementedBy` reference that resolves,
+  where the default `"concern"` emits one per distinct `<type>.<subType>`. A renderer now
+  receives the stub's identity (`package`, `unit`, `id`, `witnessKey`, `skip`) and the
+  `digest` of its requirement, and `requirementDigest`, `requirementTestIdentities` and
+  `witnessKeyOf` are exported from `@metaobjectsdev/codegen-ts`. The default stub's bytes
+  do not change.
+- **Python: how to run the tool on a different interpreter than the project's.**
+  `metaobjects` still needs Python 3.11 to run; the tests it generates need only pytest and
+  parse on 3.9. `docs/ports/python.md`, "Selecting the interpreter", gives the `uv tool run
+  --python` and `pipx run --python` forms.
+
 - **Metamodel 1.1: the reporting vocabulary (FR-044), loader-validated in all five ports.**
   Registered: `dimension.attribute`, `dimension.time` (`@grains`: `hour, day, week, month,
   quarter, year`, weeks start Monday), `measure.aggregate` (`@agg`: `count, sum, avg, min, max`),
@@ -231,6 +303,25 @@ until you regenerate.
 
 ### Changed
 
+- **TypeScript: `RequirementTestArgs` and `RequirementView` gained required fields — a
+  compile break for code that builds them by hand.** `RequirementTestArgs` has six new
+  required fields (`package`, `unit`, `id`, `witnessKey`, `skip`, `digest`) and
+  `RequirementView` a required `package`. A renderer or filter that only RECEIVES these is
+  unaffected. Application code that CONSTRUCTS one, for example a test of its own renderer,
+  stops compiling until it supplies them.
+- **TypeScript: `requirementTests({ grain })` refuses an unknown grain.** Any value other
+  than `"concern"` or `"member"` throws when the generator is built, whatever the model
+  holds, instead of running as something in between. Every other port refuses the same way.
+- **Python: project code under a standard-library module name is refused where a
+  `module:symbol` names it.** Affected: a project whose owned generator (a `module:symbol`
+  entry in `generators`) or `requirementTests.renderer` / `requirementTests.filter` hook lives
+  under a top-level name such as `types`, `json`, `code` or `platform`, as a package directory
+  or as a `<name>.py` file. `gen` and `verify --codegen` now stop with `cannot import
+  '<module>': the project package '<name>' (<path>) shadows a standard-library module of the
+  same name; rename it` (`the project module` for a file). Before, an owned generator under
+  such a name loaded, by replacing the standard-library module for the rest of the process.
+  Rename the package or module, and the `module:symbol` that names it.
+
 - **TypeScript: `runValidators` rejects more than it did — a behaviour change for
   `ObjectManager` users.** `ObjectManager.create`, `createMany`, `update`, `updateMany` and
   `validate` all go through it, so data that was accepted before can now raise a
@@ -302,6 +393,11 @@ until you regenerate.
   now holds the expanded form in a single-file model too, where it held `::parts` before.
   Gated by the new `loader-relative-package-multi-root` conformance fixture and
   `reference-field-missing-multi-root-package` in `fixtures/field-lint-conformance/`.
+- **Python: a YAML node that declares its own `package` under a packaged root now loads.**
+  A node carrying `package:` inside a document whose root already declared one raised
+  `NameError` at load, because the YAML desugar used a constant it never imported. Such a
+  document now loads, and the node resolves under the package it declares (an absolute one
+  as written, a `::`-relative one against its root's).
 - **Python: `MetaData.effective_package()`** returns the package a node resolves under, where
   `package` is `None` for an object that inherits its file's root package. See
   `docs/ports/python.md`, "Use".
diff --git a/README.md b/README.md
index 78e332da1..e5f52a94b 100644
--- a/README.md
+++ b/README.md
@@ -133,7 +133,7 @@ first-week wedge plan — and `meta init` picks up from there.
 |---|---|---|---|
 | TypeScript | **npm `1.0.13`** — the `@metaobjectsdev/*` packages | [`docs/ports/typescript.md`](docs/ports/typescript.md) | [`server/typescript/`](server/typescript/) · [`client/web/`](client/web/) |
 | Java | **Maven Central `8.0.13`** (`com.metaobjects:*` — the JVM major is npm major + 7) — loader + OMDB + render + Maven plugin all shipped; full conformance green | [`docs/ports/java.md`](docs/ports/java.md) | [`server/java/`](server/java/) |
-| Kotlin | **Maven Central `8.0.13`** — codegen tier on top of Java: 14 generators (entity, Exposed table, relations, repository, payload, output-parser, output-prompt, render-helper, extractor, filter-allowlist, validator, Spring config, storedProc, Spring controller); 24 / 24 persistence-conformance | [`docs/ports/kotlin.md`](docs/ports/kotlin.md) | [`server/java/codegen-kotlin/`](server/java/codegen-kotlin/) · [`server/java/metadata-ktx/`](server/java/metadata-ktx/) |
+| Kotlin | **Maven Central `8.0.13`** — codegen tier on top of Java: 15 generators (entity, Exposed table, names, relations, repository, output-parser, output-prompt, render-helper, extractor, filter-allowlist, validator, Spring config, storedProc, Spring controller, requirement-tests); 24 / 24 persistence-conformance | [`docs/ports/kotlin.md`](docs/ports/kotlin.md) | [`server/java/codegen-kotlin/`](server/java/codegen-kotlin/) · [`server/java/metadata-ktx/`](server/java/metadata-ktx/) |
 | C# | **NuGet `1.0.13`** — loader + conformance + EF Core codegen + render engine + `dotnet meta` CLI all shipped | [`docs/ports/csharp.md`](docs/ports/csharp.md) | [`server/csharp/`](server/csharp/) |
 | Python | **PyPI `1.0.13`** — loader + conformance + render + entity-model codegen + ObjectManager runtime shipped; schema migrations are TS-owned (ADR-0015) | [`docs/ports/python.md`](docs/ports/python.md) | [`server/python/`](server/python/) |
 
@@ -153,7 +153,7 @@ first-week wedge plan — and `meta init` picks up from there.
 | DB-drift verify | `meta verify --db <url>` | Template-drift: `Verify.check`; schema-drift is TS-owned (ADR-0015) | Template-drift: `Verify.check`; startup: `MetadataStartupValidator` | `dotnet meta verify` (codegen-drift) | Schema-drift is TS-owned (ADR-0015) |
 | Template-drift verify | Yes | Yes (`Verify.check`) | Yes (via Java) | Yes (`dotnet meta verify`) | Yes (`metaobjects.render.verify`) |
 | YAML authoring (sigil-free → JSON) | Yes | Yes | Yes (via Java) | Yes | Yes |
-| Capability requirements (`requirement.*`) | Registered + `meta verify` gate | Registered (loads + validates) | Registered (via Java) | Registered (loads + validates) | Registered (loads + validates) |
+| Capability requirements (`requirement.*`) | `meta verify` gate + authoring lint; `requirementTests()` stubs | `mvn metaobjects:verify` gate; JUnit Jupiter `requirement-tests` | Gate via the Java Maven goal; JUnit Jupiter `requirement-tests` | `dotnet meta verify` gate; xUnit `requirement-tests` | `metaobjects verify` gate; pytest `requirement-tests` |
 | Reporting vocabulary (`dimension` / `measure` / `segment` / `object.report`, FR-044) | Registered; a view-backed report becomes a SQL view in `meta migrate`, is read by `ObjectManager`, and gets generated read-only list routes (no client hook yet) | Registered; OMDB reads a view-backed report; generates a read-only Spring controller, DTO, repository and filter allowlist | Registered (via Java); generates an Exposed table object, a row data class, a filter allowlist and a read-only Spring controller per view-backed report | Registered; generates a keyless EF Core row type, read-only routes and a filter allowlist per view-backed report | Registered; `ObjectManager` reads a view-backed report; generates a Pydantic row model, a read-only FastAPI router and a filter allowlist |
 | Libraries (`libraries: [...]`) | Yes | Yes | Yes (via Java) | Yes | Yes |
 | Metadata dependencies (`dependencies`) | Yes (`meta deps sync`, `path` transport) | Phase 2 | Phase 2 | Phase 2 | Yes (loads the synced snapshot) |
@@ -226,9 +226,9 @@ sixth ships two libraries at their own stability labels:
    deterministically (snapshot-testable, cache-stable, drift-checked at build
    time, conformance-gated cross-language). See
    [`docs/features/templates-and-payloads.md`](docs/features/templates-and-payloads.md).
-5. **Requirements and testing** *(vocabulary loads and validates in all five ports;
-   the `meta verify` checks run in the Node `meta` CLI; `requirementTests()` scaffolding
-   is TypeScript-only; dogfooded on maintainer-owned projects, no outside adopter yet)* —
+5. **Requirements and testing** *(vocabulary, the `verify` checks and a `requirement-tests`
+   generator in all five ports; the authoring lint is TypeScript-only; dogfooded on
+   maintainer-owned projects, no outside adopter yet)* —
    declare what the software is supposed to *do* in the same model as the entities. The
    other four pillars keep the code honest about the model; this one asks whether a
    claimed capability is actually built. `@implementedBy` is **resolved, not trusted** —
diff --git a/agent-context/skills/metaobjects-audit/references/requirements.md b/agent-context/skills/metaobjects-audit/references/requirements.md
index 185649e66..a81dfbafd 100644
--- a/agent-context/skills/metaobjects-audit/references/requirements.md
+++ b/agent-context/skills/metaobjects-audit/references/requirements.md
@@ -4,8 +4,10 @@ This project declares `requirement.*` nodes, so the ledger is an auditable surfa
 for **truthfulness**, not volume. A large ledger that lies is worse than a small one that
 does not, because every later reader trusts it.
 
-Run `meta verify` first. It settles referential integrity mechanically — do not spend audit
-effort re-deriving what a green run already proves.
+Run `verify` first — the project's own: `meta verify`, `metaobjects verify`,
+`mvn metaobjects:verify` or `dotnet meta verify`. Every port runs the same requirement
+gate. It settles referential integrity mechanically — do not spend audit effort re-deriving
+what a green run already proves.
 
 ## What verify has already proven (do not re-check by hand)
 
@@ -18,7 +20,9 @@ on `planned`, whose nodes do not exist yet).
 
 **The authoring lint** — printed under its own heading, advisory, and unable to change the
 exit code — settles the naming and prose defects you would otherwise find by reading every
-entry:
+entry. **Only the Node `meta verify` prints it.** On a Python, Java, Kotlin or C# project
+whose pipeline runs that port's `verify` alone, nothing below has been proven: run
+the Node `meta verify` over the same metadata, or audit these by hand.
 
 | code | what a clean run has already proven |
 |---|---|
@@ -30,8 +34,10 @@ entry:
 | `WARN_REQUIREMENT_INERT_DOC_SLOT` | no `summary` is set — nothing reads it, and `@statement` is already the required one-liner |
 | `WARN_REQUIREMENT_TITLE_IS_AN_ID` | no `title` leads with a catalogue or ticket id |
 
-Two limits, and each puts something back on your list:
+Three limits, and each puts something back on your list:
 
+- **It is one port's.** See above: establish which `verify` the project's CI runs before
+  crediting a green pipeline with the table.
 - **The lint is mutable.** `--no-requirement-lint` / `META_NO_REQUIREMENT_LINT=1` silences the
   advisory half while the gate still runs. **Establish whether the project mutes it** (§F of
   the checklist asks this) — against a muted lint the whole table above proves nothing.
@@ -78,6 +84,15 @@ titles: one that restates `@statement`, or repeats the path in prose, is now vis
 a heading rather than a private authoring habit. An absent `title` is NOT a finding — the
 entry heads by its path alone, which is what every sibling surface addresses it by.
 
+**7. Witnesses that do not test the claim.** Where the project generates requirement tests
+(the `requirement-tests` generator, in any port), a passing generated test proves only that
+its witness — or, in TypeScript, the hand-filled stub — ran. Sample the witnesses and read
+them against the counterexample each generated test carries: one that asserts nothing, or asserts
+something else, is the same defect `@verifiedBy` had. Check also for witnesses that have
+gone stale silently: a Java witness that lacks the override annotation, a C# witness implemented
+implicitly, and any Python witness keep existing after their requirement is retired or
+deleted, and nothing reports them.
+
 ## Scope — do NOT flag these as defects
 
 - **Unclaimed `object.value` / `object.projection`.** Exempt by design: a value is a shape, a
diff --git a/agent-context/skills/metaobjects-authoring/references/requirements.md b/agent-context/skills/metaobjects-authoring/references/requirements.md
index a0b215c1f..8ccfc08bd 100644
--- a/agent-context/skills/metaobjects-authoring/references/requirements.md
+++ b/agent-context/skills/metaobjects-authoring/references/requirements.md
@@ -179,5 +179,20 @@ ambition rather than work.
     implementedBy: ["game::turn::Turn", "game::world::Location"]
 ```
 
+**Which `verify` says what.** The gate — dangling references, links above the floor,
+level and nesting errors, an unclaimed entity, a live requirement nothing implements — runs
+in every port's `verify` (`meta verify`, `metaobjects verify`, `mvn metaobjects:verify`,
+`dotnet meta verify`). The authoring warnings named on this page (`WARN_REQUIREMENT_NAME_*`,
+`WARN_REQUIREMENT_PROSE_*`, `WARN_REQUIREMENT_INERT_DOC_SLOT`,
+`WARN_REQUIREMENT_TITLE_IS_AN_ID`) are printed by the Node `meta verify` only, so on another
+port follow these rules without waiting for a warning.
+
+**A requirement's name and package end up in generated test names.** Every port's
+`requirement-tests` generator names a test from the requirement's package and dotted path
+(`acme::shop::Orders.Recorded` becomes `req_acme_shop_Orders_Recorded…`), and two
+requirements whose names differ only in punctuation (`Orders.Recorded` beside
+`Orders_Recorded`) are refused as a collision outside TypeScript. Another reason to keep
+names plain identifiers.
+
 There is **no `satisfies:` on a field or entity** — links live on the requirement node, not
 on the nodes it claims. Full reference: the repo's `spec/capability-ledger.md`.
diff --git a/agent-context/skills/metaobjects-codegen/references/csharp.md b/agent-context/skills/metaobjects-codegen/references/csharp.md
index a241eff89..03eeb622d 100644
--- a/agent-context/skills/metaobjects-codegen/references/csharp.md
+++ b/agent-context/skills/metaobjects-codegen/references/csharp.md
@@ -94,6 +94,26 @@ create/update re-reads the row via the view by primary key (read-your-writes). T
 view's DDL is emitted by the Node `meta migrate` from the same origin assembly as a
 projection view.
 
+**Requirement tests (`requirement-tests`).** A recommended approach, not a contract. For a
+model that declares `requirement.*` nodes it writes, per metamodel package,
+`Requirements_<pkgKey>_Witnesses.g.cs` (an interface with one default member per
+non-skipped test, each failing with `unimplemented requirement: …`) and
+`Requirements_<pkgKey>_Tests.g.cs` (one xUnit `[Fact]` per requirement; `[Fact(Skip = …)]`
+for a `planned` or `retired` one), in `<namespace>.Requirements`. Both are rewritten whole
+on every run, so never edit them: the project's code goes in one witness class
+(`<namespace>.RequirementWitnesses` by default) that implements every generated interface.
+Implement each member EXPLICITLY (`void Requirements_<pkgKey>_Witnesses.req_…() { … }`): a
+witness whose requirement is retired or deleted then stops compiling (CS0539), where an
+implicit `public void req_…()` goes stale silently. Give the generator its own
+`dotnet meta gen … --out <test project dir> --generators requirement-tests` run (a run has
+one `--out`, and the test project needs xunit), and pass `--namespace` to
+`verify --codegen` for that directory. Options (`TestNamespace`, `WitnessClass`, `Grain`,
+`Filter`, `Renderer`, `WarnUncovered`) are public properties set in an owned
+`codegen/Program.cs`; `Grain` needs `using MetaObjects.Core.Requirement;`. A filter
+REPLACES the default of functional L4/L5. `dotnet meta eject requirement-tests` copies the
+generator with its default rendering. The requirement checks in `dotnet meta verify` are
+core and are not ejectable.
+
 ## Docs — `dotnet meta docs`
 
 ```bash
diff --git a/agent-context/skills/metaobjects-codegen/references/java.md b/agent-context/skills/metaobjects-codegen/references/java.md
index df517b075..0f2a615e4 100644
--- a/agent-context/skills/metaobjects-codegen/references/java.md
+++ b/agent-context/skills/metaobjects-codegen/references/java.md
@@ -206,6 +206,24 @@ read-view (#214): OMDB routes reads through the replica view and writes to the t
 row via the view by primary key (read-your-writes). The replica view's DDL is emitted by
 `meta migrate` from the same origin assembly as a projection view.
 
+**Requirement tests (`JUnitRequirementTestsGenerator`, stable name `requirement-tests`).**
+A recommended approach, not a contract. For a model that declares `requirement.*` nodes it
+writes, per metamodel package, `Requirements_<pkgKey>_Witnesses.java` (an interface with
+one default member per non-skipped test, each failing with `unimplemented requirement: …`)
+and `Requirements_<pkgKey>_Test.java` (one JUnit Jupiter `@Test` per requirement;
+`@Disabled` for a `planned` or `retired` one). Both are rewritten whole on every run, so
+never edit them: the project's code goes in the class `witnessClass` names, which
+implements every generated interface and overrides the members it has witnesses for.
+Annotate each witness `@Override`: a witness whose requirement is retired or deleted then
+stops compiling, and without the annotation it goes stale silently. Args: `testPackage`
+and `witnessClass` (required once the model holds a requirement), `grain` (`concern` or
+`member`), `filter` and `renderer` (class names on the project classpath implementing
+`RequirementTestFilter` / `RequirementTestRenderer`; a filter REPLACES the default of
+functional L4/L5), `warnUncovered`. Jupiter only: a JUnit 4 project uses `renderer` or
+ejects. `mvn metaobjects:eject -Dnames=requirement-tests -Dport=java` copies the generator
+with its default rendering (pass `-Dport`: the name is ejectable on both JVM
+ports). The requirement checks in `mvn metaobjects:verify` are core and are not ejectable.
+
 ### Value-object jsonb columns
 
 A `field.object` with `@storage: jsonb` (single or `@isArray`) is a typed jsonb column
diff --git a/agent-context/skills/metaobjects-codegen/references/kotlin.md b/agent-context/skills/metaobjects-codegen/references/kotlin.md
index 1a53af36a..64b67df90 100644
--- a/agent-context/skills/metaobjects-codegen/references/kotlin.md
+++ b/agent-context/skills/metaobjects-codegen/references/kotlin.md
@@ -216,6 +216,25 @@ read-view (#214): reads route through the replica view and writes to the table (
 (read-your-writes). The replica view's DDL is emitted by `meta migrate` from the same
 origin assembly as a projection view.
 
+**Requirement tests (`KotlinRequirementTestsGenerator`, stable name `requirement-tests`).**
+A recommended approach, not a contract. For a model that declares `requirement.*` nodes it
+writes, per metamodel package, `Requirements_<pkgKey>_Witnesses.kt` (an interface with one
+default member per non-skipped test, each failing with `unimplemented requirement: …`) and
+`Requirements_<pkgKey>_Test.kt` (one JUnit Jupiter `@Test` per requirement; `@Disabled` for
+a `planned` or `retired` one). Both are rewritten whole on every run, so never edit them:
+the project's code goes in the class `witnessClass` names, which implements every generated
+interface and overrides the members it has witnesses for. Write that class in Kotlin (a
+Java witness class against these interfaces is untested). A witness whose requirement is
+retired or deleted stops compiling, because `override` is mandatory. Args: `testPackage`
+and `witnessClass` (required once the model holds a requirement), `grain` (`concern` or
+`member`), `filter` and `renderer` (class names on the project classpath implementing
+`RequirementTestFilter` / `RequirementTestRenderer`; a filter REPLACES the default of
+functional L4/L5; a renderer returns Kotlin source), `warnUncovered`. Jupiter only: a
+JUnit 4 project uses `renderer` or ejects.
+`mvn metaobjects:eject -Dnames=requirement-tests -Dport=kotlin` copies the generator with
+its default rendering (pass `-Dport`: the name is ejectable on both JVM ports). The
+requirement checks in `mvn metaobjects:verify` are core and are not ejectable.
+
 Metadata lives under `src/main/metaobjects/` in the same canonical JSON the other
 ports read — fused-key form, `source.rdb` + `@table`, `@column` for a renamed
 physical column.
diff --git a/agent-context/skills/metaobjects-codegen/references/python.md b/agent-context/skills/metaobjects-codegen/references/python.md
index 248ffe38b..62c3510e1 100644
--- a/agent-context/skills/metaobjects-codegen/references/python.md
+++ b/agent-context/skills/metaobjects-codegen/references/python.md
@@ -110,6 +110,24 @@ a renamed physical column).
 | `names` | `<entity_snake>_names.py` — module-level `Final` constants mirroring the object's metadata tree. Every node carries its own `_TYPE`/`_SUB_TYPE`/`_NAME`; `<ENTITY>_NAME` is the OBJECT's name, and a physical name sits under the member naming what it is: `<ENTITY>_SOURCE_<ROLE>_{TABLE,VIEW,MATERIALIZED_VIEW,PROC,FUNCTION}` (`<ROLE>` is `PRIMARY` or `REPLICA`, so a write-through entity's read view has a slot), plus `<ENTITY>_SOURCE_<ROLE>_{KIND,SCHEMA}`, a `<ENTITY>_<FIELD>_FIELD`/`_COLUMN` pair each, `<ENTITY>_IDENTITY_<NAME>_*` / `<ENTITY>_INDEX_<NAME>_*` carrying `_INDEX` (the database index name) for `identity.secondary` and `index.lookup`, and a complete `<ENTITY>_COLUMNS_BY_FIELD`. No `_READ_ONLY` — it was derived from `@kind`, never declared; ask `_SOURCE_<ROLE>_KIND`. Emitted for every object with a declared or inherited primary source, PLUS a fragment for any abstract base such an object extends (columns and keys only, no `_SOURCE_*` — it has no table and must never acquire one). Python has no static inheritance, so a module whose object extends another **imports and re-exports** the parent's constants (`AUTHOR_CREATED_AT_COLUMN: Final[str] = BASEENTITY_CREATED_AT_COLUMN`) instead of restating the literal; a TPH subtype re-exports `_SOURCE_PRIMARY_*` too, since it shares its base's table. **This port generates no SQL**, so nothing generated consumes these — they exist for the repository `Protocol` implementation you write. |
 | `template` | the generic Mustache `template` primitive. |
 
+**Requirement tests (`requirement-tests`).** A recommended approach, not a contract. For a
+model that declares `requirement.*` nodes it writes
+`requirements/test_<pkgKey>_requirements.py`, one pytest file per metamodel package,
+rewritten whole on every run, so never edit it. Each test calls a **witness**: a function
+named by the test's witness key (`req_acme_shop_Orders_Recorded__object_entity`) in the
+witness module, `tests.requirement_witnesses` by default. A `live` or `partial`
+requirement with no witness fails, naming the function to write; `planned` and `retired`
+are skipped. Nothing reports a witness whose requirement is gone, so delete it with the
+requirement. Options live in the `requirementTests` block of `metaobjects.config.yaml`:
+`witnessModule`, `grain` (`concern` or `member`), `filter` and `renderer` (`module:symbol`;
+a filter REPLACES the default of functional L4/L5; a renderer imports `RenderedTest` from
+`metaobjects.codegen.requirement_hooks`), `warnUncovered`. The generated tests need only
+pytest and run on Python 3.9 or later, while the tool itself needs 3.11
+(`uv tool run --python 3.12 metaobjects gen` runs it on another interpreter).
+`metaobjects eject requirement-tests` copies the generator with its default renderer to
+`codegen/generators/requirement_tests.py`. The requirement checks in `metaobjects verify`
+are core and are not ejectable.
+
 **Projections + entity read-views.** An `object.projection` (read-only `source.rdb`
 `@kind: view` child) gets a read-only Pydantic model from the `entity` generator.
 
diff --git a/agent-context/skills/metaobjects-codegen/references/typescript.md b/agent-context/skills/metaobjects-codegen/references/typescript.md
index 8048ef9b5..9a41d39f6 100644
--- a/agent-context/skills/metaobjects-codegen/references/typescript.md
+++ b/agent-context/skills/metaobjects-codegen/references/typescript.md
@@ -125,11 +125,22 @@ REMOVED their `@metaobjectsdev/codegen-ts/generators` export, so an owned copy i
 path for those. The engine primitives come from the package main entry,
 `@metaobjectsdev/codegen-ts`. The `/generators` subpath itself is NOT deprecated. It
 exports the prompt tier (`promptRender`, `outputParser`, `outputPrompt`, `extractor`,
-`renderHelper`) and `namesFile`, which you may import from there OR eject to own, and it is
-the only home of the package-only generators — `traceHelperFile`, `callableFile`,
-`requirementTests` — which ship no reference template (`meta gen --list` marks them
+`renderHelper`), `namesFile` and `requirementTests`, which you may import from there OR
+eject to own, and it is the only home of the package-only generators — `traceHelperFile`,
+`callableFile` — which ship no reference template (`meta gen --list` marks them
 `package-only`).
 
+**`requirementTests()` — one test stub per requirement the model claims.** A recommended
+approach, not a contract: a `live` or `partial` requirement gets a stub that fails until
+you write its assertion (the three-way merge keeps it), a `planned` or `retired` one a
+skipped stub. Options: `filter` (a predicate over `subType`, `level`, `status`, `path`,
+`package`, `implementedByTypes` that REPLACES the default of functional L4/L5), `grain`
+(`"concern"`, the default, or `"member"`; anything else is refused), `warnUncovered`,
+`renderers` / `resolveRenderer`. `meta eject requirement-tests` copies the generator and
+its default stub renderer into `codegen/generators/requirement-tests.ts`; the requirement
+walk, each test's identity and the claim digest stay in the package. The requirement
+checks in `meta verify` are core and are not ejectable.
+
 The table below is a per-emission reference, NOT the selection surface. Select with
 `meta gen --list --format json --probe`, which is generated from the live registry and
 reports a file count for your own model; a table in a document cannot do either.
diff --git a/agent-context/skills/metaobjects-verify/references/requirements.md b/agent-context/skills/metaobjects-verify/references/requirements.md
index 63f83ed67..c1e57d55a 100644
--- a/agent-context/skills/metaobjects-verify/references/requirements.md
+++ b/agent-context/skills/metaobjects-verify/references/requirements.md
@@ -3,6 +3,22 @@
 This project declares `requirement.*` nodes, so `verify` checks them. **There is no
 subverb**: requirements are metadata, so they are checked on *every* `meta verify` run.
 
+## Which command runs the gate
+
+Every port's `verify` runs the same gate, with the same codes, severities and message
+text (a shared corpus pins them). Run the one for the project's server language:
+
+| port | command |
+|---|---|
+| TypeScript | `meta verify` |
+| Python | `metaobjects verify` |
+| Java, Kotlin | `mvn metaobjects:verify` (one goal for both) |
+| C# | `dotnet meta verify <metadataDir> --templates <dir>` (or `--codegen --out <dir>`) |
+
+The gate is core: it is not a generator and cannot be ejected or replaced. What differs
+by port is the **authoring lint** further down this page, which only the Node `meta verify`
+prints. This page writes `meta verify` throughout; read it as the port's own command.
+
 ## The split, and why it matters when you read a failure
 
 | | owns |
@@ -65,6 +81,25 @@ So on a `planned` entry a dangling reference is the entry doing its job, not dri
 | `@implementedBy` above the L4 link floor | 1 |
 | live `requirement.architectural` claimed by nothing | 1 |
 | an entity no requirement claims | 0 (warning) |
+| a `live`/`partial` functional requirement nothing implements | 0 (warning); **1 under the strict switch** |
+
+## The strict switch — `--require-implementers`
+
+`WARN_REQUIREMENT_NOTHING_IMPLEMENTS` (a `live` or `partial` functional requirement where
+neither it nor anything nested under it names a node) is a warning by default. A project
+whose ledger has caught up with its links can make it fail the build:
+
+| port | flag | environment |
+|---|---|---|
+| TypeScript | `meta verify --require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+| Python | `metaobjects verify --require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+| Java, Kotlin | `mvn metaobjects:verify -Dmeta.verify.requireImplementers=true` | `META_REQUIRE_IMPLEMENTERS=1` |
+| C# | `dotnet meta verify … --require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+
+It raises that one finding to an error and **keeps its code**. Every other warning stays a
+warning. If CI went red on this code, check whether the switch is set before treating it
+as a new defect: the fix is to add the `@implementedBy` link (or drop the entry to
+`planned`), not to unset the switch.
 
 ## The error codes, and the fix for each
 
@@ -91,8 +126,10 @@ reasons, so reading only the code you hit can send you the wrong way. The questi
 
 ## The authoring lint — a second section, never an error
 
-`verify` also prints an **authoring lint** under its own heading, after the gate's own
-warnings:
+The Node `meta verify` also prints an **authoring lint** under its own heading, after the
+gate's own warnings. It is TypeScript-only: `metaobjects verify`, `mvn metaobjects:verify`
+and `dotnet meta verify` run the gate above and never print these codes, so on those ports
+a clean run says nothing about them.
 
 ```
 meta verify — requirements: 6 authoring warning(s) (advisory — does not fail the build):
@@ -135,6 +172,11 @@ way to satisfy the check is to find any name that already exists.
 
 The attribute is retired. Tying a requirement to a test is the job of a generator that emits
 the test **from** the requirement, so the link is structural rather than a name someone chose.
+Every port ships one, `requirement-tests` (see the codegen skill's reference for the
+project's language). `verify` still never reads test results: the codegen drift gate
+(`verify --codegen`) proves the generated tests match the ledger, a live test with nothing
+behind it fails in the project's own test run, and a generated test that passes proves its
+witness ran, not that the witness tests the claim.
 
 ## What a green run does NOT prove
 
diff --git a/docs/CONFORMANCE.md b/docs/CONFORMANCE.md
index 1bcc00402..f82ef7817 100644
--- a/docs/CONFORMANCE.md
+++ b/docs/CONFORMANCE.md
@@ -1,6 +1,6 @@
 # Conformance coverage
 
-The MetaObjects standard ships **26 shared conformance corpora** under
+The MetaObjects standard ships **28 shared conformance corpora** under
 [`fixtures/`](../fixtures/). Every port runs every corpus that is *applicable to
 it* and asserts the same expected behaviour against the same fixtures. **This page
 is the inverse index**: fixture → feature doc + per-port pass status, and it is the
@@ -50,6 +50,8 @@ regenerate with `ls -d fixtures/<corpus>/*/ | wc -l` for directory-shaped corpor
 | [`fixtures/metamodel-docs/`](../fixtures/metamodel-docs/) | 1 | ✓ (docs emit is TS-owned) | — | — | — | — |
 | [`fixtures/fmt-conformance/`](../fixtures/fmt-conformance/) (#304 — `meta fmt`) | 12 | ✓ (reference) | ✓ | inherits via Java | ✓ | ✓ |
 | [`fixtures/field-lint-conformance/`](../fixtures/field-lint-conformance/) (the `verify` field authoring lint) | 15 | ✓ (reference) | ✓ | inherits via Java | ✓ | ✓ |
+| [`fixtures/requirement-check-conformance/`](../fixtures/requirement-check-conformance/) (the `verify` requirement gate, ADR-0057) | 43 cases | ✓ (reference) | ✓ | inherits via Java (one Maven `metaobjects:verify` goal) | ✓ | ✓ |
+| [`fixtures/requirement-test-identity-conformance/`](../fixtures/requirement-test-identity-conformance/) (the identity, skip state and digest of each generated requirement test, and the filter seam, ADR-0057) | 26 cases | ✓ (reference) | ✓ | identity function inherits via Java; emitted names asserted by its own generator test | ✓ | ✓ |
 | [`fixtures/naming-conformance/`](../fixtures/naming-conformance/) | 8 cases | ✓ | ✓ | inherits via Java (`RouteNaming.pluralize`) | ✓ | ✓ |
 | [`fixtures/codegen-noop/`](../fixtures/codegen-noop/) (FR-044 — reporting vocabulary: what is lowered, what stays inert) | 1 model pair (`reporting/with` vs `reporting/without`) | ✓ (codegen + migrate) | ✓ | ✓ | ✓ | ✓ |
 
@@ -73,13 +75,17 @@ the corpora above do two different jobs. Only the first is a promise to adopters
   `extract-conformance/`, `verify-conformance/`, `verify-strict-conformance/`,
   `persistence-conformance/` (runtime reads and writes, and the TS-owned migration
   scenarios), `agent-context-conformance/`, `metamodel-docs/`, `fmt-conformance/`
-  (the canonical serializer, surfaced per-file — ADR-0034's "canonical format" is core)
-  and `field-lint-conformance/` (the advisory field lint every port's `verify` prints).
+  (the canonical serializer, surfaced per-file — ADR-0034's "canonical format" is core),
+  `field-lint-conformance/` (the advisory field lint every port's `verify` prints) and
+  `requirement-check-conformance/` (the requirement gate every port's `verify` runs; a
+  drift gate is core, and it is not ejectable in any port).
   A red cell here is a MetaObjects bug.
 - **Template quality checks — not a promise.** The generated lane of
   `api-contract-conformance/`, `generator-registry-conformance/` (stable generator names),
-  `codegen-noop/` (vocabulary with no lowering yet emits nothing) and the codegen-compile
-  gate. They check that the reference generators are correct
+  `codegen-noop/` (vocabulary with no lowering yet emits nothing),
+  `requirement-test-identity-conformance/` (which tests the `requirement-tests` reference
+  generator yields from a ledger and what each is called; the text it writes is not
+  pinned) and the codegen-compile gate. They check that the reference generators are correct
   starting points; an adopter's ejected copy is theirs and is not gated. The hand-rolled
   reference-server lane of `api-contract-conformance/` still pins the wire contract that
   the runtimes and the client speak, which is core.
@@ -97,16 +103,25 @@ are recorded here instead.
   enums travel in `registry-conformance`'s byte-matched manifest, which every port
   reproduces exactly, and accept/reject behaviour is pinned by `requirement-*` fixtures
   in `fixtures/conformance/`. A port that drifts on what it will load fails.
-- *Checks — TypeScript only, by decision.* The `meta verify` diagnostics over
-  requirements ship in the TypeScript CLI; the other ports load and validate and stop
-  there. Same call as [ADR-0015](../spec/decisions/ADR-0015-single-shared-migrate-engine.md):
-  one implementation of a build-time gate rather than five, where the gate is not a
-  per-port runtime concern. `verify-conformance` therefore holds no requirement cases,
-  and that absence is deliberate rather than a gap.
+- *Checks — gated in all five ports.* Every port's `verify` runs the requirement gate
+  ([ADR-0057](../spec/decisions/ADR-0057-requirement-checks-and-tests-in-every-port.md),
+  which reversed a TypeScript-only split recorded here). `requirement-check-conformance`
+  pins each diagnostic's code, severity, path and message text and the summary counts
+  against the TypeScript reference. Kotlin has no CLI of its own and runs the gate through
+  the Java Maven goal. `verify-conformance` still holds no requirement cases: that corpus
+  is template drift, and the gate has its own.
+- *Generated tests — identity gated in all five ports, text in none.*
+  `requirement-test-identity-conformance` pins which tests a ledger yields, each one's id,
+  witness key, skip state and digest, and what a project's filter is shown. The file a
+  port writes is its reference helper's output and is not a cross-port contract.
+- *Authoring lint — TypeScript only, by decision.* The seven `WARN_REQUIREMENT_*`
+  authoring advisories are printed by the Node `meta verify` and by no other port (ADR-0057,
+  Consequences). They never fail a build, and no corpus holds them. The structured
+  `--format json|toon` payload is TypeScript-only too.
 
 Stated as mechanisms rather than as a list of attribute names on purpose — the
 requirement vocabulary has a breaking change scheduled (FR-038), which moves what the
-manifest contains without moving the boundary between the two halves.
+manifest contains without moving these boundaries.
 
 **Does the generated code compile** (`codegen-compile-conformance`, all five ports):
 
@@ -166,8 +181,10 @@ manifest contains without moving the boundary between the two halves.
 
 **How to tell a deliberate split from a real parity gap**, since the two look identical
 in the matrix — both show one port covered and four blank. Ask what the uncovered ports
-*claim*. Here they claim nothing: they load requirement vocabulary and stop, exactly as the
-feature doc says. Contrast `{{#hasField}}` in 0.23.1, where the JVM emitted `has<Field>()`
+*claim*. For the requirement authoring lint they claim nothing: no other port's `verify`
+prints one of those advisories, exactly as the feature doc says. (The requirement *checks*
+were a split of this kind until ADR-0057 moved them into every port, and they stopped
+being one the moment a second port made the claim.) Contrast `{{#hasField}}` in 0.23.1, where the JVM emitted `has<Field>()`
 onto generated payload records **and** `verify` accepted the section, while no render engine
 in any port implemented the other half — two ports shipping halves of one promise, with no
 fixture that could see it. A split is deliberate when no port makes a claim the corpus would
@@ -225,7 +242,7 @@ unit-test runners (`bun test`, `dotnet test`, `pytest`, `mvn test`) pull Docker.
 | `template-*`, `error-template-*` | [features/templates-and-payloads.md](features/templates-and-payloads.md) |
 | `origin-*`, `error-origin-*` | [features/templates-and-payloads.md](features/templates-and-payloads.md) (payload origins) |
 | `projection-*`, `error-projection-*`, `field-readonly-on-view-projection` | [features/source-kinds.md](features/source-kinds.md) (projections + the object taxonomy, ADR-0028) |
-| `requirement-*`, `error-unknown-attr-requirement` | [features/requirements.md](features/requirements.md) (vocabulary only — the `meta verify` checks are TS-owned; see "Split coverage" above) |
+| `requirement-*`, `error-unknown-attr-requirement` | [features/requirements.md](features/requirements.md) (vocabulary only — the gate has its own corpus, `requirement-check-conformance/`; see "Split coverage" above) |
 | `reporting-*`, `error-dimension-*`, `error-measure-*`, `error-ratio-*`, `error-segment-*`, `error-report-*`, `error-relative-date-*` | [features/reporting.md](features/reporting.md) (the `dimension` / `measure` / `segment` / `object.report` vocabulary and its load-time rules; design in the [FR-044 spec](superpowers/specs/2026-10-02-fr-044-core-reporting-design.md)) |
 | `smoke-empty-metadata` | [features/entities.md](features/entities.md) |
 
@@ -404,11 +421,48 @@ own those two functions), and
 `server/python/tests/codegen/test_route_path_naming.py` +
 `server/python/tests/unit/test_fr016_source_name_and_kind_aliases.py` (same split).
 
+### `fixtures/requirement-check-conformance/` (43 cases)
+
+All 43 cases → [features/requirements.md](features/requirements.md) ("The gate in every
+port"). Each case is a directory: `input/` metadata, an optional `options.json`
+(`libraries`, `requireImplementers`) and an `expected.json` holding the gate's diagnostics
+(severity, code, requirement path, message text) and the ledger summary, or `null` for a
+model with no requirement. The expectations are written from the TypeScript reference and
+a port that disagrees with one is wrong. The case list, and what each pins, is in the
+[corpus README](../fixtures/requirement-check-conformance/README.md).
+
+**Every port's `verify` is held to it:**
+`server/typescript/packages/cli/test/requirement-check-conformance.test.ts`,
+`server/python/tests/conformance/test_requirement_check_conformance.py`,
+`server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementCheckConformanceTest.java`
+(Kotlin inherits it, through the shared Maven goal) and
+`server/csharp/MetaObjects.Conformance.Tests/RequirementCheckConformanceTests.cs`.
+
+### `fixtures/requirement-test-identity-conformance/` (26 cases)
+
+All 26 cases → [features/requirements.md](features/requirements.md) ("Generated
+requirement tests and witnesses"). It pins the *identity* of every test the
+`requirement-tests` generator yields from a ledger (package, path, unit, id, witness key,
+status, skip state and digest), witness-key collisions, and the view a project's filter
+receives, through eight named filters each port's runner implements in its own language.
+It does not pin the text of a generated file, the uncovered warning, or a requirement name
+outside ASCII. The case list is in the
+[corpus README](../fixtures/requirement-test-identity-conformance/README.md).
+
+**All five ports run it:**
+`server/typescript/packages/codegen-ts/test/requirement-test-identity-conformance.test.ts`,
+`server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementTestIdentityConformanceTest.java`,
+`server/python/tests/conformance/test_requirement_test_identity_conformance.py` and
+`server/csharp/MetaObjects.Conformance.Tests/RequirementTestIdentityConformanceTests.cs`.
+Kotlin's identity function is the Java one; the names its generator emits are asserted by
+`server/java/codegen-kotlin/src/test/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGeneratorTest.kt`.
+
 ## Orphaned fixtures (tested but not yet documented)
 
 The fixtures in the nine corpora mapped above (metamodel 364 + yaml 16 + verify 31
 + render 15 + persistence 39 + api-contract 78 + source-resolution 25 + scope 10 +
-dependency 23) each map to a feature doc. None are orphaned today. The remaining
+dependency 23) each map to a feature doc, and so do the two requirement corpora, whose
+case lists live in their own READMEs. None are orphaned today. The remaining
 corpora in the totals table gate tooling contracts (registry manifests, provider
 composition, agent context, docs emit) rather than user-facing metamodel behaviour,
 so they have no feature-doc row.
diff --git a/docs/features/cli.md b/docs/features/cli.md
index 81d715d8a..626b935bd 100644
--- a/docs/features/cli.md
+++ b/docs/features/cli.md
@@ -146,6 +146,27 @@ Rules of the contract:
 
   The codes and message text are identical in every port, gated by
   [`fixtures/field-lint-conformance/`](../../fixtures/field-lint-conformance/README.md).
+- **The requirement gate runs on every `verify`, in every port**
+  ([ADR-0057](../../spec/decisions/ADR-0057-requirement-checks-and-tests-in-every-port.md)).
+  It is not a subverb and nothing mutes it. A model with no `requirement.*` node gets no
+  line and no change to the exit code. A model with one gets the ledger summary on every
+  run, and an error (a link above the floor, a dangling reference on a `live` or `partial`
+  requirement, a live policy applied to nothing) exits non-zero. Unlike the lints above,
+  this one can fail the build. One of its warnings can be raised to an error, per port:
+
+  | CLI | Flag | Environment |
+  |---|---|---|
+  | Node `meta verify` | `--require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+  | `dotnet meta verify` | `--require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+  | `mvn metaobjects:verify` | `-Dmeta.verify.requireImplementers=true` | `META_REQUIRE_IMPLEMENTERS=1` |
+  | `metaobjects verify` | `--require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+
+  The switch reports `WARN_REQUIREMENT_NOTHING_IMPLEMENTS` (a live functional requirement
+  that nothing implements) at severity `error`, under the same code, and changes no other
+  finding. The codes, severities and message text are identical in every port, gated by
+  [`fixtures/requirement-check-conformance/`](../../fixtures/requirement-check-conformance/README.md).
+  The seven requirement *authoring-lint* advisories are still printed by the Node `meta`
+  only. See [requirements.md](requirements.md#the-gate-in-every-port).
 
 ### The prompt directory: `--prompts` everywhere (F101)
 
@@ -319,9 +340,12 @@ by the other port's docs command.
 
 Alongside its flag-only mode (`metaobjects gen <metadata_dir> --out <dir>`), the
 Python `metaobjects` CLI supports a declarative project config,
-`metaobjects.config.yaml` (#267). The **schema keys are identical to the TS
-`metaobjects.config.ts` vocabulary** — a polyglot adopter learns one
-targets-registry shape regardless of port. A JSON Schema ships at
+`metaobjects.config.yaml` (#267). Its **`targets` registry uses the TS
+`metaobjects.config.ts` vocabulary** (named targets, each with its own `outDir`) — a
+polyglot adopter learns one targets-registry shape regardless of port. The keys are not
+identical beyond that: a Python target carries its own `generators` and `entities`, and
+`requirementTests` is a block that exists only here, where TypeScript passes that
+generator's options to `requirementTests({ … })` in code. A JSON Schema ships at
 [`server/python/src/metaobjects/codegen/metaobjects-config.schema.json`](../../server/python/src/metaobjects/codegen/metaobjects-config.schema.json)
 for editor autocomplete and non-Python validation.
 
@@ -330,6 +354,12 @@ metadata: metaobjects            # optional, default "metaobjects" — relative
 providers:                       # optional; "module:symbol" refs, resolved config-relative (no PYTHONPATH=)
   - my_project.providers:register_custom_types
 libraries: [ai]                  # optional; MetaObjects-shipped library packages (see below)
+requirementTests:                # optional; options of the `requirement-tests` generator, every key optional
+  witnessModule: tests.requirement_witnesses   # the default
+  grain: concern                 # or: member
+  filter: codegen.requirement_hooks:include    # "module:symbol", resolved config-relative
+  renderer: codegen.requirement_hooks:render   # "module:symbol", resolved config-relative
+  warnUncovered: true            # the default
 targets:
   api:
     outDir: src/generated/api
diff --git a/docs/features/own-your-codegen.md b/docs/features/own-your-codegen.md
index e9214ba20..e6340f4c1 100644
--- a/docs/features/own-your-codegen.md
+++ b/docs/features/own-your-codegen.md
@@ -289,7 +289,7 @@ generator code. The 20-line programmatic shape for each port is in
 
 | Port | Invocation | Programmatic — write a `Generator` | Declarative — template + scope |
 |---|---|---|---|
-| **TypeScript** | `meta init` → `meta gen --list --probe` → `meta eject <names...>` → `meta gen` (Bun/Node CLI) | **Yes.** `meta generator new <name>` writes a working generator of your own into `codegen/generators/` and wires it — the first move for an output nothing ships. To start from a reference instead: `meta init` scaffolds the LAYOUT and an empty selection (ADR-0034 Amendment 2); `meta eject <name>...` copies each generator you choose into `codegen/generators/*.ts` and prints the import to add to `metaobjects.config.ts`. Edit them freely. The prompt tier (`prompt-render`, `output-parser`, `extractor`, `output-prompt`, `render-helper`) ejects like the rest: you own which templates get a module and where it lands, while the render and extract engines those modules call stay in the package. Not every registered generator is ejectable: `callable`, `trace-helper`, `requirement-tests`, the `template` primitive, the docs tier (`docs`, `api-docs`, `mermaid-er`, whose door is `meta docs`) and `shared-model` ship no reference template, so they are **package-only** — `meta gen --list` marks them so and `meta eject` names them as such. `shared-model` (FR-023's publisher generator) stays package-only deliberately, since it emits a hash-pinned cross-port contract artifact. | **Yes** — `templateGenerator({ template, scope, outputPattern })` in the config's `generators: [...]`. No CLI flag: the config already takes generator values. |
+| **TypeScript** | `meta init` → `meta gen --list --probe` → `meta eject <names...>` → `meta gen` (Bun/Node CLI) | **Yes.** `meta generator new <name>` writes a working generator of your own into `codegen/generators/` and wires it — the first move for an output nothing ships. To start from a reference instead: `meta init` scaffolds the LAYOUT and an empty selection (ADR-0034 Amendment 2); `meta eject <name>...` copies each generator you choose into `codegen/generators/*.ts` and prints the import to add to `metaobjects.config.ts`. Edit them freely. The prompt tier (`prompt-render`, `output-parser`, `extractor`, `output-prompt`, `render-helper`) ejects like the rest: you own which templates get a module and where it lands, while the render and extract engines those modules call stay in the package. `requirement-tests` ejects as one file holding the generator and its default stub renderer, so the stub text is yours to change; the requirement walk, each test's identity and the claim digest stay in the package. Not every registered generator is ejectable: `callable`, `trace-helper`, the `template` primitive, the docs tier (`docs`, `api-docs`, `mermaid-er`, whose door is `meta docs`) and `shared-model` ship no reference template, so they are **package-only** — `meta gen --list` marks them so and `meta eject` names them as such. `shared-model` (FR-023's publisher generator) stays package-only deliberately, since it emits a hash-pinned cross-port contract artifact. | **Yes** — `templateGenerator({ template, scope, outputPattern })` in the config's `generators: [...]`. No CLI flag: the config already takes generator values. |
 | **Java / Kotlin** | `mvn metaobjects:generate` / `mvn metaobjects:verify` (`metaobjects-maven-plugin`) | **Yes.** Extend `FileEmittingGenerator` and read the model through `ModelWalk` (both in `metaobjects-codegen-base`) for one of your own. Every generator — built-in or your own — is named in `<generator><classname>` and loaded from the project classpath: one seam, not two. There is no default suite, so `<generators>` is the complete list. Kotlin runs through the same goal. | **Yes** — `TemplateScopeGenerator` wired as an ordinary `<generator>`. No CLI flag: `<generator>` is already the seam. |
 | **C#** | `dotnet meta gen` / `dotnet meta verify` (.NET tool) | **Yes.** Implement `IGenerator` in the owned console project `codegen/` and list it in `codegen/Program.cs`; `dotnet meta gen` / `verify --codegen` hand off to that project whenever `codegen/Codegen.csproj` exists. `dotnet meta eject <name>` scaffolds the project, or write its two files by hand. An owned generator the `--generators` selection does not name still runs. | **Yes** — `dotnet meta gen --template-spec <json> --template-root <dir>`. |
 | **Python** | `metaobjects gen` / `metaobjects verify` (console-script) | **Yes.** Name your generator as `module:symbol` in `--generators` or a target's `generators` in `metaobjects.config.yaml`; the symbol is an instance or a function returning one. Read the model through `metaobjects.codegen.model_walk`. (`--provider module:symbol` registers **metamodel vocabulary**, not a generator.) | **Yes** — `metaobjects gen --template-spec <json> --templates <dir>`. |
@@ -442,6 +442,12 @@ can see when an upgrade changed the generator you copied. A copy imports the sam
 `metaobjects.codegen.*` modules the packaged one does, and those module paths are the
 surface an owned generator builds on.
 
+`requirement-tests` ejects the same way, to `codegen/generators/requirement_tests.py`,
+wired as `codegen.generators.requirement_tests:requirement_tests_generator`. The copy holds
+the generator and its default renderer and keeps reading the `requirementTests` config
+block; the requirement walk, the test identities and the digest stay in the package. See
+[Generated requirement tests and witnesses](requirements.md#generated-requirement-tests-and-witnesses).
+
 ### The runtime your generated code imports comes with it
 
 Owning a generator only helps if you also own the helper code its **output** calls.
@@ -522,6 +528,14 @@ that runs `metaobjects:generate`, and the new `<classname>` for each `<generator
 never overwrites a copy without `-Dforce`, and `-Dlist` marks each owned copy `identical`
 or `DIFFERS: N behind, M of your own`.
 
+A name that is ejectable on both ports needs `-Dport`, unless your project declares a
+dependency on exactly one of `metaobjects-codegen-spring` and `metaobjects-codegen-kotlin`,
+from which the goal infers it. `requirement-tests` is one such name:
+`mvn metaobjects:eject -Dnames=requirement-tests -Dport=java` copies
+`JUnitRequirementTestsGenerator.java` and `-Dport=kotlin` copies
+`KotlinRequirementTestsGenerator.kt`, each with its default rendering. The identity
+function, the digest and the renderer and filter hook types stay in the package.
+
 ### What eject hands over, and what stays core
 
 An owned generator is only yours if the code its output depends on is yours too. The Java
@@ -633,6 +647,12 @@ not the other eight. The owned project finds metadata exactly as the tool does,
 `dotnet meta gen --list` marks owned copies `identical` or `DIFFERS: N behind, M of your
 own`. The `template` primitive is not ejectable; it has no emit logic of its own.
 
+`dotnet meta eject requirement-tests` copies `RequirementTestsGenerator.cs`, which holds the
+generator and its default rendering. Its options are public properties you set in
+`codegen/Program.cs` (`new RequirementTestsGenerator { WitnessClass = "…" }`); the hook
+types (`IRequirementTestRenderer`, `IRequirementTestFilter`), the identity function and the
+digest stay in the package.
+
 ### Ejecting routes hands over the helper runtime too
 
 Generated routes call a handful of helpers: the filter parser, the EF Core filter
diff --git a/docs/features/requirements.md b/docs/features/requirements.md
index 86f337744..48a0c9797 100644
--- a/docs/features/requirements.md
+++ b/docs/features/requirements.md
@@ -1,10 +1,11 @@
 # Capability requirements
 
 _`requirement.functional` / `requirement.architectural` — record what your system is
-supposed to do, as metadata, checked by `meta verify`._
+supposed to do, as metadata, checked by `verify` in every port._
 
 **Status:** registered vocabulary in all five ports (TypeScript, Java, C#, Python, Kotlin).
-The `meta verify` gate is TypeScript-CLI-only; the other ports load and validate.
+The requirement gate runs in every port's `verify`, and every port ships a
+`requirement-tests` generator. The authoring lint is TypeScript-only.
 
 **Entirely opt-in.** A model with no `requirement.*` nodes gets no diagnostics, generates
 nothing, and reads nothing — no codegen, migrate or runtime path touches the type. You opt in
@@ -143,8 +144,8 @@ Two failure modes are worth naming because both look like diligence:
 
 A requirement's `name` is the segment of its **dotted path** — `Ordering.Placement.Recorded`,
 the same addressing every other node uses — and that path is also the filename of its
-generated test stub (`requirements/<path>.test.ts`). So a name is an identifier, and two
-habits break it:
+generated TypeScript test stub (`requirements/<path>.test.ts`) and part of the name of its
+generated test in every other port. So a name is an identifier, and two habits break it:
 
 - **A `.` in the name** makes it indistinguishable from nesting. A single node named
   `Orders.Recorded` and a node `Orders` containing a node `Recorded` produce the *identical*
@@ -160,7 +161,7 @@ cleanly. `verify` warns about them.
 
 ## Two kinds, opposite checks
 
-| | check | what `meta verify` does |
+| | check | what `verify` does |
 |---|---|---|
 | `requirement.functional` (levelled) | **existence** | **warns** when nothing in a live/partial node's subtree implements it; **fails** when a node it names no longer exists |
 | `requirement.architectural` (flat by default) | **universality** | **fails** a live/partial policy applied to nothing, or one naming a node that no longer exists; it does not check that each claimed node complies |
@@ -201,6 +202,8 @@ branch of their own.
 ## What `meta verify` checks
 
 Requirements are metadata, so they are checked on **every** `meta verify` — no subverb.
+The same gate runs in the other ports' `verify`; [The gate in every port](#the-gate-in-every-port)
+gives each command and the full list of codes.
 
 The rule worth knowing before you read a failure: **a dangling `@implementedBy` is an error
 on `live`/`partial` and allowed on `planned`.** On `planned` the nodes do not exist *yet* —
@@ -275,7 +278,7 @@ your agents never read it, restoring the entry buys you a coin flip. Point at it
 
 ```
 meta verify — requirements: 235 entries (226 functional, 9 architectural) —
-  173 live, 62 partial; 55/55 entities claimed.
+  173 live, 62 partial; 55/55 entities claimed, counted over 14 metadata file(s).
 meta verify — requirements: 62 recorded gap(s) with no @disposition.
 ```
 
@@ -284,7 +287,8 @@ nothing — and a ledger that skipped an entire grain reads exactly like a compl
 
 ### The authoring lint
 
-Alongside the gate, `verify` runs an **authoring lint** and prints it under its own heading:
+Alongside the gate, `meta verify` runs an **authoring lint** and prints it under its own
+heading. The lint is TypeScript-only: the other ports' `verify` run the gate and not the lint.
 
 ```
 meta verify — requirements: 6 authoring warning(s) (advisory — does not fail the build):
@@ -327,6 +331,105 @@ with, and a gate people argue with is a gate people mute. And it never asks whet
 statement is *true*, a description *useful*, or a counterexample *sufficient*; those are the
 judgements the ledger exists to record, and no check reaches them.
 
+## The gate in every port
+
+The gate is the same in all five ports. Each port's `verify` runs it on every run, with no
+subverb to ask for it, from the port's own core library
+([ADR-0057](../../spec/decisions/ADR-0057-requirement-checks-and-tests-in-every-port.md)).
+A shared corpus,
+[`fixtures/requirement-check-conformance/`](../../fixtures/requirement-check-conformance/README.md),
+holds every port to the TypeScript reference: the code, severity, requirement path and
+message text of each diagnostic, and the summary counts.
+
+| Port | Command | Its lines start |
+|---|---|---|
+| TypeScript | `meta verify` | `meta verify — requirements:` |
+| Python | `metaobjects verify` | `metaobjects verify — requirements:` |
+| Java, Kotlin | `mvn metaobjects:verify` (one goal for both, in either mode) | `metaobjects:verify — requirements:` |
+| C# | `dotnet meta verify ./metadata --templates ./prompts` | `dotnet meta verify — requirements:` |
+
+The C# tool has to be given one of its drift gates (`--templates <dir>`, or `--codegen
+--out <dir>`); the requirement gate then runs beside whichever one it was given. Maven logs
+the summary at `info`, warnings as warnings and errors as errors.
+
+**What it reports**, checked per requirement in this order:
+
+| Code | Severity | Fires when |
+|---|---|---|
+| `ERR_REQUIREMENT_BAD_LEVEL` | error | The level is outside 1 to 5, on a functional requirement or a levelled architectural one. |
+| `ERR_REQUIREMENT_LEVEL_NESTING` | error | A levelled requirement sits at or above the level of the requirement it is nested under. |
+| `ERR_REQUIREMENT_LINK_ABOVE_FLOOR` | error | `@implementedBy` on a levelled requirement at L1 to L3. Nothing further is reported for that node: the checks below this row are skipped, and the two above it have already run. |
+| `ERR_REQUIREMENT_L4_NOT_OBJECT` | error | A functional L4 names a member. |
+| `ERR_REQUIREMENT_L5_NOT_MEMBER` | error | A functional L5 names an object. |
+| `ERR_REQUIREMENT_DANGLING_REF` | error | An `@implementedBy` reference does not resolve on `live` or `partial`, or `@supersededBy` does not name a requirement in the ledger. |
+| `ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS` | error | A `live` or `partial` architectural requirement that may name the model (a flat policy, or one at L4 or L5) names nothing. |
+| `WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE` | warn | `@disposition` on a status other than `planned` or `partial`. |
+| `WARN_REQUIREMENT_NOTHING_IMPLEMENTS` | warn | A `live` or `partial` functional requirement where neither it nor anything nested under it names a node. An error under [the strict switch](#requiring-implementers). |
+| `WARN_REQUIREMENT_DEFERRED_UNTRACKED` | warn | `@disposition: deferred` with no `@trackedBy`. |
+| `WARN_REQUIREMENT_OBJECT_UNCLAIMED` | warn | Coverage is measured and no requirement claims a concrete entity. The line has no requirement path, because its subject is the entity. |
+
+A diagnostic prints as `  <code> [<path>]: <message>`.
+
+**What counts as claimed.** A requirement that is not `planned` contributes its claims, and
+each reference that resolves adds the object it names (a member reference adds the member's
+owner). An **architectural** claim on a base also covers every object whose `extends` chain
+reaches that base; a functional claim does not spread. What is counted is concrete
+`object.entity` nodes: abstract entities, `object.value` and `object.projection` are not.
+
+**When coverage is measured.** Only when the project authored at least one requirement of
+its own. A project whose only requirements came from a shipped library, with or without an
+overlay on one of them, is not measured, and the summary says so instead of printing a
+ratio.
+
+**The summary**, one line whenever the model declares a requirement:
+
+```
+<prefix> <total> entries (<n> functional, <n> architectural) — <n> planned, <n> live,
+  <n> partial, <n> retired; <claimed>/<total> entities claimed, counted over <n> metadata file(s).
+```
+
+A status with no entry is left out. When coverage is not measured the line ends
+`coverage: not measured (no project-authored requirements).` TypeScript and Python end it
+`, <n> from dependencies.` when the project declares metadata dependencies. A second line
+counts the recorded gaps with no `@disposition`, when there are any. Then come the
+diagnostics, and when any is an error, `<prefix> <n> error(s).` and a non-zero exit.
+TypeScript caps the warnings it prints at `--limit` (20 by default); the other ports print
+every one. The structured `--format json|toon` payload is TypeScript-only.
+
+**Metadata that does not load** is not a model with no requirement: `verify` fails on it in
+every port. The load errors are printed once. Where the drift gate that ran loaded the model,
+that gate prints them; where none did (`metaobjects verify` with no generators selected,
+`dotnet meta verify --codegen` handed off to an owned `codegen/` project), the requirement
+gate prints them itself. Its load is strict unless `--lax`, as the drift gates' is.
+
+### Known differences between ports
+
+- The package a requirement is taken to be in can differ between ports for two multi-file
+  shapes: a root document with no package loaded beside packaged ones, and a child merged
+  from a package-less document into a requirement that declares its own package.
+- Python applies only the dependency-import rule to decide which of a project's own
+  entities are counted; TypeScript also applies the project's `scope` patterns.
+- A `level` that is not an integer (`4.5`) is refused at load by the Python, Java and C#
+  loaders (`ERR_BAD_ATTR_VALUE`). The TypeScript loader lets it through, and the gate reports
+  it as `ERR_REQUIREMENT_BAD_LEVEL`.
+
+## Requiring implementers
+
+`WARN_REQUIREMENT_NOTHING_IMPLEMENTS` is a warning because a young ledger usually claims
+more than it links. A project whose ledger has caught up can make it fail the build:
+
+| Port | Flag | Environment |
+|---|---|---|
+| TypeScript | `meta verify --require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+| Python | `metaobjects verify --require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+| Java, Kotlin | `mvn metaobjects:verify -Dmeta.verify.requireImplementers=true` | `META_REQUIRE_IMPLEMENTERS=1` |
+| C# | `dotnet meta verify ./metadata --templates ./prompts --require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+
+The switch raises that one finding to an error and keeps its code, so a report or a
+suppression keyed on the code still matches. No other warning changes severity. It is not
+called `--strict`, because `verify` already has `--lax` on a different axis and a `--strict`
+beside it would read as that flag's opposite.
+
 ## Recording gaps: `partial` is a feature, not a failure
 
 `partial` is the most valuable status in the enum, because it is the only one that says
@@ -387,11 +490,239 @@ nothing.
 
 Pair it with `@trackedBy` to link the ticket it will be built under.
 
-### What a green run does not prove
+## Generated requirement tests and witnesses
+
+**This is a recommended approach, not a contract.** The `requirement-tests` generator, its
+default renderer and the witness model described here are a reference helper
+([ADR-0034 Amendment 3](../../spec/decisions/ADR-0034-codegen-scaffold-and-own.md#amendment-3-2026-09-22--generators-are-reference-helpers-the-core-is-what-metaobjects-guarantees)).
+Every port ships one and every port can eject it, and an application may change its copy or
+replace it. The checks in `verify` are the part MetaObjects guarantees. They are not
+ejectable in any port, because they are the contract the ports share.
+
+The generator writes one test per requirement its filter selects. By default that is every
+functional requirement at L4 or L5. A `live` or `partial` requirement gets a test that
+fails until the project supplies the proof; a `planned` or `retired` one gets a skipped
+test.
+
+Each test has an identity, and the identity is the same in all five ports:
+
+| Part | What it is |
+|---|---|
+| id | `<package>::<path> [<unit>]`, or `<path> [<unit>]` when the requirement has no package. |
+| unit | By default (`grain: concern`) one test per distinct `<type>.<subType>` the requirement's resolved references name. Under `grain: member`, one test per distinct reference that resolves. A requirement that resolves no reference gets one test, with unit `*`. |
+| witness key | An identifier-safe spelling of the id: `req_`, the package and path, then `__` and the unit unless the unit is `*`, with every run of characters outside `A-Z`, `a-z` and `0-9` written as one `_`. `acme::shop::Orders.Recorded [object.entity]` gives `req_acme_shop_Orders_Recorded__object_entity`. |
+| digest | A SHA-256 over the requirement's subtype, level, status, statement, counterexample and `@implementedBy` list. It answers "did the claim change", so a title, a note or a disposition does not move it. |
+
+[`fixtures/requirement-test-identity-conformance/`](../../fixtures/requirement-test-identity-conformance/README.md)
+pins those identities in every port. It does not pin the text of a generated file, which is
+each port's own language and the application's to change. TypeScript's default stub keeps
+the test name it always had, `<path> [<concern>]`, with no package; there the identity is
+what a renderer receives.
+
+### What each port writes
+
+| Port | Framework | Files | The project supplies |
+|---|---|---|---|
+| TypeScript | `bun:test` in the default stub | One stub per test: `requirements/<path>.<concern>.test.ts`, or `requirements/<path>.test.ts` for a requirement that resolves no reference. | The assertion, written into the stub. The three-way merge keeps it. |
+| Python | pytest | `requirements/test_<pkgKey>_requirements.py`, one per metamodel package. | A function named by the witness key, in the witness module (`tests.requirement_witnesses` by default). |
+| Java | JUnit Jupiter | `Requirements_<pkgKey>_Witnesses.java` and `Requirements_<pkgKey>_Test.java`, in `testPackage`. | The class `witnessClass` names, implementing each generated interface. |
+| Kotlin | JUnit Jupiter | `Requirements_<pkgKey>_Witnesses.kt` and `Requirements_<pkgKey>_Test.kt`, in `testPackage`. | As Java. |
+| C# | xUnit | `Requirements_<pkgKey>_Witnesses.g.cs` and `Requirements_<pkgKey>_Tests.g.cs`. | The class `WitnessClass` names, implementing each generated interface. |
+
+`<pkgKey>` is the metamodel package with each run of non-alphanumeric characters as one
+`_` (`acme::shop` gives `acme_shop`), or `root` for a requirement with no package.
+
+Generated Java and Kotlin tests are JUnit Jupiter only. A JUnit 4 project uses the renderer
+hook or ejects the generator. Generated tests import their test framework (and, in Python,
+`importlib`) and nothing from MetaObjects.
+
+### Witnesses
+
+TypeScript keeps the model it had: you fill in the stub, and regeneration preserves what
+you wrote. In the other four ports the generated file is machine-owned and rewritten whole
+on every run, so your code goes somewhere else: in a **witness**, a function or method you
+own that the generated test calls. A `live` or `partial` requirement with no witness is a
+failing test that names what to write:
+
+```
+unimplemented requirement: acme::shop::Orders.Recorded [object.entity] - write
+  tests.requirement_witnesses.req_acme_shop_Orders_Recorded__object_entity() so that it
+  fails when: A placed order has no row.
+```
+
+**Python.** Create the witness module and add a function per test. There is nothing else to
+set up: a missing module or function is "no witness", and the test fails with the message
+above. A witness module that exists and fails to import raises its own error.
+
+```python
+# tests/requirement_witnesses.py
+def req_acme_shop_Orders_Recorded__object_entity():
+    order = place_order()
+    assert find_order_row(order.id) is not None
+```
+
+**Java and Kotlin.** The generator writes an interface with one member per test that is not
+skipped, each with a default body that fails. You write one class, with a public
+no-argument constructor, that implements every generated interface. This is a one-time
+setup with a cost: the generated tests construct that class with `new`, so the test module
+does not compile until it exists.
+
+```java
+public class Witnesses implements Requirements_acme_shop_Witnesses {
+    @Override
+    public void req_acme_shop_Orders_Recorded__object_entity() {
+        Order order = placeOrder();
+        assertNotNull(findOrderRow(order.id()));
+    }
+}
+```
+
+```kotlin
+class Witnesses : Requirements_acme_shop_Witnesses {
+    override fun req_acme_shop_Orders_Recorded__object_entity() {
+        val order = placeOrder()
+        assertNotNull(findOrderRow(order.id))
+    }
+}
+```
+
+**C#.** The same shape: an interface with default members, and one class of yours, with a
+public parameterless constructor, that the generated tests construct.
+
+```csharp
+using Acme.Shop.Requirements;
+using Xunit;
+
+namespace Acme.Shop;
+
+public class RequirementWitnesses : Requirements_acme_shop_Witnesses
+{
+    void Requirements_acme_shop_Witnesses.req_acme_shop_Orders_Recorded__object_entity()
+    {
+        var order = PlaceOrder();
+        Assert.NotNull(FindOrderRow(order.Id));
+    }
+}
+```
+
+In the three compiled ports a requirement that becomes `live` adds an interface member with
+a failing default, which is a red test and not a compile break. A requirement that is
+retired or deleted removes its member, and whether a witness left behind then stops
+compiling depends on how it was written:
+
+- **Kotlin:** always. `override` is mandatory.
+- **Java:** only when the method carries `@Override`. Without it a stale method is an
+  ordinary method and compiles.
+- **C#:** only when the member is implemented explicitly, as above. A `public void req_…()`
+  implements it implicitly, and a stale one keeps compiling.
+- **Python:** never. There is no compile step, and a witness whose requirement is gone is
+  simply not called.
+
+The examples use the form that signals. A witness written in the other form goes stale
+silently when its requirement is retired or deleted.
+
+Two cautions. In C#, a method that does not actually implement the interface member (an
+implicit one that is not `public`, or one whose name is off by a character) leaves the
+failing default in place, so the test reports `unimplemented requirement` for a witness you
+believe you wrote: check the signature against the generated interface. In Kotlin, write
+the witness class in Kotlin. A witness class written in Java is untested: unless your
+Kotlin compiler is set to emit JVM default methods for interface members, Java sees every
+member as abstract, and each new live requirement becomes a compile break instead of a red
+test.
+
+### Choosing which requirements get a test
+
+Every port offers the same seams. Only the spelling differs.
+
+| Seam | TypeScript | Python | Java, Kotlin | C# |
+|---|---|---|---|---|
+| Grain: `concern` (default) or `member` | `grain` | `grain` | `<grain>` | `Grain` |
+| Filter: a predicate that **replaces** the default | `filter` | `filter`, a `module:symbol` | `<filter>`, a class implementing `RequirementTestFilter` | `Filter`, an `IRequirementTestFilter` |
+| The uncovered warning, on by default | `warnUncovered: false` | `warnUncovered: false` | `<warnUncovered>false</warnUncovered>` | `WarnUncovered = false` |
+| Renderer: replaces the text of one test | `renderers`, `resolveRenderer` | `renderer`, a `module:symbol` | `<renderer>`, a class implementing `RequirementTestRenderer` | `Renderer`, an `IRequirementTestRenderer` |
+| Where the witnesses are | not applicable | `witnessModule` | `<testPackage>`, `<witnessClass>` | `TestNamespace`, `WitnessClass` |
+
+Where they are set: in TypeScript, the options of `requirementTests({ … })` in
+`metaobjects.config.ts`. In Python, the `requirementTests` block of
+`metaobjects.config.yaml` (the flag-only `metaobjects gen <dir> --out <dir>` mode runs the
+generator with its defaults). In Java and Kotlin, the `<args>` of the `<generator>` entry.
+In C#, public properties set where the generator is constructed, in the owned
+`codegen/Program.cs`; the packaged `dotnet meta gen --generators requirement-tests` runs
+with the defaults. The per-port pages have a worked configuration each:
+[TypeScript](../ports/typescript.md#requirement-tests),
+[Python](../ports/python.md#requirement-tests),
+[Java](../ports/java.md#requirement-tests--junitrequirementtestsgenerator),
+[Kotlin](../ports/kotlin.md), [C#](../ports/csharp.md#requirement-tests).
+
+**The filter sees one view of a requirement, never the node:** `subType`, `level` (absent
+when the requirement declares none, which is not the same as zero), `status`, `path`,
+`package` and `implementedByTypes` (the distinct `<type>.<subType>` of the references that
+resolve). Python spells two of them `sub_type` and `implemented_by_types`; Java and Kotlin
+read them through accessors and spell the package `pkg()`; C# capitalises them and types
+`Level` as `int?`.
+
+**The uncovered warning** names the requirements the filter left out, so "no test here" is a
+visible choice. Its text is the same in every port, and it names requirement paths:
+
+```
+3 requirement(s) matched no filter and get no test. If that is deliberate, set
+  warnUncovered: false to silence this. Uncovered: Shop, Shop.Orders, Shop.Billing.
+```
+
+It lists at most five paths and then `, and <k> more`. The switch is spelled the way that
+port spells it, and TypeScript says `stub` where the others say `test`.
+
+Three refusals. In every port, a grain other than `concern` or `member` is an error, never
+a hybrid run. Outside TypeScript, two tests that would share one witness key refuse to
+generate (`ERR_REQUIREMENT_WITNESS_KEY_COLLISION`, naming both ids). And in Python, Java
+and Kotlin, where a renderer or filter is given by name, one that exists but fails to load
+is reported with its real cause, not as missing. TypeScript and C# take the function or
+object itself, so there is nothing to look up.
+
+### When a claim changes, and when a package empties
+
+Outside TypeScript each generated test carries its digest in a comment. Edit a statement, a
+counterexample, a status, a level or an `@implementedBy` list and the committed file no
+longer matches a fresh run, so the port's codegen drift gate (`metaobjects verify`,
+`mvn metaobjects:verify`, `dotnet meta verify --codegen`) fails until you regenerate. That
+is the prompt to re-read the witness against the new claim.
+
+**A known limit.** In Python, Java, Kotlin and C#, a package that loses its last
+requirement leaves its generated test file behind. `gen` does not remove it. The port's
+codegen drift gate reports it, and you delete it by hand. TypeScript's generator reconciles
+these itself: it removes the stub of a requirement that is gone, and refuses, by name, one
+that carries a hand edit.
+
+### Owning the generator
+
+| Port | Command | The copy |
+|---|---|---|
+| TypeScript | `meta eject requirement-tests` | `codegen/generators/requirement-tests.ts` |
+| Python | `metaobjects eject requirement-tests` | `codegen/generators/requirement_tests.py` |
+| Java | `mvn metaobjects:eject -Dnames=requirement-tests -Dport=java` | `JUnitRequirementTestsGenerator.java`, in a `codegen/` Maven module under your package |
+| Kotlin | `mvn metaobjects:eject -Dnames=requirement-tests -Dport=kotlin` | `KotlinRequirementTestsGenerator.kt`, likewise |
+| C# | `dotnet meta eject requirement-tests` | `codegen/generators/RequirementTestsGenerator.cs` |
+
+The copy holds the generator and its default renderer, so the text of a generated test is
+yours to change. What stays in the package is what the ports agree on: the walk over the
+ledger, the claim resolver, the identity function, the digest and the hook types. An owned
+generator imports those like any other code. The Maven goal needs `-Dport` because the name
+is ejectable on both JVM ports; it infers the port only when your project declares a
+dependency on exactly one of `metaobjects-codegen-spring` and `metaobjects-codegen-kotlin`.
+Each command prints what to wire. See [Own your codegen](own-your-codegen.md).
+
+## What a green run does not prove
 
 It proves **referential integrity**. It cannot prove a status is *true*, or that a node
 genuinely implements the requirement claiming it — no test can.
 
+The generated tests do not change that. `verify` never reads test results: it checks the
+ledger, the drift gate checks that the generated tests match it, and your own test run
+supplies "passing". A generated test that passes proves the witness ran, not that the
+witness tests the claim. And a witness written without the compile signal (a Java method
+with no `@Override`, a C# member implemented implicitly, any Python function) goes stale
+silently when its requirement is retired or deleted.
+
 Coverage is also narrower than it sounds: entity grain only. `object.value` and
 `object.projection` are exempt, and fields, views, validators and identities are never
 required to be claimed. Green means "every entity is claimed by something", not "every node
diff --git a/docs/llms/llms-full.txt b/docs/llms/llms-full.txt
index 813e1b6d6..e0a313368 100644
--- a/docs/llms/llms-full.txt
+++ b/docs/llms/llms-full.txt
@@ -12,13 +12,13 @@
 
 **One typed model of your app** — data, API, UI, prompt payloads, and what it's supposed to do — that your agent reads and writes. Two things happen to it. **Generate:** the boring parts are derived from it, in TypeScript, Java, Kotlin, C# and Python — at build time by reference generators you copy into your repo and own, or at runtime from the live model. **Verify:** the build fails when generated code drifts from the model and when a prompt's payload no longer matches what it's told — and it fails or warns when a feature someone marked done has nothing implementing it. That last one has no equivalent in a test suite: a test exercises code that exists, so nothing flags a claimed capability that was never built. It checks that the claim points at something real, not that the something is correct. It protects what the model declares; your hand-written logic is still yours.
 
-Underneath those two verbs, the model is a cross-language metadata standard for declaring typed entity models. From a single metadata definition, MetaObjects drives six capabilities. The first four **ship in all five ports** (TypeScript, Java, Kotlin, C#, Python), though not uniformly deep (field ranking: drift > codegen > prompts > runtime metadata); the fifth loads in every port, runs its `meta verify` checks in the Node `meta` CLI and scaffolds tests in TypeScript only; the sixth ships two libraries at their own stability labels:
+Underneath those two verbs, the model is a cross-language metadata standard for declaring typed entity models. From a single metadata definition, MetaObjects drives six capabilities. The first four **ship in all five ports** (TypeScript, Java, Kotlin, C#, Python), though not uniformly deep (field ranking: drift > codegen > prompts > runtime metadata); the fifth ships its vocabulary, `verify` checks and a `requirement-tests` generator in every port, with its authoring lint in TypeScript only; the sixth ships two libraries at their own stability labels:
 
 1. **Code generation** -- idiomatic per-language code generated from the same metadata model.
 2. **Runtime metadata access** -- load the metadata at runtime to drive dynamic behavior: CRUD operations, validation, relationships, dynamic admin UIs. (Typed tool payloads are declared today; MCP exposure of tools is on the roadmap.)
 3. **Drift detection** -- catch divergence between code and metadata before it ships, surfacing drift as build-time breakage.
 4. **Prompt construction** -- treat LLM prompts as governed metadata: a typed payload (a projection), external provider-resolved prompt text, byte-identical cross-language render, and build-time prompt-to-payload drift detection.
-5. **Requirements and testing** -- declare what the software is supposed to *do* as a node in the same model, so `implementedBy` is resolved rather than trusted, `meta verify` reports the ledger on every run, and `requirementTests()` scaffolds a test stub per claim (TypeScript only).
+5. **Requirements and testing** -- declare what the software is supposed to *do* as a node in the same model, so `implementedBy` is resolved rather than trusted, `verify` reports the ledger on every run in every port, and each port's `requirement-tests` generator scaffolds a test per claim.
 6. **Libraries** -- reusable declared design opted into by name (`"libraries": ["iam"]`): entities, requirements and implied generators as one drift-gated artifact. Since 1.0.4, in all five ports; `ai` is `stable`, `iam` is `preview`.
 
 The metamodel is the **durable spine**; generated code is the **disposable artifact**. Substrate is local-first: typed metadata lives in your repo, and the generated code is idiomatic per-language output with **no proprietary runtime** — the entity/model tier is dependency-free, and the optional client, prompt-render, and runtime tiers are ordinary Apache-2.0 packages you could vendor or fork. If the `@metaobjectsdev/*` (npm) or `com.metaobjects:*` (Maven) packages disappeared tomorrow, your generated code keeps working in every language.
@@ -47,7 +47,7 @@ This file is the short corpus; the deep, version-matched how-to is the scaffolde
 
 ## The six pillars
 
-The pillars are views on the same metadata, not separate products, and each carries a maturity label rather than a blanket "ships today". The first four ship per language in all five ports, conformance-gated so behavior is byte-identical across ports — though they are not uniformly deep. In field materialization the ranking is drift > codegen > prompts > runtime metadata (the youngest of the four); see the capability matrix in the README for per-port coverage. The fifth, requirements and testing, loads and validates in every port, runs its `meta verify` checks in the Node `meta` CLI and scaffolds tests in TypeScript only, and has been dogfooded on maintainer-owned projects only — the split is stated below because it is easy to overclaim. The sixth, libraries, shipped in 1.0.4: `ai` is `stable` and `iam` is `preview`.
+The pillars are views on the same metadata, not separate products, and each carries a maturity label rather than a blanket "ships today". The first four ship per language in all five ports, conformance-gated so behavior is byte-identical across ports — though they are not uniformly deep. In field materialization the ranking is drift > codegen > prompts > runtime metadata (the youngest of the four); see the capability matrix in the README for per-port coverage. The fifth, requirements and testing, loads, validates, runs its `verify` checks and scaffolds tests in every port, keeps its authoring lint in TypeScript only, and has been dogfooded on maintainer-owned projects only — the split is stated below because it is easy to overclaim. The sixth, libraries, shipped in 1.0.4: `ai` is `stable` and `iam` is `preview`.
 
 ### Codegen
 
@@ -97,13 +97,13 @@ Because the render is conformance-gated, the determinism guarantee holds in ever
 
 The other four pillars keep the code honest about the *model*. This one asks a question none of them can: is the thing you said the software does actually built? A test exercises code that exists; there is no test that fails because a column nobody writes was never wired to anything. The absence has no address — so give it one.
 
-A capability is declared as a node in the same model as the entities, not in a side document and not in a tool where the link to the code is a string. `requirement.functional` (existence — `meta verify` warns when nothing implements it) and `requirement.architectural` (universality — `meta verify` fails a live policy applied to nothing) are registered vocabulary in all five ports, with the loader enforcing the closed `@status` enum so a typo fails the load in every language rather than passing silently in four of them. The `meta verify` checks themselves run in the Node `meta` CLI; the other ports load and validate. Hierarchy is nesting, so regrouping moves a subtree.
+A capability is declared as a node in the same model as the entities, not in a side document and not in a tool where the link to the code is a string. `requirement.functional` (existence — `meta verify` warns when nothing implements it) and `requirement.architectural` (universality — `meta verify` fails a live policy applied to nothing) are registered vocabulary in all five ports, with the loader enforcing the closed `@status` enum so a typo fails the load in every language rather than passing silently in four of them. The same checks run in every port's `verify` — `meta verify`, `metaobjects verify`, `mvn metaobjects:verify`, `dotnet meta verify` — held to one shared corpus. Hierarchy is nesting, so regrouping moves a subtree.
 
 `@implementedBy` is **resolved, not trusted**: it names a real member of the real model, so a claim whose implementation was renamed or deleted fails the build instead of going quietly stale. `meta verify` reports the ledger on **every** run — a gate that says nothing when it passes cannot be told apart from a gate that checked nothing — covering unresolved links, entities no claim covers, and gaps recorded versus gaps nobody has ruled on, plus an authoring lint whose findings are warnings that can never fail a build. `meta docs` renders the ledger for humans and for agents.
 
-**The port split, stated exactly:** the vocabulary is cross-port; the `meta verify` checks run in the Node `meta` CLI (the other ports' CLIs do not run them). A live claim naming nothing is a warning, and a green run proves referential integrity, never that a status is true or an implementation correct. **`requirementTests()` — which scaffolds a test stub per claim, carrying the statement and counterexample in, kept from rotting by `verify --codegen` — is TypeScript-only.** There is no five-language test generation.
+**The port split, stated exactly:** the vocabulary is cross-port, and so is the gate: every port's `verify` runs the same requirement checks. The seven authoring-lint advisories are printed by the Node `meta` CLI only. A live claim naming nothing is a warning (an error under `--require-implementers`), and a green run proves referential integrity, never that a status is true or an implementation correct. **Every port ships a `requirement-tests` generator** — a test per claim, carrying the statement and counterexample in, kept from rotting by the port's codegen drift gate. It is a reference helper each port can eject, not a contract: TypeScript emits a stub you fill in, and Python (pytest), Java and Kotlin (JUnit Jupiter) and C# (xUnit) emit a machine-owned test that calls a witness you own.
 
-What MetaObjects does not do is write the assertion. A generated stub is a place to put a proof and a guarantee that it stays in step with the claim; it is not a proof. Entirely opt-in — a project that declares no `requirement.*` nodes sees no change at all.
+What MetaObjects does not do is write the assertion. A generated test is a place to put a proof and a guarantee that it stays in step with the claim; it is not a proof. Entirely opt-in — a project that declares no `requirement.*` nodes sees no change at all.
 
 ### Libraries
 
@@ -121,7 +121,7 @@ Today the TypeScript toolchain publishes and TypeScript and Python projects cons
 
 | Language | Status | Notes |
 |---|---|---|
-| TypeScript | Reference implementation, npm `1.0.13` | All six pillars, and the only port that runs the requirements `meta verify` checks and publishes shared models. 2500+ tests passing. Owns the canonical schema-migration toolchain used by every port (ADR-0015). Bun-first dev. |
+| TypeScript | Reference implementation, npm `1.0.13` | All six pillars, and the only port that prints the requirements authoring lint and publishes shared models. 2500+ tests passing. Owns the canonical schema-migration toolchain used by every port (ADR-0015). Bun-first dev. |
 | Java | Maven Central `8.0.13` | Spring REST + DTO + repository-interface codegen, OMDB runtime persistence (pure data-access) with Spring-tx. Fully green across all conformance corpora. |
 | Kotlin | Maven Central `8.0.13` | KotlinPoet codegen + Exposed runtime + `metadata-ktx` facade. Ships via the Java reactor. |
 | C# | NuGet `1.0.13` (.NET tool) | Loader + canonical serializer + EF Core + ASP.NET codegen + render/verify. `dotnet meta` tool. |
@@ -322,7 +322,7 @@ $ meta migrate --dialect sqlite --slug add-subscriber --db file:./dev.db --apply
 $ meta export --out ./snapshot.json
 ```
 
-Capability requirements (`requirement.functional` / `requirement.architectural`) are registered vocabulary in all five ports: what the system is supposed to do, declared in `metaobjects/` beside the entities it describes and loaded by the same loader -- no side file, no bespoke parser. `functional` is checked for existence (a warning when nothing implements it); `architectural` for universality (an error when a live policy is applied to nothing — compliance of each claimed node is not checked). Hierarchy is nesting, `@status` is a loader-enforced closed enum (`planned | live | partial | retired`), and a dangling `@implementedBy` is an ERROR on `live`/`partial` but CORRECT on `planned` -- an intention has nothing to point at yet. A requirement states what SHOULD be true and is never a journal of what happened, and `retired` satisfies that rule by stating a prohibition in force rather than narrating history: a capability that was BUILT AND THEN DELIBERATELY REMOVED keeps its entry, its `@statement` written as the rule that it must not return. Do NOT delete it -- that entry is the feature's whole reason to exist: given a brief for a capability that had been retired, agents working from the model alone proposed rebuilding it 24 times out of 24, each believing they were reusing rather than reviving. On `retired`, `@implementedBy` is REFUSED at load (`ERR_REQUIREMENT_RETIRED_HAS_IMPLEMENTORS`) and `@supersededBy` names the requirement that replaced it -- it is RESOLVED like any other reference, so it must be a full dotted path and is legal on `retired` only (`ERR_REQUIREMENT_SUPERSEDED_BY_NOT_RETIRED` otherwise). `@verifiedBy` and the `abandoned`/`superseded` statuses were RETIRED in `0.24.0` and now fail the load (`ERR_UNKNOWN_ATTR` / `ERR_BAD_ATTR_VALUE`); `meta upgrade` rewrites what it can and refuses what needs a decision. Object coverage is a WARNING, never a failure. Entirely opt-in -- a model with no `requirement.*` nodes produces no diagnostics, and no codegen, migrate or runtime path reads the type. The `meta verify` gate is the Node CLI; the other ports load and validate. See docs/features/requirements.md.
+Capability requirements (`requirement.functional` / `requirement.architectural`) are registered vocabulary in all five ports: what the system is supposed to do, declared in `metaobjects/` beside the entities it describes and loaded by the same loader -- no side file, no bespoke parser. `functional` is checked for existence (a warning when nothing implements it); `architectural` for universality (an error when a live policy is applied to nothing — compliance of each claimed node is not checked). Hierarchy is nesting, `@status` is a loader-enforced closed enum (`planned | live | partial | retired`), and a dangling `@implementedBy` is an ERROR on `live`/`partial` but CORRECT on `planned` -- an intention has nothing to point at yet. A requirement states what SHOULD be true and is never a journal of what happened, and `retired` satisfies that rule by stating a prohibition in force rather than narrating history: a capability that was BUILT AND THEN DELIBERATELY REMOVED keeps its entry, its `@statement` written as the rule that it must not return. Do NOT delete it -- that entry is the feature's whole reason to exist: given a brief for a capability that had been retired, agents working from the model alone proposed rebuilding it 24 times out of 24, each believing they were reusing rather than reviving. On `retired`, `@implementedBy` is REFUSED at load (`ERR_REQUIREMENT_RETIRED_HAS_IMPLEMENTORS`) and `@supersededBy` names the requirement that replaced it -- it is RESOLVED like any other reference, so it must be a full dotted path and is legal on `retired` only (`ERR_REQUIREMENT_SUPERSEDED_BY_NOT_RETIRED` otherwise). `@verifiedBy` and the `abandoned`/`superseded` statuses were RETIRED in `0.24.0` and now fail the load (`ERR_UNKNOWN_ATTR` / `ERR_BAD_ATTR_VALUE`); `meta upgrade` rewrites what it can and refuses what needs a decision. Object coverage is a WARNING, never a failure. Entirely opt-in -- a model with no `requirement.*` nodes produces no diagnostics, and no codegen, migrate or runtime path reads the type. Every port's `verify` runs the gate; the authoring lint is the Node CLI only. See docs/features/requirements.md.
 
 Non-TS ports run codegen + codegen-verify in their own build tool: `mvn metaobjects:generate` / `mvn metaobjects:verify` (Java/Kotlin), `dotnet meta gen` / `dotnet meta verify` (C#), `metaobjects gen` / `metaobjects verify` (Python). Schema migration is always the Node `meta` CLI.
 
diff --git a/docs/llms/llms.txt b/docs/llms/llms.txt
index 75c69d0da..e444d5432 100644
--- a/docs/llms/llms.txt
+++ b/docs/llms/llms.txt
@@ -45,14 +45,14 @@ This `llms.txt` is the short index; the deep, version-matched how-to is the scaf
 MetaObjects pillars are capabilities of the same metadata spine, not separate products. Each carries a maturity label — what ships, in which ports, at what stability:
 
 - **Codegen, Runtime metadata, Drift detection, Prompt construction** — shipped in all five ports (TS / Java / Kotlin / C# / Python), gated by the cross-port conformance corpora, though not uniformly deep: see the [capability matrix](https://github.com/metaobjectsdev/metaobjects#capability-matrix) for per-port coverage, and note the field ranking is drift > codegen > prompts > runtime metadata (the youngest of the four).
-- **Requirements and testing** — vocabulary loads and validates in all five ports; the `meta verify` checks run in the Node `meta` CLI; `requirementTests()` scaffolding is TypeScript-only; dogfooded on maintainer-owned projects, no outside adopter yet.
+- **Requirements and testing** — vocabulary, the `verify` checks and a `requirement-tests` generator in all five ports; the authoring lint is TypeScript-only; dogfooded on maintainer-owned projects, no outside adopter yet.
 - **Libraries** — since 1.0.4, in all five ports: `ai` is `stable`, `iam` is `preview` (the same labels `meta gen --list` prints).
 
 - **Codegen** — reference generators you own (ejectable in every port) that emit per-language code from a single metadata model. Drizzle + Zod + Fastify (TypeScript), Spring REST + DTO + repository interfaces (the persistence impl is consumer-supplied) (Java via `codegen-spring`), KotlinPoet + Exposed + Spring (Kotlin via `codegen-kotlin`), EF Core + ASP.NET (C#), Pydantic + FastAPI (Python). Hand-edit-preserving regeneration via three-way merge. Includes M:N relationship codegen (FR-018) in all five ports — entity navigation, idiomatic ORM wiring, and REST traversal (`GET /<source-plural>/{id}/<relation>`).
 - **Runtime metadata** — load metadata at runtime and drive behavior dynamically: CRUD, validation, relationships, dynamic admin UIs. (Typed tool payloads are declared today; MCP exposure of tools is on the roadmap.) Kysely (TS), a DB-API 2 driver (pg8000 / psycopg) via ObjectManager (Python), modernized JDBC + Spring-tx via OMDB (Java), Exposed (Kotlin); C# runtime metadata is on the roadmap (its EF Core output is generated code, not a metadata-driven runtime). Runtime queries return native in-process types (ADR-0019); wire canonicalization happens only at the serialization boundary.
 - **Drift detection** — catch divergence between generated code and metadata before it ships. `verify` is one verb with explicit subverbs (ADR-0021): `verify --codegen` (regen-and-diff against committed output), `verify --templates` (prompt `{{field}}` ↔ payload-VO drift), and `verify --db` (live-DB schema drift, Node `meta` only). Surfaces drift as build-time breakage rather than a production incident.
 - **Prompt construction** — treat LLM prompts as governed metadata instead of strings scattered across services. A typed payload declared as a projection (so payload bloat and token cost are a diff, not a mystery), external provider-resolved prompt text, and a logic-less Mustache engine that renders deterministically: snapshot-testable in CI, byte-stable so an exact-prefix prompt-cache hit doesn't break on a stray whitespace, and drift-checked at build time so a renamed field can't silently degrade a prompt. Conformance-gated, so the guarantee holds in every language port. Render + payload-VO codegen + `verify` + `template.output` parser-on-receipt (FR-006) + the output-format prompt fragment & tolerant `extract` parser (FR-010/FR-011) ship in all five ports today.
-- **Requirements and testing** — declare what the software is supposed to *do* in the same model as the entities, so a capability claim is checkable instead of prose. `requirement.functional` / `requirement.architectural` are registered vocabulary in all five ports, with the loader enforcing the closed `@status` enum, and `@implementedBy` is **resolved, not trusted**: it names a real member of the real model, so a claim whose implementation was renamed or deleted fails the build rather than going quietly stale. `meta verify` reports the ledger on every run — unresolved links, entities no claim covers, gaps recorded versus gaps nobody has ruled on — and lints the authoring; `meta docs` renders it for humans and for agents. A live claim naming nothing is a warning; a green run proves the references resolve, never that an implementation is correct. **`requirementTests()`, which scaffolds a test stub per claim carrying the statement and counterexample in, is TypeScript-only**; the vocabulary loads in every port, and the `meta verify` checks run in the Node `meta` CLI. A project that declares no `requirement.*` nodes sees no change at all.
+- **Requirements and testing** — declare what the software is supposed to *do* in the same model as the entities, so a capability claim is checkable instead of prose. `requirement.functional` / `requirement.architectural` are registered vocabulary in all five ports, with the loader enforcing the closed `@status` enum, and `@implementedBy` is **resolved, not trusted**: it names a real member of the real model, so a claim whose implementation was renamed or deleted fails the build rather than going quietly stale. `meta verify` reports the ledger on every run — unresolved links, entities no claim covers, gaps recorded versus gaps nobody has ruled on — and lints the authoring; `meta docs` renders it for humans and for agents. A live claim naming nothing is a warning; a green run proves the references resolve, never that an implementation is correct. **Every port ships a `requirement-tests` generator**, which scaffolds a test per claim carrying the statement and counterexample in (a stub you fill in for TypeScript, a test that calls a witness you own in the other four); the vocabulary and the `verify` checks are in every port too, and only the authoring lint is TypeScript-only. A project that declares no `requirement.*` nodes sees no change at all.
 - **Libraries** — reusable declared design you opt into by name (`"libraries": ["iam"]` in `.metaobjects/config.json`): entities, the requirements they promise and the generators they imply, as one drift-gated artifact. A library is layered and its core layer is inert: it declares no source, so it adds no tables until you also opt into its `/db` layer (`["iam", "iam/db"]`). `meta eject <library>` copies one into your repo to own. `ai` (the LLM-call trace envelope) is `stable`; `iam` (users, nestable groups, roles, grants) is `preview`.
 
 **Sharing a model across your own projects** — today the TypeScript toolchain publishes and TypeScript and Python projects consume, over a `path` dependency (a sibling checkout or submodule); Java, Kotlin and C# arrive in Phase 2. One project publishes part of its model with the `sharedModelFile()` generator; another declares it under `dependencies` in `.metaobjects/config.json`, runs `meta deps sync` to commit a hash-locked snapshot, and builds on it with `extends` and references. When the publisher's model moves, `meta verify --deps` reports it instead of two copies drifting apart.
@@ -84,7 +84,7 @@ MetaObjects deliberately does **not** ship one universal binary. Schema operatio
 - `meta init` — scaffold `metaobjects/`, `.metaobjects/`, and `metaobjects.config.ts`, **plus** the agent context: a slim `.metaobjects/AGENTS.md` + `CLAUDE.md` (auto-wired into the project's root `CLAUDE.md`/`AGENTS.md`) and six `metaobjects-*` Claude Code skills under `.claude/skills/` scoped to the project's stack. `meta init --refresh-docs` updates only the agent docs.
 - `meta gen [<entity>...]` — TS codegen from entities defined under `metaobjects/`. Supports `--dry-run` and `--watch`. Generators (`entityFile()`, `queriesFile()`, `routesFile()`, `formFile()`, `tanstackQuery()`, `tanstackGrid()`, `barrel()`) are reference templates you own, not framework imports: `meta init` wires none, and `meta eject <name>...` copies the ones you choose (`entity`, `queries`, `routes`, `names`, `barrel`, `form`, `hooks`, `grid`, `grid-hook`, `routes-hono`) into `codegen/generators/` in your own repo (ADR-0034 scaffold-and-own) and prints the import and entry to add to `metaobjects.config.ts`. The shipped defaults target Fastify/Drizzle/React/TanStack and are retargeted by editing your copy, not by switching tools. Per-port codegen runs in that port's own build tool: `mvn metaobjects:generate` (Java/Kotlin), `dotnet meta gen` (C#), `metaobjects gen` (Python).
 - `meta verify` — drift check. `verify --codegen` (regen-and-diff vs committed output), `verify --templates` (prompt `{{field}}` ↔ payload-VO drift), `verify --db` (live-DB schema drift, Node `meta` only). Per-port codegen verify: `mvn metaobjects:verify -Dmeta.verify.mode=codegen|templates` (Java/Kotlin), `dotnet meta verify` (C#), `metaobjects verify` (Python).
-- `meta verify` also checks any `requirement.*` nodes the model declares (capability requirements — what the system is supposed to do, as metadata). `@status` is a loader-enforced closed enum: `planned | live | partial | retired`. A dangling `@implementedBy` is an ERROR on `live`/`partial` and CORRECT on `planned` — an intention has nothing to point at yet. A requirement states what SHOULD be true and is never a journal of what happened, and **`retired` satisfies that by stating a prohibition in force**: a capability that was built and then deliberately removed keeps its entry, written as the rule that it must not come back (`@supersededBy` names what replaced it, and is RESOLVED, so it must be a full dotted path; `@implementedBy` is REFUSED on `retired`). Do NOT delete a retired capability's requirement — that entry is the whole point of the feature: given a brief for a capability that had been retired, agents working from the model alone proposed rebuilding it 24 times out of 24. `@verifiedBy` and the `abandoned`/`superseded` statuses were retired in `0.24.0` and now fail the load. Entirely opt-in: no `requirement.*` nodes means no diagnostics. Registered vocabulary in all five ports; the verify gate is the Node `meta` CLI.
+- `meta verify` also checks any `requirement.*` nodes the model declares (capability requirements — what the system is supposed to do, as metadata). `@status` is a loader-enforced closed enum: `planned | live | partial | retired`. A dangling `@implementedBy` is an ERROR on `live`/`partial` and CORRECT on `planned` — an intention has nothing to point at yet. A requirement states what SHOULD be true and is never a journal of what happened, and **`retired` satisfies that by stating a prohibition in force**: a capability that was built and then deliberately removed keeps its entry, written as the rule that it must not come back (`@supersededBy` names what replaced it, and is RESOLVED, so it must be a full dotted path; `@implementedBy` is REFUSED on `retired`). Do NOT delete a retired capability's requirement — that entry is the whole point of the feature: given a brief for a capability that had been retired, agents working from the model alone proposed rebuilding it 24 times out of 24. `@verifiedBy` and the `abandoned`/`superseded` statuses were retired in `0.24.0` and now fail the load. Entirely opt-in: no `requirement.*` nodes means no diagnostics. Registered vocabulary in all five ports, and every port's `verify` runs the same gate (`meta verify`, `metaobjects verify`, `mvn metaobjects:verify`, `dotnet meta verify`); the authoring lint is the Node `meta` CLI only.
 - `meta migrate --dialect <d> --slug <name>` — diff metadata vs the committed schema snapshot and emit migration SQL files under `.metaobjects/migrations`; add `--db <url> --apply` to run them. `--dialect` selects the diff pipeline, not just the SQL flavor — required offline and on `baseline`, auto-detected from the URL scheme when `--db` is given. On a brand-new database the first command is `meta migrate --from-db --db <url> --dialect <d> --slug init --apply` (diff against the empty database, emit `CREATE TABLE`, apply, record the snapshot) — **not** `meta migrate baseline`, which is for adopting a database that already has its schema. `meta migrate apply-pending --db <url> --dialect <d>` replays committed migrations with no diff (fresh DB / CI). Supports SQLite (`file:`, `libsql:`), Postgres (`postgres:`, `postgresql:`), and Cloudflare D1 (TS only). `--dry-run` prints SQL to stdout. **Schema migration is owned by the Node `meta` CLI (ADR-0015) and used by every port regardless of backend language** — a JVM/Python/C# project needs no per-language migrate engine, but DOES need Node (or Bun) available to run it: no pre-built binary is published today. There is no Maven, .NET, or Python migrate command.
 - `meta export [--out <file>]` — flatten loaded metadata to one canonical JSON artifact.
 
diff --git a/docs/ports/csharp.md b/docs/ports/csharp.md
index 5bc987503..787977abc 100644
--- a/docs/ports/csharp.md
+++ b/docs/ports/csharp.md
@@ -393,6 +393,114 @@ the feature reference is at
 NuGet package to add. The generated parser uses the strict (case-sensitive)
 default options.
 
+## Requirement tests
+
+Declare what the software must do as `requirement.*` nodes and `dotnet meta verify` checks
+them on every run; the `requirement-tests` generator then writes one xUnit test per tested
+requirement. The generator is a reference helper and a recommended approach, not a
+contract: `dotnet meta eject requirement-tests` copies it to
+`codegen/generators/RequirementTestsGenerator.cs` for you to change. The checks in `verify`
+are core and are not ejectable.
+
+```bash
+# The gate: runs beside whichever drift gate verify was given
+dotnet meta verify ./metadata --templates ./prompts
+dotnet meta verify ./metadata --templates ./prompts --require-implementers
+
+# The tests: their own run, into a test project that references xunit
+dotnet meta gen ./metadata --out ./tests/Acme.Shop.Tests/Generated \
+  --namespace Acme.Shop --generators requirement-tests
+dotnet meta verify ./metadata --codegen --out ./tests/Acme.Shop.Tests/Generated \
+  --namespace Acme.Shop --generators requirement-tests
+```
+
+A `gen` run has one `--out`, so give this generator a run of its own rather than adding it
+to the run that writes your entities. Pass `--namespace` to `verify --codegen` as well:
+without it the namespace is inferred from the first generated file in `--out`, and in a
+directory that holds only these tests that is the tests' own namespace, which regenerates
+one level too deep and reports drift.
+
+Per metamodel package the generator writes `Requirements_<pkgKey>_Witnesses.g.cs`, an
+interface with one default member per test that is not skipped, and
+`Requirements_<pkgKey>_Tests.g.cs`, one `[Fact]` per requirement (`[Fact(Skip = "…")]` for
+a `planned` or `retired` one). Both are in `<namespace>.Requirements` and are rewritten
+whole on every run. The tests construct one class of yours, `<namespace>.RequirementWitnesses`
+by default, which implements every generated interface. Until that class exists the test
+project does not compile. Implement each member **explicitly**:
+
+```csharp
+using Acme.Shop.Requirements;
+using Xunit;
+
+namespace Acme.Shop;
+
+public class RequirementWitnesses : Requirements_acme_shop_Witnesses
+{
+    void Requirements_acme_shop_Witnesses.req_acme_shop_Orders_Recorded__object_entity()
+    {
+        // fails when a placed order has no row
+    }
+}
+```
+
+A requirement that becomes `live` adds a member whose default fails the test
+(`unimplemented requirement: <id> - write <WitnessClass>.<key>() so that it fails when:
+<counterexample>`), with no compile break. One that is retired or deleted removes its
+member, and an explicit implementation of it then stops compiling (CS0539). A
+`public void req_…()` implements the member implicitly, and a stale one keeps compiling, so
+it goes stale silently. If a test reports `unimplemented requirement` for a witness you
+believe you wrote, the method is not implementing the member: in the implicit form it must
+be `public`, non-static, parameterless and named exactly as the interface names it.
+
+The six options are public properties on the generator. This port has no per-generator
+option channel, so they are reachable only where the generator is constructed, in an owned
+`codegen/Program.cs`. That file exists once you have ejected something (or written it by
+hand); the packaged `dotnet meta gen --generators requirement-tests` runs with the defaults.
+
+```csharp
+// codegen/Program.cs
+using Codegen.Generators;
+using MetaObjects.Codegen;
+using MetaObjects.Core.Requirement;   // RequirementTestGrain, IRequirementTestFilter
+
+IReadOnlyList<IGenerator> generators =
+[
+    new RequirementTestsGenerator
+    {
+        WitnessClass = "Acme.Shop.Tests.Witnesses",
+        Grain = RequirementTestGrain.Member,
+        WarnUncovered = false,
+    },
+];
+
+return CodegenCli.Run(args, generators);
+```
+
+The example is the file as it stands after `dotnet meta eject requirement-tests`: the class
+is your owned copy, in `Codegen.Generators`. If `Program.cs` exists because you ejected
+something else and you are constructing the packaged generator, the class is in
+`MetaObjects.Codegen.Generators`: write it fully qualified, as
+`new MetaObjects.Codegen.Generators.RequirementTestsGenerator { … }`. Do not add
+`using MetaObjects.Codegen.Generators;`, because every generator you ejected has a packaged
+class of the same simple name there, and the second `using` makes each `new <Name>Generator()`
+already in the file ambiguous (CS0104).
+
+| Property | Meaning |
+|---|---|
+| `TestNamespace` | Namespace of the generated tests. Default `<namespace>.Requirements`. |
+| `WitnessClass` | Full name of your witness class. Default `<namespace>.RequirementWitnesses`. |
+| `Grain` | `RequirementTestGrain.Concern` (default): one test per distinct `<type>.<subType>` a requirement claims. `Member`: one per distinct `implementedBy` reference that resolves. |
+| `Filter` | An `IRequirementTestFilter` (`bool Include(RequirementView view)`) that **replaces** the default of functional requirements at L4 and L5. The view carries `SubType`, `Level` (`int?`, null when not declared), `Status`, `Path`, `Package` and `ImplementedByTypes`. |
+| `Renderer` | An `IRequirementTestRenderer` (in `MetaObjects.Codegen`); it returns a `RenderedTest` to replace the text of one test, or `null` to keep the default. |
+| `WarnUncovered` | `true` (default): one warning naming up to five requirements the filter left out. |
+
+The hook types, the identity function and the digest stay in the package when you eject;
+the owned copy uses them from there. A package that loses its last requirement leaves its
+two files behind: `gen` does not remove them, `dotnet meta verify --codegen` reports each as
+`committed but a fresh regen would not emit it`, and you delete them. The model and the
+other ports' spelling are in
+[Generated requirement tests and witnesses](../features/requirements.md#generated-requirement-tests-and-witnesses).
+
 ## Declarative template-codegen (`--template-spec`)
 
 Beyond the built-in EF Core / routes suite, `dotnet meta gen` runs **declarative
@@ -484,6 +592,7 @@ on their list route, against an allowlist of their own fields. Remaining gaps ar
 | Declarative template-codegen | Yes — `dotnet meta gen --template-spec` (scope perEntity/perPackage/perModel + outputPattern; the cross-port JSON contract shared with Python) |
 | Migrations | Owned by the Node `meta` CLI (ADR-0015) — no C# migrate surface |
 | Drift verify | `dotnet meta verify` (template drift, FR-004) |
+| Requirement gate + requirement tests | Yes (`dotnet meta verify`, on every run; `requirement-tests` emits xUnit and is ejectable) |
 | Runtime metadata | Loader API + render engine; ObjectManager-style runtime tier on the roadmap |
 
 ## Conformance status
diff --git a/docs/ports/java.md b/docs/ports/java.md
index 2ab4b67d6..62f848051 100644
--- a/docs/ports/java.md
+++ b/docs/ports/java.md
@@ -280,6 +280,7 @@ name in every port.
 | `filter-allowlist` | `SpringFilterAllowlistGenerator` | `metaobjects-codegen-spring` | One `<Entity>FilterAllowlist.java` per writable entity: the filterable field set plus the operator set permitted per field, gated by field subtype (FR-009 §5, identical across ports). Only `@filterable: true` fields appear. Emitted even when no field is filterable (with empty constants), so the generated controller delegates to it unconditionally. |
 | `value-object` | `SpringValueObjectGenerator` | `metaobjects-codegen-spring` | One Java 21 `record` per concrete `object.value` and per sourceless `object.projection`, in the value object's own package. It carries jakarta bean-validation constraints plus `@Valid` on nested members, so a VO jsonb column POSTs and PATCHes with validation cascading to depth ≥ 2. It is THE Java type for the value object (ADR-0056): `<Entity>Dto` / `<Entity>Patch` bind to it, a render helper takes it, and a response parser returns it. The template tier declares no copy, so it needs this generator in the same run. |
 | `names` | `SpringNamesGenerator` | `metaobjects-codegen-spring` | One `<Entity>Names.java` per object with a declared/inherited primary `source.rdb` — `public static final` physical database name constants (table/view name, schema, per-field columns). See "`<Entity>Names`" below. |
+| `requirement-tests` | `JUnitRequirementTestsGenerator` | `metaobjects-codegen-spring` | Per metamodel package that holds a tested requirement, two files in `testPackage`: `Requirements_<pkgKey>_Witnesses.java` (an interface with one default member per non-skipped test, failing with `unimplemented requirement: ...`) and `Requirements_<pkgKey>_Test.java` (one JUnit Jupiter `@Test` per requirement, calling that member on your `witnessClass`; a planned or retired requirement is `@Disabled`). Args: `testPackage` and `witnessClass` (required), `grain` (`concern` or `member`), `filter` and `renderer` (class names on your project classpath), `warnUncovered`. Your test classpath needs `org.junit.jupiter:junit-jupiter-api`. A model with no requirement writes nothing. See "Requirement tests" below. |
 | `entity` | `JavaObjectCodeGenerator` | `metaobjects-codegen-base` | Flavor-selected via the `flavor` generator arg (`com.metaobjects.generator.direct.object.javacode`). `flavor=pojoAware` emits `class <Name> extends PojoObject` — a concrete `MetaObjectAware` class whose inherited `getMetaData()` back-reference breaks a default Jackson/Gson mapper (see [Serializing generated objects](#serializing-generated-objects) below). `flavor=valueObject` emits a map-backed `class <Name> extends ValueObject` instead. Either flavor also emits a `<Name>Extractor` and a self-registering `ObjectClassBindingProvider`. For a plain default-Jackson-friendly type, use the `codegen-spring` record surface instead — never `pojoAware`. |
 | `output-parser` | `SpringOutputParserGenerator` | `metaobjects-codegen-spring` | One `<Template>Parser` per **responding** `template.prompt` (ADR-0052: one carrying `@responseRef`) — a Jackson-backed throw-only parser returning the `@responseRef` value object's own record (ADR-0056). FR-006 / ADR-0010; the Java sibling of TS's `outputParser()`. See [FR-006 — response parsing](#fr-006--response-parsing) below. |
 | `output-prompt` | `SpringOutputPromptGenerator` | `metaobjects-codegen-spring` | One `<Template>ResponseFormat` per responding `template.prompt` — a static `renderFormat()` / `renderFormat(PromptOverrides)` pair emitting the output-format prompt fragment (FR-010). The reply's syntax comes from `@responseFormat`, never `@format` (which is the syntax of the rendered prompt BODY). |
@@ -440,6 +441,77 @@ call — a project pairing that call with this generator must pass the same
 strategy string to both, by hand (see
 [`features/field-types.md`](../features/field-types.md)).
 
+### Requirement tests — `JUnitRequirementTestsGenerator`
+
+Declare what the software must do as `requirement.*` nodes and `mvn metaobjects:verify`
+checks them on every run, in either mode: it logs the ledger summary, and an error (a
+dangling reference on a live requirement, a link above the floor, a live policy applied to
+nothing) fails the build. `-Dmeta.verify.requireImplementers=true` (or
+`META_REQUIRE_IMPLEMENTERS=1`) also fails it on a live functional requirement that nothing
+implements. Those checks are core and are not ejectable.
+
+This generator is the other half, and it is a reference helper and a recommended approach,
+not a contract: it writes one JUnit Jupiter test per tested requirement. The test does not
+assert anything itself: it calls a **witness**, a method you write, and a live requirement
+with no witness fails. Generated tests are JUnit Jupiter only; a JUnit 4 project replaces
+the text through the `renderer` arg, or ejects the generator.
+
+```xml
+<generator>
+  <classname>com.metaobjects.generator.spring.JUnitRequirementTestsGenerator</classname>
+  <args>
+    <outputDir>${project.build.directory}/generated-test-sources/requirements</outputDir>
+    <testPackage>com.acme.requirements</testPackage>
+    <witnessClass>com.acme.requirements.Witnesses</witnessClass>
+  </args>
+</generator>
+```
+
+Per metamodel package it writes `Requirements_<pkgKey>_Witnesses.java` (an interface whose
+default members fail with `unimplemented requirement: <id> - write <witnessClass>.<key>() so
+that it fails when: <counterexample>`) and `Requirements_<pkgKey>_Test.java`. You write the
+class `witnessClass` names, implementing every generated witness interface and overriding the
+members you have witnesses for, with a public no-argument constructor:
+
+```java
+public class Witnesses implements Requirements_acme_shop_Witnesses {
+    @Override public void req_acme_shop_Orders_Recorded__object_entity() { /* fails when a placed order has no row */ }
+}
+```
+
+A requirement that becomes live adds a failing member (a red test, no compile break). One that
+is retired or deleted removes its member, and a witness annotated `@Override` then stops
+compiling. That signal depends on the annotation: without `@Override` a stale witness is an
+ordinary method, compiles, and goes stale silently, so annotate every witness. A planned or
+retired requirement is `@Disabled` and has no member. The generated files are rewritten whole,
+so do not edit them; `mvn metaobjects:verify` reports them stale when a claim changes, and a
+package that loses its last requirement leaves its two files behind, which `verify` reports as
+`[stale-in-repo]` (delete them: `gen` never removes a file).
+
+| Arg | Meaning |
+|---|---|
+| `testPackage`, `witnessClass` | Required once the model holds a requirement. The generated tests are in `testPackage`; `witnessClass` is a fully-qualified class name. |
+| `grain` | `concern` (default): one test per distinct `<type>.<subType>` a requirement claims. `member`: one per distinct `implementedBy` reference that resolves. Anything else is refused. |
+| `filter` | The name of a class implementing `com.metaobjects.requirement.RequirementTestFilter` (`boolean include(RequirementTestIdentities.View view)`) that **replaces** the default of functional requirements at level 4 and above. The view is a record: `subType()`, `level()` (an `Integer`, `null` when the requirement declares none), `status()`, `path()`, `pkg()` (the effective package) and `implementedByTypes()`. |
+| `renderer` | The name of a class implementing `com.metaobjects.generator.requirement.RequirementTestRenderer`; it may return a `RenderedTest` to replace the text of one test, or `null` to keep the default. |
+| `warnUncovered` | `true` (default): one warning naming up to five requirements the filter excluded. `false` silences it. |
+
+`filter` and `renderer` are loaded from your project's classpath, so the class must be
+compiled before the goal runs (a module the build already compiled). A class that is found
+but fails to load is reported with its real cause, not as missing. Your test classpath needs
+`org.junit.jupiter:junit-jupiter-api`. Which tests exist, their names and their digests are
+shared by every language port and checked by one corpus.
+
+To own the generator, `mvn metaobjects:eject -Dnames=requirement-tests -Dport=java` copies
+`JUnitRequirementTestsGenerator.java`, with its default rendering, into a `codegen/` Maven
+module under your package and prints the `<classname>` to wire. `-Dport` is needed because
+`requirement-tests` is ejectable on both JVM ports: the goal infers the port only when your
+project declares a dependency on exactly one of `metaobjects-codegen-spring` and
+`metaobjects-codegen-kotlin`, and otherwise refuses with `ejectable on more than one port`.
+The identity function, the digest and the hook types stay in the package, and the owned
+copy imports them. The model and the other ports' spelling are in
+[Generated requirement tests and witnesses](../features/requirements.md#generated-requirement-tests-and-witnesses).
+
 ### Authoring your own — two paths
 
 **Own a generator.** `mvn metaobjects:eject -Dnames=<name,...>` copies a reference generator into a `codegen/` Maven module under your own package, and prints the module, dependency and `<classname>` to wire. See [Own your codegen → Java and Kotlin](../features/own-your-codegen.md#java-and-kotlin-mvn-metaobjectseject).
@@ -605,6 +677,7 @@ configuration model that has not yet been specced.
 | Output parser codegen (FR-006) | Yes — `SpringOutputParserGenerator` (in `metaobjects-codegen-spring`) — see usage below |
 | Migrations | TS-only (`@metaobjectsdev/cli migrate`) — the Java migration engine and the OMDB runtime auto-create path were both removed (ADR-0015); apply the TS-produced DDL to the database |
 | Drift verify | `Verify.check` / `Verify.checkOutputPrompt` (prompts). Live-DB schema-drift verification is part of the TS migration toolchain |
+| Requirement gate + requirement tests | Yes (`mvn metaobjects:verify`, on every run; `JUnitRequirementTestsGenerator` emits JUnit Jupiter and is ejectable) |
 | Runtime metadata | Full — OMDB ObjectManager |
 | REST controller codegen | Spring Web MVC — `metaobjects-codegen-spring` (FR-008 §2.1) |
 
diff --git a/docs/ports/kotlin.md b/docs/ports/kotlin.md
index 27df91fd1..0a715276c 100644
--- a/docs/ports/kotlin.md
+++ b/docs/ports/kotlin.md
@@ -106,6 +106,7 @@ The 15 generators registered in `codegen-kotlin` (`GeneratorRegistry.kt`):
 | `KotlinSpringConfigGenerator` | `MetadataExposedConfig.kt` — `@Configuration` wiring `Database.connect()` + auto-validator | once per project |
 | `KotlinStoredProcGenerator` | Stored-procedure call wrappers | entities with `source.rdb @kind="storedProc"` |
 | `KotlinSpringControllerGenerator` | `<Entity>Controller.kt` — Spring `@RestController` (5 CRUD endpoints; cross-port API contract). **Select `KotlinRelationsGenerator` with it** when the model has a M:N relationship: the traversal routes call the `<rel>Query` helpers only that generator emits, and without it the controller does not compile | entities with `source.rdb @kind="table"` |
+| `KotlinRequirementTestsGenerator` | Per metamodel package that holds a tested requirement, two files in `testPackage`: `Requirements_<pkgKey>_Witnesses.kt` (an interface whose default members fail with `unimplemented requirement: ...`) and `Requirements_<pkgKey>_Test.kt` (one JUnit Jupiter `@Test` per requirement, calling a project-owned witness). See "Requirement tests" below | every tested `requirement.*` (functional, level 4 or above by default) |
 
 Maven wiring:
 
@@ -151,6 +152,29 @@ Maven wiring:
 </plugin>
 ```
 
+**Requirement tests.** `mvn metaobjects:verify` checks the model's `requirement.*` nodes on every run (the Java goal; Kotlin has no CLI of its own), and `-Dmeta.verify.requireImplementers=true` or `META_REQUIRE_IMPLEMENTERS=1` also fails the build on a live functional requirement that nothing implements. Those checks are core and are not ejectable. `KotlinRequirementTestsGenerator` is the other half: a reference helper and a recommended approach, not a contract. It is the Kotlin sibling of the Java `JUnitRequirementTestsGenerator` (the same args, the same test identities, one conformance corpus for both). It writes one JUnit Jupiter test per tested requirement; the test calls a **witness**, a function you write, and a live requirement with no witness fails. A JUnit 4 project replaces the text through the `renderer` arg, or ejects the generator.
+
+```xml
+<generator>
+  <classname>com.metaobjects.generator.kotlin.KotlinRequirementTestsGenerator</classname>
+  <args>
+    <outputDir>${project.build.directory}/generated-test-sources/requirements</outputDir>
+    <testPackage>com.acme.requirements</testPackage>
+    <witnessClass>com.acme.requirements.Witnesses</witnessClass>
+  </args>
+</generator>
+```
+
+You write the class `witnessClass` names, with a public no-argument constructor, implementing every generated `Requirements_<pkgKey>_Witnesses` interface and overriding the members you have witnesses for:
+
+```kotlin
+class Witnesses : Requirements_acme_shop_Witnesses {
+    override fun req_acme_shop_Orders_Recorded__object_entity() { /* fails when a placed order has no row */ }
+}
+```
+
+A requirement that becomes live adds a failing member (a red test, no compile break); one that is retired or deleted removes its member, so a stale override stops compiling (always, in Kotlin: `override` is mandatory). A planned or retired requirement is `@Disabled` and has no member. Write the witness class in Kotlin. The interface's members have default bodies, and a witness class written in **Java** against it is untested: unless your Kotlin compiler is set to emit JVM default methods for interface members (a compiler setting of your build, which this generator does not control), Java sees every member as abstract and has to implement all of them, which turns each new live requirement into a compile break instead of a red test. The args are `grain` (`concern`, the default, or `member`), `filter` and `renderer` (class names on your project's classpath implementing `RequirementTestFilter` and `RequirementTestRenderer`; a renderer's `source` is Kotlin and its `imports` are Kotlin import names) and `warnUncovered` (`true` by default). The generated files are rewritten whole and import only `org.junit.jupiter.api`, so the test classpath needs `org.junit.jupiter:junit-jupiter-api`. A package that loses its last requirement leaves its two files behind (`gen` never removes a file), and `mvn metaobjects:verify` reports them stale. `mvn metaobjects:eject -Dnames=requirement-tests -Dport=kotlin` copies `KotlinRequirementTestsGenerator.kt`, with its default rendering, into a `codegen/` module under your package; `-Dport` is needed because the name is ejectable on both JVM ports, and the goal infers it only when your project declares a dependency on exactly one of `metaobjects-codegen-kotlin` and `metaobjects-codegen-spring`. The identity function, the digest and the hook types stay in the package. The Java page, [Requirement tests](java.md#requirement-tests--junitrequirementtestsgenerator), has the full arg table.
+
 **Own a generator.** `mvn metaobjects:eject -Dnames=<name,...>` copies a reference generator into a `codegen/` Maven module under your own package, and prints the module, dependency and `<classname>` to wire. See [Own your codegen → Java and Kotlin](../features/own-your-codegen.md#java-and-kotlin-mvn-metaobjectseject).
 
 **Nothing else to hand over.** Unlike the Java `routes`/`dto`/`repository` output, no Kotlin generator's output imports helper runtime. The generated controller declares its filter parser, constraint mapping and patch handling inline, per file, and the rest imports only core: render and extract, the loader, and `metadata-ktx`. So an ejected Kotlin generator's output depends on nothing you do not own beyond the core. `EjectRuntimeRoundTripTest` in the Maven plugin checks this against every Kotlin generator's real output. `com.metaobjects.generator.kotlin.runtime.M2mJoinResolver` is a helper you may call from hand-written traversal code. No generated file imports it, so eject does not copy it; copy it yourself if you use it and want to own it.
@@ -658,6 +682,7 @@ the contract is universal.
 | Payload-VO codegen | Yes — the payload IS the value object's own data class, from `KotlinEntityGenerator` (ADR-0056); no separate payload generator |
 | Migrations | Via the TS toolchain (`@metaobjectsdev/cli migrate`) |
 | Drift verify | Template-drift: `Renderer.verify` (build-time); generated-table drift: `MetadataStartupValidator` (startup) |
+| Requirement gate + requirement tests | Yes (`mvn metaobjects:verify`, the Java goal; `KotlinRequirementTestsGenerator` emits JUnit Jupiter and is ejectable) |
 | Runtime metadata | Via Java OMDB (or hand-written Exposed transactions) |
 
 ## Test count
diff --git a/docs/ports/python.md b/docs/ports/python.md
index 9764d2a65..d81effc19 100644
--- a/docs/ports/python.md
+++ b/docs/ports/python.md
@@ -34,6 +34,28 @@ dependencies = [
 > `uv run --extra dev pytest` from `server/python/` (the in-repo dev workflow is
 > `uv`-based, with `pytest` / `mypy` / `ruff` as the `dev` extra).
 
+## Selecting the interpreter
+
+`metaobjects` needs Python 3.11 or later to **run**. That floor is not being lowered. What
+it generates has a lower one: the requirement tests it writes need only pytest and parse
+under the Python 3.9 grammar, so they run on your project's own interpreter.
+
+A project on an older interpreter therefore runs the tool with a different one, without
+changing its own:
+
+```bash
+uv tool run --python 3.12 metaobjects gen
+uv tool run --python 3.12 metaobjects verify
+
+# or, with pipx (the interpreter is named by its executable)
+pipx run --python python3.12 metaobjects gen
+pipx run --python python3.12 metaobjects verify
+```
+
+Each fetches `metaobjects` into an environment of its own on the interpreter you name and
+runs the console-script there. Your project's virtualenv, and the interpreter your tests
+run on, are untouched.
+
 ## Configure
 
 Drop metadata under `metaobjects/`:
@@ -362,6 +384,75 @@ than the one a row actually lands in. `metaobjects verify` also takes
 regen resolves the same column strings `gen` did instead of reporting
 spurious drift against a differently-configured run.
 
+### Requirement tests
+
+Declare what the software must do as `requirement.*` nodes and `metaobjects verify` checks
+them on every run: it prints the ledger summary, and an error (a dangling reference on a
+live requirement, a link above the floor, a live policy applied to nothing) exits non-zero.
+`--require-implementers` (or `META_REQUIRE_IMPLEMENTERS=1`) also fails the run on a live
+functional requirement that nothing implements. Those checks are core and are not
+ejectable. A model with no requirement sees no change. Metadata that does not load is not
+that: `verify` prints the load errors and exits non-zero, also when no generators are
+selected and so no drift gate loaded it.
+
+The `requirement-tests` generator is the other half. It is a reference helper and a
+recommended approach, not a contract: `metaobjects eject requirement-tests` copies it, with
+its default renderer, to `codegen/generators/requirement_tests.py`, wired as
+`codegen.generators.requirement_tests:requirement_tests_generator`.
+
+```yaml
+# metaobjects.config.yaml
+targets:
+  tests:
+    outDir: tests/generated
+    generators: [requirement-tests]
+requirementTests:                               # every key optional
+  witnessModule: tests.requirement_witnesses    # the default
+  grain: concern                                # or: member
+  filter: codegen.requirement_hooks:include     # module:symbol, relative to this file's directory
+  renderer: codegen.requirement_hooks:render    # module:symbol
+  warnUncovered: true                           # the default
+```
+
+It writes `requirements/test_<pkgKey>_requirements.py` under the target's `outDir`, one
+file per metamodel package, rewritten whole on every run. Each test looks up a **witness**:
+a function named by the test's witness key, in the witness module. A `live` or `partial`
+requirement with no witness fails, naming the function to write; a `planned` or `retired`
+one is skipped and never looks one up.
+
+```python
+# tests/requirement_witnesses.py
+def req_acme_shop_Orders_Recorded__object_entity():
+    order = place_order()
+    assert find_order_row(order.id) is not None
+```
+
+A missing witness module is "no witness". A witness module that exists and fails to import
+raises its own error. There is no compile step, so a witness whose requirement is retired
+or deleted is simply never called again: nothing reports it, and you delete it by hand.
+
+| Key | Meaning |
+|---|---|
+| `witnessModule` | The dotted module the witnesses live in. |
+| `grain` | `concern` (default): one test per distinct `<type>.<subType>` a requirement claims. `member`: one per distinct `implementedBy` reference that resolves. Anything else is a config error. |
+| `filter` | A function taking the requirement view and returning a bool. It **replaces** the default of functional requirements at L4 and L5. The view has `sub_type`, `level` (`None` when the requirement declares none), `status`, `path`, `package` and `implemented_by_types`. |
+| `renderer` | A function taking a `RequirementTestArgs` and returning a `RenderedTest(imports, source)` to replace the text of one test, or `None` to keep the default. Import both types from `metaobjects.codegen.requirement_hooks`, never from an ejected copy of the generator. |
+| `warnUncovered` | `true` (default): one warning naming up to five requirements the filter left out. |
+
+The block is read in config mode. The flag-only form
+(`metaobjects gen ./metaobjects --out ./tests/generated --generators requirement-tests`)
+runs the generator with its defaults. A `filter` or `renderer` whose module raises on
+import is reported with the real cause. Both hooks, like a `providers` entry, are found
+relative to the config file's directory, with no `PYTHONPATH=`. They differ in how they are
+imported: a provider is imported with plain `importlib`, and a hook goes through the resolver
+an owned generator is imported with, which loads the project's own copy of a module when
+another copy is already cached and refuses a project package or module whose top-level name
+is a standard-library module name (`types`, `json`): rename it. `metaobjects verify` goes
+out of sync when a claim changes, because each test carries a digest of its requirement. A
+package that loses its last requirement leaves its file behind: `gen` does not remove it,
+`verify` lists it as `extra:`, and you delete it. The model and the other ports' spelling are in
+[Generated requirement tests and witnesses](../features/requirements.md#generated-requirement-tests-and-witnesses).
+
 ### Declarative template-codegen (`--template-spec`)
 
 Beyond the built-in Pydantic/FastAPI suite, the `metaobjects gen` console-script
@@ -561,7 +652,9 @@ each as `<Name>.py`. So the prompt+parse story is two generators:
 
 **Own a generator.** Every generator is a reference helper you can copy and change:
 `metaobjects eject <name>` copies it into `codegen/generators/`, and you wire the copy as
-`module:symbol` in place of its name. See
+`module:symbol` in place of its name. A project package or module whose top-level name is a
+standard-library module name (`types`, `json`) is refused there with an error naming it:
+rename it. See
 [Own your codegen → Python](../features/own-your-codegen.md#python-metaobjects-eject).
 
 Ejecting `routes` also hands over the helper runtime the generated routers call:
@@ -703,6 +796,7 @@ import lines are stable.
 | Declarative template-codegen | Yes — `metaobjects gen --template-spec` (scope perEntity/perPackage/perModel + outputPattern; the cross-port JSON contract shared with C#) |
 | Migrations | TS-only by design (ADR-0015) — no Python `migrate` command; consume the canonical `schema.postgres.sql` |
 | Drift verify | Yes — template / payload drift (`metaobjects.render.verify`) |
+| Requirement gate + requirement tests | Yes (`metaobjects verify`, on every run; `requirement-tests` emits pytest and is ejectable) |
 | Runtime metadata | Yes (`metaobjects.runtime.ObjectManager` — DB-API 2 driver, pg8000/psycopg) + loader API + render engine |
 
 ## Conformance status (as of 2026-05-27)
diff --git a/docs/ports/typescript.md b/docs/ports/typescript.md
index d6ba4a4e7..6e6bdad56 100644
--- a/docs/ports/typescript.md
+++ b/docs/ports/typescript.md
@@ -698,6 +698,49 @@ the feature reference is at
 your `dependencies` (Drizzle / `@metaobjectsdev/runtime-ts` both lean on it);
 if not, `npm i zod`.
 
+## Requirement tests
+
+`requirementTests()` writes one test stub per requirement the model claims: a `live` or
+`partial` requirement gets a stub that fails until you write its assertion, a `planned` or
+`retired` one a skipped stub. It is a reference helper and a recommended approach, not a
+contract. Run it from the package, or own it: `meta eject requirement-tests` copies the
+generator and its default stub renderer into `codegen/generators/requirement-tests.ts`. The
+requirement checks in `meta verify` are core and are not ejectable.
+
+```ts
+// metaobjects.config.ts
+import { defineConfig } from "@metaobjectsdev/cli";
+import { requirementTests } from "@metaobjectsdev/codegen-ts/generators";
+
+export default defineConfig({
+  outDir: "src/generated",
+  generators: [
+    requirementTests({
+      grain: "member",                                                    // default: "concern"
+      filter: (r) => r.subType === "functional" && r.status === "live",   // REPLACES the default
+      warnUncovered: false,                                               // default: true
+    }),
+  ],
+});
+```
+
+| Option | Meaning |
+|---|---|
+| `grain` | `"concern"` (default): one stub per distinct `<type>.<subType>` a requirement claims, at `requirements/<path>.<concern>.test.ts`. `"member"`: one per distinct `@implementedBy` reference that resolves. Anything else is refused when the generator is built. |
+| `filter` | A predicate over the requirement view (`subType`, `level`, `status`, `path`, `package`, `implementedByTypes`) that replaces the default of functional requirements at L4 and L5. `level` is `undefined` on a requirement that declares none. |
+| `warnUncovered` | One warning naming up to five requirements the filter left out. `false` silences it. |
+| `renderers`, `resolveRenderer` | Replace the stub text per concern. A renderer receives the stub's identity too: `package`, `unit`, `id`, `witnessKey`, `skip` and `digest`, the same record every other port generates from. |
+| `path`, `owns` | Where stubs land, and which paths the generator may clean up. |
+
+The stub is yours to fill in, and the three-way merge keeps what you wrote. A stub whose
+requirement is gone is removed on the next run (refused by name when it carries a hand
+edit). The other four ports do not merge: their generated tests call a *witness* you own.
+See [Generated requirement tests and witnesses](../features/requirements.md#generated-requirement-tests-and-witnesses).
+
+`meta verify --require-implementers` (or `META_REQUIRE_IMPLEMENTERS=1`) raises
+`WARN_REQUIREMENT_NOTHING_IMPLEMENTS` to an error. See
+[Requiring implementers](../features/requirements.md#requiring-implementers).
+
 ## Capability snapshot
 
 | Feature | Status |
@@ -708,6 +751,7 @@ if not, `npm i zod`.
 | `field.currency` / `field.enum` / `field.object` + `@storage` | Yes |
 | Templates + render (FR-004) | Yes |
 | Output parser codegen (FR-006) | Yes (`outputParser()` — Zod dual API) |
+| Requirement gate + requirement tests | Yes (`meta verify`; `requirementTests()`, ejectable) |
 | Payload-VO codegen | Yes (via projection codegen) |
 | Migrations | `meta migrate` (Postgres / SQLite / D1) |
 | Drift verify | `meta verify` (DB drift) |
diff --git a/docs/superpowers/plans/2026-10-05-requirements-slice-1-checks-and-test-generators.md b/docs/superpowers/plans/2026-10-05-requirements-slice-1-checks-and-test-generators.md
index 7747de25b..cc347cb9e 100644
--- a/docs/superpowers/plans/2026-10-05-requirements-slice-1-checks-and-test-generators.md
+++ b/docs/superpowers/plans/2026-10-05-requirements-slice-1-checks-and-test-generators.md
@@ -12,6 +12,37 @@
 
 **This is slice 1.** Not in this slice: publishing requirements across repositories, inherited requirements, the Python publisher and `deps` commands, transitive dependencies with the five-level test, and the response-model items.
 
+## Amendments after the owner's answers (2026-10-05)
+
+The plan as merged asked nine questions. The owner answered them, and added one requirement while the work was starting. What changed in this document:
+
+| Change | Where |
+|---|---|
+| **Answer 8, "make it uniform".** The filter that selects which requirements get a test offers the same two options in all five ports: a predicate over one shared requirement view, and the uncovered-warning switch. | Table F, Table I (two new rows), Table J (the `filter` option, seven named predicates, seven `filter-*` cases), Tasks 3, 4, 6, 8, 10, 11 |
+| **Added requirement: the generator is application-owned.** "Whatever we do for this around requirements and testing needs to also eject and be owned by the application. It may change or significantly. This is just a recommended approach." In every port the `requirement-tests` generator, with its default renderer, is ejectable through that port's existing eject mechanism, and a test proves an unedited ejected copy produces byte-identical output. The checks in `verify` stay stock: they are the shared contract. | Table L (new), Table K, Tasks 3, 6, 8, 10, 11, 12 |
+| A separate identity case `worked-example` holds the model of Tables F, G and H; `concern-fanout` keeps its fan-out meaning. One case could not pin both. The identity corpus is 26 cases after review (an eighth predicate and a case for an absent level, and a case for an abstract requirement). | Table J, Tasks 4, 6, 8, 11 |
+| Answers 1 to 7 and 9 take the plan's stated defaults, with answers 3 and 4 confirmed as written. | [Answered questions](#answered-questions) |
+
+Every port was confirmed to have an eject mechanism before Table L was written (`meta eject`, `metaobjects eject`, `mvn metaobjects:eject` for Java and Kotlin, `dotnet meta eject`); none had to be invented.
+
+### As built: where the code differs from the task text below
+
+The tasks were written before the code. Where an implementer found the task text wrong or had to add something, the contract tables above each task were corrected in place and the differences are listed here, so the task steps can be read as the record of intent they are.
+
+| Where | The task text says | What was built, and why |
+|---|---|---|
+| Task 6, Python | the hook types sit in the generator module | They are in `codegen/requirement_hooks.py`. The eject copies the generator module whole; hook types inside it would be a second class in the project's copy, and a project renderer's result would fail the copy's type check. |
+| Task 6, Python | `renderer` and `filter` are resolved "the way `providers` are" | One resolver, `codegen/project_import.py`, serves owned generators and config hooks. It drops a cached module only when it is not under the current project root and that root offers the top-level name; it never unloads the running package; it refuses a project package named like a standard-library module. |
+| Task 6, Python | the ejected copy is `codegen/generators/requirement_tests_generator.py` | `codegen/generators/requirement_tests.py`: the eject names a copy after the registry name. |
+| Task 7, Java | each printed line carries the `metaobjects:verify —` prefix | Diagnostic lines are `  <code> [<path>]: <message>` with no prefix, as the reference and the field lint print them; the summary, recorded-gaps and error-count lines carry it. The same holds in Python and C#. |
+| Task 8, Java | a renderer or filter class is "loaded the way the generator is" | A packaged generator's own class loader cannot see project classes. A new opt-in interface, `ProjectClassLoaderAware` in `codegen-base`, lets the Maven goal hand such a generator the project class loader. `codegen-spring` pins the JUnit 4 surefire provider, because adding the Jupiter API for compiling generated output would otherwise switch providers. |
+| Tasks 8 and 11 | `testPackage` and `witnessClass` are required | They are demanded only once the model holds a requirement, so a model with none still generates nothing and needs no configuration. |
+| Task 10, C# | the hook types are created with the generator | They are in `MetaObjects.Codegen/RequirementTestHooks.cs`, in the package, for the same reason as Python's. The generator and the identity function select requirements through one function, `RequirementTestIdentities.Select`. |
+| Task 11, Kotlin | the registry factory returns a `MultiFileDirectGeneratorBase` | The factory type is widened to `() -> Generator`. `requirement-tests` now exists in both JVM registries, so `mvn metaobjects:eject -Dnames=requirement-tests` needs `-Dport=java` or `-Dport=kotlin` when the port cannot be inferred. |
+| Tasks 6, 8, 10, 11 | failing tests first | The identity runners were written first in every port. The generators were written before their tests in Python, Java, Kotlin and C#; each review then required break-and-restore runs for the output rules, and found the rules those runs had not covered. |
+| Task 12 | the project's own ledger is updated | Unchanged: no `planned` entry concerns the gate or the generated tests. |
+
+
 ## How this plan was verified
 
 Every path, function and test file cited below was read or located in the tree at `5153aa9dc`, unless it is marked **UNVERIFIED**. Read in full: `codegen-ts/src/requirement-walk.ts`, `codegen-ts/src/generators/requirement-tests.ts`, `codegen-ts/src/templates/requirement-test.ts`, `cli/src/lib/requirement-check.ts`, `cli/src/lib/requirement-lint.ts`, `metadata/src/core/requirement/resolve-claim.ts`, the `MetaRequirement` class, `requirement-constants.ts`, `cli/src/commands/verify.ts:670-800`, `fixtures/requirement-harness/README.md`, `scripts/generate-requirement-harness.ts`, `spec/metamodel/requirement.json` (all TypeScript paths are under `server/typescript/packages/`). The Python, Java and C# requirement classes, `verify` entry points and generator registries were read by outline and targeted search.
@@ -47,7 +78,7 @@ What the code does that the documents do not say. Each row changes a task below:
 - **Bind at build time, never by runtime reflection** in JVM and .NET generated code (ADR-0001). Python's witness lookup is a by-name import in test code and is the one exception, stated in Table H.
 - ADR-0039: read effective properties with resolving accessors. Any `own*()` call carries a comment naming its sanctioned case. Python `attr()` is OWN; use `get_meta_attr()`.
 - TS: named constants for metamodel strings, no `any`, never `instanceof` a node from another package.
-- The requirement-test generator is a **reference helper** (ADR-0034 Amendment 3). The requirement gate is **core** (`meta verify` is a drift gate).
+- The requirement-test generator is a **reference helper** (ADR-0034 Amendment 3), and a **recommended approach, not a contract**: it is ejectable in every port (Table L) and an application may change its copy freely. The requirement gate is **core** (`meta verify` is a drift gate) and stays stock.
 - Public repo: no private project names, no absolute home paths, in code, fixtures, docs or commit messages.
 - **Release hold continues:** `main` carries `metamodelVersion 1.1`, so no 1.0.x PATCH is cut from it. This slice adds no vocabulary and can ship with 1.1.
 - Do not push implementation work until every port in the task's track is green.
@@ -70,7 +101,7 @@ What the code does that the documents do not say. Each row changes a task below:
 |---|---|
 | Walk | Depth-first over the loaded root's children, in declaration order, descending through **every** node. A node of type `requirement` is collected. |
 | Path | The dotted chain of requirement names from the root to the node. Only a requirement contributes a segment; a non-requirement node between two requirements is walked through and adds nothing. No package. Example: `Shop.Orders.Recorded`. |
-| Effective package | `node.package`, else the file's default package (`fileDefaultPackage`), else `""`. Read on the requirement node itself. |
+| Effective package | The package the loader resolved for the requirement node: its own declared `package`, else the package of the nearest enclosing node that declares one, else the file's default package, else `""`. In TypeScript that is `node.package ?? node.fileDefaultPackage ?? ""` read on the node itself, because the loader has already carried a parent's declared package down to its children. A port whose loader does not do that walks up. (Corrected in review: the first wording, read literally, gave a child of a package-declaring requirement the file's package; the reference gives it the parent's. Identity case `filter-by-package` pins it.) The ports are held to agree on the shapes the corpora pin: packaged root documents, a node-level `package`, a child nested under a package-declaring node in one document, and a single package-less document. Two multi-file shapes are known to differ between ports and are **not** pinned or fixed in this slice, because both come from loader-level package context: a package-less root document loaded beside packaged ones, and a child merged from a package-less document into a requirement that declares its own package. |
 | Qualified address | `<effective package>::<path>`, or the bare path when the package is `""`. Example: `acme::shop::Shop.Orders.Recorded`. |
 
 Diagnostics use the **path**. Test identities use the **qualified address**.
@@ -108,7 +139,7 @@ Source: `server/typescript/packages/cli/src/lib/requirement-check.ts`. Eleven co
 | 11 | `WARN_REQUIREMENT_DEFERRED_UNTRACKED` | warn | `disposition` is `deferred` and `trackedBy` is empty | `is deferred but names no @trackedBy issue. Deferring without a ticket is how a known gap becomes an unknown one — nothing will raise it again.` |
 | 12 | `WARN_REQUIREMENT_OBJECT_UNCLAIMED` | warn (the `OBJECT_COVERAGE_SEVERITY` constant; each port keeps a named constant) | coverage is measured (Table D) and a coverable entity's resolution key is not in the claim set. **No path.** | `no requirement claims '<entity resolution key>'. Add it to an L4 requirement's 'implementedBy'.` |
 
-Reachability, from `spec/metamodel/requirement.json`: `level` is required on functional and is an integer with no range rule, so row 1 is reached with an out-of-range integer and never with an absent level on a functional node. `status` is required on both subtypes. The loader refuses `implementedBy` on `retired`.
+Reachability, from `spec/metamodel/requirement.json`: `level` is required on functional and is an integer with no range rule, so row 1 is reached with an out-of-range integer and never with an absent level on a functional node. (Found while building the corpus: the TypeScript loader also lets a non-integer such as `4.5` through to row 1. The corpus does not pin that, because the other loaders are not known to agree.) `status` is required on both subtypes. The loader refuses `implementedBy` on `retired`.
 
 A printed line is `  <code> [<path>]: <message>`, or `  <code>: <message>` when there is no path (`formatDiagnostic`, `cli/src/commands/verify.ts:1899`).
 
@@ -152,12 +183,12 @@ One record per generated test. This is what the identity corpus pins, and it is
 | `path` | The requirement's path (Table A). |
 | `unit` | Under `grain: concern` (default): one test per **distinct** `<type>.<subType>` among the requirement's resolved targets, first-seen order. Under `grain: member`: one test per **distinct** `implementedBy` entry that resolves, the reference exactly as authored. In both grains a requirement with no resolved target yields exactly one test with unit `*`. |
 | `id` | `<qualified address> [<unit>]`. |
-| `witnessKey` | `req_` + mangle(qualified address), then `__` + mangle(unit) unless the unit is `*`. mangle replaces each maximal run of characters outside `[A-Za-z0-9]` with one `_`. |
+| `witnessKey` | `req_` + mangle(qualified address), then `__` + mangle(unit) unless the unit is `*`. mangle replaces each maximal run of characters outside `[A-Za-z0-9]` with one `_`. The class is ASCII and excludes `_` itself: `Orders__Recorded` mangles to `Orders_Recorded`, and `Café.Réglé` to `Caf_R_gl_`. A port's idiomatic word class is wrong: `\W` keeps the underscore and non-ASCII letters, and `isalnum` / `isLetterOrDigit` keep non-ASCII letters. The corpus pins the doubled underscore, which catches `\W`; the non-ASCII half, which is the only thing that catches the other two, is pinned by a direct test of the key function in every port, because the loaders are not known to agree on non-ASCII names. |
 | `status` | The requirement's status. |
 | `skip` | `null` when the status is `live` or `partial`; otherwise the status (`planned` or `retired`). Derived from the status lists, never a literal set. |
 | `digest` | Table G. |
 
-Which requirements get a test: the default filter is **functional and `level >= 4`**. Requirements the filter excludes produce one warning, capped at five names, with the text of `requirement-tests.ts:179-183`.
+Which requirements get a test: the default filter is **functional and `level >= 4`**. Every port lets a project replace it with its own predicate over the requirement view (Table I). Requirements the filter excludes produce one warning; every port can switch it off. Its text is the same in every port: `<n> requirement(s) matched no filter and get no test. If that is deliberate, set <the switch> to silence this. Uncovered: <up to five paths, comma-separated>[, and <k> more].` It names **paths**, never qualified addresses (Table A: diagnostics use the path). Two things vary by port and nothing else: TypeScript says `stub` where the others say `test`, because only TypeScript emits a stub to fill in; and `<the switch>` is spelled the way that port's surface spells it (`warnUncovered: false` in TypeScript and in Python's config, `warnUncovered=false` for a Java or Kotlin generator arg, `WarnUncovered = false` in C#).
 
 Two records with the same `witnessKey` are a **collision**. Every generator outside TypeScript refuses to generate, with code `ERR_REQUIREMENT_WITNESS_KEY_COLLISION` and a message naming both `id` values. TypeScript's generator does not use the key in its output and does not refuse.
 
@@ -224,8 +255,10 @@ Rules the four generators share:
 - Every author-supplied value is escaped wherever it lands. In a string literal: `\`, `"`, newline and carriage return; `$` as well in Kotlin. In a comment: one comment marker per line, and `*/` broken as `* /`. Prose is never placed in a Python docstring.
 - Above each test, as comments: the `id`, the statement, `Counterexample:`, `Status:`, `Claims:` (each target as `<ref>  (<type>.<subType>)`, or `(none)`), and `Digest:`. The digest in the file is what makes `verify --codegen` go red when a claim changes.
 - Tests are emitted sorted by `id`. Output is deterministic.
+- A package that loses its last requirement leaves its generated file behind in Python, Java, Kotlin and C#: `gen` does not remove it, and the port's codegen drift gate reports it. That is each of those ports' existing behaviour for every generator, and it stands for this slice (TypeScript's generator reconciles orphans). Each port's `stale file` test names the behaviour in its title.
+- A renderer or filter the project names that exists but fails to load (a class that does not link, a module that raises on import) is reported with its name and the real cause, never as missing.
 - The file header says it is generated and rewritten whole, and names the witness module or class.
-- A JVM or .NET witness interface lists **only** non-skipped tests. A requirement that becomes live adds a failing default member (a red test, no compile break). A requirement that is retired or deleted removes the member, so a stale override stops compiling. That is the drift signal for orphan witnesses.
+- A JVM or .NET witness interface lists **only** non-skipped tests. A requirement that becomes live adds a failing default member (a red test, no compile break). A requirement that is retired or deleted removes the member. Whether a witness left behind then stops compiling depends on the language, and each generated header names the form that makes it so: in Kotlin always, because `override` is mandatory; in Java only when the witness method carries `@Override`; in C# only when the witness implements the member explicitly (`void Requirements_<pkgKey>_Witnesses.<witnessKey>()`), because an implicit `public void <witnessKey>()` stays an ordinary method. A witness written in the other form goes stale silently. That compile error is the drift signal for orphan witnesses, and each of the three ports has a compile test for both forms. (Corrected in review: this row first stated the signal unconditionally. It was true as written only for Kotlin, no port tested it, and the Java and C# headers said only "override the members".)
 - The generated JVM and .NET test constructs the configured witness class with `new`. If that class does not exist the test module does not compile: a one-time setup, documented in Task 12, and the only by-name binding is a static one (ADR-0001).
 
 The reference Python output for the worked example (the shape Task 6 emits; the other three follow the same structure in their syntax, and `scripts/generate-requirement-harness.ts:128-181` holds each language's skip annotation and class frame):
@@ -290,20 +323,22 @@ def test_req_acme_shop_Orders_Refunded():
 
 | Seam | TypeScript | Python | Java and Kotlin | C# |
 |---|---|---|---|---|
-| Grain (`concern` default, or `member`) | `requirementTests({ grain })` | `requirement_tests(grain=…)`; config `requirementTests.grain` | generator arg `grain` | **UNVERIFIED** option surface; a property on the generator |
+| Grain (`concern` default, or `member`; any other value is refused with a clear error, never run as a hybrid) | `requirementTests({ grain })` | `requirement_tests(grain=…)`; config `requirementTests.grain` | generator arg `grain` | **UNVERIFIED** option surface; a property on the generator |
 | Renderer hook. Receives the Table F record plus `statement`, `counterexample`, `targets` (`ref`, `concern`), `disposition`, `trackedBy`. Its result replaces the default text of that one test. | existing `renderers` and `resolveRenderer`; `RequirementTestArgs` gains `package`, `unit`, `id`, `witnessKey`, `skip`, `digest` | `requirement_tests(renderer=…)`; config `requirementTests.renderer` as `module:symbol`. Returns `RenderedTest(imports, source)` or `None` for the default | generator arg `renderer`: the class name of a `RequirementTestRenderer` | as Java, an `IRequirementTestRenderer` |
 | Strict switch: row 10 of Table C becomes severity `error`, code unchanged | `meta verify --require-implementers`, or `META_REQUIRE_IMPLEMENTERS=1` | `metaobjects verify --require-implementers`, same variable | `-Dmeta.verify.requireImplementers=true`, same variable | `dotnet meta verify --require-implementers`, same variable |
 | Witness location | not applicable | `requirement_tests(witness_module=…)`; config `requirementTests.witnessModule` | generator args `testPackage` and `witnessClass` | the same two, C# names |
+| Filter: a predicate over the requirement view. Absent, the default of Table F applies. | `requirementTests({ filter })` | `requirement_tests(filter=…)`; config `requirementTests.filter` as `module:symbol` | generator arg `filter`: the class name of a `RequirementTestFilter` (`boolean include(RequirementView view)`), loaded the way the renderer is | as Java, an `IRequirementTestFilter` (`bool Include(RequirementView view)`) |
+| Uncovered warning: name the requirements the filter excluded (Table F). Default on. | `requirementTests({ warnUncovered })` | `requirement_tests(warn_uncovered=…)`; config `requirementTests.warnUncovered` | generator arg `warnUncovered` (`true` or `false`) | as Java |
 
-A filter predicate stays a code-level option: TypeScript `filter` and Python `requirement_tests(filter=…)`. Java, Kotlin and C# ship the default filter only in this slice.
+**The filter is uniform (owner's answer 8).** Every port offers the same two options, and every port's predicate receives the same projection, the **requirement view**: `subType`, `level` (absent on an unlevelled architectural requirement), `status`, `path`, `package` (the effective package) and `implementedByTypes` (the distinct `<type>.<subType>` of the resolved targets, first-seen order). The view never hands out the node. A port that cannot express one of the two options is wrong; the identity corpus's `filter-*` cases (Table J) run each port's predicate seam.
 
 The flag is not called `--strict`: `cli/src/lib/args.ts:357` records why a `--strict` beside `--lax` misreads.
 
 ### Table J — the two corpora
 
-Both follow the field-lint corpus shape: each case is a directory with `input/` (one or more `.json` or `.yaml` metadata documents), an optional `options.json`, and `expected.json`. A runner (1) loads `input/` with the port's loader, **strict**, with the libraries `options.json` names, and asserts no load error; (2) computes; (3) compares.
+Both follow the field-lint corpus shape: each case is a directory with `input/` (one or more `.json` or `.yaml` metadata documents), an optional `options.json`, and `expected.json`. A runner (1) loads the files of `input/` **in file-name order** with the port's loader, **strict**, with the libraries `options.json` names, and asserts no load error (the order is part of the contract: one did-you-mean hint and the file default package of a later document depend on it); (2) computes; (3) compares.
 
-**`fixtures/requirement-check-conformance/`**. `options.json` keys: `libraries` (string array), `requireImplementers` (boolean). `expected.json`:
+**`fixtures/requirement-check-conformance/`**. `options.json` keys: `libraries` (string array), `requireImplementers` (boolean). A runner passes no scope predicate and does not force the coverage answer: both are left to the port's defaults, or `coverage-library-plus-project` is reachable with the wrong total. `expected.json`:
 
 ```json
 {
@@ -324,7 +359,7 @@ Both follow the field-lint corpus shape: each case is a directory with `input/`
 | `clean-fully-claimed` | An L1 to L5 tree claiming every entity: no diagnostics, full summary |
 | `dangling-object-live`, `dangling-object-partial` | Row 6 for each live status |
 | `dangling-object-planned-clean` | A planned requirement may name nodes that do not exist |
-| `dangling-object-did-you-mean` | Row 6's hint when the short name exists in another package |
+| `dangling-object-did-you-mean` | Row 6's hint when the short name exists in another package, for a bare object reference and for a member reference whose **owner** does not resolve (`Invoice.total`): the gate splits first and hints on the owner, so the message names `Invoice`, not the member. Added in review: every other dotted dangling reference in the corpus has a resolved owner, so this branch had no case |
 | `dangling-bare-name-in-two-packages` | A bare name present in two other packages binds nothing |
 | `dangling-member-of-resolved-object`, `dangling-member-first-missing-segment` | Row 6's member hint, at one and two levels |
 | `claim-on-root-template` | A reference to a root-level `template.prompt` resolves |
@@ -338,6 +373,7 @@ Both follow the field-lint corpus shape: each case is a directory with `input/`
 | `disposition-not-applicable`, `deferred-untracked` | Rows 9 and 11, with a tracked deferral beside the untracked one |
 | `nothing-implements-subtree`, `nothing-implements-delegating-parent-clean` | Row 10 on every live node of an empty subtree, and not on a parent whose child claims |
 | `require-implementers` | Same input as `nothing-implements-subtree` with the strict option: severity `error`, same code |
+| `require-implementers-raises-only-that-code` | The strict option over a model that also has an untracked deferral and an unclaimed entity: row 10 is `error`, rows 11 and 12 stay `warn`. Added in review: without it a port that raised every warning would pass |
 | `superseded-by-resolves-clean`, `superseded-by-dangling`, `superseded-by-package-local` | Row 7 and Table B's ledger lookup |
 | `retired-clean` | A retired entry reports nothing and claims nothing |
 | `same-name-in-two-branches` | Two requirements with one name are told apart by path |
@@ -351,7 +387,20 @@ Both follow the field-lint corpus shape: each case is a directory with `input/`
 | `coverage-library-overlay-does-not-activate` | An overlay on a library requirement does not |
 | `summary-undecided-rollup` | A partial parent over a partial child counts once, at the child; a grandchild excludes both ancestors |
 
-**`fixtures/requirement-test-identity-conformance/`**. `options.json` key: `grain`. `expected.json`:
+**`fixtures/requirement-test-identity-conformance/`**. `options.json` keys: `grain`, and `filter`, the **name** of one predicate from the closed list below. A predicate cannot be written in a language-neutral file, so the corpus names it and each port's runner implements the list in its own language and passes the predicate through the port's public filter seam. That is what makes the seam, and every field of the view it receives, a five-port contract. With no `filter` key the port's default applies.
+
+| `filter` | The predicate over the requirement view |
+|---|---|
+| `all` | always true |
+| `architectural` | `subType` is `architectural` |
+| `live` | `status` is `live` |
+| `level-5` | `level` is `5` |
+| `package-acme-shop` | `package` is `acme::shop` |
+| `path-under-Shop` | `path` is `Shop` or starts with `Shop.` |
+| `claims-entity` | `implementedByTypes` contains `object.entity` |
+| `unlevelled` | `level` is absent (not `0`, not a sentinel) |
+
+`expected.json`:
 
 ```json
 { "tests": [ { "id": "acme::shop::Orders.Recorded [object.entity]", "package": "acme::shop",
@@ -367,17 +416,27 @@ Both follow the field-lint corpus shape: each case is a directory with `input/`
 | Case | Pins |
 |---|---|
 | `default-filter` | L1 to L3 and architectural nodes get no test; functional L4 and L5 do |
+| `worked-example` | The model of Tables F, G and H exactly: `Orders.Recorded` (functional, level 4, live, claiming `Order`) and `Orders.Refunded` (functional, level 4, planned, no links) in `acme::shop`. Both digests are the pinned ones. Every port's generator test renders this case |
 | `concern-fanout` | One requirement claiming two entities and a template yields two tests |
 | `no-targets` | A live L4 with no `implementedBy` yields one test, unit `*` |
 | `planned-skip`, `retired-skip`, `partial-not-skipped` | `skip` per status; a planned requirement naming absent nodes has unit `*` |
 | `member-grain`, `member-grain-unresolved-dropped`, `member-grain-duplicate-ref` | One test per distinct resolving reference, bare and qualified forms kept as authored |
 | `package-in-address` | The same path in two packages gives two ids and two keys |
-| `unpackaged` | An empty package gives a bare address |
+| `unpackaged` | An empty package gives a bare address. One document only: a package-less document loaded after a packaged one takes that document's package as its file default |
 | `nested-path` | A five-deep path |
 | `digest-claim-fields` | Two requirements differing in statement differ in digest; two differing only in `title`, `notes`, `disposition` and `trackedBy` do not |
 | `digest-inherited` | A requirement inheriting its statement through `extends` hashes the effective text |
 | `digest-multibyte-and-crlf` | A non-ASCII statement and a `\r\n` in the counterexample |
-| `witness-key-collision` | `Orders.Recorded` beside `Orders_Recorded`: one entry in `collisions` |
+| `witness-key-collision` | `Orders.Recorded` beside `Orders_Recorded`: one entry in `collisions`. A third requirement with a doubled underscore in its name does not collide and pins that `_` is outside the kept class |
+| `abstract-collected` | An `abstract` functional L4 gets a test like any other requirement (Table A: every requirement node is collected). Pinned as the reference behaves so the ports cannot drift apart; the owner has not ruled on whether an abstract requirement should be tested |
+| `filter-all` | `filter: all` over an L1 to L5 tree with one architectural policy: every requirement gets a test, the L1 to L3 nodes with unit `*` |
+| `filter-by-subtype` | `filter: architectural`: an unlevelled policy and a levelled one get tests, the functional nodes none. Pins `subType`, and that an absent `level` reaches the predicate as absent |
+| `filter-by-status` | `filter: live`: a partial and a planned requirement are dropped. Pins `status` |
+| `filter-by-level` | `filter: level-5`: only the L5 nodes. Pins `level` |
+| `filter-by-absent-level` | `filter: unlevelled`: only the flat architectural policies. Pins that an absent `level` reaches the predicate as absent in every port |
+| `filter-by-package` | `filter: package-acme-shop` over two packages, one requirement taking its package from the file default. Pins `package` as the effective package |
+| `filter-by-path` | `filter: path-under-Shop`: `Shop` and its descendants, not a sibling `Shopfront`. Pins `path` |
+| `filter-by-claimed-concern` | `filter: claims-entity`: a requirement claiming an entity is kept, one claiming only a template or only an unresolvable name is dropped. Pins `implementedByTypes` as the resolved concerns |
 
 ### Table K — where the code lives in each port
 
@@ -387,19 +446,35 @@ The checks live in each port's **core library**, not its CLI, because the genera
 |---|---|---|---|---|
 | TypeScript | existing: `cli/src/lib/requirement-check.ts`, `metadata/src/core/requirement/resolve-claim.ts` | existing: `cli/src/commands/verify.ts` | existing: `codegen-ts/src/generators/requirement-tests.ts`, `requirement-walk.ts` | existing |
 | Python (`server/python/src/metaobjects/`) | `meta/core/requirement/resolve_claim.py`, `requirement_check.py` | `cli.py` (`_cmd_verify`) | `codegen/requirement_walk.py`, `codegen/generators/requirement_tests_generator.py` | `codegen/generator_registry.py` |
-| Java (`server/java/`) | `metadata/src/main/java/com/metaobjects/requirement/RequirementClaims.java`, `RequirementCheck.java`, `RequirementTestIdentities.java` | `maven-plugin/src/main/java/com/metaobjects/mojo/MetaDataVerifyMojo.java` | `codegen-base/src/main/java/com/metaobjects/generator/requirement/JUnitRequirementTestsGenerator.java` | `codegen-spring/src/main/java/com/metaobjects/generator/GeneratorRegistry.java` |
+| Java (`server/java/`) | `metadata/src/main/java/com/metaobjects/requirement/RequirementClaims.java`, `RequirementCheck.java`, `RequirementTestIdentities.java` | `maven-plugin/src/main/java/com/metaobjects/mojo/MetaDataVerifyMojo.java` | `codegen-spring/src/main/java/com/metaobjects/generator/` (the package the other ejectable Java generators live in) `JUnitRequirementTestsGenerator.java`; the hook types in `codegen-base/src/main/java/com/metaobjects/generator/requirement/` | `codegen-spring/src/main/java/com/metaobjects/generator/GeneratorRegistry.java` |
 | Kotlin | Java's | Java's Maven goal | `codegen-kotlin/src/main/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGenerator.kt` | `codegen-kotlin/.../GeneratorRegistry.kt` |
 | C# (`server/csharp/`) | `MetaObjects/Core/Requirement/RequirementClaims.cs`, `RequirementCheck.cs`, `RequirementTestIdentities.cs` | `MetaObjects.Cli/Program.cs`, `VerifyCommand.cs` | `MetaObjects.Codegen/Generators/RequirementTestsGenerator.cs` | `MetaObjects.Codegen/GeneratorRegistry.cs` |
 
 Each port also adds a library-package accessor beside its embedded manifests: Python `library_packages()` in `library/library_sources.py`, Java `LibrarySources.libraryPackages()`, C# `LibrarySources.LibraryPackages()`.
 
+### Table L — eject: the application-owned copy
+
+Every port already has an eject mechanism; this slice wires the new generator into each and adds nothing to the mechanisms themselves. One rule makes that enough: **in every port the default rendering lives in the generator's own source file**, because every port's eject copies exactly one file per generator. One eject therefore takes the generator and its renderer together.
+
+| Port | What `eject` copies, and to where | What makes the generator ejectable | How the owned copy runs | The byte-identity test |
+|---|---|---|---|---|
+| TypeScript | `codegen-ts/src/reference/requirement-tests.ts` to `codegen/generators/requirement-tests.ts`. A new reference template holding the generator **and** the default stub renderer, importing only public exports of `@metaobjectsdev/codegen-ts` and `@metaobjectsdev/metadata` | `"requirement-tests"` in `REFERENCE_GENERATOR_NAMES` (`codegen-ts/src/reference-templates.ts`); the registry's `ejectable` flag is derived from it | the import swap in `metaobjects.config.ts` that `meta eject` prints | a `PAIRS["requirement-tests"]` entry in `codegen-ts/test/reference-byte-identical.test.ts`, over a model that has requirements, in both grains |
+| Python | the module `codegen/generators/requirement_tests_generator.py`, whole, to `codegen/generators/requirement_tests.py` (the eject names the copy after the registry name) | `source=` on the registry entry | `codegen.generators.requirement_tests:requirement_tests_generator` in `generators`. The factory named by `source=` takes the build context, so an owned copy still reads the `requirementTests` config block | in `tests/codegen/test_eject.py`: packaged and owned `gen` output compared byte for byte over the `worked-example` model with a `requirementTests` block set |
+| Java | `JUnitRequirementTestsGenerator.java`, with its package line rewritten, to the project's `codegen/` module | `ejectPath(JUnitRequirementTestsGenerator.class)` on the `register(...)` line, an `<include>` in `codegen-spring/pom.xml`, the name in `EjectedGeneratorsCompileTest` | the `<classname>` swap `metaobjects:eject` prints | a round trip on the pattern of `maven-plugin`'s `EjectRoundTripTest` proof B: the unchanged ejected copy, compiled, emits the same bytes as the packaged class |
+| Kotlin | `KotlinRequirementTestsGenerator.kt`, package line rewritten | `ejectResourcePath = ejectPath("KotlinRequirementTestsGenerator")`, an `<include>` in `codegen-kotlin/pom.xml`, the name in `ejectableSimpleNames` | the same `<classname>` swap | new in `codegen-kotlin`: the package-renamed copy is compiled with kotlin-compile-testing, run, and its output compared with the packaged generator's |
+| C# | `Generators/RequirementTestsGenerator.cs`, namespace line rewritten, to `codegen/generators/` | `SourceFileName` on the registry entry and an `<EmbeddedResource>` item in `MetaObjects.Codegen.csproj` | the owned `codegen/Program.cs` lists `new RequirementTestsGenerator { … }` | on the pattern of `EjectedGeneratorCompileTests`: the rewritten copy compiled with Roslyn against the public API and compared file by file over the `worked-example` model (`meta.fitness.json` has no requirement, so the existing list alone would compare nothing) |
+
+What stays in the package, and why: the walk, the claim resolver, the identity function, the digest and the hook types. They are what the corpora pin and what the gate shares; an owned generator imports them from the package like any other code. An application that wants different identities writes them in its own copy. That is its right, and its `verify --codegen` then compares its own output with itself.
+
+The requirement checks are **not** ejectable in any port. They are the shared contract.
+
 ## File structure
 
-**Shared, new:** `fixtures/requirement-check-conformance/` (a `README.md` and the 42 cases of Table J), `fixtures/requirement-test-identity-conformance/` (a `README.md` and 16 cases), `spec/decisions/ADR-0057-requirement-checks-and-tests-in-every-port.md`, `scripts/write-requirement-corpus-expected.ts`.
+**Shared, new:** `fixtures/requirement-check-conformance/` (a `README.md` and the 43 cases of Table J), `fixtures/requirement-test-identity-conformance/` (a `README.md` and 26 cases), `spec/decisions/ADR-0057-requirement-checks-and-tests-in-every-port.md`, `scripts/write-requirement-corpus-expected.ts`.
 
 **Shared, modified:** `fixtures/generator-registry-conformance/registry.json` (the `requirement-tests` entry's `ports`, one port per generator task).
 
-**TypeScript, modified** (under `server/typescript/packages/`): `cli/src/lib/requirement-check.ts`, `cli/src/lib/args.ts`, `cli/src/commands/verify.ts`, `codegen-ts/src/requirement-walk.ts`, `codegen-ts/src/generators/requirement-tests.ts`, `codegen-ts/src/templates/requirement-test.ts`. **New tests:** `cli/test/requirement-check-conformance.test.ts`, `codegen-ts/test/requirement-test-identity-conformance.test.ts`.
+**TypeScript, modified** (under `server/typescript/packages/`): `cli/src/lib/requirement-check.ts`, `cli/src/lib/args.ts`, `cli/src/commands/verify.ts`, `codegen-ts/src/requirement-walk.ts`, `codegen-ts/src/generators/requirement-tests.ts`, `codegen-ts/src/templates/requirement-test.ts`, `codegen-ts/src/reference-templates.ts`. **New:** `codegen-ts/src/reference/requirement-tests.ts` (Table L). **New tests:** `cli/test/requirement-check-conformance.test.ts`, `codegen-ts/test/requirement-test-identity-conformance.test.ts`.
 
 **Other ports:** Table K, and the test files named in Tasks 5 to 11.
 
@@ -456,7 +531,7 @@ export interface RequirementScan {
 }
 ```
 
-- [ ] **Step 1: Write the ADR** in Nygard format. Context: the decision recorded only in `docs/CONFORMANCE.md` "Split coverage" ("Checks — TypeScript only, by decision … one implementation of a build-time gate rather than five") and why it was made. Decision: the owner's ruling that every language runs the requirement checks and scaffolds tests from requirements; the gate is implemented per port and held to the TypeScript reference by `requirement-check-conformance`; the generator is implemented per port and held by `requirement-test-identity-conformance`; the witness model replaces the three-way merge outside TypeScript; `verify` still never reads test results. Consequences: a change to a gate code, a message, the identity or the digest is now a five-port change with a corpus edit; the analogy with ADR-0015 no longer applies to requirements and ADR-0015 itself is unchanged; the authoring lint stays TypeScript-only until ruled on (open question 1).
+- [ ] **Step 1: Write the ADR** in Nygard format. Context: the decision recorded only in `docs/CONFORMANCE.md` "Split coverage" ("Checks — TypeScript only, by decision … one implementation of a build-time gate rather than five") and why it was made. Decision: the owner's ruling that every language runs the requirement checks and scaffolds tests from requirements; the gate is implemented per port and held to the TypeScript reference by `requirement-check-conformance`; the generator is implemented per port and held by `requirement-test-identity-conformance`; the witness model replaces the three-way merge outside TypeScript; the filter that selects which requirements get a test offers the same two options in every port (a predicate over one shared requirement view, and the uncovered-warning switch); the generator, its renderer and the witness model are a **recommended approach, not a contract**: the generator is ejectable in every port through that port's existing eject mechanism, and an application may change or replace its copy freely, while the checks in `verify` stay stock because they are the shared contract; `verify` still never reads test results. Consequences: a change to a gate code, a message, the identity or the digest is now a five-port change with a corpus edit; the analogy with ADR-0015 no longer applies to requirements and ADR-0015 itself is unchanged; the seven authoring-lint advisories stay TypeScript-only in this slice, by the owner's ruling, and porting them is a follow-up slice.
 - [ ] **Step 2: Failing tests.** In `requirement-check.test.ts`: `requireImplementers raises nothing-implements to an error and keeps the code` (a live functional L4 with no links: default scan gives severity `warn`; `scanRequirements(root, { requireImplementers: true })` gives severity `error`, code `WARN_REQUIREMENT_NOTHING_IMPLEMENTS`, same path and message) and `requireImplementers changes no other diagnostic`. In `args-verify.test.ts`: `--require-implementers` parses to `requireImplementers: true`, default `false`. In `verify-requirements-e2e.test.ts`: the flag, and `META_REQUIRE_IMPLEMENTERS=1`, each turn a run with only that warning from exit 0 to exit 1.
 
 Run: `cd server/typescript/packages/cli && bun test test/unit/requirement-check.test.ts test/unit/args-verify.test.ts test/verify-requirements-e2e.test.ts`. Expected: the new tests FAIL.
@@ -469,7 +544,7 @@ Run: `cd server/typescript/packages/cli && bun test test/unit/requirement-check.
 ### Task 2: The requirement-check corpus and its TypeScript runner
 
 **Files:**
-- Create: `fixtures/requirement-check-conformance/README.md` and the 42 case directories of Table J
+- Create: `fixtures/requirement-check-conformance/README.md` and the 43 case directories of Table J
 - Create: `scripts/write-requirement-corpus-expected.ts`
 - Create: `server/typescript/packages/cli/test/requirement-check-conformance.test.ts`
 
@@ -484,7 +559,7 @@ Run: `cd server/typescript/packages/cli && bun test test/unit/requirement-check.
 - [ ] **Step 5: Write the expectations script.** `scripts/write-requirement-corpus-expected.ts` takes a corpus name, loads each case the way the runner does and writes `expected.json`. It imports the reference by relative path, as `scripts/generate-requirement-harness.ts` does. Run `bun scripts/write-requirement-corpus-expected.ts check`.
 - [ ] **Step 6: Review every written file by hand against Table C, D and E.** This is the step that makes the corpus a contract instead of a snapshot. For each case confirm the codes are the ones the row "Pins" names and no others; fix the **input** when a case produces more than it should. A disagreement between Table C and the reference is a finding to report, not something to paper over in the expectation.
 - [ ] **Step 7: Write the README:** the two-line purpose, the format, the three runner steps, the case table, and a "Who asserts it" table (TypeScript now; the other rows are added by Tasks 5, 7 and 9).
-- [ ] **Step 8: Run** the runner. Expected: PASS, 43 tests.
+- [ ] **Step 8: Run** the runner. Expected: PASS, 44 tests.
 - [ ] **Step 9: Commit.** `git commit -m "test(conformance): requirement-check corpus, run by the TypeScript reference"`
 
 ---
@@ -494,7 +569,9 @@ Run: `cd server/typescript/packages/cli && bun test test/unit/requirement-check.
 **Files:**
 - Modify: `server/typescript/packages/codegen-ts/src/requirement-walk.ts`, `src/generators/requirement-tests.ts`, `src/templates/requirement-test.ts`
 - Modify: the package's public exports (**UNVERIFIED** file; find where `walkRequirements` is exported and add the new names beside it)
-- Test: `codegen-ts/test/requirement-walk.test.ts`, `requirement-tests-generator.test.ts`, `requirement-test-render.test.ts`
+- Create: `server/typescript/packages/codegen-ts/src/reference/requirement-tests.ts`; modify `src/reference-templates.ts` (Table L)
+- Modify: `spec/decisions/ADR-0034-codegen-scaffold-and-own.md` (the 2026-09-26 correction lists `requirement-tests` among the generators that ship no reference template; record that it now ships one) and `docs/features/own-your-codegen.md` (the same list)
+- Test: `codegen-ts/test/requirement-walk.test.ts`, `requirement-tests-generator.test.ts`, `requirement-test-render.test.ts`, `reference-byte-identical.test.ts`, `reference-templates.test.ts`, `cli/test/eject-multi.test.ts`
 
 **Interfaces:**
 - Produces, in `requirement-walk.ts`:
@@ -550,7 +627,7 @@ test("witness keys follow Table F", () => {
 });
 ```
 
-Also: `the view carries the effective package`; `member grain yields one identity per distinct resolving reference`; `a requirement with no resolved target yields unit *` in both grains; `skip is derived from the status lists` (planned and retired skip, live and partial do not); `identities come back sorted by id`; `two addresses that mangle alike are reported as a collision`; `the digest ignores title, notes, disposition and trackedBy`; `the digest normalises CRLF`. In `requirement-tests-generator.test.ts`: `grain: "member"` emits one file per reference and the renderer receives `digest` and `witnessKey`. In `requirement-test-render.test.ts`: `the default output is byte-identical with the new args present` (compare with the existing expected text, unchanged).
+Also: `the view carries the effective package`; `member grain yields one identity per distinct resolving reference`; `a requirement with no resolved target yields unit *` in both grains; `skip is derived from the status lists` (planned and retired skip, live and partial do not); `identities come back sorted by id`; `a filter replaces the default and its view carries the effective package` (a predicate keeping only `package === "acme::shop"` over two packages); `two addresses that mangle alike are reported as a collision`; `the digest ignores title, notes, disposition and trackedBy`; `the digest normalises CRLF`. In `requirement-tests-generator.test.ts`: `grain: "member"` emits one file per reference and the renderer receives `digest` and `witnessKey`. In `requirement-test-render.test.ts`: `the default output is byte-identical with the new args present` (compare with the existing expected text, unchanged).
 
 Run: `cd server/typescript/packages/codegen-ts && bun test test/requirement-walk.test.ts test/requirement-tests-generator.test.ts test/requirement-test-render.test.ts`. Expected: the new tests FAIL.
 - [ ] **Step 2: Implement the digest and key.**
@@ -596,13 +673,18 @@ export function witnessKeyOf(qualifiedAddress: string, unit: string): string {
 - [ ] **Step 4: Thread the generator.** Move `defaultFilter` out of `requirement-tests.ts` to the exported `defaultRequirementTestFilter`. Under `grain: "member"`, the generator iterates references instead of concerns; the default path's last segment is the mangled unit, so a qualified reference never puts `::` in a filename. Fill the six new `RequirementTestArgs` fields for every call. `renderRequirementTest` ignores them.
 - [ ] **Step 5: Run** the Step 1 command, `bun test test/requirement-orphans-e2e.test.ts test/requirement-stub-executes.test.ts`, and the workspace typecheck. Expected: PASS, with the existing render expectations untouched.
 - [ ] **Step 6: Commit.** `git commit -m "feat(codegen-ts): requirement test identities, the requirement digest and a per-member grain"`
+- [ ] **Step 7: Read the eject machinery.** `cli/src/commands/eject.ts` (one file per name, read from `<pkg>/src/reference/<name>.ts`, written verbatim), `codegen-ts/src/reference-templates.ts`, one existing reference template with its header (`src/reference/output-parser.ts`), `test/reference-byte-identical.test.ts` (`PAIRS`), `test/reference-templates.test.ts` (the hard-coded name list and the header rules), `scripts/check-reference-templates-lint.ts`, and `cli/src/lib/catalog-listing.ts` (the `use-when:` and `emits:` header lines it reads).
+- [ ] **Step 8: Failing tests.** Add `"requirement-tests"` to the name list in `reference-templates.test.ts`; add `PAIRS["requirement-tests"]` in `reference-byte-identical.test.ts`, run over a model that holds requirements (functional L4 and L5, one planned, one with no targets, one architectural) under the default grain and under `grain: "member"`, with a non-default `filter` in one run; in `cli/test/eject-multi.test.ts` (or the eject test beside it) `meta eject requirement-tests` writes `codegen/generators/requirement-tests.ts` and no longer answers `package-only`. Run them. Expected: FAIL.
+- [ ] **Step 9: Write the reference template.** `src/reference/requirement-tests.ts` holds the generator and the default stub renderer in one file (Table L's one-file rule: the eject copies one file, and the renderer is what an application is most likely to change). It imports only public exports of `@metaobjectsdev/codegen-ts` and `@metaobjectsdev/metadata`; export from `codegen-ts/src/index.ts` any primitive it needs that is not public yet (the identity and digest functions of Step 2 and 3). The built-in in `src/generators/` stays the oracle. Add the name to `REFERENCE_GENERATOR_NAMES`. Update the two documents named under Files, and nothing else in them.
+- [ ] **Step 10: Run** the Step 8 tests, `bun scripts/check-reference-templates-lint.ts` from the repository root, `test-generators`' `owned-copies-current.test.ts`, `codegen-ts/test/generator-registry.test.ts`, the CLI's `gen --list` snapshot if one holds the `package-only` marker, and the workspace typecheck. Expected: PASS.
+- [ ] **Step 11: Commit.** `git commit -m "feat(codegen-ts): a reference template for requirement-tests, so meta eject can hand it to the application"`
 
 ---
 
 ### Task 4: The requirement-test identity corpus and its TypeScript runner
 
 **Files:**
-- Create: `fixtures/requirement-test-identity-conformance/README.md` and the 16 case directories of Table J
+- Create: `fixtures/requirement-test-identity-conformance/README.md` and the 26 case directories of Table J
 - Create: `server/typescript/packages/codegen-ts/test/requirement-test-identity-conformance.test.ts`
 - Modify: `scripts/write-requirement-corpus-expected.ts` (the `identity` corpus)
 
@@ -610,11 +692,11 @@ export function witnessKeyOf(qualifiedAddress: string, unit: string): string {
 - Consumes: `requirementTestIdentities`, `witnessKeyCollisions` (Task 3).
 - Produces: the corpus Tasks 6, 8, 10 and 11 run.
 
-- [ ] **Step 1: Write the runner** on the pattern of Task 2's: load strict, assert no load error, compute `requirementTestIdentities(root, { grain })` and `witnessKeyCollisions(...)`, compare with `expected.tests` (both sorted by `id`) and `expected.collisions`. Include the README-equals-disk test.
-- [ ] **Step 2: Write the inputs** for each row of Table J. `concern-fanout` holds the worked example of Tables F and G exactly, so its expected digest is the pinned one.
+- [ ] **Step 1: Write the runner** on the pattern of Task 2's: load strict, assert no load error, compute `requirementTestIdentities(root, { grain, filter })` (the `filter` option is a name, mapped to a predicate by a table in the runner that holds exactly the eight rows of Table J; an unknown name fails the test) and `witnessKeyCollisions(...)`, compare with `expected.tests` (both sorted by `id`) and `expected.collisions`. Include the README-equals-disk test.
+- [ ] **Step 2: Write the inputs** for each row of Table J. `worked-example` holds the model of Tables F, G and H exactly, so its two expected digests are the pinned ones (`2714aa39…` and `4ddcd781…`). If the second does not come out as pinned, the input differs from the model the plan's author hashed: find the difference (level, statement or counterexample text) before touching Table H. Each `filter-*` case keeps a requirement the default filter would drop, or drops one it would keep, so a runner that ignores the option fails the case.
 - [ ] **Step 3: Write and review the expectations.** `bun scripts/write-requirement-corpus-expected.ts identity`, then check each file by hand: the unit set against Table F, each `witnessKey` by applying the mangle rule on paper, each `skip` against the status, and for `digest-claim-fields` that the digests differ and agree where the case says. Recompute one digest independently (`printf` the text of Table G into `sha256sum`) for `digest-multibyte-and-crlf`.
 - [ ] **Step 4: Write the README** (purpose, format, runner steps, case table, "Who asserts it").
-- [ ] **Step 5: Run.** `cd server/typescript/packages/codegen-ts && bun test test/requirement-test-identity-conformance.test.ts`. Expected: PASS, 17 tests.
+- [ ] **Step 5: Run.** `cd server/typescript/packages/codegen-ts && bun test test/requirement-test-identity-conformance.test.ts`. Expected: PASS, 27 tests.
 - [ ] **Step 6: Commit.** `git commit -m "test(conformance): requirement-test identity corpus, run by the TypeScript reference"`
 
 ---
@@ -664,7 +746,7 @@ The code constants carry the TypeScript names (`ERR_REQUIREMENT_DANGLING_REF`, a
 Run: `cd server/python && uv run pytest tests/conformance/test_requirement_check_conformance.py -q` (use the repository's usual Python test invocation if it differs). Expected: FAIL, `requirement_check` not importable.
 - [ ] **Step 3: Implement the accessors and the resolver.** `superseded_by()` returns the stripped-non-blank string or `None`; `is_retired()` compares with `REQUIREMENT_STATUS_RETIRED`. Both read through `get_meta_attr()`. `library_packages()` parses `EMBEDDED_LIBRARY_MANIFESTS` and returns the frozen union of every manifest's `packages`. `resolve_claim_target` calls `naming_refs.resolve_object_ref` first, then applies Table B's second row.
 - [ ] **Step 4: Implement the checks,** row by row from Table C, in the order of Table C, with the message text copied from the TypeScript file. Row 3 ends the loop body for that requirement. `scan_requirements` computes the claim set once (Table D) and `measure_coverage` from `library_packages()` unless forced.
-- [ ] **Step 5: Run the conformance runner.** Expected: PASS for all 42 cases. A failing case is a porting error; do not edit an `expected.json`.
+- [ ] **Step 5: Run the conformance runner.** Expected: PASS for all 43 cases. A failing case is a porting error; do not edit an `expected.json`.
 - [ ] **Step 6: Failing CLI tests** in `test_cli_verify_requirements.py`: `a model with no requirements prints nothing and exits as before` (compare stderr and the exit code of `verify` on an existing no-requirement fixture before and after); `a dangling live reference exits 1 and prints the code, the path and the summary line`; `warnings alone exit 0`; `--require-implementers exits 1 on a nothing-implements warning` and so does `META_REQUIRE_IMPLEMENTERS=1`; `the gate runs with --templates alone` (no subverb selects it); `a metadata load failure prints no requirement line`.
 - [ ] **Step 7: Wire `verify`.** Add `--require-implementers` to the `verify` parser. Factor the load inside `_field_lint_findings` into one helper that returns the root, the project's own files and the collection, and use it for both the field lint and the new `_verify_requirements(args) -> int`, so `verify` loads once for the two. `_verify_requirements` returns 0 when the root did not load, prints the lines of Table E to stderr with the `metaobjects verify —` prefix, and returns 1 when any diagnostic has severity `error`. In `_cmd_verify`: `exit_code = max(exit_code, _verify_requirements(args))`, on every run. Pass `coverable=collection.in_scope` when a collection was resolved.
 - [ ] **Step 8: Run** `uv run pytest tests/conformance/test_requirement_check_conformance.py tests/codegen/test_cli_verify_requirements.py tests/codegen/test_cli_verify_field_lint.py -q`, then the port's lint and type check as `scripts/ci-local.sh` runs them (read the Python lane for the commands). Expected: PASS.
@@ -678,7 +760,7 @@ Run: `cd server/python && uv run pytest tests/conformance/test_requirement_check
 **Files:**
 - Create: `server/python/src/metaobjects/codegen/requirement_walk.py`, `codegen/generators/requirement_tests_generator.py`
 - Modify: `codegen/generator_registry.py`, `codegen/project_config.py`, `codegen/metaobjects-config.schema.json`, `cli.py` (pass the config block to the factory), `fixtures/generator-registry-conformance/registry.json` (add `"python"` to `requirement-tests`' `ports`)
-- Test: `server/python/tests/conformance/test_requirement_test_identity_conformance.py`, `tests/codegen/test_requirement_tests_generator.py`
+- Test: `server/python/tests/conformance/test_requirement_test_identity_conformance.py`, `tests/codegen/test_requirement_tests_generator.py`, `tests/codegen/test_eject.py`
 
 **Interfaces:**
 - Consumes: `collect_addressed_requirements`, `resolve_claim` (Task 5).
@@ -697,6 +779,16 @@ class RequirementTestIdentity:
     skip: str | None          # None | "planned" | "retired"
     digest: str
 
+@dataclass(frozen=True)
+class RequirementView:          # what a filter receives; never the node
+    sub_type: str
+    level: int | None
+    status: str | None
+    path: str
+    package: str
+    implemented_by_types: tuple[str, ...]
+
+def default_requirement_test_filter(view: RequirementView) -> bool: ...
 def requirement_digest(node: MetaRequirement) -> str: ...
 def witness_key_of(qualified_address: str, unit: str) -> str: ...
 def requirement_test_identities(root, *, grain="concern", filter=None) -> list[RequirementTestIdentity]: ...
@@ -720,8 +812,15 @@ class RenderedTest:
 def requirement_tests(*, witness_module: str = "tests.requirement_witnesses",
                       grain: str = "concern", renderer=None, filter=None,
                       warn_uncovered: bool = True) -> Generator: ...
+
+def requirement_tests_generator(ctx: GeneratorBuildContext) -> Generator: ...
+    # The registry's `source=`, and so the symbol an ejected copy is wired by. It takes
+    # the build context (one required positional parameter, which is what `build_owned`
+    # passes the context to) and builds requirement_tests(...) from the config block.
 ```
 
+The module holds the generator **and** the default renderer and nothing unrelated: `metaobjects eject` copies the module file whole (Table L). **As built:** `RequirementTestArgs`, `RenderedTest` and the renderer type live in the packaged module `codegen/requirement_hooks.py`, not in the generator module as the block above shows. A project renderer imports them from the package, and an ejected copy must check a renderer's result against the package's class, not its own.
+
 Config block, in `metaobjects.config.yaml`:
 
 ```yaml
@@ -729,13 +828,15 @@ requirementTests:
   witnessModule: tests.requirement_witnesses
   grain: member
   renderer: codegen.requirement_renderer:render
+  filter: codegen.requirement_filter:include
+  warnUncovered: false
 ```
 
-- [ ] **Step 1: Read first.** `requirement-walk.ts`, `generators/requirement-tests.ts` and `templates/requirement-test.ts` (the escaping comments are the specification of Review Focus 1), then an existing Python generator factory and its registry entry, `eject.build_owned` (how a `module:symbol` is imported relative to the config), and `test_schema_and_loader_accept_EXACTLY_the_same_keys`. **UNVERIFIED:** how `metaobjects gen` reports or removes a generated file that is no longer emitted (`_diff_report`, `_is_ours_for` in `cli.py`), and whether a generator entry needs `source=` to appear in `eject`.
-- [ ] **Step 2: Failing identity runner,** parametrized over `fixtures/requirement-test-identity-conformance/`, comparing records as dicts with the corpus's field names (`witnessKey`, not `witness_key`). Run it. Expected: FAIL.
-- [ ] **Step 3: Implement `requirement_walk.py`** from Tables F and G. Digest lengths use `len(value.encode("utf-8"))`. Sort by `id` with plain string comparison. Run the identity runner. Expected: PASS for all 16 cases.
+- [ ] **Step 1: Read first.** `requirement-walk.ts`, `generators/requirement-tests.ts` and `templates/requirement-test.ts` (the escaping comments are the specification of Review Focus 1), then an existing Python generator factory and its registry entry, `eject.build_owned` (how a `module:symbol` is imported relative to the config), and `test_schema_and_loader_accept_EXACTLY_the_same_keys`. **UNVERIFIED:** how `metaobjects gen` reports or removes a generated file that is no longer emitted (`_diff_report`, `_is_ours_for` in `cli.py`). Confirmed since the plan was written: a registry entry is ejectable when it carries `source=`, `tests/codegen/test_eject.py::test_every_ejectable_entry_names_its_source` fails on an entry without it, and `eject.build_owned` passes the build context to a factory with exactly one required positional parameter. Read `codegen/eject.py` and that test before writing the factory.
+- [ ] **Step 2: Failing identity runner,** parametrized over `fixtures/requirement-test-identity-conformance/`, comparing records as dicts with the corpus's field names (`witnessKey`, not `witness_key`). The runner maps the `filter` name of `options.json` to a predicate over `RequirementView` with a table of exactly the eight rows of Table J, and passes it as `filter=`. Run it. Expected: FAIL.
+- [ ] **Step 3: Implement `requirement_walk.py`** from Tables F and G. Digest lengths use `len(value.encode("utf-8"))`. Sort by `id` with plain string comparison. Add one direct test of the key function: `witness_key_of("acme::shop::Café.Réglé", "*") == "req_acme_shop_Caf_R_gl_"` (Table F: the class is ASCII). Run the identity runner. Expected: PASS for all 26 cases.
 - [ ] **Step 4: Failing generator tests** in `test_requirement_tests_generator.py`:
-  - `the worked example renders the reference file`: compare with the Python block of Table H, byte for byte.
+  - `the worked example renders the reference file`: generate from the identity corpus's `worked-example` input and compare with the Python block of Table H, byte for byte.
   - `one file per metamodel package`, `an unpackaged ledger writes test_root_requirements.py`.
   - `the output imports only importlib and pytest`: parse with `ast` and collect every `Import` and `ImportFrom`.
   - `the output parses under the Python 3.9 grammar`: `ast.parse(source, feature_version=(3, 9))`.
@@ -743,13 +844,14 @@ requirementTests:
   - `the generated tests run`: write the file and a witness module into `tmp_path`, run `sys.executable -m pytest` in a subprocess, and assert one passed (witness present and returning), one failed with `unimplemented requirement:` and the counterexample (no witness), one failed with the witness's own assertion, one skipped (planned).
   - `a broken witness module raises its own error`: a witness module whose body does `import does_not_exist` makes the test error with `ModuleNotFoundError: No module named 'does_not_exist'`, not "unimplemented requirement".
   - `a witness-key collision refuses generation` with `ERR_REQUIREMENT_WITNESS_KEY_COLLISION` and both ids in the message.
-  - `grain="member" emits one test per reference`.
+  - `grain="member" emits one test per reference`; `an unknown grain is refused with a clear error` (in the identity function and in the generator; no corpus pins this, so the test is the gate).
   - `a renderer hook replaces one test and receives the digest`; `a hook returning None keeps the default`; `the hook's imports are merged, deduplicated and sorted`.
   - `a model with no requirement emits nothing and warns nothing`.
-  - `requirements the filter excludes produce one capped warning`.
+  - `requirements the filter excludes produce one capped warning`; `warn_uncovered=False` silences it; `a filter keeps an L3 requirement the default drops, and it renders with unit *`; `requirementTests.filter in the config is imported as module:symbol and applied`.
+  - In `tests/codegen/test_eject.py`: `an unchanged ejected requirement-tests copy generates identical output` (eject, wire the owned `module:symbol`, run `gen` over the identity corpus's `worked-example` model with a `requirementTests` block that sets `witnessModule` and `grain`, and compare with the packaged generator's output byte for byte; the non-default block is what proves the owned copy still reads its options), and `an edited copy drives gen` (change the failure message in the copy and see it in the output).
   - `stale file`: generate for two packages, remove one package's requirements, generate again, and assert what `gen` and `verify --codegen` report for the file that is no longer emitted. Write the assertion to match the port's existing behaviour for any generator and name that behaviour in the test title.
-- [ ] **Step 5: Implement the generator.** The factory returns a generator that reads `ctx.loaded_root`, returns `[]` when it is `None` or holds no requirement, refuses on a collision, groups identities by package and renders each file per Table H. The default renderer is a function with the hook's signature. Register it: name `requirement-tests`, tier `native`, layer `capability`, description equal to the manifest's `concept`.
-- [ ] **Step 6: Config.** Add `requirementTests` to `TOP_LEVEL_KEYS` and to the JSON Schema with its three string keys (`grain` an enum of `concern` and `member`), reject unknown keys, resolve `renderer` the way `providers` are resolved, and carry the block on `GeneratorBuildContext` so the registry factory builds `requirement_tests(...)` from it. With no block, the defaults apply.
+- [ ] **Step 5: Implement the generator.** The factory returns a generator that reads `ctx.loaded_root`, returns `[]` when it is `None` or holds no requirement, refuses on a collision, groups identities by package and renders each file per Table H. The default renderer is a function with the hook's signature. Register it: name `requirement-tests`, tier `native`, layer `capability`, description equal to the manifest's `concept`, `factory=requirement_tests_generator` and `source=requirement_tests_generator`.
+- [ ] **Step 6: Config.** Add `requirementTests` to `TOP_LEVEL_KEYS` and to the JSON Schema with its five keys (`witnessModule`, `renderer` and `filter` strings, `grain` an enum of `concern` and `member`, `warnUncovered` a boolean), reject unknown keys, resolve `renderer` and `filter` the way `providers` are resolved, and carry the block on `GeneratorBuildContext` so the registry factory builds `requirement_tests(...)` from it. With no block, the defaults apply.
 - [ ] **Step 7: Run** `uv run pytest tests/conformance/test_requirement_test_identity_conformance.py tests/conformance/test_generator_registry_conformance.py tests/codegen/test_requirement_tests_generator.py tests/codegen/test_codegen_compile_conformance.py -q` and the config-key parity test. Expected: PASS. The compile gate's model has no requirement, so its output set is unchanged.
 - [ ] **Step 8: Add the Python row** to the identity corpus README.
 - [ ] **Step 9: Commit.** `git commit -m "feat(python): requirement-tests generator emitting pytest with project-owned witnesses"`
@@ -792,7 +894,7 @@ public final class RequirementCheck {
 
 Run: `mvn -q -f server/java/pom.xml -pl metadata test -Dtest=RequirementCheckConformanceTest`. Expected: FAIL to compile. Use `MAVEN_ARGS` for a repository override, never `MAVEN_OPTS`.
 - [ ] **Step 3: Implement** the accessors, `libraryPackages()` (parse each `EmbeddedLibrary.MANIFESTS` value's `packages`, the way `parseLayers` reads `layers`), `RequirementClaims` (objects through one `SymbolTable` built per scan) and `RequirementCheck`, row by row from Table C with the message text copied from the TypeScript file. Expose one did-you-mean helper instead of writing a third copy.
-- [ ] **Step 4: Run** the runner. Expected: PASS for all 42 cases.
+- [ ] **Step 4: Run** the runner. Expected: PASS for all 43 cases.
 - [ ] **Step 5: Failing mojo tests** in `MetaDataVerifyRequirementsTest.java`, on the pattern of `MetaDataVerifyFieldLintTest.java`: no requirements logs nothing and does not fail; a dangling live reference throws `MojoFailureException` after logging the code, path and summary; warnings alone do not fail; `requireImplementers` (the parameter and the environment variable) fails on a nothing-implements warning; the gate runs once per `execute()` whichever of the template and codegen gates ran.
 - [ ] **Step 6: Wire the mojo.** A `@Parameter(property = "meta.verify.requireImplementers", defaultValue = "false")`, and `runRequirementGate(loader)` called once from `execute()`. It logs the summary with `getLog().info`, warnings with `getLog().warn`, errors with `getLog().error`, each prefixed `metaobjects:verify —`, and throws `MojoFailureException` when any error was found. Kotlin projects get the gate through this goal.
 - [ ] **Step 7: Run** `mvn -q -f server/java/pom.xml -pl metadata,maven-plugin -am test -Dtest='RequirementCheckConformanceTest,MetaDataVerifyRequirementsTest,MetaDataVerifyFieldLintTest,RequirementTest'`. Expected: PASS.
@@ -804,10 +906,11 @@ Run: `mvn -q -f server/java/pom.xml -pl metadata test -Dtest=RequirementCheckCon
 ### Task 8: Java `requirement-tests` generator
 
 **Files:**
-- Create: `server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementTestIdentities.java`
-- Create: `server/java/codegen-base/src/main/java/com/metaobjects/generator/requirement/JUnitRequirementTestsGenerator.java`, `RequirementTestRenderer.java`, `RequirementTestArgs.java`, `RenderedTest.java`
-- Modify: `codegen-spring/src/main/java/com/metaobjects/generator/GeneratorRegistry.java`, `codegen-base/pom.xml` (JUnit Jupiter API, test scope, for compiling generated output in the test), `fixtures/generator-registry-conformance/registry.json` (add `"java"`)
-- Test: `metadata/src/test/java/com/metaobjects/conformance/RequirementTestIdentityConformanceTest.java`, `codegen-base/src/test/java/com/metaobjects/generator/requirement/JUnitRequirementTestsGeneratorTest.java`
+- Create: `server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementTestIdentities.java`, `RequirementTestFilter.java`
+- Create: `server/java/codegen-base/src/main/java/com/metaobjects/generator/requirement/RequirementTestRenderer.java`, `RequirementTestArgs.java`, `RenderedTest.java` (the hook types: package API, not ejected, and visible to `codegen-kotlin`)
+- Create: `JUnitRequirementTestsGenerator.java` in `codegen-spring`, in the package the other ejectable Java generators live in. One file, holding the default rendering (Table L). It lives in `codegen-spring` because that module's `pom.xml` is what ships generator sources as eject resources.
+- Modify: `codegen-spring/src/main/java/com/metaobjects/generator/GeneratorRegistry.java`, `codegen-spring/pom.xml` (the eject `<include>`; JUnit Jupiter API, test scope, for compiling generated output in the test), `docs/ports/java.md` (the registry conformance test requires every registered generator to be named there by stable name and class), `fixtures/generator-registry-conformance/registry.json` (add `"java"`)
+- Test: `metadata/src/test/java/com/metaobjects/conformance/RequirementTestIdentityConformanceTest.java`, `JUnitRequirementTestsGeneratorTest.java` beside the generator in `codegen-spring`, `codegen-spring`'s `EjectedGeneratorsCompileTest.java` (the name list), and a round-trip test in `maven-plugin` on the pattern of `EjectRoundTripTest.java`
 
 **Interfaces:**
 - Consumes: `RequirementCheck.collectAddressed`, `RequirementClaims.resolveClaim` (Task 7).
@@ -820,23 +923,33 @@ public final class RequirementTestIdentities {
                            String status, String skip, String digest) {}
     public static String digest(MetaRequirement node);
     public static String witnessKeyOf(String qualifiedAddress, String unit);
-    public static List<Identity> identities(MetaRoot root, Grain grain);
+    /** What a filter receives; never the node. level and status may be null. */
+    public record View(String subType, Integer level, String status, String path, String pkg,
+                       List<String> implementedByTypes) {}
+    public static boolean defaultFilter(View view);
+    /** A null filter means the default. */
+    public static List<Identity> identities(MetaRoot root, Grain grain, RequirementTestFilter filter);
     public static List<String[]> witnessKeyCollisions(List<Identity> tests);
 }
 
+/** In `metadata`, beside the identities, because the identity function applies it. */
+public interface RequirementTestFilter {
+    boolean include(RequirementTestIdentities.View view);
+}
+
 public interface RequirementTestRenderer {
     /** Return null to keep the default rendering of this test. */
     RenderedTest render(RequirementTestArgs args);
 }
 ```
 
-Generator args: `testPackage` (required), `witnessClass` (required, a fully-qualified class name), `grain` (`concern` or `member`), `renderer` (optional class name).
+Generator args: `testPackage` (required), `witnessClass` (required, a fully-qualified class name), `grain` (`concern` or `member`), `renderer` (optional class name), `filter` (optional class name of a `RequirementTestFilter`), `warnUncovered` (`true` by default).
 
-- [ ] **Step 1: Read first.** `GeneratorBase.java` (`getArg`, the output-directory args), one existing `codegen-base` generator that writes Java source and its test, `CodegenCompileConformanceTest.java` in `codegen-spring` (how generated Java is compiled in a test), and how `MetaDataGeneratorMojo` instantiates a generator class by name. **UNVERIFIED:** whether `codegen-base` or the registry module should own the generator given `GeneratorRegistry` lives in `codegen-spring`; how a renderer class named in an arg can be loaded with the same class loader as the generator; how the JUnit Jupiter version is managed in `server/java/pom.xml` (it is used today only by the Kotlin and integration modules).
-- [ ] **Step 2: Failing identity runner,** then implement `RequirementTestIdentities` from Tables F and G (`value.getBytes(StandardCharsets.UTF_8).length`, `MessageDigest` SHA-256, sort with `String.compareTo`). Run: `mvn -q -f server/java/pom.xml -pl metadata test -Dtest=RequirementTestIdentityConformanceTest`. Expected: FAIL, then PASS for all 16 cases.
-- [ ] **Step 3: Failing generator tests:** the worked example emits `Requirements_acme_shop_Witnesses.java` and `Requirements_acme_shop_Test.java` in `testPackage`; the interface has one default member per non-skipped test and none for a skipped one; a skipped test carries `@Disabled` with the reason of Table H; the output imports only `org.junit.jupiter.api.*`; **the output compiles** with `javax.tools` together with a hand-written witness class, and invoking the test method on the compiled class throws `AssertionError` whose message holds `unimplemented requirement:` and the counterexample when the witness class does not override it, and returns normally when it does; prose with `"`, `\`, a newline and `*/` still compiles; a collision throws `GeneratorException` naming `ERR_REQUIREMENT_WITNESS_KEY_COLLISION` and both ids; `grain=member`; a renderer class replaces one test and receives the digest; a missing `witnessClass` arg is a clear `GeneratorException`; a model with no requirement writes nothing; `stale file` as in Task 6.
-- [ ] **Step 4: Implement** per Table H. The test class holds `private final Requirements_<pkgKey>_Witnesses witnesses = new <witnessClass>();`. Register `requirement-tests` with `Tier.NATIVE` and `Layer.CAPABILITY` (the enum's capability constant; read its name).
-- [ ] **Step 5: Run** `mvn -q -f server/java/pom.xml -pl metadata,codegen-base,codegen-spring -am test -Dtest='RequirementTestIdentityConformanceTest,JUnitRequirementTestsGeneratorTest,GeneratorRegistryConformanceTest,CodegenCompileConformanceTest'`. Expected: PASS.
+- [ ] **Step 1: Read first.** `GeneratorBase.java` (`getArg`, the output-directory args), one existing `codegen-base` generator that writes Java source and its test, `CodegenCompileConformanceTest.java` in `codegen-spring` (how generated Java is compiled in a test), and how `MetaDataGeneratorMojo` instantiates a generator class by name. Also read `maven-plugin`'s `MetaDataEjectMojo.java`, `EjectSupport.java` and `EjectRoundTripTest.java`, and `codegen-spring/pom.xml`'s eject `<include>` list. Settled since the plan was written: the generator lives in `codegen-spring` (Table L). **UNVERIFIED:** how a renderer or filter class named in an arg can be loaded so that a class on the **project's** classpath is found. The mojo loads the generator with a project class loader whose parent is the plugin's, so a packaged generator's own loader does not see project classes; read `AbstractMetaDataMojo.buildGenerators` and `createProjectClassLoader`, and pass or set the loader rather than guess. No generator arg names a loadable class today, so this is new ground: stop and report if it cannot be done without changing how every generator is constructed; how the JUnit Jupiter version is managed in `server/java/pom.xml` (it is used today only by the Kotlin and integration modules).
+- [ ] **Step 2: Failing identity runner,** then implement `RequirementTestIdentities` from Tables F and G (`value.getBytes(StandardCharsets.UTF_8).length`, `MessageDigest` SHA-256, sort with `String.compareTo`; one direct test that `witnessKeyOf("acme::shop::Café.Réglé", "*")` is `req_acme_shop_Caf_R_gl_`, since `Character.isLetterOrDigit` is the wrong class). The runner maps the `filter` name of `options.json` to a `RequirementTestFilter` with a table of exactly the eight rows of Table J. Run: `mvn -q -f server/java/pom.xml -pl metadata test -Dtest=RequirementTestIdentityConformanceTest`. Expected: FAIL, then PASS for all 26 cases.
+- [ ] **Step 3: Failing generator tests:** the worked example (the identity corpus's `worked-example` input) emits `Requirements_acme_shop_Witnesses.java` and `Requirements_acme_shop_Test.java` in `testPackage`; the interface has one default member per non-skipped test and none for a skipped one; a skipped test carries `@Disabled` with the reason of Table H; the output imports only `org.junit.jupiter.api.*`; **the output compiles** with `javax.tools` together with a hand-written witness class, and invoking the test method on the compiled class throws `AssertionError` whose message holds `unimplemented requirement:` and the counterexample when the witness class does not override it, and returns normally when it does; prose with `"`, `\`, a newline and `*/` still compiles; a collision throws `GeneratorException` naming `ERR_REQUIREMENT_WITNESS_KEY_COLLISION` and both ids; `grain=member`; an unknown `grain` is refused with a clear error (no corpus pins this, so the test is the gate); a renderer class replaces one test and receives the digest; a `filter` class keeps an L3 requirement the default drops and it renders with unit `*`; the excluded requirements produce one capped warning and `warnUncovered=false` silences it; a `filter` class that cannot be loaded is a clear `GeneratorException`; a missing `witnessClass` arg is a clear `GeneratorException`; a model with no requirement writes nothing; `stale file` as in Task 6. **Eject:** `requirement-tests` is in `EjectedGeneratorsCompileTest`'s list and compiles package-renamed against the published API; the round-trip test ejects it, compiles the unchanged copy and gets byte-identical output over the `worked-example` model with non-default `grain` and `testPackage` args; `EjectSupportTest` still passes with its hard-coded non-ejectable set unchanged.
+- [ ] **Step 4: Implement** per Table H. The test class holds `private final Requirements_<pkgKey>_Witnesses witnesses = new <witnessClass>();`. Register `requirement-tests` with `Tier.NATIVE`, `Layer.CAPABILITY` (the enum's capability constant; read its name) and `ejectPath(JUnitRequirementTestsGenerator.class)`, add the `<include>` to `codegen-spring/pom.xml`, and name the generator in `docs/ports/java.md`. Nothing in the generated header may carry the generator's own class or package name: the ejected copy has a different one, and its output must be byte-identical.
+- [ ] **Step 5: Run** `mvn -q -f server/java/pom.xml -pl metadata,codegen-base,codegen-spring,maven-plugin -am test -Dtest='RequirementTestIdentityConformanceTest,JUnitRequirementTestsGeneratorTest,GeneratorRegistryConformanceTest,CodegenCompileConformanceTest,EjectedGeneratorsCompileTest,EjectSupportTest,EjectRoundTripTest,MetaDataEjectMojoTest'` plus the new round-trip test by name (add `-Dsurefire.failIfNoSpecifiedTests=false` if a module holds none of them). Expected: PASS.
 - [ ] **Step 6: Add the Java row** to the identity corpus README.
 - [ ] **Step 7: Commit.** `git commit -m "feat(java): requirement-tests generator emitting JUnit with a typed witness interface"`
 
@@ -855,7 +968,7 @@ Generator args: `testPackage` (required), `witnessClass` (required, a fully-qual
 - [ ] **Step 1: Read first.** The two TypeScript files; `NamingRefs.cs` (`ResolveObjectRef`, `EffectivePackage`, `DidYouMeanHint`); `MetaObjects.Cli/FieldLint.cs` and `Program.cs:460-650` (flag parsing, `--no-field-lint`, the `FieldLint.RunAdvisory` call and its output prefix); `MetaObjects.Cli.Tests/FieldLintConformanceTests.cs`. `MetaData` has `SuperData`, `Parent`, `ResolutionKey()` and `IsAbstract`. **UNVERIFIED:** whether `DidYouMeanHint`'s text matches TypeScript's; where `verify` computes its exit code so the gate can contribute to it.
 - [ ] **Step 2: Failing conformance runner** on the pattern of `FieldLintConformanceTests.cs`, in `MetaObjects.Conformance.Tests` (the checks are core, not CLI). Run: `dotnet test server/csharp --filter RequirementCheckConformance`. Expected: FAIL to compile.
 - [ ] **Step 3: Implement** the accessors, `LibraryPackages()` and the two classes, row by row from Table C.
-- [ ] **Step 4: Run** the runner. Expected: PASS for all 42 cases.
+- [ ] **Step 4: Run** the runner. Expected: PASS for all 43 cases.
 - [ ] **Step 5: Failing CLI tests** in `VerifyRequirementsTests.cs`, mirroring Task 5 Step 6: silence and an unchanged exit code with no requirements; exit 1 and the printed lines on a dangling live reference; exit 0 on warnings; `--require-implementers` and `META_REQUIRE_IMPLEMENTERS=1`.
 - [ ] **Step 6: Wire the CLI.** Parse `--require-implementers`, add it to the usage line, and run the gate on every `verify` beside the field lint, writing to `Console.Error` and folding a non-zero result into the command's exit code.
 - [ ] **Step 7: Run** `dotnet test server/csharp --filter "RequirementCheckConformance|VerifyRequirements|VerifyFieldLint|FieldLintConformance"`. Expected: PASS.
@@ -868,18 +981,18 @@ Generator args: `testPackage` (required), `witnessClass` (required, a fully-qual
 
 **Files:**
 - Create: `server/csharp/MetaObjects/Core/Requirement/RequirementTestIdentities.cs`, `MetaObjects.Codegen/Generators/RequirementTestsGenerator.cs`
-- Modify: `MetaObjects.Codegen/GeneratorRegistry.cs`, `fixtures/generator-registry-conformance/registry.json` (add `"csharp"`)
-- Test: `MetaObjects.Conformance.Tests/RequirementTestIdentityConformanceTests.cs`, `MetaObjects.Codegen.Tests/RequirementTestsGeneratorTests.cs`
+- Modify: `MetaObjects.Codegen/GeneratorRegistry.cs` (the entry, with `SourceFileName`), `MetaObjects.Codegen/MetaObjects.Codegen.csproj` (the `<EmbeddedResource>` item), `fixtures/generator-registry-conformance/registry.json` (add `"csharp"`)
+- Test: `MetaObjects.Conformance.Tests/RequirementTestIdentityConformanceTests.cs`, `MetaObjects.Codegen.Tests/RequirementTestsGeneratorTests.cs`, `MetaObjects.Codegen.Tests/EjectedGeneratorCompileTests.cs`, `EjectableGeneratorsTests.cs`
 
 **Interfaces:**
 - Consumes: Task 9's walk and resolver.
-- Produces: `RequirementTestIdentities.Digest`, `WitnessKeyOf`, `Identities(root, grain)`, `WitnessKeyCollisions`; `record RequirementTestIdentity(string Package, string Path, string Unit, string Id, string WitnessKey, string? Status, string? Skip, string Digest)`; `interface IRequirementTestRenderer { RenderedTest? Render(RequirementTestArgs args); }`.
+- Produces: `RequirementTestIdentities.Digest`, `WitnessKeyOf`, `DefaultFilter`, `Identities(root, grain, filter: null)`, `WitnessKeyCollisions`; `record RequirementView(string SubType, int? Level, string? Status, string Path, string Package, IReadOnlyList<string> ImplementedByTypes)`; `interface IRequirementTestFilter { bool Include(RequirementView view); }`; `record RequirementTestIdentity(string Package, string Path, string Unit, string Id, string WitnessKey, string? Status, string? Skip, string Digest)`; `interface IRequirementTestRenderer { RenderedTest? Render(RequirementTestArgs args); }`.
 
-- [ ] **Step 1: Read first.** `Generator.cs` (`IGenerator`, `GenContext`), an existing generator and its registry entry, `CodegenCompileConformanceTests.cs` (the Roslyn compile helper), `MetaObjects.Cli/GenCommand.cs` and `OwnedCopy.cs`. **UNVERIFIED:** how a per-generator option (`testNamespace`, `witnessClass`, `grain`, a renderer) reaches a C# generator from the CLI or a config file; decide from the code, keep the four names of Table I, and state the surface in the commit. **UNVERIFIED:** that `Xunit.Sdk.XunitException(string)` is usable from generated code under xUnit 2.9.2; if not, throw `System.InvalidOperationException` and say so in Table H when updating the docs.
-- [ ] **Step 2: Failing identity runner,** then implement `RequirementTestIdentities` (`Encoding.UTF8.GetByteCount`, `SHA256.HashData`, lower-case hex, `StringComparer.Ordinal`). Expected: PASS for all 16 cases.
-- [ ] **Step 3: Failing generator tests,** the C# equivalents of Task 8 Step 3: the two files per package; interface members only for non-skipped tests; `[Fact(Skip = "…")]`; only `Xunit` imported; **the output compiles** with Roslyn beside a hand-written witness class, and invoking the test method throws with the unimplemented message when the member is not implemented and returns when it is; the escaping case (`"`, `\`, a newline, `*/`); the collision refusal; member grain; the renderer hook; no requirements writes nothing; `stale file`.
-- [ ] **Step 4: Implement** per Table H and register `requirement-tests` (`Tier` native, `Layer` capability).
-- [ ] **Step 5: Run** `dotnet test server/csharp --filter "RequirementTestIdentityConformance|RequirementTestsGenerator|GeneratorRegistryConformance|CodegenCompileConformance"`. Expected: PASS.
+- [ ] **Step 1: Read first.** `Generator.cs` (`IGenerator`, `GenContext`), an existing generator and its registry entry, `CodegenCompileConformanceTests.cs` (the Roslyn compile helper), `MetaObjects.Cli/GenCommand.cs` and `OwnedCopy.cs`. **UNVERIFIED:** how a per-generator option (`testNamespace`, `witnessClass`, `grain`, a renderer, a filter, `warnUncovered`) reaches a C# generator from the CLI or a config file; decide from the code, keep the six names of Table I, and state the surface in the commit. Known since the plan was written: no per-generator option channel exists (`GenConfig` is global to the run, `.metaobjects/config.json` carries `sources` and `libraries` only), an owned `codegen/Program.cs` constructs generators itself (`new X { … }`), and the packaged tool cannot load a project's classes. The surface that follows from that: **public init properties on `RequirementTestsGenerator`**, with defaults that make the packaged `dotnet meta gen --generators requirement-tests` run work with no option at all (derive the test namespace and the witness class name from `GenConfig.Namespace`), and the project sets any of the six in its `codegen/Program.cs`. Do not add keys to `.metaobjects/config.json`: it is the neutral config every port reads. Also read `EjectableGenerators.cs` (`RewriteForEject` needs the exact line `namespace MetaObjects.Codegen.Generators;`, and the file may use nothing `internal`), `EjectCommand.cs`, `EjectedGeneratorCompileTests.cs` and `EjectableGeneratorsTests.cs`. **UNVERIFIED:** that `Xunit.Sdk.XunitException(string)` is usable from generated code under xUnit 2.9.2; if not, throw `System.InvalidOperationException` and say so in Table H when updating the docs.
+- [ ] **Step 2: Failing identity runner,** the runner mapping the `filter` name of `options.json` to an `IRequirementTestFilter` with a table of exactly the eight rows of Table J; then implement `RequirementTestIdentities` (`Encoding.UTF8.GetByteCount`, `SHA256.HashData`, lower-case hex, `StringComparer.Ordinal`; one direct test that `WitnessKeyOf("acme::shop::Café.Réglé", "*")` is `req_acme_shop_Caf_R_gl_`, since `char.IsLetterOrDigit` is the wrong class). Expected: PASS for all 26 cases.
+- [ ] **Step 3: Failing generator tests,** the C# equivalents of Task 8 Step 3: the two files per package; interface members only for non-skipped tests; `[Fact(Skip = "…")]`; only `Xunit` imported; **the output compiles** with Roslyn beside a hand-written witness class, and invoking the test method throws with the unimplemented message when the member is not implemented and returns when it is; the escaping case (`"`, `\`, a newline, `*/`); the collision refusal; member grain; an unknown grain refused with a clear error; the renderer hook; a filter keeps an L3 requirement the default drops; the capped uncovered warning and its switch; no requirements writes nothing; `stale file`. **Eject:** the embedded copy is byte-identical to `Generators/RequirementTestsGenerator.cs` and the embedded set still equals the registry's ejectable set (`EjectableGeneratorsTests`); the rewritten copy compiles with Roslyn against the public API only and, with non-default `Grain` and `TestNamespace`, emits the same bytes as the packaged generator over the `worked-example` model.
+- [ ] **Step 4: Implement** per Table H, in one file that holds the default rendering (Table L), and register `requirement-tests` (`Tier` native, `Layer` capability, `SourceFileName = "RequirementTestsGenerator.cs"`) with its `<EmbeddedResource>` item.
+- [ ] **Step 5: Run** `dotnet test server/csharp --filter "RequirementTestIdentityConformance|RequirementTestsGenerator|GeneratorRegistryConformance|CodegenCompileConformance|EjectableGenerators|EjectedGeneratorCompile|EjectEndToEnd"`. Expected: PASS.
 - [ ] **Step 6: Add the C# row** to the identity corpus README.
 - [ ] **Step 7: Commit.** `git commit -m "feat(csharp): requirement-tests generator emitting xUnit with a typed witness interface"`
 
@@ -889,15 +1002,15 @@ Generator args: `testPackage` (required), `witnessClass` (required, a fully-qual
 
 **Files:**
 - Create: `server/java/codegen-kotlin/src/main/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGenerator.kt`
-- Modify: `codegen-kotlin/.../GeneratorRegistry.kt`, `fixtures/generator-registry-conformance/registry.json` (add `"kotlin"`)
-- Test: `codegen-kotlin/src/test/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGeneratorTest.kt`
+- Modify: `codegen-kotlin/.../GeneratorRegistry.kt` (the entry, with `ejectResourcePath`), `codegen-kotlin/pom.xml` (the eject `<include>`), `fixtures/generator-registry-conformance/registry.json` (add `"kotlin"`), `docs/ports/kotlin.md` if its registry conformance test requires the generator to be named there
+- Test: `codegen-kotlin/src/test/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGeneratorTest.kt`, `EjectedGeneratorsCompileTest.kt` (`ejectableSimpleNames`)
 
 **Interfaces:**
-- Consumes: `RequirementTestIdentities`, `RequirementTestRenderer`, `RequirementTestArgs`, `RenderedTest` (Task 8). Same four generator args as Java.
+- Consumes: `RequirementTestIdentities`, `RequirementTestRenderer`, `RequirementTestArgs`, `RenderedTest` (Task 8). Same six generator args as Java, the `filter` arg naming a `RequirementTestFilter` class.
 
 - [ ] **Step 1: Read first.** `KotlinNamesGenerator.kt` (a small generator and how it writes), `KotlinGenUtil.kt` (string escaping helpers, including `$`), `CodegenCompileConformanceTest.kt` and `KotlinSpringControllerGeneratorTest.kt` (kotlin-compile-testing). **UNVERIFIED:** that `codegen-kotlin` can see `codegen-base`'s `generator.requirement` types.
-- [ ] **Step 2: Failing tests:** the worked example emits `Requirements_acme_shop_Witnesses.kt` (an interface whose members have default bodies) and `Requirements_acme_shop_Test.kt`; the emitted test function names equal the `witnessKey` values of the identity corpus's `concern-fanout` case (this is how Kotlin asserts the identity contract; the identity function itself is the JVM one Task 8 gates); skipped tests carry `@Disabled`; **the output compiles** with a hand-written witness class and behaves as in Task 8 when invoked; a counterexample containing `$name`, `"`, `\` and a newline compiles and survives into the message; the collision refusal; member grain; the renderer hook; no requirements writes nothing.
-- [ ] **Step 3: Implement** per Table H and register `requirement-tests`.
+- [ ] **Step 2: Failing tests:** the worked example emits `Requirements_acme_shop_Witnesses.kt` (an interface whose members have default bodies) and `Requirements_acme_shop_Test.kt`; the emitted test function names equal the `witnessKey` values of the identity corpus's `worked-example` and `concern-fanout` cases (this is how Kotlin asserts the identity contract; the identity function itself is the JVM one Task 8 gates); skipped tests carry `@Disabled`; **the output compiles** with a hand-written witness class and behaves as in Task 8 when invoked; a counterexample containing `$name`, `"`, `\` and a newline compiles and survives into the message; the collision refusal; member grain; an unknown grain refused with a clear error; the renderer hook; a `filter` class keeps an L3 requirement the default drops; the capped uncovered warning and its switch; no requirements writes nothing. **Eject:** `KotlinRequirementTestsGenerator` is in `ejectableSimpleNames` and compiles package-renamed; and, new for this port, the package-renamed copy is instantiated from the compiled result, run over the `worked-example` model with non-default `grain` and `testPackage`, and its output is byte-identical to the packaged generator's.
+- [ ] **Step 3: Implement** per Table H, in one file that holds the default rendering (Table L), and register `requirement-tests` with `ejectResourcePath = ejectPath("KotlinRequirementTestsGenerator")` and the `<include>` in `codegen-kotlin/pom.xml`.
 - [ ] **Step 4: Run** the `codegen-kotlin` unit suite for the new test, `GeneratorRegistryConformanceTest`, `CodegenCompileConformanceTest`, and the Exposed 1.x check module (`codegen-kotlin-exposed1x-check`) since it re-runs the Kotlin generators. Expected: PASS.
 - [ ] **Step 5: Add the Kotlin row** to the identity corpus README ("identity function inherits via Java; emitted names asserted by `KotlinRequirementTestsGeneratorTest`").
 - [ ] **Step 6: Commit.** `git commit -m "feat(kotlin): requirement-tests generator emitting JUnit with a typed witness interface"`
@@ -916,6 +1029,8 @@ Generator args: `testPackage` (required), `witnessClass` (required, a fully-qual
 - Modify: `metaobjects/meta.requirements.yaml`, then regenerate `fixtures/requirement-harness/*`
 
 - [ ] **Step 1: `docs/features/requirements.md`.** State the gate as Tables C to E in prose, per port, with each port's command. State the witness model as Table H with one short example per ecosystem and the one-time setup (create the witness module or class). State the strict switch. Keep "What a green run does not prove" and add: a generated test that passes proves the witness ran, not that the witness tests the claim.
+- [ ] **Step 1b: Present it as a recommendation.** In `docs/features/requirements.md`, the section on generated tests opens by saying what it is: the stock generator and the witness model are a **recommended approach**, shipped as a reference helper, and an application may change or replace them. Give each port's eject command (`meta eject requirement-tests`, `metaobjects eject requirement-tests`, `mvn metaobjects:eject -Dgenerator=requirement-tests` in the form that goal really takes, `dotnet meta eject requirement-tests`; **run each before documenting it**), say what the copy holds (the generator and its default renderer) and what stays in the package (the identity function, the digest and the checks), and say plainly that the checks in `verify` are not ejectable because they are the contract. Add the generator to `docs/features/own-your-codegen.md` where that page lists what each port can eject. The same framing goes into the per-port `metaobjects-codegen` skill paragraphs and the `docs/ports/*.md` rows.
+- [ ] **Step 1c: `CLAUDE.md` and `AGENTS.md`, one more sentence this change makes false:** the "Core vs helpers" paragraph lists `requirement-tests` among the TypeScript generators that ship no reference copy. Remove that one name from the list. Nothing else.
 - [ ] **Step 2: `docs/ports/python.md`, "Selecting the interpreter".** `metaobjects` needs Python 3.11 or later to **run**. The tests it generates need only pytest and run on the project's own interpreter, 3.9 or later. A project on an older interpreter runs the tool with a different one, without changing its own: `uv tool run --python 3.12 metaobjects gen` and `uv tool run --python 3.12 metaobjects verify` (**UNVERIFIED:** run both before documenting them, and add the `pipx run --python` form only if it is confirmed). Say plainly that the floor is not being lowered.
 - [ ] **Step 3: Skills, then regenerate.**
 
@@ -929,7 +1044,7 @@ cd ../../../.. && bun scripts/check-doc-examples.ts
 Expected: PASS.
 - [ ] **Step 4: Counts.** Two new corpora take the shared-corpus count from 26 to 28 wherever it is stated (`docs/CONFORMANCE.md`, `CLAUDE.md`, `AGENTS.md`). Run `bun test scripts/site/counts.test.ts`. **UNVERIFIED:** what that test counts; read it first.
 - [ ] **Step 5: The project's own ledger.** Read the entries in `metaobjects/meta.requirements.yaml` about the requirement gate and requirement tests. Move to a non-`planned` status only what this slice makes true, with an `implementedBy` that resolves, then run `bun scripts/generate-requirement-harness.ts` and `scripts/check-requirements-ledger.ts`. **UNVERIFIED:** which entries those are; if none, change nothing and say so in the commit.
-- [ ] **Step 6: CHANGELOG `[Unreleased]`.** Added: the requirement gate in `metaobjects verify`, `metaobjects:verify` and `dotnet meta verify`; a `requirement-tests` generator in Python, Java, Kotlin and C#; `--require-implementers` in every port; `grain` and the digest on the TypeScript generator. State that a project with no `requirement.*` node sees no change, and that a project **with** requirements on a non-TypeScript port will now see diagnostics it did not see before, and may see a failing `verify`.
+- [ ] **Step 6: CHANGELOG `[Unreleased]`.** Added: the requirement gate in `metaobjects verify`, `metaobjects:verify` and `dotnet meta verify`; a `requirement-tests` generator in Python, Java, Kotlin and C#, ejectable in each; a TypeScript reference template for `requirement-tests`, so `meta eject requirement-tests` works instead of answering `package-only`; `--require-implementers` in every port; `grain` and the digest on the TypeScript generator; the same filter and uncovered-warning options on the generator in every port. State that a project with no `requirement.*` node sees no change, and that a project **with** requirements on a non-TypeScript port will now see diagnostics it did not see before, and may see a failing `verify`.
 - [ ] **Step 7: Commit.** `git commit -m "docs(requirements): the gate and the requirement-test generator in every port (ADR-0057)"`
 
 ---
@@ -967,28 +1082,32 @@ Each is the first step of the task that touches it.
 |---|---|
 | No corpus case has been loaded yet; a case of Table J may need a different model shape to load strict, or may be unreachable | 2, 4 |
 | Where `codegen-ts` exports `walkRequirements` from, and whether `node:crypto` is already used in that package | 3 |
-| What `ejectable("requirement-tests")` means in `codegen-ts/src/generator-registry.ts:404`, given no copy exists under `codegen-ts/src/reference/` | 3 |
+| ~~What `ejectable("requirement-tests")` means~~ Resolved: the flag is derived from `REFERENCE_GENERATOR_NAMES`, so it is `false` until Task 3 Step 9 ships the reference template | 3 |
 | Python: the effective package of a nested requirement in a multi-file collection; the resolved-super accessor and the abstract flag on `MetaData`; that `in_scope` matches TypeScript's `inScope` | 5 |
 | That each port's did-you-mean hint is byte-identical to TypeScript's (the corpus pins it) | 5, 7, 9 |
 | How each port's `gen` and `verify --codegen` treat a generated file that is no longer emitted | 6, 8, 10, 11 |
-| Whether a Python registry entry needs `source=` to be ejectable, and whether `requirement-tests` should be | 6 |
+| ~~Whether a Python registry entry needs `source=`~~ Resolved: it does, and `requirement-tests` is ejectable in every port by the owner's requirement (Table L) | 6 |
 | Java: the file-default-package and abstract accessors on `MetaData`; whether `getPackage()` is set on a nested requirement; the Java language level of `metadata` | 7 |
-| Java: which module should own the generator; loading a renderer class named in a generator arg; JUnit Jupiter version management | 8 |
+| Java: loading a renderer or filter class named in a generator arg from the project's classpath; JUnit Jupiter version management. (Which module owns the generator is resolved: `codegen-spring`, Table L) | 8 |
 | C#: the output prefix of `FieldLint.RunAdvisory`; where `verify` computes its exit code | 9 |
-| C#: how a per-generator option reaches a generator; `Xunit.Sdk.XunitException` from generated code | 10 |
-| Kotlin: that `codegen-kotlin` sees `codegen-base`'s new types | 11 |
+| C#: `Xunit.Sdk.XunitException` from generated code. (The option surface is resolved: init properties on the generator, Task 10 Step 1) | 10 |
+| ~~Kotlin: that `codegen-kotlin` sees `codegen-base`'s new types~~ Resolved: it depends on `metaobjects-codegen-base` | 11 |
 | The `uv tool run --python` commands (not run) | 12 |
 | What `scripts/site/counts.test.ts` counts; whether `README.md` states the TypeScript-only split; which ledger entries this slice makes true | 12 |
 | That a requirement can nest only under a requirement or the root (read from `requirement.json`'s child rules only, not from a loader) | 2 |
 
-## Open questions for the captain
-
-1. **The seven authoring-lint advisories** (`requirement-lint.ts`). The plan ports the eleven gate codes and the summary, and leaves the advisory lint TypeScript-only. It never fails a build, and it is about 380 lines of prose rules per port. Default: a follow-up slice. Say if "do them all" includes it now.
-2. **The strict switch.** The plan raises `WARN_REQUIREMENT_NOTHING_IMPLEMENTS` to severity error and keeps the code, as the object-coverage constant already does, and names the flag `--require-implementers`. The alternative is a new `ERR_` code. Default: keep the code.
-3. **How a JVM or .NET test finds its witness.** The plan generates an interface with a failing default per test and has the project name one class that implements it: no reflection, and a deleted requirement breaks a stale override at compile time. The cost is one compile error until the project creates that class. The alternative is a by-name lookup at run time, as Python does. Default: the interface.
-4. **Java's test framework.** Generated Java and Kotlin tests use JUnit Jupiter. A JUnit 4 project would use the renderer hook. Default: Jupiter only.
-5. **What the digest covers.** Subtype, level, status, statement, counterexample and the `implementedBy` list. A change to title, notes, disposition or `trackedBy` does not change it. Default: those six.
-6. **Message text is pinned by the corpus.** Rewording a diagnostic becomes a five-port change. The field-lint corpus already works this way. Default: pinned.
-7. **TypeScript keeps its own model.** TypeScript stubs stay hand-filled and merged; the witness model is not offered there in this slice. Default: unchanged.
-8. **Filters outside TypeScript and Python.** Java, Kotlin and C# ship the default filter (functional, L4 and L5) with no way to change it short of the renderer hook. Default: accept for this slice.
-9. **Tracking.** This work has no FR number or issue in the repository. Default: commits cite this plan and ADR-0057; assign a number if one is wanted before Task 1.
+## Answered questions
+
+The plan as merged asked the owner nine questions. The answers, for the record:
+
+1. **The seven authoring-lint advisories** stay TypeScript-only in this slice. Porting them is a follow-up slice.
+2. **The strict switch** keeps the `WARN_REQUIREMENT_NOTHING_IMPLEMENTS` code and raises it to severity `error` behind `--require-implementers`.
+3. **How a JVM or .NET test finds its witness:** a generated interface with a failing default per test; the project names one implementing class. No run-time lookup by name.
+4. **Java's test framework:** generated Java and Kotlin tests are JUnit Jupiter only. A JUnit 4 project uses the renderer hook, or ejects the generator.
+5. **The digest** covers subtype, level, status, statement, counterexample and the `implementedBy` list.
+6. **Message text is pinned by the corpus.**
+7. **TypeScript keeps its own model:** hand-filled, merged stubs.
+8. **Filters: "make it uniform."** The same two options in all five ports (Table I). This is the one answer that changed the plan.
+9. **Tracking:** commits cite this plan and ADR-0057.
+
+Added after the questions were answered: the generator must eject and be owned by the application in every port; it is a recommended approach, not a contract (Table L).
diff --git a/examples/showcase/metaobjects.config.ts b/examples/showcase/metaobjects.config.ts
index 37a3386b0..71f2a554b 100644
--- a/examples/showcase/metaobjects.config.ts
+++ b/examples/showcase/metaobjects.config.ts
@@ -32,8 +32,9 @@ export default defineConfig({
     promptRender(),
     renderHelper(),
     // The fifth pillar's own evidence — a test stub per claim, carrying the
-    // statement and counterexample in. TypeScript-only; the requirement.*
-    // vocabulary and its verify checks are cross-port.
+    // statement and counterexample in. The hand-filled stub is TypeScript's form;
+    // the other ports generate tests that call a witness you own. The
+    // requirement.* vocabulary and its verify checks are cross-port.
     requirementTests(),
     barrel(),
   ],
diff --git a/examples/showcase/site-payload.json b/examples/showcase/site-payload.json
index 6bb2339bc..e84e9bead 100644
--- a/examples/showcase/site-payload.json
+++ b/examples/showcase/site-payload.json
@@ -8,7 +8,7 @@
   },
   "counts": {
     "fixtures": 364,
-    "corpora": 26,
+    "corpora": 28,
     "baseTypes": 17
   },
   "snippets": {
diff --git a/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/java.md b/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/java.md
index df517b075..0f2a615e4 100644
--- a/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/java.md
+++ b/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/java.md
@@ -206,6 +206,24 @@ read-view (#214): OMDB routes reads through the replica view and writes to the t
 row via the view by primary key (read-your-writes). The replica view's DDL is emitted by
 `meta migrate` from the same origin assembly as a projection view.
 
+**Requirement tests (`JUnitRequirementTestsGenerator`, stable name `requirement-tests`).**
+A recommended approach, not a contract. For a model that declares `requirement.*` nodes it
+writes, per metamodel package, `Requirements_<pkgKey>_Witnesses.java` (an interface with
+one default member per non-skipped test, each failing with `unimplemented requirement: …`)
+and `Requirements_<pkgKey>_Test.java` (one JUnit Jupiter `@Test` per requirement;
+`@Disabled` for a `planned` or `retired` one). Both are rewritten whole on every run, so
+never edit them: the project's code goes in the class `witnessClass` names, which
+implements every generated interface and overrides the members it has witnesses for.
+Annotate each witness `@Override`: a witness whose requirement is retired or deleted then
+stops compiling, and without the annotation it goes stale silently. Args: `testPackage`
+and `witnessClass` (required once the model holds a requirement), `grain` (`concern` or
+`member`), `filter` and `renderer` (class names on the project classpath implementing
+`RequirementTestFilter` / `RequirementTestRenderer`; a filter REPLACES the default of
+functional L4/L5), `warnUncovered`. Jupiter only: a JUnit 4 project uses `renderer` or
+ejects. `mvn metaobjects:eject -Dnames=requirement-tests -Dport=java` copies the generator
+with its default rendering (pass `-Dport`: the name is ejectable on both JVM
+ports). The requirement checks in `mvn metaobjects:verify` are core and are not ejectable.
+
 ### Value-object jsonb columns
 
 A `field.object` with `@storage: jsonb` (single or `@isArray`) is a typed jsonb column
diff --git a/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/kotlin.md b/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/kotlin.md
index 1a53af36a..64b67df90 100644
--- a/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/kotlin.md
+++ b/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/kotlin.md
@@ -216,6 +216,25 @@ read-view (#214): reads route through the replica view and writes to the table (
 (read-your-writes). The replica view's DDL is emitted by `meta migrate` from the same
 origin assembly as a projection view.
 
+**Requirement tests (`KotlinRequirementTestsGenerator`, stable name `requirement-tests`).**
+A recommended approach, not a contract. For a model that declares `requirement.*` nodes it
+writes, per metamodel package, `Requirements_<pkgKey>_Witnesses.kt` (an interface with one
+default member per non-skipped test, each failing with `unimplemented requirement: …`) and
+`Requirements_<pkgKey>_Test.kt` (one JUnit Jupiter `@Test` per requirement; `@Disabled` for
+a `planned` or `retired` one). Both are rewritten whole on every run, so never edit them:
+the project's code goes in the class `witnessClass` names, which implements every generated
+interface and overrides the members it has witnesses for. Write that class in Kotlin (a
+Java witness class against these interfaces is untested). A witness whose requirement is
+retired or deleted stops compiling, because `override` is mandatory. Args: `testPackage`
+and `witnessClass` (required once the model holds a requirement), `grain` (`concern` or
+`member`), `filter` and `renderer` (class names on the project classpath implementing
+`RequirementTestFilter` / `RequirementTestRenderer`; a filter REPLACES the default of
+functional L4/L5; a renderer returns Kotlin source), `warnUncovered`. Jupiter only: a
+JUnit 4 project uses `renderer` or ejects.
+`mvn metaobjects:eject -Dnames=requirement-tests -Dport=kotlin` copies the generator with
+its default rendering (pass `-Dport`: the name is ejectable on both JVM ports). The
+requirement checks in `mvn metaobjects:verify` are core and are not ejectable.
+
 Metadata lives under `src/main/metaobjects/` in the same canonical JSON the other
 ports read — fused-key form, `source.rdb` + `@table`, `@column` for a renamed
 physical column.
diff --git a/fixtures/agent-context-conformance/java-react/expected/.claude/skills/metaobjects-codegen/references/java.md b/fixtures/agent-context-conformance/java-react/expected/.claude/skills/metaobjects-codegen/references/java.md
index df517b075..0f2a615e4 100644
--- a/fixtures/agent-context-conformance/java-react/expected/.claude/skills/metaobjects-codegen/references/java.md
+++ b/fixtures/agent-context-conformance/java-react/expected/.claude/skills/metaobjects-codegen/references/java.md
@@ -206,6 +206,24 @@ read-view (#214): OMDB routes reads through the replica view and writes to the t
 row via the view by primary key (read-your-writes). The replica view's DDL is emitted by
 `meta migrate` from the same origin assembly as a projection view.
 
+**Requirement tests (`JUnitRequirementTestsGenerator`, stable name `requirement-tests`).**
+A recommended approach, not a contract. For a model that declares `requirement.*` nodes it
+writes, per metamodel package, `Requirements_<pkgKey>_Witnesses.java` (an interface with
+one default member per non-skipped test, each failing with `unimplemented requirement: …`)
+and `Requirements_<pkgKey>_Test.java` (one JUnit Jupiter `@Test` per requirement;
+`@Disabled` for a `planned` or `retired` one). Both are rewritten whole on every run, so
+never edit them: the project's code goes in the class `witnessClass` names, which
+implements every generated interface and overrides the members it has witnesses for.
+Annotate each witness `@Override`: a witness whose requirement is retired or deleted then
+stops compiling, and without the annotation it goes stale silently. Args: `testPackage`
+and `witnessClass` (required once the model holds a requirement), `grain` (`concern` or
+`member`), `filter` and `renderer` (class names on the project classpath implementing
+`RequirementTestFilter` / `RequirementTestRenderer`; a filter REPLACES the default of
+functional L4/L5), `warnUncovered`. Jupiter only: a JUnit 4 project uses `renderer` or
+ejects. `mvn metaobjects:eject -Dnames=requirement-tests -Dport=java` copies the generator
+with its default rendering (pass `-Dport`: the name is ejectable on both JVM
+ports). The requirement checks in `mvn metaobjects:verify` are core and are not ejectable.
+
 ### Value-object jsonb columns
 
 A `field.object` with `@storage: jsonb` (single or `@isArray`) is a typed jsonb column
diff --git a/fixtures/agent-context-conformance/python/expected/.claude/skills/metaobjects-codegen/references/python.md b/fixtures/agent-context-conformance/python/expected/.claude/skills/metaobjects-codegen/references/python.md
index 248ffe38b..62c3510e1 100644
--- a/fixtures/agent-context-conformance/python/expected/.claude/skills/metaobjects-codegen/references/python.md
+++ b/fixtures/agent-context-conformance/python/expected/.claude/skills/metaobjects-codegen/references/python.md
@@ -110,6 +110,24 @@ a renamed physical column).
 | `names` | `<entity_snake>_names.py` — module-level `Final` constants mirroring the object's metadata tree. Every node carries its own `_TYPE`/`_SUB_TYPE`/`_NAME`; `<ENTITY>_NAME` is the OBJECT's name, and a physical name sits under the member naming what it is: `<ENTITY>_SOURCE_<ROLE>_{TABLE,VIEW,MATERIALIZED_VIEW,PROC,FUNCTION}` (`<ROLE>` is `PRIMARY` or `REPLICA`, so a write-through entity's read view has a slot), plus `<ENTITY>_SOURCE_<ROLE>_{KIND,SCHEMA}`, a `<ENTITY>_<FIELD>_FIELD`/`_COLUMN` pair each, `<ENTITY>_IDENTITY_<NAME>_*` / `<ENTITY>_INDEX_<NAME>_*` carrying `_INDEX` (the database index name) for `identity.secondary` and `index.lookup`, and a complete `<ENTITY>_COLUMNS_BY_FIELD`. No `_READ_ONLY` — it was derived from `@kind`, never declared; ask `_SOURCE_<ROLE>_KIND`. Emitted for every object with a declared or inherited primary source, PLUS a fragment for any abstract base such an object extends (columns and keys only, no `_SOURCE_*` — it has no table and must never acquire one). Python has no static inheritance, so a module whose object extends another **imports and re-exports** the parent's constants (`AUTHOR_CREATED_AT_COLUMN: Final[str] = BASEENTITY_CREATED_AT_COLUMN`) instead of restating the literal; a TPH subtype re-exports `_SOURCE_PRIMARY_*` too, since it shares its base's table. **This port generates no SQL**, so nothing generated consumes these — they exist for the repository `Protocol` implementation you write. |
 | `template` | the generic Mustache `template` primitive. |
 
+**Requirement tests (`requirement-tests`).** A recommended approach, not a contract. For a
+model that declares `requirement.*` nodes it writes
+`requirements/test_<pkgKey>_requirements.py`, one pytest file per metamodel package,
+rewritten whole on every run, so never edit it. Each test calls a **witness**: a function
+named by the test's witness key (`req_acme_shop_Orders_Recorded__object_entity`) in the
+witness module, `tests.requirement_witnesses` by default. A `live` or `partial`
+requirement with no witness fails, naming the function to write; `planned` and `retired`
+are skipped. Nothing reports a witness whose requirement is gone, so delete it with the
+requirement. Options live in the `requirementTests` block of `metaobjects.config.yaml`:
+`witnessModule`, `grain` (`concern` or `member`), `filter` and `renderer` (`module:symbol`;
+a filter REPLACES the default of functional L4/L5; a renderer imports `RenderedTest` from
+`metaobjects.codegen.requirement_hooks`), `warnUncovered`. The generated tests need only
+pytest and run on Python 3.9 or later, while the tool itself needs 3.11
+(`uv tool run --python 3.12 metaobjects gen` runs it on another interpreter).
+`metaobjects eject requirement-tests` copies the generator with its default renderer to
+`codegen/generators/requirement_tests.py`. The requirement checks in `metaobjects verify`
+are core and are not ejectable.
+
 **Projections + entity read-views.** An `object.projection` (read-only `source.rdb`
 `@kind: view` child) gets a read-only Pydantic model from the `entity` generator.
 
diff --git a/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/typescript.md b/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/typescript.md
index 8048ef9b5..9a41d39f6 100644
--- a/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/typescript.md
+++ b/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-codegen/references/typescript.md
@@ -125,11 +125,22 @@ REMOVED their `@metaobjectsdev/codegen-ts/generators` export, so an owned copy i
 path for those. The engine primitives come from the package main entry,
 `@metaobjectsdev/codegen-ts`. The `/generators` subpath itself is NOT deprecated. It
 exports the prompt tier (`promptRender`, `outputParser`, `outputPrompt`, `extractor`,
-`renderHelper`) and `namesFile`, which you may import from there OR eject to own, and it is
-the only home of the package-only generators — `traceHelperFile`, `callableFile`,
-`requirementTests` — which ship no reference template (`meta gen --list` marks them
+`renderHelper`), `namesFile` and `requirementTests`, which you may import from there OR
+eject to own, and it is the only home of the package-only generators — `traceHelperFile`,
+`callableFile` — which ship no reference template (`meta gen --list` marks them
 `package-only`).
 
+**`requirementTests()` — one test stub per requirement the model claims.** A recommended
+approach, not a contract: a `live` or `partial` requirement gets a stub that fails until
+you write its assertion (the three-way merge keeps it), a `planned` or `retired` one a
+skipped stub. Options: `filter` (a predicate over `subType`, `level`, `status`, `path`,
+`package`, `implementedByTypes` that REPLACES the default of functional L4/L5), `grain`
+(`"concern"`, the default, or `"member"`; anything else is refused), `warnUncovered`,
+`renderers` / `resolveRenderer`. `meta eject requirement-tests` copies the generator and
+its default stub renderer into `codegen/generators/requirement-tests.ts`; the requirement
+walk, each test's identity and the claim digest stay in the package. The requirement
+checks in `meta verify` are core and are not ejectable.
+
 The table below is a per-emission reference, NOT the selection surface. Select with
 `meta gen --list --format json --probe`, which is generated from the live registry and
 reports a file count for your own model; a table in a document cannot do either.
diff --git a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-audit/references/requirements.md b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-audit/references/requirements.md
index 185649e66..a81dfbafd 100644
--- a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-audit/references/requirements.md
+++ b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-audit/references/requirements.md
@@ -4,8 +4,10 @@ This project declares `requirement.*` nodes, so the ledger is an auditable surfa
 for **truthfulness**, not volume. A large ledger that lies is worse than a small one that
 does not, because every later reader trusts it.
 
-Run `meta verify` first. It settles referential integrity mechanically — do not spend audit
-effort re-deriving what a green run already proves.
+Run `verify` first — the project's own: `meta verify`, `metaobjects verify`,
+`mvn metaobjects:verify` or `dotnet meta verify`. Every port runs the same requirement
+gate. It settles referential integrity mechanically — do not spend audit effort re-deriving
+what a green run already proves.
 
 ## What verify has already proven (do not re-check by hand)
 
@@ -18,7 +20,9 @@ on `planned`, whose nodes do not exist yet).
 
 **The authoring lint** — printed under its own heading, advisory, and unable to change the
 exit code — settles the naming and prose defects you would otherwise find by reading every
-entry:
+entry. **Only the Node `meta verify` prints it.** On a Python, Java, Kotlin or C# project
+whose pipeline runs that port's `verify` alone, nothing below has been proven: run
+the Node `meta verify` over the same metadata, or audit these by hand.
 
 | code | what a clean run has already proven |
 |---|---|
@@ -30,8 +34,10 @@ entry:
 | `WARN_REQUIREMENT_INERT_DOC_SLOT` | no `summary` is set — nothing reads it, and `@statement` is already the required one-liner |
 | `WARN_REQUIREMENT_TITLE_IS_AN_ID` | no `title` leads with a catalogue or ticket id |
 
-Two limits, and each puts something back on your list:
+Three limits, and each puts something back on your list:
 
+- **It is one port's.** See above: establish which `verify` the project's CI runs before
+  crediting a green pipeline with the table.
 - **The lint is mutable.** `--no-requirement-lint` / `META_NO_REQUIREMENT_LINT=1` silences the
   advisory half while the gate still runs. **Establish whether the project mutes it** (§F of
   the checklist asks this) — against a muted lint the whole table above proves nothing.
@@ -78,6 +84,15 @@ titles: one that restates `@statement`, or repeats the path in prose, is now vis
 a heading rather than a private authoring habit. An absent `title` is NOT a finding — the
 entry heads by its path alone, which is what every sibling surface addresses it by.
 
+**7. Witnesses that do not test the claim.** Where the project generates requirement tests
+(the `requirement-tests` generator, in any port), a passing generated test proves only that
+its witness — or, in TypeScript, the hand-filled stub — ran. Sample the witnesses and read
+them against the counterexample each generated test carries: one that asserts nothing, or asserts
+something else, is the same defect `@verifiedBy` had. Check also for witnesses that have
+gone stale silently: a Java witness that lacks the override annotation, a C# witness implemented
+implicitly, and any Python witness keep existing after their requirement is retired or
+deleted, and nothing reports them.
+
 ## Scope — do NOT flag these as defects
 
 - **Unclaimed `object.value` / `object.projection`.** Exempt by design: a value is a shape, a
diff --git a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-authoring/references/requirements.md b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-authoring/references/requirements.md
index a0b215c1f..8ccfc08bd 100644
--- a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-authoring/references/requirements.md
+++ b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-authoring/references/requirements.md
@@ -179,5 +179,20 @@ ambition rather than work.
     implementedBy: ["game::turn::Turn", "game::world::Location"]
 ```
 
+**Which `verify` says what.** The gate — dangling references, links above the floor,
+level and nesting errors, an unclaimed entity, a live requirement nothing implements — runs
+in every port's `verify` (`meta verify`, `metaobjects verify`, `mvn metaobjects:verify`,
+`dotnet meta verify`). The authoring warnings named on this page (`WARN_REQUIREMENT_NAME_*`,
+`WARN_REQUIREMENT_PROSE_*`, `WARN_REQUIREMENT_INERT_DOC_SLOT`,
+`WARN_REQUIREMENT_TITLE_IS_AN_ID`) are printed by the Node `meta verify` only, so on another
+port follow these rules without waiting for a warning.
+
+**A requirement's name and package end up in generated test names.** Every port's
+`requirement-tests` generator names a test from the requirement's package and dotted path
+(`acme::shop::Orders.Recorded` becomes `req_acme_shop_Orders_Recorded…`), and two
+requirements whose names differ only in punctuation (`Orders.Recorded` beside
+`Orders_Recorded`) are refused as a collision outside TypeScript. Another reason to keep
+names plain identifiers.
+
 There is **no `satisfies:` on a field or entity** — links live on the requirement node, not
 on the nodes it claims. Full reference: the repo's `spec/capability-ledger.md`.
diff --git a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-codegen/references/typescript.md b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-codegen/references/typescript.md
index 8048ef9b5..9a41d39f6 100644
--- a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-codegen/references/typescript.md
+++ b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-codegen/references/typescript.md
@@ -125,11 +125,22 @@ REMOVED their `@metaobjectsdev/codegen-ts/generators` export, so an owned copy i
 path for those. The engine primitives come from the package main entry,
 `@metaobjectsdev/codegen-ts`. The `/generators` subpath itself is NOT deprecated. It
 exports the prompt tier (`promptRender`, `outputParser`, `outputPrompt`, `extractor`,
-`renderHelper`) and `namesFile`, which you may import from there OR eject to own, and it is
-the only home of the package-only generators — `traceHelperFile`, `callableFile`,
-`requirementTests` — which ship no reference template (`meta gen --list` marks them
+`renderHelper`), `namesFile` and `requirementTests`, which you may import from there OR
+eject to own, and it is the only home of the package-only generators — `traceHelperFile`,
+`callableFile` — which ship no reference template (`meta gen --list` marks them
 `package-only`).
 
+**`requirementTests()` — one test stub per requirement the model claims.** A recommended
+approach, not a contract: a `live` or `partial` requirement gets a stub that fails until
+you write its assertion (the three-way merge keeps it), a `planned` or `retired` one a
+skipped stub. Options: `filter` (a predicate over `subType`, `level`, `status`, `path`,
+`package`, `implementedByTypes` that REPLACES the default of functional L4/L5), `grain`
+(`"concern"`, the default, or `"member"`; anything else is refused), `warnUncovered`,
+`renderers` / `resolveRenderer`. `meta eject requirement-tests` copies the generator and
+its default stub renderer into `codegen/generators/requirement-tests.ts`; the requirement
+walk, each test's identity and the claim digest stay in the package. The requirement
+checks in `meta verify` are core and are not ejectable.
+
 The table below is a per-emission reference, NOT the selection surface. Select with
 `meta gen --list --format json --probe`, which is generated from the live registry and
 reports a file count for your own model; a table in a document cannot do either.
diff --git a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-verify/references/requirements.md b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-verify/references/requirements.md
index 63f83ed67..c1e57d55a 100644
--- a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-verify/references/requirements.md
+++ b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-verify/references/requirements.md
@@ -3,6 +3,22 @@
 This project declares `requirement.*` nodes, so `verify` checks them. **There is no
 subverb**: requirements are metadata, so they are checked on *every* `meta verify` run.
 
+## Which command runs the gate
+
+Every port's `verify` runs the same gate, with the same codes, severities and message
+text (a shared corpus pins them). Run the one for the project's server language:
+
+| port | command |
+|---|---|
+| TypeScript | `meta verify` |
+| Python | `metaobjects verify` |
+| Java, Kotlin | `mvn metaobjects:verify` (one goal for both) |
+| C# | `dotnet meta verify <metadataDir> --templates <dir>` (or `--codegen --out <dir>`) |
+
+The gate is core: it is not a generator and cannot be ejected or replaced. What differs
+by port is the **authoring lint** further down this page, which only the Node `meta verify`
+prints. This page writes `meta verify` throughout; read it as the port's own command.
+
 ## The split, and why it matters when you read a failure
 
 | | owns |
@@ -65,6 +81,25 @@ So on a `planned` entry a dangling reference is the entry doing its job, not dri
 | `@implementedBy` above the L4 link floor | 1 |
 | live `requirement.architectural` claimed by nothing | 1 |
 | an entity no requirement claims | 0 (warning) |
+| a `live`/`partial` functional requirement nothing implements | 0 (warning); **1 under the strict switch** |
+
+## The strict switch — `--require-implementers`
+
+`WARN_REQUIREMENT_NOTHING_IMPLEMENTS` (a `live` or `partial` functional requirement where
+neither it nor anything nested under it names a node) is a warning by default. A project
+whose ledger has caught up with its links can make it fail the build:
+
+| port | flag | environment |
+|---|---|---|
+| TypeScript | `meta verify --require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+| Python | `metaobjects verify --require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+| Java, Kotlin | `mvn metaobjects:verify -Dmeta.verify.requireImplementers=true` | `META_REQUIRE_IMPLEMENTERS=1` |
+| C# | `dotnet meta verify … --require-implementers` | `META_REQUIRE_IMPLEMENTERS=1` |
+
+It raises that one finding to an error and **keeps its code**. Every other warning stays a
+warning. If CI went red on this code, check whether the switch is set before treating it
+as a new defect: the fix is to add the `@implementedBy` link (or drop the entry to
+`planned`), not to unset the switch.
 
 ## The error codes, and the fix for each
 
@@ -91,8 +126,10 @@ reasons, so reading only the code you hit can send you the wrong way. The questi
 
 ## The authoring lint — a second section, never an error
 
-`verify` also prints an **authoring lint** under its own heading, after the gate's own
-warnings:
+The Node `meta verify` also prints an **authoring lint** under its own heading, after the
+gate's own warnings. It is TypeScript-only: `metaobjects verify`, `mvn metaobjects:verify`
+and `dotnet meta verify` run the gate above and never print these codes, so on those ports
+a clean run says nothing about them.
 
 ```
 meta verify — requirements: 6 authoring warning(s) (advisory — does not fail the build):
@@ -135,6 +172,11 @@ way to satisfy the check is to find any name that already exists.
 
 The attribute is retired. Tying a requirement to a test is the job of a generator that emits
 the test **from** the requirement, so the link is structural rather than a name someone chose.
+Every port ships one, `requirement-tests` (see the codegen skill's reference for the
+project's language). `verify` still never reads test results: the codegen drift gate
+(`verify --codegen`) proves the generated tests match the ledger, a live test with nothing
+behind it fails in the project's own test run, and a generated test that passes proves its
+witness ran, not that the witness tests the claim.
 
 ## What a green run does NOT prove
 
diff --git a/fixtures/generator-registry-conformance/registry.json b/fixtures/generator-registry-conformance/registry.json
index 5c69ac6ca..56dea137e 100644
--- a/fixtures/generator-registry-conformance/registry.json
+++ b/fixtures/generator-registry-conformance/registry.json
@@ -187,7 +187,7 @@
       "concept": "Per-requirement test stub, one per requirement.functional claim in the ledger.",
       "tier": "native",
       "layer": "capability",
-      "ports": ["typescript"]
+      "ports": ["typescript", "java", "kotlin", "python", "csharp"]
     },
     "docs": {
       "concept": "Neutral per-entity / per-template Markdown documentation pages.",
diff --git a/fixtures/requirement-check-conformance/README.md b/fixtures/requirement-check-conformance/README.md
new file mode 100644
index 000000000..ec7837492
--- /dev/null
+++ b/fixtures/requirement-check-conformance/README.md
@@ -0,0 +1,147 @@
+# `verify` requirement-gate conformance corpus
+
+Every port's `verify` runs the **requirement gate**: it reads the `requirement.*` nodes of a
+loaded model and reports what the loader cannot (ADR-0057). This corpus is the shared source
+of truth for the gate's codes, severities, node addresses, message text and summary counts.
+
+TypeScript is the reference. The codes, their conditions and their order come from
+`server/typescript/packages/cli/src/lib/requirement-check.ts`; a port reads that file before
+it writes its own checks, and its test suite runs this corpus so the ports cannot drift.
+
+## Fixture format
+
+Each case is a directory:
+
+- `input/` holds one or more metadata documents (`.yaml` or `.json`).
+- `options.json` is optional. Its keys are `libraries` (a string array: the shipped
+  libraries to load beside `input/`) and `requireImplementers` (a boolean: the strict
+  switch, `verify --require-implementers`). No other key is legal.
+- `expected.json` holds `{ "diagnostics": [...], "summary": {...} | null }`.
+
+A runner does three things, in this order:
+
+1. Load `input/` with the port's loader, **strict**, with the libraries `options.json`
+   names, and assert **no load errors**. Load the files in ascending file-name order.
+2. Run the gate over the loaded model, with the strict switch `options.json` sets
+   (default off), and compute the summary from the same run. Pass **no scope predicate**:
+   every non-abstract entity in the loaded model is coverable. Do **not force the coverage
+   answer**: whether coverage is measured is derived from the requirements' packages, which
+   is what the `coverage-library-*` cases test. (In the reference these are the
+   `coverable` and `measureCoverage` options of `scanRequirements`; a runner sets neither.)
+3. Compare both with `expected.json`.
+
+### What is compared
+
+`diagnostics` is an unordered multiset of `(severity, code, path, message)`. The files list
+them in the order the reference reports them, which is not part of the contract.
+
+- `severity` is `error` or `warn`.
+- `path` is the dotted chain of requirement names from the root, with no package:
+  `Shop.Orders.Recorded`. It is **absent** on `WARN_REQUIREMENT_OBJECT_UNCLAIMED`, whose
+  subject is an entity; compare an absent `path` as the empty string.
+- `message` is compared exactly.
+
+`summary` is `null` when the model declares no requirement. Otherwise it holds `total`,
+`functional`, `architectural`, `byStatus` (a count per status that occurs; a status with no
+requirement has no key), `undecided` and `deferredUntracked`. `entitiesClaimed` and
+`entitiesTotal` are present **only when coverage is measured**: their absence is the
+statement that the project authored no requirement of its own.
+
+### Where the expectations come from
+
+`bun scripts/write-requirement-corpus-expected.ts check` writes every `expected.json` from
+the TypeScript reference. Each written file is then reviewed by hand against the reference's
+rules, and a case that reports more than its row below says gets its **input** fixed.
+
+A committed `expected.json` is never edited to make a port pass. A port that disagrees with
+it is wrong, unless the reference is shown to be wrong first.
+
+## Things the cases pin that are easy to miss
+
+- **A rejected claim still counts toward coverage.** The claim set is built from every
+  requirement that is not `planned`, whatever its level and whatever the gate says about
+  the reference's grain. `link-above-floor`, `l4-names-member`, `l5-names-object` and
+  `arch-levelled-tree` each report an error on a claim and no unclaimed entity.
+- **`ERR_REQUIREMENT_LINK_ABOVE_FLOOR` ends that requirement's checks.** Nothing further is
+  reported for the node (`link-above-floor`): the level and nesting checks run before it, so
+  a node can carry those as well.
+- **A grain error replaces the dangling check for that reference.** `l4-names-member` and
+  `l5-names-object` each hold a reference that does not resolve and report it once.
+- **Existence is about naming, not resolving.** A requirement whose subtree holds any
+  non-empty `implementedBy` is not reported by `WARN_REQUIREMENT_NOTHING_IMPLEMENTS`, even
+  when the only one is on a `planned` child and names a node that does not exist yet
+  (`nothing-implements-delegating-parent-clean`).
+- **`supersededBy` resolves against the ledger, not the model, and a bare path that is
+  ambiguous across packages still binds.** The name of an object does not resolve
+  (`superseded-by-dangling`). A bare path is looked up across every package, and when two
+  packages both have it the reference takes the first in walk order instead of refusing
+  (`superseded-by-package-local`). This deliberately differs from `implementedBy`, where a
+  bare name that exists in two other packages binds nothing
+  (`dangling-bare-name-in-two-packages`). The case pins that the reference resolves; which
+  of the two requirements it binds is not observable in a diagnostic.
+- **One message names two objects, in a fixed order.** The hint in
+  `dangling-bare-name-in-two-packages` reads `acme::billing::Order, acme::shop::Order`.
+  The fixture loads the billing file first and the two names also sort that way, so it
+  pins the order of this one message and not the rule behind it. The reference lists the
+  objects in load order, which is why step 1 fixes the file order.
+- **The library cases count the library's own ledger.** The three `coverage-library-*`
+  summaries include the requirements the `iam` library ships, so a change to that ledger
+  changes those three files. Every port embeds the same library, so the ports still agree.
+
+## Cases
+
+| Case | What it pins |
+|---|---|
+| `no-requirements` | Entities and no requirement: no diagnostics, and `summary` is `null`. |
+| `clean-fully-claimed` | An L1 to L5 tree that claims every entity: no diagnostics, and the full summary with both coverage counts. |
+| `dangling-object-live` | `ERR_REQUIREMENT_DANGLING_REF` on a `live` requirement naming an object that does not exist. No object has that short name, so there is no hint. |
+| `dangling-object-partial` | The same on `partial`. The message carries the status. |
+| `dangling-object-planned-clean` | The same reference on `planned` reports nothing: a planned requirement may name nodes that do not exist yet. |
+| `dangling-object-did-you-mean` | The hint when the short name exists in one other package, for a bare object reference and for a member reference whose owner does not resolve. The second message quotes the whole reference (`Invoice.total`) while its hint names the object (`Invoice`), not the member. |
+| `dangling-bare-name-in-two-packages` | A bare name that exists in two other packages binds neither. The hint lists both, `acme::billing::Order` first. |
+| `dangling-member-of-resolved-object` | The object resolves and its member does not: the hint names the object's resolution key and the missing member. |
+| `dangling-member-first-missing-segment` | Two-segment member paths. The hint names the first segment that did not resolve and the node it was looked for under: once when the first segment resolves, once when it does not. |
+| `claim-on-root-template` | A root-level `template.prompt` is a claim target, by bare name and by qualified name. Coverage is measured over zero entities, so both counts are `0`. |
+| `claim-package-local` | A bare reference binds in the requirement's own package across two files, while an object of the same name exists in another package and is claimed there the same way. |
+| `link-above-floor` | `ERR_REQUIREMENT_LINK_ABOVE_FLOOR` at L1 and at L3. The `disposition` on the live L1 produces no `WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE`. |
+| `l4-names-member` | `ERR_REQUIREMENT_L4_NOT_OBJECT` on a functional L4, for a member that exists and for one that does not. |
+| `l5-names-object` | `ERR_REQUIREMENT_L5_NOT_MEMBER` on a functional L5, for an object that exists and for one that does not. |
+| `l5-member-resolves-clean` | A functional L5 naming a field, an identity, and a view under a field: no diagnostics. |
+| `bad-level-out-of-range` | `ERR_REQUIREMENT_BAD_LEVEL` for levels 0 and 6 on functional requirements. The message has no architectural suffix. |
+| `level-nesting` | `ERR_REQUIREMENT_LEVEL_NESTING` for a child at its parent's level and for a child above it. |
+| `arch-live-no-implementers` | `ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS` on a flat policy that is `live`, on one that is `partial`, and on a levelled L4 that is `live`: the rule is "may name the model and names nothing", not "has no level". |
+| `arch-planned-clean` | A `planned` flat policy with no implementer reports nothing. |
+| `arch-retired-clean` | A `retired` flat policy with no implementer reports nothing. |
+| `arch-levelled-tree` | Levelled architectural requirements: an L1 with links gets `ERR_REQUIREMENT_LINK_ABOVE_FLOOR`; an L1 and an L2 without links get no `ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS`; a child that re-ascends gets `ERR_REQUIREMENT_LEVEL_NESTING`; a level of 7 gets `ERR_REQUIREMENT_BAD_LEVEL` with the architectural suffix. |
+| `arch-unlevelled-exempt` | A flat policy at the root, and one nested under a levelled parent, get neither the level error nor the nesting error. |
+| `arch-mixed-grain-clean` | An architectural L4 may name a member and an architectural L5 may name an object: no diagnostics. |
+| `disposition-not-applicable` | `WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE` on `live` and on `retired`. The message carries the disposition and the status. |
+| `deferred-untracked` | `WARN_REQUIREMENT_DEFERRED_UNTRACKED` on a deferral with no `trackedBy`, and nothing on the tracked deferral beside it. `deferredUntracked` is `1`. |
+| `nothing-implements-subtree` | `WARN_REQUIREMENT_NOTHING_IMPLEMENTS`, severity `warn`, on every node of a subtree in which nothing names a node: a `live` L1, a `partial` L3 and a `live` L4. |
+| `nothing-implements-delegating-parent-clean` | A parent whose child claims is not reported. Neither is one whose only claiming child is `planned`. |
+| `require-implementers` | The input of `nothing-implements-subtree`, byte for byte (the reference runner asserts it), with `requireImplementers: true`: the same code, path and message, at severity `error`. |
+| `require-implementers-raises-only-that-code` | `requireImplementers: true` over a model that also has an untracked deferral and an unclaimed entity: `WARN_REQUIREMENT_NOTHING_IMPLEMENTS` is an `error`, while `WARN_REQUIREMENT_DEFERRED_UNTRACKED` and `WARN_REQUIREMENT_OBJECT_UNCLAIMED` stay `warn`. |
+| `superseded-by-resolves-clean` | A `supersededBy` given as the requirement's path, and as the path qualified by its package: no diagnostics. |
+| `superseded-by-dangling` | `ERR_REQUIREMENT_DANGLING_REF` for a `supersededBy` that is a misspelt path, a requirement's name without its path, and the name of an object. |
+| `superseded-by-package-local` | The ledger lookup over four packages, all resolving: a bare path that two packages both have, referenced from each of them and from a third package that has no such path (ambiguous across packages, and it still binds); and a reference completed with the referrer's package. |
+| `retired-clean` | A retired requirement, and a retired tree with nothing claimed beneath it, report nothing. |
+| `same-name-in-two-branches` | Two requirements named `Recorded` report the same error with the same message. Only `path` tells them apart. |
+| `coverage-unclaimed-entity` | `WARN_REQUIREMENT_OBJECT_UNCLAIMED` for the one entity no requirement claims. It has no `path`. |
+| `coverage-planned-claim-does-not-count` | An entity claimed only by a `planned` requirement is still unclaimed. |
+| `coverage-arch-claim-propagates` | An architectural claim on an abstract base covers a subtype and a subtype of that subtype: no diagnostics, two of two entities claimed. The first `extends` is a bare name; the second is in another package and is a qualified name, so matching either string form alone does not reach both. |
+| `coverage-functional-claim-does-not-propagate` | The same model with a functional claim leaves both subtypes unclaimed. |
+| `coverage-exemptions` | An abstract entity, an `object.value` and an `object.projection` are not counted: one of one entities claimed. |
+| `coverage-library-only-not-measured` | `libraries: ["iam"]` and no project requirement: no unclaimed-entity warning, and no `entities*` keys in the summary. |
+| `coverage-library-plus-project` | One project requirement switches coverage on, over the library's entities too. The library's ledger claims its own, so only the project's unclaimed entity is reported. |
+| `coverage-library-overlay-does-not-activate` | An overlay on a library requirement changes that requirement's status and does not switch coverage on. |
+| `summary-undecided-rollup` | `undecided` is `4` over four trees and one root node: a partial parent over a partial child counts once, at the child; a partial grandchild excludes both ancestors; a child with a `disposition` is not counted and still excludes its parent; a partial parent over a `live` child counts at the parent; and `DeliveryNote` beside `Delivery` counts without excluding it, because ancestry is by path segment and not by string prefix. |
+
+## Who asserts it
+
+| Port | Runner |
+|---|---|
+| TypeScript (reference) | `server/typescript/packages/cli/test/requirement-check-conformance.test.ts` |
+| Python | `server/python/tests/conformance/test_requirement_check_conformance.py` |
+| Java | `server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementCheckConformanceTest.java` |
+| Kotlin | inherits via Java: Kotlin has no CLI of its own and runs `verify` through the same Maven `metaobjects:verify` goal |
+| C# | `server/csharp/MetaObjects.Conformance.Tests/RequirementCheckConformanceTests.cs` |
diff --git a/fixtures/requirement-check-conformance/arch-levelled-tree/expected.json b/fixtures/requirement-check-conformance/arch-levelled-tree/expected.json
new file mode 100644
index 000000000..324f78740
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-levelled-tree/expected.json
@@ -0,0 +1,34 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_LINK_ABOVE_FLOOR",
+      "path": "Security",
+      "message": "'implementedBy' is legal at L4 (object) and L5 (member) only. L1-L3 are organisational and never reference the model — move the links to a nested L4 child."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_LEVEL_NESTING",
+      "path": "Reliability.Recovery",
+      "message": "nested under \"Reliability\" (level 2) but declares level 1. Nesting is the hierarchy — a child sits strictly below its parent."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_BAD_LEVEL",
+      "path": "Portability",
+      "message": "level must be an integer 1-5 (got 7). L1 solution, L2 segment (app/library), L3 service, L4 object, L5 member. On an architectural requirement the level is optional — omit it for a flat policy."
+    }
+  ],
+  "summary": {
+    "total": 4,
+    "functional": 0,
+    "architectural": 4,
+    "byStatus": {
+      "live": 4
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/arch-levelled-tree/input/meta.shop.yaml b/fixtures/requirement-check-conformance/arch-levelled-tree/input/meta.shop.yaml
new file mode 100644
index 000000000..8f5ff7a67
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-levelled-tree/input/meta.shop.yaml
@@ -0,0 +1,43 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # An organisational tier that names the model.
+    - requirement.architectural:
+        name: Security
+        level: 1
+        status: live
+        statement: The shop protects the data it holds.
+        counterexample: A record read by someone with no claim to it.
+        implementedBy: [Order]
+
+    # An organisational tier that names nothing: not a policy applied to nothing.
+    - requirement.architectural:
+        name: Reliability
+        level: 2
+        status: live
+        statement: The shop keeps working when a part fails.
+        counterexample: One failed part stops every sale.
+        children:
+          # Re-ascends: a level above its parent.
+          - requirement.architectural:
+              name: Recovery
+              level: 1
+              status: live
+              statement: The shop can be restored from a backup.
+              counterexample: A backup that cannot be restored.
+
+    # Above the ladder.
+    - requirement.architectural:
+        name: Portability
+        level: 7
+        status: live
+        statement: The shop runs on more than one database.
+        counterexample: A query only one database accepts.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/arch-live-no-implementers/expected.json b/fixtures/requirement-check-conformance/arch-live-no-implementers/expected.json
new file mode 100644
index 000000000..97ea5f9c6
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-live-no-implementers/expected.json
@@ -0,0 +1,35 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS",
+      "path": "Audited",
+      "message": "architectural requirement is 'live' but nothing implements it. Its check is universality — a claim set of zero means the policy is declared and unapplied."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS",
+      "path": "Attributed",
+      "message": "architectural requirement is 'partial' but nothing implements it. Its check is universality — a claim set of zero means the policy is declared and unapplied."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS",
+      "path": "Encrypted",
+      "message": "architectural requirement is 'live' but nothing implements it. Its check is universality — a claim set of zero means the policy is declared and unapplied."
+    }
+  ],
+  "summary": {
+    "total": 4,
+    "functional": 0,
+    "architectural": 4,
+    "byStatus": {
+      "live": 3,
+      "partial": 1
+    },
+    "undecided": 1,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/arch-live-no-implementers/input/meta.shop.yaml b/fixtures/requirement-check-conformance/arch-live-no-implementers/input/meta.shop.yaml
new file mode 100644
index 000000000..b055bf8c6
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-live-no-implementers/input/meta.shop.yaml
@@ -0,0 +1,36 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.architectural:
+        name: Identified
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [Order]
+
+    - requirement.architectural:
+        name: Audited
+        status: live
+        statement: Every row records who changed it.
+        counterexample: A row with no change attribution.
+
+    - requirement.architectural:
+        name: Attributed
+        status: partial
+        statement: Every row records when it changed.
+        counterexample: A row with no change time.
+
+    # Levelled at the link floor: it may name the model, and it names nothing.
+    - requirement.architectural:
+        name: Encrypted
+        level: 4
+        status: live
+        statement: Every stored row is encrypted at rest.
+        counterexample: A backup that opens in a text editor.
diff --git a/fixtures/requirement-check-conformance/arch-mixed-grain-clean/expected.json b/fixtures/requirement-check-conformance/arch-mixed-grain-clean/expected.json
new file mode 100644
index 000000000..e1d0d0760
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-mixed-grain-clean/expected.json
@@ -0,0 +1,15 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 2,
+    "functional": 0,
+    "architectural": 2,
+    "byStatus": {
+      "live": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/arch-mixed-grain-clean/input/meta.shop.yaml b/fixtures/requirement-check-conformance/arch-mixed-grain-clean/input/meta.shop.yaml
new file mode 100644
index 000000000..7f6c754c7
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-mixed-grain-clean/input/meta.shop.yaml
@@ -0,0 +1,25 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.architectural:
+        name: Identified
+        level: 4
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [Order, Order.id]
+        children:
+          - requirement.architectural:
+              name: Keyed
+              level: 5
+              status: live
+              statement: Every key is a single uuid column.
+              counterexample: A key made of two columns.
+              implementedBy: [Order, Order.pk]
diff --git a/fixtures/requirement-check-conformance/arch-planned-clean/expected.json b/fixtures/requirement-check-conformance/arch-planned-clean/expected.json
new file mode 100644
index 000000000..4393b2132
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-planned-clean/expected.json
@@ -0,0 +1,16 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 2,
+    "functional": 0,
+    "architectural": 2,
+    "byStatus": {
+      "planned": 1,
+      "live": 1
+    },
+    "undecided": 1,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/arch-planned-clean/input/meta.shop.yaml b/fixtures/requirement-check-conformance/arch-planned-clean/input/meta.shop.yaml
new file mode 100644
index 000000000..377da8654
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-planned-clean/input/meta.shop.yaml
@@ -0,0 +1,22 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.architectural:
+        name: Identified
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [Order]
+
+    - requirement.architectural:
+        name: Audited
+        status: planned
+        statement: Every row records who changed it.
+        counterexample: A row with no change attribution.
diff --git a/fixtures/requirement-check-conformance/arch-retired-clean/expected.json b/fixtures/requirement-check-conformance/arch-retired-clean/expected.json
new file mode 100644
index 000000000..747006404
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-retired-clean/expected.json
@@ -0,0 +1,16 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 2,
+    "functional": 0,
+    "architectural": 2,
+    "byStatus": {
+      "live": 1,
+      "retired": 1
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/arch-retired-clean/input/meta.shop.yaml b/fixtures/requirement-check-conformance/arch-retired-clean/input/meta.shop.yaml
new file mode 100644
index 000000000..2635a3a4b
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-retired-clean/input/meta.shop.yaml
@@ -0,0 +1,22 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.architectural:
+        name: Identified
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [Order]
+
+    - requirement.architectural:
+        name: Audited
+        status: retired
+        statement: Every row records who changed it.
+        counterexample: A row with no change attribution.
diff --git a/fixtures/requirement-check-conformance/arch-unlevelled-exempt/expected.json b/fixtures/requirement-check-conformance/arch-unlevelled-exempt/expected.json
new file mode 100644
index 000000000..01b7899d1
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-unlevelled-exempt/expected.json
@@ -0,0 +1,15 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 3,
+    "functional": 1,
+    "architectural": 2,
+    "byStatus": {
+      "live": 3
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/arch-unlevelled-exempt/input/meta.shop.yaml b/fixtures/requirement-check-conformance/arch-unlevelled-exempt/input/meta.shop.yaml
new file mode 100644
index 000000000..8103c8ea9
--- /dev/null
+++ b/fixtures/requirement-check-conformance/arch-unlevelled-exempt/input/meta.shop.yaml
@@ -0,0 +1,33 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # A flat policy: no level, and none is demanded.
+    - requirement.architectural:
+        name: Identified
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [Order]
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+        children:
+          # A flat policy under a levelled parent: it has no level to compare.
+          - requirement.architectural:
+              name: Addressable
+              status: live
+              statement: An order is addressed by one stable key.
+              counterexample: An order that cannot be pointed at.
+              implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/bad-level-out-of-range/expected.json b/fixtures/requirement-check-conformance/bad-level-out-of-range/expected.json
new file mode 100644
index 000000000..e814c5212
--- /dev/null
+++ b/fixtures/requirement-check-conformance/bad-level-out-of-range/expected.json
@@ -0,0 +1,28 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_BAD_LEVEL",
+      "path": "Shop",
+      "message": "level must be an integer 1-5 (got 0). L1 solution, L2 segment (app/library), L3 service, L4 object, L5 member."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_BAD_LEVEL",
+      "path": "Audited",
+      "message": "level must be an integer 1-5 (got 6). L1 solution, L2 segment (app/library), L3 service, L4 object, L5 member."
+    }
+  ],
+  "summary": {
+    "total": 3,
+    "functional": 3,
+    "architectural": 0,
+    "byStatus": {
+      "live": 3
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/bad-level-out-of-range/input/meta.shop.yaml b/fixtures/requirement-check-conformance/bad-level-out-of-range/input/meta.shop.yaml
new file mode 100644
index 000000000..34ec6ce74
--- /dev/null
+++ b/fixtures/requirement-check-conformance/bad-level-out-of-range/input/meta.shop.yaml
@@ -0,0 +1,34 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Below the ladder.
+    - requirement.functional:
+        name: Shop
+        level: 0
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Recorded
+              level: 4
+              status: live
+              statement: An order is recorded when it is placed.
+              counterexample: A placed order has no row.
+              implementedBy: [Order]
+
+    # Above the ladder.
+    - requirement.functional:
+        name: Audited
+        level: 6
+        status: live
+        statement: Every row records who changed it.
+        counterexample: A row with no change attribution.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/claim-on-root-template/expected.json b/fixtures/requirement-check-conformance/claim-on-root-template/expected.json
new file mode 100644
index 000000000..eb7ac65b7
--- /dev/null
+++ b/fixtures/requirement-check-conformance/claim-on-root-template/expected.json
@@ -0,0 +1,15 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 2,
+    "functional": 2,
+    "architectural": 0,
+    "byStatus": {
+      "live": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 0,
+    "entitiesTotal": 0
+  }
+}
diff --git a/fixtures/requirement-check-conformance/claim-on-root-template/input/meta.shop.yaml b/fixtures/requirement-check-conformance/claim-on-root-template/input/meta.shop.yaml
new file mode 100644
index 000000000..d5d90a009
--- /dev/null
+++ b/fixtures/requirement-check-conformance/claim-on-root-template/input/meta.shop.yaml
@@ -0,0 +1,29 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.value:
+        name: OrderConfirmationPayload
+        children:
+          - field.string: { name: reference }
+
+    - template.prompt:
+        name: orderConfirmation
+        payloadRef: OrderConfirmationPayload
+        textRef: orders/confirmation
+        format: xml
+
+    - requirement.functional:
+        name: Confirmed
+        level: 4
+        status: live
+        statement: A customer is told their order was placed.
+        counterexample: A placed order nobody confirmed.
+        implementedBy: [orderConfirmation]
+
+    - requirement.functional:
+        name: Acknowledged
+        level: 4
+        status: live
+        statement: The confirmation names the order it is about.
+        counterexample: A confirmation that names no order.
+        implementedBy: ["acme::shop::orderConfirmation"]
diff --git a/fixtures/requirement-check-conformance/claim-package-local/expected.json b/fixtures/requirement-check-conformance/claim-package-local/expected.json
new file mode 100644
index 000000000..a95564bd5
--- /dev/null
+++ b/fixtures/requirement-check-conformance/claim-package-local/expected.json
@@ -0,0 +1,15 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 2,
+    "functional": 2,
+    "architectural": 0,
+    "byStatus": {
+      "live": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 2,
+    "entitiesTotal": 2
+  }
+}
diff --git a/fixtures/requirement-check-conformance/claim-package-local/input/meta.billing.yaml b/fixtures/requirement-check-conformance/claim-package-local/input/meta.billing.yaml
new file mode 100644
index 000000000..81cb1e88b
--- /dev/null
+++ b/fixtures/requirement-check-conformance/claim-package-local/input/meta.billing.yaml
@@ -0,0 +1,16 @@
+metadata:
+  package: acme::billing
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Billed
+        level: 4
+        status: live
+        statement: A billing order is recorded when it is raised.
+        counterexample: A raised billing order has no row.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/claim-package-local/input/meta.shop.requirements.yaml b/fixtures/requirement-check-conformance/claim-package-local/input/meta.shop.requirements.yaml
new file mode 100644
index 000000000..1ab6a84bd
--- /dev/null
+++ b/fixtures/requirement-check-conformance/claim-package-local/input/meta.shop.requirements.yaml
@@ -0,0 +1,10 @@
+metadata:
+  package: acme::shop
+  children:
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/claim-package-local/input/meta.shop.yaml b/fixtures/requirement-check-conformance/claim-package-local/input/meta.shop.yaml
new file mode 100644
index 000000000..0b986d2dd
--- /dev/null
+++ b/fixtures/requirement-check-conformance/claim-package-local/input/meta.shop.yaml
@@ -0,0 +1,8 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
diff --git a/fixtures/requirement-check-conformance/clean-fully-claimed/expected.json b/fixtures/requirement-check-conformance/clean-fully-claimed/expected.json
new file mode 100644
index 000000000..322a2148f
--- /dev/null
+++ b/fixtures/requirement-check-conformance/clean-fully-claimed/expected.json
@@ -0,0 +1,15 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 6,
+    "functional": 6,
+    "architectural": 0,
+    "byStatus": {
+      "live": 6
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 2,
+    "entitiesTotal": 2
+  }
+}
diff --git a/fixtures/requirement-check-conformance/clean-fully-claimed/input/meta.shop.yaml b/fixtures/requirement-check-conformance/clean-fully-claimed/input/meta.shop.yaml
new file mode 100644
index 000000000..c9b9dcb05
--- /dev/null
+++ b/fixtures/requirement-check-conformance/clean-fully-claimed/input/meta.shop.yaml
@@ -0,0 +1,59 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Customer
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Sales
+              level: 2
+              status: live
+              statement: Sales are taken through the shop.
+              counterexample: A sale made outside the shop.
+              children:
+                - requirement.functional:
+                    name: Orders
+                    level: 3
+                    status: live
+                    statement: Every placed order is kept.
+                    counterexample: A placed order that is lost.
+                    children:
+                      - requirement.functional:
+                          name: Recorded
+                          level: 4
+                          status: live
+                          statement: An order is recorded when it is placed.
+                          counterexample: A placed order has no row.
+                          implementedBy: [Order]
+                          children:
+                            - requirement.functional:
+                                name: Quotable
+                                level: 5
+                                status: live
+                                statement: An order carries a reference the customer can quote.
+                                counterexample: An order nobody can quote back.
+                                implementedBy: [Order.reference]
+                      - requirement.functional:
+                          name: Enrolled
+                          level: 4
+                          status: live
+                          statement: A customer is recorded once.
+                          counterexample: Two rows for one customer.
+                          implementedBy: [Customer]
diff --git a/fixtures/requirement-check-conformance/coverage-arch-claim-propagates/expected.json b/fixtures/requirement-check-conformance/coverage-arch-claim-propagates/expected.json
new file mode 100644
index 000000000..4adc5ced4
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-arch-claim-propagates/expected.json
@@ -0,0 +1,15 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 1,
+    "functional": 0,
+    "architectural": 1,
+    "byStatus": {
+      "live": 1
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 2,
+    "entitiesTotal": 2
+  }
+}
diff --git a/fixtures/requirement-check-conformance/coverage-arch-claim-propagates/input/meta.express.yaml b/fixtures/requirement-check-conformance/coverage-arch-claim-propagates/input/meta.express.yaml
new file mode 100644
index 000000000..760dd4a92
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-arch-claim-propagates/input/meta.express.yaml
@@ -0,0 +1,10 @@
+# A subtype of a subtype, in a second package: its extends is a qualified name, so the
+# claim reaches it only through the resolved super chain.
+metadata:
+  package: acme::express
+  children:
+    - object.entity:
+        name: ExpressOrder
+        extends: acme::shop::Order
+        children:
+          - field.string: { name: courier }
diff --git a/fixtures/requirement-check-conformance/coverage-arch-claim-propagates/input/meta.shop.yaml b/fixtures/requirement-check-conformance/coverage-arch-claim-propagates/input/meta.shop.yaml
new file mode 100644
index 000000000..a2d9dfa12
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-arch-claim-propagates/input/meta.shop.yaml
@@ -0,0 +1,22 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: BaseEntity
+        abstract: true
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Order
+        extends: BaseEntity
+        children:
+          - field.string: { name: reference }
+
+    - requirement.architectural:
+        name: Identified
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [BaseEntity]
diff --git a/fixtures/requirement-check-conformance/coverage-exemptions/expected.json b/fixtures/requirement-check-conformance/coverage-exemptions/expected.json
new file mode 100644
index 000000000..d206e55f4
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-exemptions/expected.json
@@ -0,0 +1,15 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 1,
+    "functional": 1,
+    "architectural": 0,
+    "byStatus": {
+      "live": 1
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/coverage-exemptions/input/meta.shop.yaml b/fixtures/requirement-check-conformance/coverage-exemptions/input/meta.shop.yaml
new file mode 100644
index 000000000..5fae8f25e
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-exemptions/input/meta.shop.yaml
@@ -0,0 +1,33 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: BaseEntity
+        abstract: true
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Order
+        extends: BaseEntity
+        children:
+          - field.string: { name: reference }
+
+    - object.value:
+        name: Address
+        children:
+          - field.string: { name: city }
+
+    - object.projection:
+        name: OrderSummary
+        children:
+          - field.string: { name: reference, extends: Order.reference }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/coverage-functional-claim-does-not-propagate/expected.json b/fixtures/requirement-check-conformance/coverage-functional-claim-does-not-propagate/expected.json
new file mode 100644
index 000000000..d961c9475
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-functional-claim-does-not-propagate/expected.json
@@ -0,0 +1,26 @@
+{
+  "diagnostics": [
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_OBJECT_UNCLAIMED",
+      "message": "no requirement claims 'acme::express::ExpressOrder'. Add it to an L4 requirement's 'implementedBy'."
+    },
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_OBJECT_UNCLAIMED",
+      "message": "no requirement claims 'acme::shop::Order'. Add it to an L4 requirement's 'implementedBy'."
+    }
+  ],
+  "summary": {
+    "total": 1,
+    "functional": 1,
+    "architectural": 0,
+    "byStatus": {
+      "live": 1
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 0,
+    "entitiesTotal": 2
+  }
+}
diff --git a/fixtures/requirement-check-conformance/coverage-functional-claim-does-not-propagate/input/meta.express.yaml b/fixtures/requirement-check-conformance/coverage-functional-claim-does-not-propagate/input/meta.express.yaml
new file mode 100644
index 000000000..760dd4a92
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-functional-claim-does-not-propagate/input/meta.express.yaml
@@ -0,0 +1,10 @@
+# A subtype of a subtype, in a second package: its extends is a qualified name, so the
+# claim reaches it only through the resolved super chain.
+metadata:
+  package: acme::express
+  children:
+    - object.entity:
+        name: ExpressOrder
+        extends: acme::shop::Order
+        children:
+          - field.string: { name: courier }
diff --git a/fixtures/requirement-check-conformance/coverage-functional-claim-does-not-propagate/input/meta.shop.yaml b/fixtures/requirement-check-conformance/coverage-functional-claim-does-not-propagate/input/meta.shop.yaml
new file mode 100644
index 000000000..2f7ff4b0b
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-functional-claim-does-not-propagate/input/meta.shop.yaml
@@ -0,0 +1,23 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: BaseEntity
+        abstract: true
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Order
+        extends: BaseEntity
+        children:
+          - field.string: { name: reference }
+
+    - requirement.functional:
+        name: Kept
+        level: 4
+        status: live
+        statement: Every record is kept.
+        counterexample: A record that is lost.
+        implementedBy: [BaseEntity]
diff --git a/fixtures/requirement-check-conformance/coverage-library-only-not-measured/expected.json b/fixtures/requirement-check-conformance/coverage-library-only-not-measured/expected.json
new file mode 100644
index 000000000..96c707a2c
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-library-only-not-measured/expected.json
@@ -0,0 +1,14 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 12,
+    "functional": 8,
+    "architectural": 4,
+    "byStatus": {
+      "live": 10,
+      "partial": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 0
+  }
+}
diff --git a/fixtures/requirement-check-conformance/coverage-library-only-not-measured/input/meta.shop.yaml b/fixtures/requirement-check-conformance/coverage-library-only-not-measured/input/meta.shop.yaml
new file mode 100644
index 000000000..61c027d31
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-library-only-not-measured/input/meta.shop.yaml
@@ -0,0 +1,15 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Customer
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
diff --git a/fixtures/requirement-check-conformance/coverage-library-only-not-measured/options.json b/fixtures/requirement-check-conformance/coverage-library-only-not-measured/options.json
new file mode 100644
index 000000000..1df71b7f8
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-library-only-not-measured/options.json
@@ -0,0 +1,5 @@
+{
+  "libraries": [
+    "iam"
+  ]
+}
diff --git a/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/expected.json b/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/expected.json
new file mode 100644
index 000000000..70440157b
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/expected.json
@@ -0,0 +1,14 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 12,
+    "functional": 8,
+    "architectural": 4,
+    "byStatus": {
+      "live": 9,
+      "partial": 3
+    },
+    "undecided": 0,
+    "deferredUntracked": 0
+  }
+}
diff --git a/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/input/meta.iam.overlay.yaml b/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/input/meta.iam.overlay.yaml
new file mode 100644
index 000000000..e33acd032
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/input/meta.iam.overlay.yaml
@@ -0,0 +1,11 @@
+# An adopter disagreeing with a requirement the iam library ships. It merges into the
+# library's node, in the library's package, so the project has still authored none.
+metadata:
+  package: metaobjects::iam
+  children:
+    - requirement.architectural:
+        name: noCredentialsOnUser
+        overlay: true
+        status: partial
+        disposition: accepted
+        notes: A password hash is stored on the user row because the login stack predates this library.
diff --git a/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/input/meta.shop.yaml b/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/input/meta.shop.yaml
new file mode 100644
index 000000000..61c027d31
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/input/meta.shop.yaml
@@ -0,0 +1,15 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Customer
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
diff --git a/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/options.json b/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/options.json
new file mode 100644
index 000000000..1df71b7f8
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-library-overlay-does-not-activate/options.json
@@ -0,0 +1,5 @@
+{
+  "libraries": [
+    "iam"
+  ]
+}
diff --git a/fixtures/requirement-check-conformance/coverage-library-plus-project/expected.json b/fixtures/requirement-check-conformance/coverage-library-plus-project/expected.json
new file mode 100644
index 000000000..ed83334ac
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-library-plus-project/expected.json
@@ -0,0 +1,22 @@
+{
+  "diagnostics": [
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_OBJECT_UNCLAIMED",
+      "message": "no requirement claims 'acme::shop::Customer'. Add it to an L4 requirement's 'implementedBy'."
+    }
+  ],
+  "summary": {
+    "total": 13,
+    "functional": 9,
+    "architectural": 4,
+    "byStatus": {
+      "live": 11,
+      "partial": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 10,
+    "entitiesTotal": 11
+  }
+}
diff --git a/fixtures/requirement-check-conformance/coverage-library-plus-project/input/meta.shop.yaml b/fixtures/requirement-check-conformance/coverage-library-plus-project/input/meta.shop.yaml
new file mode 100644
index 000000000..6eb85bff3
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-library-plus-project/input/meta.shop.yaml
@@ -0,0 +1,23 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Customer
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/coverage-library-plus-project/options.json b/fixtures/requirement-check-conformance/coverage-library-plus-project/options.json
new file mode 100644
index 000000000..1df71b7f8
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-library-plus-project/options.json
@@ -0,0 +1,5 @@
+{
+  "libraries": [
+    "iam"
+  ]
+}
diff --git a/fixtures/requirement-check-conformance/coverage-planned-claim-does-not-count/expected.json b/fixtures/requirement-check-conformance/coverage-planned-claim-does-not-count/expected.json
new file mode 100644
index 000000000..739d8b4a7
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-planned-claim-does-not-count/expected.json
@@ -0,0 +1,22 @@
+{
+  "diagnostics": [
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_OBJECT_UNCLAIMED",
+      "message": "no requirement claims 'acme::shop::Customer'. Add it to an L4 requirement's 'implementedBy'."
+    }
+  ],
+  "summary": {
+    "total": 2,
+    "functional": 2,
+    "architectural": 0,
+    "byStatus": {
+      "planned": 1,
+      "live": 1
+    },
+    "undecided": 1,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 2
+  }
+}
diff --git a/fixtures/requirement-check-conformance/coverage-planned-claim-does-not-count/input/meta.shop.yaml b/fixtures/requirement-check-conformance/coverage-planned-claim-does-not-count/input/meta.shop.yaml
new file mode 100644
index 000000000..5267e0f76
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-planned-claim-does-not-count/input/meta.shop.yaml
@@ -0,0 +1,31 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Customer
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    - requirement.functional:
+        name: Enrolled
+        level: 4
+        status: planned
+        statement: A customer is recorded once.
+        counterexample: Two rows for one customer.
+        implementedBy: [Customer]
diff --git a/fixtures/requirement-check-conformance/coverage-unclaimed-entity/expected.json b/fixtures/requirement-check-conformance/coverage-unclaimed-entity/expected.json
new file mode 100644
index 000000000..66cc8b261
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-unclaimed-entity/expected.json
@@ -0,0 +1,21 @@
+{
+  "diagnostics": [
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_OBJECT_UNCLAIMED",
+      "message": "no requirement claims 'acme::shop::Customer'. Add it to an L4 requirement's 'implementedBy'."
+    }
+  ],
+  "summary": {
+    "total": 1,
+    "functional": 1,
+    "architectural": 0,
+    "byStatus": {
+      "live": 1
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 2
+  }
+}
diff --git a/fixtures/requirement-check-conformance/coverage-unclaimed-entity/input/meta.shop.yaml b/fixtures/requirement-check-conformance/coverage-unclaimed-entity/input/meta.shop.yaml
new file mode 100644
index 000000000..6eb85bff3
--- /dev/null
+++ b/fixtures/requirement-check-conformance/coverage-unclaimed-entity/input/meta.shop.yaml
@@ -0,0 +1,23 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Customer
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/expected.json b/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/expected.json
new file mode 100644
index 000000000..3202b1431
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/expected.json
@@ -0,0 +1,22 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Reconciled",
+      "message": "'Order' does not resolve in the loaded model (status 'live' — the model moved and the requirement is stale). An object named \"Order\" exists in: acme::billing::Order, acme::shop::Order. Qualify it with its package (FQN)."
+    }
+  ],
+  "summary": {
+    "total": 3,
+    "functional": 3,
+    "architectural": 0,
+    "byStatus": {
+      "live": 3
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 2,
+    "entitiesTotal": 2
+  }
+}
diff --git a/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/input/meta.billing.yaml b/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/input/meta.billing.yaml
new file mode 100644
index 000000000..13c41709a
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/input/meta.billing.yaml
@@ -0,0 +1,8 @@
+metadata:
+  package: acme::billing
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
diff --git a/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/input/meta.ledger.yaml b/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/input/meta.ledger.yaml
new file mode 100644
index 000000000..68f59b541
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/input/meta.ledger.yaml
@@ -0,0 +1,27 @@
+metadata:
+  package: acme::ledger
+  children:
+    - requirement.functional:
+        name: ShopOrders
+        level: 4
+        status: live
+        statement: A shop order is recorded when it is placed.
+        counterexample: A placed shop order has no row.
+        implementedBy: ["acme::shop::Order"]
+
+    - requirement.functional:
+        name: BillingOrders
+        level: 4
+        status: live
+        statement: A billing order is recorded when it is invoiced.
+        counterexample: An invoice with no billing order.
+        implementedBy: ["acme::billing::Order"]
+
+    # Order exists in acme::billing and in acme::shop, and in neither is it local to acme::ledger.
+    - requirement.functional:
+        name: Reconciled
+        level: 4
+        status: live
+        statement: Every shop order is matched to a billing order.
+        counterexample: A shop order billing never saw.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/input/meta.shop.yaml b/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/input/meta.shop.yaml
new file mode 100644
index 000000000..0b986d2dd
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-bare-name-in-two-packages/input/meta.shop.yaml
@@ -0,0 +1,8 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
diff --git a/fixtures/requirement-check-conformance/dangling-member-first-missing-segment/expected.json b/fixtures/requirement-check-conformance/dangling-member-first-missing-segment/expected.json
new file mode 100644
index 000000000..2ceef26da
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-member-first-missing-segment/expected.json
@@ -0,0 +1,28 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Recorded.Readable",
+      "message": "'Order.reference.display' does not resolve in the loaded model (status 'live' — the model moved and the requirement is stale). 'acme::shop::Order.reference' has no member 'display'."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Recorded.Tracked",
+      "message": "'Order.shipment.carrier' does not resolve in the loaded model (status 'live' — the model moved and the requirement is stale). 'acme::shop::Order' has no member 'shipment'."
+    }
+  ],
+  "summary": {
+    "total": 3,
+    "functional": 3,
+    "architectural": 0,
+    "byStatus": {
+      "live": 3
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/dangling-member-first-missing-segment/input/meta.shop.yaml b/fixtures/requirement-check-conformance/dangling-member-first-missing-segment/input/meta.shop.yaml
new file mode 100644
index 000000000..b106733e0
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-member-first-missing-segment/input/meta.shop.yaml
@@ -0,0 +1,34 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+        children:
+          # Order.reference resolves; it has no member named display.
+          - requirement.functional:
+              name: Readable
+              level: 5
+              status: live
+              statement: An order reference is shown in a form a person can read.
+              counterexample: A reference shown as a raw string.
+              implementedBy: [Order.reference.display]
+          # Order has no member named shipment, so carrier is never reached.
+          - requirement.functional:
+              name: Tracked
+              level: 5
+              status: live
+              statement: An order names the carrier that ships it.
+              counterexample: A shipped order with no carrier.
+              implementedBy: [Order.shipment.carrier]
diff --git a/fixtures/requirement-check-conformance/dangling-member-of-resolved-object/expected.json b/fixtures/requirement-check-conformance/dangling-member-of-resolved-object/expected.json
new file mode 100644
index 000000000..24cfb28b8
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-member-of-resolved-object/expected.json
@@ -0,0 +1,22 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Recorded.Totalled",
+      "message": "'Order.total' does not resolve in the loaded model (status 'live' — the model moved and the requirement is stale). 'acme::shop::Order' has no member 'total'."
+    }
+  ],
+  "summary": {
+    "total": 2,
+    "functional": 2,
+    "architectural": 0,
+    "byStatus": {
+      "live": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/dangling-member-of-resolved-object/input/meta.shop.yaml b/fixtures/requirement-check-conformance/dangling-member-of-resolved-object/input/meta.shop.yaml
new file mode 100644
index 000000000..e27840895
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-member-of-resolved-object/input/meta.shop.yaml
@@ -0,0 +1,26 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+        children:
+          # Order resolves; it has no member named total.
+          - requirement.functional:
+              name: Totalled
+              level: 5
+              status: live
+              statement: An order carries the total the customer pays.
+              counterexample: An order with no total.
+              implementedBy: [Order.total]
diff --git a/fixtures/requirement-check-conformance/dangling-object-did-you-mean/expected.json b/fixtures/requirement-check-conformance/dangling-object-did-you-mean/expected.json
new file mode 100644
index 000000000..7aa314814
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-object-did-you-mean/expected.json
@@ -0,0 +1,28 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Invoiced.Totalled",
+      "message": "'Invoice.total' does not resolve in the loaded model (status 'live' — the model moved and the requirement is stale). An object named \"Invoice\" exists in: acme::billing::Invoice. Qualify it with its package (FQN)."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Paid",
+      "message": "'Invoice' does not resolve in the loaded model (status 'live' — the model moved and the requirement is stale). An object named \"Invoice\" exists in: acme::billing::Invoice. Qualify it with its package (FQN)."
+    }
+  ],
+  "summary": {
+    "total": 4,
+    "functional": 4,
+    "architectural": 0,
+    "byStatus": {
+      "live": 4
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 2,
+    "entitiesTotal": 2
+  }
+}
diff --git a/fixtures/requirement-check-conformance/dangling-object-did-you-mean/input/meta.billing.yaml b/fixtures/requirement-check-conformance/dangling-object-did-you-mean/input/meta.billing.yaml
new file mode 100644
index 000000000..344fbea33
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-object-did-you-mean/input/meta.billing.yaml
@@ -0,0 +1,8 @@
+metadata:
+  package: acme::billing
+  children:
+    - object.entity:
+        name: Invoice
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
diff --git a/fixtures/requirement-check-conformance/dangling-object-did-you-mean/input/meta.shop.yaml b/fixtures/requirement-check-conformance/dangling-object-did-you-mean/input/meta.shop.yaml
new file mode 100644
index 000000000..f29b1f5aa
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-object-did-you-mean/input/meta.shop.yaml
@@ -0,0 +1,44 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    - requirement.functional:
+        name: Invoiced
+        level: 4
+        status: live
+        statement: An invoice is raised for every order.
+        counterexample: An order with no invoice.
+        implementedBy: ["acme::billing::Invoice"]
+        children:
+          # A member reference whose owner does not bind: Invoice is not local to acme::shop.
+          # The hint is about the object, Invoice, and never about the member.
+          - requirement.functional:
+              name: Totalled
+              level: 5
+              status: live
+              statement: An invoice carries the total the customer pays.
+              counterexample: An invoice with no total.
+              implementedBy: [Invoice.total]
+
+    # Invoice lives in acme::billing, so the bare name does not bind from acme::shop.
+    - requirement.functional:
+        name: Paid
+        level: 4
+        status: live
+        statement: A payment is recorded against its invoice.
+        counterexample: A payment with no invoice.
+        implementedBy: [Invoice]
diff --git a/fixtures/requirement-check-conformance/dangling-object-live/expected.json b/fixtures/requirement-check-conformance/dangling-object-live/expected.json
new file mode 100644
index 000000000..34fb753d3
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-object-live/expected.json
@@ -0,0 +1,22 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Shop.Orders.Refunded",
+      "message": "'Refund' does not resolve in the loaded model (status 'live' — the model moved and the requirement is stale)."
+    }
+  ],
+  "summary": {
+    "total": 4,
+    "functional": 4,
+    "architectural": 0,
+    "byStatus": {
+      "live": 4
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/dangling-object-live/input/meta.shop.yaml b/fixtures/requirement-check-conformance/dangling-object-live/input/meta.shop.yaml
new file mode 100644
index 000000000..7bff2b3d4
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-object-live/input/meta.shop.yaml
@@ -0,0 +1,39 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Orders
+              level: 3
+              status: live
+              statement: Every placed order is kept.
+              counterexample: A placed order that is lost.
+              children:
+                - requirement.functional:
+                    name: Recorded
+                    level: 4
+                    status: live
+                    statement: An order is recorded when it is placed.
+                    counterexample: A placed order has no row.
+                    implementedBy: [Order]
+                # No object is named Refund.
+                - requirement.functional:
+                    name: Refunded
+                    level: 4
+                    status: live
+                    statement: A refund is recorded against its order.
+                    counterexample: A refund with no order.
+                    implementedBy: [Refund]
diff --git a/fixtures/requirement-check-conformance/dangling-object-partial/expected.json b/fixtures/requirement-check-conformance/dangling-object-partial/expected.json
new file mode 100644
index 000000000..eeadd8c84
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-object-partial/expected.json
@@ -0,0 +1,23 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Shop.Orders.Refunded",
+      "message": "'Refund' does not resolve in the loaded model (status 'partial' — the model moved and the requirement is stale)."
+    }
+  ],
+  "summary": {
+    "total": 4,
+    "functional": 4,
+    "architectural": 0,
+    "byStatus": {
+      "live": 3,
+      "partial": 1
+    },
+    "undecided": 1,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/dangling-object-partial/input/meta.shop.yaml b/fixtures/requirement-check-conformance/dangling-object-partial/input/meta.shop.yaml
new file mode 100644
index 000000000..c1bcd398b
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-object-partial/input/meta.shop.yaml
@@ -0,0 +1,39 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Orders
+              level: 3
+              status: live
+              statement: Every placed order is kept.
+              counterexample: A placed order that is lost.
+              children:
+                - requirement.functional:
+                    name: Recorded
+                    level: 4
+                    status: live
+                    statement: An order is recorded when it is placed.
+                    counterexample: A placed order has no row.
+                    implementedBy: [Order]
+                # No object is named Refund.
+                - requirement.functional:
+                    name: Refunded
+                    level: 4
+                    status: partial
+                    statement: A refund is recorded against its order.
+                    counterexample: A refund with no order.
+                    implementedBy: [Refund]
diff --git a/fixtures/requirement-check-conformance/dangling-object-planned-clean/expected.json b/fixtures/requirement-check-conformance/dangling-object-planned-clean/expected.json
new file mode 100644
index 000000000..916ad5ba1
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-object-planned-clean/expected.json
@@ -0,0 +1,16 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 4,
+    "functional": 4,
+    "architectural": 0,
+    "byStatus": {
+      "planned": 1,
+      "live": 3
+    },
+    "undecided": 1,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/dangling-object-planned-clean/input/meta.shop.yaml b/fixtures/requirement-check-conformance/dangling-object-planned-clean/input/meta.shop.yaml
new file mode 100644
index 000000000..cf9bf7196
--- /dev/null
+++ b/fixtures/requirement-check-conformance/dangling-object-planned-clean/input/meta.shop.yaml
@@ -0,0 +1,39 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Orders
+              level: 3
+              status: live
+              statement: Every placed order is kept.
+              counterexample: A placed order that is lost.
+              children:
+                - requirement.functional:
+                    name: Recorded
+                    level: 4
+                    status: live
+                    statement: An order is recorded when it is placed.
+                    counterexample: A placed order has no row.
+                    implementedBy: [Order]
+                # No object is named Refund.
+                - requirement.functional:
+                    name: Refunded
+                    level: 4
+                    status: planned
+                    statement: A refund is recorded against its order.
+                    counterexample: A refund with no order.
+                    implementedBy: [Refund]
diff --git a/fixtures/requirement-check-conformance/deferred-untracked/expected.json b/fixtures/requirement-check-conformance/deferred-untracked/expected.json
new file mode 100644
index 000000000..04e23c9b2
--- /dev/null
+++ b/fixtures/requirement-check-conformance/deferred-untracked/expected.json
@@ -0,0 +1,23 @@
+{
+  "diagnostics": [
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_DEFERRED_UNTRACKED",
+      "path": "Refunded",
+      "message": "is deferred but names no @trackedBy issue. Deferring without a ticket is how a known gap becomes an unknown one — nothing will raise it again."
+    }
+  ],
+  "summary": {
+    "total": 3,
+    "functional": 3,
+    "architectural": 0,
+    "byStatus": {
+      "planned": 2,
+      "live": 1
+    },
+    "undecided": 0,
+    "deferredUntracked": 1,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/deferred-untracked/input/meta.shop.yaml b/fixtures/requirement-check-conformance/deferred-untracked/input/meta.shop.yaml
new file mode 100644
index 000000000..c46d28469
--- /dev/null
+++ b/fixtures/requirement-check-conformance/deferred-untracked/input/meta.shop.yaml
@@ -0,0 +1,34 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    - requirement.functional:
+        name: Refunded
+        level: 4
+        status: planned
+        disposition: deferred
+        statement: A refund is recorded against its order.
+        counterexample: A refund with no order.
+
+    - requirement.functional:
+        name: Exchanged
+        level: 4
+        status: planned
+        disposition: deferred
+        trackedBy: [SHOP-412]
+        statement: An exchange is recorded against its order.
+        counterexample: An exchange with no order.
diff --git a/fixtures/requirement-check-conformance/disposition-not-applicable/expected.json b/fixtures/requirement-check-conformance/disposition-not-applicable/expected.json
new file mode 100644
index 000000000..de7cc9a40
--- /dev/null
+++ b/fixtures/requirement-check-conformance/disposition-not-applicable/expected.json
@@ -0,0 +1,29 @@
+{
+  "diagnostics": [
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE",
+      "path": "Recorded",
+      "message": "carries @disposition 'accepted' but its status is 'live', which has no outstanding work to decide about. A disposition is meaningful on 'planned' and 'partial' only — on any other status the decision IS the status."
+    },
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE",
+      "path": "Faxed",
+      "message": "carries @disposition 'deferred' but its status is 'retired', which has no outstanding work to decide about. A disposition is meaningful on 'planned' and 'partial' only — on any other status the decision IS the status."
+    }
+  ],
+  "summary": {
+    "total": 2,
+    "functional": 2,
+    "architectural": 0,
+    "byStatus": {
+      "live": 1,
+      "retired": 1
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/disposition-not-applicable/input/meta.shop.yaml b/fixtures/requirement-check-conformance/disposition-not-applicable/input/meta.shop.yaml
new file mode 100644
index 000000000..748a51808
--- /dev/null
+++ b/fixtures/requirement-check-conformance/disposition-not-applicable/input/meta.shop.yaml
@@ -0,0 +1,27 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        disposition: accepted
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    - requirement.functional:
+        name: Faxed
+        level: 4
+        status: retired
+        disposition: deferred
+        trackedBy: [SHOP-12]
+        statement: An order confirmation is sent by fax.
+        counterexample: A confirmed order with no fax.
diff --git a/fixtures/requirement-check-conformance/l4-names-member/expected.json b/fixtures/requirement-check-conformance/l4-names-member/expected.json
new file mode 100644
index 000000000..ae46c1d8d
--- /dev/null
+++ b/fixtures/requirement-check-conformance/l4-names-member/expected.json
@@ -0,0 +1,28 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_L4_NOT_OBJECT",
+      "path": "Quotable",
+      "message": "L4 references an object; 'Order.reference' names a member. Move it to a nested L5 child, or reference the object itself."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_L4_NOT_OBJECT",
+      "path": "Totalled",
+      "message": "L4 references an object; 'Order.total' names a member. Move it to a nested L5 child, or reference the object itself."
+    }
+  ],
+  "summary": {
+    "total": 2,
+    "functional": 2,
+    "architectural": 0,
+    "byStatus": {
+      "live": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/l4-names-member/input/meta.shop.yaml b/fixtures/requirement-check-conformance/l4-names-member/input/meta.shop.yaml
new file mode 100644
index 000000000..a39d49de2
--- /dev/null
+++ b/fixtures/requirement-check-conformance/l4-names-member/input/meta.shop.yaml
@@ -0,0 +1,26 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Quotable
+        level: 4
+        status: live
+        statement: An order carries a reference the customer can quote.
+        counterexample: An order nobody can quote back.
+        implementedBy: [Order.reference]
+
+    # Order has no member named total. The grain error is reported and the dangling check is skipped.
+    - requirement.functional:
+        name: Totalled
+        level: 4
+        status: live
+        statement: An order carries the total the customer pays.
+        counterexample: An order with no total.
+        implementedBy: [Order.total]
diff --git a/fixtures/requirement-check-conformance/l5-member-resolves-clean/expected.json b/fixtures/requirement-check-conformance/l5-member-resolves-clean/expected.json
new file mode 100644
index 000000000..a7968484d
--- /dev/null
+++ b/fixtures/requirement-check-conformance/l5-member-resolves-clean/expected.json
@@ -0,0 +1,15 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 4,
+    "functional": 4,
+    "architectural": 0,
+    "byStatus": {
+      "live": 4
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/l5-member-resolves-clean/input/meta.shop.yaml b/fixtures/requirement-check-conformance/l5-member-resolves-clean/input/meta.shop.yaml
new file mode 100644
index 000000000..d12388acd
--- /dev/null
+++ b/fixtures/requirement-check-conformance/l5-member-resolves-clean/input/meta.shop.yaml
@@ -0,0 +1,47 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - field.currency:
+              name: total
+              currency: USD
+              children:
+                - view.currency: { name: display, locale: en-US }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+        children:
+          # A field.
+          - requirement.functional:
+              name: Quotable
+              level: 5
+              status: live
+              statement: An order carries a reference the customer can quote.
+              counterexample: An order nobody can quote back.
+              implementedBy: [Order.reference]
+          # An identity.
+          - requirement.functional:
+              name: Addressable
+              level: 5
+              status: live
+              statement: An order is addressed by one stable key.
+              counterexample: An order that cannot be pointed at.
+              implementedBy: [Order.pk]
+          # A view under a field.
+          - requirement.functional:
+              name: Priced
+              level: 5
+              status: live
+              statement: An order total is shown in the customer currency.
+              counterexample: A total shown as a bare number.
+              implementedBy: [Order.total.display]
diff --git a/fixtures/requirement-check-conformance/l5-names-object/expected.json b/fixtures/requirement-check-conformance/l5-names-object/expected.json
new file mode 100644
index 000000000..5b044324b
--- /dev/null
+++ b/fixtures/requirement-check-conformance/l5-names-object/expected.json
@@ -0,0 +1,28 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_L5_NOT_MEMBER",
+      "path": "Recorded",
+      "message": "L5 references a member (field, view or identity); 'Order' names an object. Move it to its L4 parent."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_L5_NOT_MEMBER",
+      "path": "Refunded",
+      "message": "L5 references a member (field, view or identity); 'Refund' names an object. Move it to its L4 parent."
+    }
+  ],
+  "summary": {
+    "total": 2,
+    "functional": 2,
+    "architectural": 0,
+    "byStatus": {
+      "live": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/l5-names-object/input/meta.shop.yaml b/fixtures/requirement-check-conformance/l5-names-object/input/meta.shop.yaml
new file mode 100644
index 000000000..43f265d9b
--- /dev/null
+++ b/fixtures/requirement-check-conformance/l5-names-object/input/meta.shop.yaml
@@ -0,0 +1,26 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 5
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    # No object is named Refund. The grain error is reported and the dangling check is skipped.
+    - requirement.functional:
+        name: Refunded
+        level: 5
+        status: live
+        statement: A refund is recorded against its order.
+        counterexample: A refund with no order.
+        implementedBy: [Refund]
diff --git a/fixtures/requirement-check-conformance/level-nesting/expected.json b/fixtures/requirement-check-conformance/level-nesting/expected.json
new file mode 100644
index 000000000..5f7a1be3e
--- /dev/null
+++ b/fixtures/requirement-check-conformance/level-nesting/expected.json
@@ -0,0 +1,28 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_LEVEL_NESTING",
+      "path": "Recorded.Duplicated",
+      "message": "nested under \"Recorded\" (level 4) but declares level 4. Nesting is the hierarchy — a child sits strictly below its parent."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_LEVEL_NESTING",
+      "path": "Recorded.Quotable.Inverted",
+      "message": "nested under \"Quotable\" (level 5) but declares level 4. Nesting is the hierarchy — a child sits strictly below its parent."
+    }
+  ],
+  "summary": {
+    "total": 4,
+    "functional": 4,
+    "architectural": 0,
+    "byStatus": {
+      "live": 4
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/level-nesting/input/meta.shop.yaml b/fixtures/requirement-check-conformance/level-nesting/input/meta.shop.yaml
new file mode 100644
index 000000000..50d2dc1d6
--- /dev/null
+++ b/fixtures/requirement-check-conformance/level-nesting/input/meta.shop.yaml
@@ -0,0 +1,42 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+        children:
+          # The same level as its parent.
+          - requirement.functional:
+              name: Duplicated
+              level: 4
+              status: live
+              statement: An order is recorded once.
+              counterexample: Two rows for one order.
+              implementedBy: [Order]
+          - requirement.functional:
+              name: Quotable
+              level: 5
+              status: live
+              statement: An order carries a reference the customer can quote.
+              counterexample: An order nobody can quote back.
+              implementedBy: [Order.reference]
+              children:
+                # A level above its parent.
+                - requirement.functional:
+                    name: Inverted
+                    level: 4
+                    status: live
+                    statement: An order can be found again by its reference.
+                    counterexample: A reference that finds no order.
+                    implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/link-above-floor/expected.json b/fixtures/requirement-check-conformance/link-above-floor/expected.json
new file mode 100644
index 000000000..34c301a99
--- /dev/null
+++ b/fixtures/requirement-check-conformance/link-above-floor/expected.json
@@ -0,0 +1,28 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_LINK_ABOVE_FLOOR",
+      "path": "Shop",
+      "message": "'implementedBy' is legal at L4 (object) and L5 (member) only. L1-L3 are organisational and never reference the model — move the links to a nested L4 child."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_LINK_ABOVE_FLOOR",
+      "path": "Shop.Orders",
+      "message": "'implementedBy' is legal at L4 (object) and L5 (member) only. L1-L3 are organisational and never reference the model — move the links to a nested L4 child."
+    }
+  ],
+  "summary": {
+    "total": 2,
+    "functional": 2,
+    "architectural": 0,
+    "byStatus": {
+      "live": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/link-above-floor/input/meta.shop.yaml b/fixtures/requirement-check-conformance/link-above-floor/input/meta.shop.yaml
new file mode 100644
index 000000000..eebbc7720
--- /dev/null
+++ b/fixtures/requirement-check-conformance/link-above-floor/input/meta.shop.yaml
@@ -0,0 +1,27 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # The disposition on a live node would be a warning of its own; the link error stops the node's checks first.
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        disposition: accepted
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        implementedBy: [Order]
+        children:
+          - requirement.functional:
+              name: Orders
+              level: 3
+              status: live
+              statement: Every placed order is kept.
+              counterexample: A placed order that is lost.
+              implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/no-requirements/expected.json b/fixtures/requirement-check-conformance/no-requirements/expected.json
new file mode 100644
index 000000000..7aba952d1
--- /dev/null
+++ b/fixtures/requirement-check-conformance/no-requirements/expected.json
@@ -0,0 +1,4 @@
+{
+  "diagnostics": [],
+  "summary": null
+}
diff --git a/fixtures/requirement-check-conformance/no-requirements/input/meta.shop.yaml b/fixtures/requirement-check-conformance/no-requirements/input/meta.shop.yaml
new file mode 100644
index 000000000..61c027d31
--- /dev/null
+++ b/fixtures/requirement-check-conformance/no-requirements/input/meta.shop.yaml
@@ -0,0 +1,15 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Customer
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
diff --git a/fixtures/requirement-check-conformance/nothing-implements-delegating-parent-clean/expected.json b/fixtures/requirement-check-conformance/nothing-implements-delegating-parent-clean/expected.json
new file mode 100644
index 000000000..fd6f689cf
--- /dev/null
+++ b/fixtures/requirement-check-conformance/nothing-implements-delegating-parent-clean/expected.json
@@ -0,0 +1,16 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 5,
+    "functional": 5,
+    "architectural": 0,
+    "byStatus": {
+      "planned": 1,
+      "live": 4
+    },
+    "undecided": 1,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/nothing-implements-delegating-parent-clean/input/meta.shop.yaml b/fixtures/requirement-check-conformance/nothing-implements-delegating-parent-clean/input/meta.shop.yaml
new file mode 100644
index 000000000..c9bd43e05
--- /dev/null
+++ b/fixtures/requirement-check-conformance/nothing-implements-delegating-parent-clean/input/meta.shop.yaml
@@ -0,0 +1,46 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Orders
+              level: 3
+              status: live
+              statement: Every placed order is kept.
+              counterexample: A placed order that is lost.
+              children:
+                - requirement.functional:
+                    name: Recorded
+                    level: 4
+                    status: live
+                    statement: An order is recorded when it is placed.
+                    counterexample: A placed order has no row.
+                    implementedBy: [Order]
+          - requirement.functional:
+              name: Refunds
+              level: 3
+              status: live
+              statement: Every refund is kept.
+              counterexample: A refund that is lost.
+              children:
+                # Planned, and Refund does not exist yet. It still names a node, so Refunds delegates.
+                - requirement.functional:
+                    name: Refunded
+                    level: 4
+                    status: planned
+                    statement: A refund is recorded against its order.
+                    counterexample: A refund with no order.
+                    implementedBy: [Refund]
diff --git a/fixtures/requirement-check-conformance/nothing-implements-subtree/expected.json b/fixtures/requirement-check-conformance/nothing-implements-subtree/expected.json
new file mode 100644
index 000000000..2efce487a
--- /dev/null
+++ b/fixtures/requirement-check-conformance/nothing-implements-subtree/expected.json
@@ -0,0 +1,35 @@
+{
+  "diagnostics": [
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_NOTHING_IMPLEMENTS",
+      "path": "Returns",
+      "message": "is 'live' but neither it nor anything nested under it names an implementing node. A functional requirement's check is existence — a subtree that claims nothing is a capability nobody built."
+    },
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_NOTHING_IMPLEMENTS",
+      "path": "Returns.Refunds",
+      "message": "is 'partial' but neither it nor anything nested under it names an implementing node. A functional requirement's check is existence — a subtree that claims nothing is a capability nobody built."
+    },
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_NOTHING_IMPLEMENTS",
+      "path": "Returns.Refunds.Refunded",
+      "message": "is 'live' but neither it nor anything nested under it names an implementing node. A functional requirement's check is existence — a subtree that claims nothing is a capability nobody built."
+    }
+  ],
+  "summary": {
+    "total": 4,
+    "functional": 4,
+    "architectural": 0,
+    "byStatus": {
+      "live": 3,
+      "partial": 1
+    },
+    "undecided": 1,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/nothing-implements-subtree/input/meta.shop.yaml b/fixtures/requirement-check-conformance/nothing-implements-subtree/input/meta.shop.yaml
new file mode 100644
index 000000000..504b85c85
--- /dev/null
+++ b/fixtures/requirement-check-conformance/nothing-implements-subtree/input/meta.shop.yaml
@@ -0,0 +1,39 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    # Nothing in this subtree names an implementing node.
+    - requirement.functional:
+        name: Returns
+        level: 1
+        status: live
+        statement: A customer can send an order back.
+        counterexample: An order that cannot be returned.
+        children:
+          - requirement.functional:
+              name: Refunds
+              level: 3
+              status: partial
+              statement: Every refund is kept.
+              counterexample: A refund that is lost.
+              children:
+                - requirement.functional:
+                    name: Refunded
+                    level: 4
+                    status: live
+                    statement: A refund is recorded against its order.
+                    counterexample: A refund with no order.
diff --git a/fixtures/requirement-check-conformance/require-implementers-raises-only-that-code/expected.json b/fixtures/requirement-check-conformance/require-implementers-raises-only-that-code/expected.json
new file mode 100644
index 000000000..799b91b5c
--- /dev/null
+++ b/fixtures/requirement-check-conformance/require-implementers-raises-only-that-code/expected.json
@@ -0,0 +1,34 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "WARN_REQUIREMENT_NOTHING_IMPLEMENTS",
+      "path": "Refunded",
+      "message": "is 'live' but neither it nor anything nested under it names an implementing node. A functional requirement's check is existence — a subtree that claims nothing is a capability nobody built."
+    },
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_DEFERRED_UNTRACKED",
+      "path": "Exchanged",
+      "message": "is deferred but names no @trackedBy issue. Deferring without a ticket is how a known gap becomes an unknown one — nothing will raise it again."
+    },
+    {
+      "severity": "warn",
+      "code": "WARN_REQUIREMENT_OBJECT_UNCLAIMED",
+      "message": "no requirement claims 'acme::shop::Customer'. Add it to an L4 requirement's 'implementedBy'."
+    }
+  ],
+  "summary": {
+    "total": 3,
+    "functional": 3,
+    "architectural": 0,
+    "byStatus": {
+      "planned": 1,
+      "live": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 1,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 2
+  }
+}
diff --git a/fixtures/requirement-check-conformance/require-implementers-raises-only-that-code/input/meta.shop.yaml b/fixtures/requirement-check-conformance/require-implementers-raises-only-that-code/input/meta.shop.yaml
new file mode 100644
index 000000000..6362e8750
--- /dev/null
+++ b/fixtures/requirement-check-conformance/require-implementers-raises-only-that-code/input/meta.shop.yaml
@@ -0,0 +1,41 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # No requirement claims Customer: a coverage warning the strict switch leaves alone.
+    - object.entity:
+        name: Customer
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    # Live and names nothing: the one finding the strict switch raises to an error.
+    - requirement.functional:
+        name: Refunded
+        level: 4
+        status: live
+        statement: A refund is recorded against its order.
+        counterexample: A refund with no order.
+
+    # Deferred with no ticket: a warning the strict switch leaves alone.
+    - requirement.functional:
+        name: Exchanged
+        level: 4
+        status: planned
+        disposition: deferred
+        statement: An exchange is recorded against its order.
+        counterexample: An exchange with no order.
diff --git a/fixtures/requirement-check-conformance/require-implementers-raises-only-that-code/options.json b/fixtures/requirement-check-conformance/require-implementers-raises-only-that-code/options.json
new file mode 100644
index 000000000..92afc2d38
--- /dev/null
+++ b/fixtures/requirement-check-conformance/require-implementers-raises-only-that-code/options.json
@@ -0,0 +1,3 @@
+{
+  "requireImplementers": true
+}
diff --git a/fixtures/requirement-check-conformance/require-implementers/expected.json b/fixtures/requirement-check-conformance/require-implementers/expected.json
new file mode 100644
index 000000000..2194ac2cc
--- /dev/null
+++ b/fixtures/requirement-check-conformance/require-implementers/expected.json
@@ -0,0 +1,35 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "WARN_REQUIREMENT_NOTHING_IMPLEMENTS",
+      "path": "Returns",
+      "message": "is 'live' but neither it nor anything nested under it names an implementing node. A functional requirement's check is existence — a subtree that claims nothing is a capability nobody built."
+    },
+    {
+      "severity": "error",
+      "code": "WARN_REQUIREMENT_NOTHING_IMPLEMENTS",
+      "path": "Returns.Refunds",
+      "message": "is 'partial' but neither it nor anything nested under it names an implementing node. A functional requirement's check is existence — a subtree that claims nothing is a capability nobody built."
+    },
+    {
+      "severity": "error",
+      "code": "WARN_REQUIREMENT_NOTHING_IMPLEMENTS",
+      "path": "Returns.Refunds.Refunded",
+      "message": "is 'live' but neither it nor anything nested under it names an implementing node. A functional requirement's check is existence — a subtree that claims nothing is a capability nobody built."
+    }
+  ],
+  "summary": {
+    "total": 4,
+    "functional": 4,
+    "architectural": 0,
+    "byStatus": {
+      "live": 3,
+      "partial": 1
+    },
+    "undecided": 1,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/require-implementers/input/meta.shop.yaml b/fixtures/requirement-check-conformance/require-implementers/input/meta.shop.yaml
new file mode 100644
index 000000000..504b85c85
--- /dev/null
+++ b/fixtures/requirement-check-conformance/require-implementers/input/meta.shop.yaml
@@ -0,0 +1,39 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    # Nothing in this subtree names an implementing node.
+    - requirement.functional:
+        name: Returns
+        level: 1
+        status: live
+        statement: A customer can send an order back.
+        counterexample: An order that cannot be returned.
+        children:
+          - requirement.functional:
+              name: Refunds
+              level: 3
+              status: partial
+              statement: Every refund is kept.
+              counterexample: A refund that is lost.
+              children:
+                - requirement.functional:
+                    name: Refunded
+                    level: 4
+                    status: live
+                    statement: A refund is recorded against its order.
+                    counterexample: A refund with no order.
diff --git a/fixtures/requirement-check-conformance/require-implementers/options.json b/fixtures/requirement-check-conformance/require-implementers/options.json
new file mode 100644
index 000000000..92afc2d38
--- /dev/null
+++ b/fixtures/requirement-check-conformance/require-implementers/options.json
@@ -0,0 +1,3 @@
+{
+  "requireImplementers": true
+}
diff --git a/fixtures/requirement-check-conformance/retired-clean/expected.json b/fixtures/requirement-check-conformance/retired-clean/expected.json
new file mode 100644
index 000000000..2538bc46e
--- /dev/null
+++ b/fixtures/requirement-check-conformance/retired-clean/expected.json
@@ -0,0 +1,16 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 3,
+    "functional": 3,
+    "architectural": 0,
+    "byStatus": {
+      "live": 1,
+      "retired": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/retired-clean/input/meta.shop.yaml b/fixtures/requirement-check-conformance/retired-clean/input/meta.shop.yaml
new file mode 100644
index 000000000..10e661648
--- /dev/null
+++ b/fixtures/requirement-check-conformance/retired-clean/input/meta.shop.yaml
@@ -0,0 +1,31 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    - requirement.functional:
+        name: Fax
+        level: 1
+        status: retired
+        statement: A customer can order by fax.
+        counterexample: A faxed order that is refused.
+        children:
+          - requirement.functional:
+              name: Faxed
+              level: 4
+              status: retired
+              statement: An order confirmation is sent by fax.
+              counterexample: A confirmed order with no fax.
diff --git a/fixtures/requirement-check-conformance/same-name-in-two-branches/expected.json b/fixtures/requirement-check-conformance/same-name-in-two-branches/expected.json
new file mode 100644
index 000000000..e5ef0d3cf
--- /dev/null
+++ b/fixtures/requirement-check-conformance/same-name-in-two-branches/expected.json
@@ -0,0 +1,28 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Shop.Orders.Recorded",
+      "message": "'Ordr' does not resolve in the loaded model (status 'live' — the model moved and the requirement is stale)."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Shop.Returns.Recorded",
+      "message": "'Ordr' does not resolve in the loaded model (status 'live' — the model moved and the requirement is stale)."
+    }
+  ],
+  "summary": {
+    "total": 5,
+    "functional": 5,
+    "architectural": 0,
+    "byStatus": {
+      "live": 5
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/same-name-in-two-branches/input/meta.shop.yaml b/fixtures/requirement-check-conformance/same-name-in-two-branches/input/meta.shop.yaml
new file mode 100644
index 000000000..d25e8f8d6
--- /dev/null
+++ b/fixtures/requirement-check-conformance/same-name-in-two-branches/input/meta.shop.yaml
@@ -0,0 +1,46 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Orders
+              level: 3
+              status: live
+              statement: Every placed order is kept.
+              counterexample: A placed order that is lost.
+              children:
+                # No object is named Ordr.
+                - requirement.functional:
+                    name: Recorded
+                    level: 4
+                    status: live
+                    statement: An order is recorded when it is placed.
+                    counterexample: A placed order has no row.
+                    implementedBy: [Order, Ordr]
+          - requirement.functional:
+              name: Returns
+              level: 3
+              status: live
+              statement: A customer can send an order back.
+              counterexample: An order that cannot be returned.
+              children:
+                - requirement.functional:
+                    name: Recorded
+                    level: 4
+                    status: live
+                    statement: A return is recorded when it is received.
+                    counterexample: A received return has no row.
+                    implementedBy: [Order, Ordr]
diff --git a/fixtures/requirement-check-conformance/summary-undecided-rollup/expected.json b/fixtures/requirement-check-conformance/summary-undecided-rollup/expected.json
new file mode 100644
index 000000000..7398d074b
--- /dev/null
+++ b/fixtures/requirement-check-conformance/summary-undecided-rollup/expected.json
@@ -0,0 +1,16 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 10,
+    "functional": 10,
+    "architectural": 0,
+    "byStatus": {
+      "live": 1,
+      "partial": 9
+    },
+    "undecided": 4,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 2,
+    "entitiesTotal": 2
+  }
+}
diff --git a/fixtures/requirement-check-conformance/summary-undecided-rollup/input/meta.shop.yaml b/fixtures/requirement-check-conformance/summary-undecided-rollup/input/meta.shop.yaml
new file mode 100644
index 000000000..11bdba74b
--- /dev/null
+++ b/fixtures/requirement-check-conformance/summary-undecided-rollup/input/meta.shop.yaml
@@ -0,0 +1,97 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Customer
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Counted once, at the child: a parent is partial because its child is.
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: partial
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Recorded
+              level: 4
+              status: partial
+              statement: An order is recorded when it is placed.
+              counterexample: A placed order has no row.
+              implementedBy: [Order]
+
+    # Counted once, at the grandchild: both ancestors are roll-ups.
+    - requirement.functional:
+        name: Returns
+        level: 1
+        status: partial
+        statement: A customer can send an order back.
+        counterexample: An order that cannot be returned.
+        children:
+          - requirement.functional:
+              name: Refunds
+              level: 3
+              status: partial
+              statement: Every refund is kept.
+              counterexample: A refund that is lost.
+              children:
+                - requirement.functional:
+                    name: Refunded
+                    level: 4
+                    status: partial
+                    statement: A refund is recorded against its order.
+                    counterexample: A refund with no order.
+                    implementedBy: [Order]
+
+    # Not counted: the child is ruled on, and it still makes its parent a roll-up.
+    - requirement.functional:
+        name: Loyalty
+        level: 1
+        status: partial
+        statement: A returning customer is recognised.
+        counterexample: A returning customer treated as new.
+        children:
+          - requirement.functional:
+              name: Enrolled
+              level: 4
+              status: partial
+              disposition: accepted
+              statement: A customer is recorded once.
+              counterexample: Two rows for one customer.
+              implementedBy: [Customer]
+
+    # Counted at the parent: nothing beneath it has outstanding work.
+    - requirement.functional:
+        name: Delivery
+        level: 1
+        status: partial
+        statement: An order reaches the customer.
+        counterexample: An order that never arrives.
+        children:
+          - requirement.functional:
+              name: Dispatched
+              level: 4
+              status: live
+              statement: An order is recorded when it leaves.
+              counterexample: A dispatched order has no row.
+              implementedBy: [Order]
+
+    # Counted, and so is Delivery: DeliveryNote starts with the same letters and is not
+    # beneath it. Ancestry is by path segment, never by string prefix.
+    - requirement.functional:
+        name: DeliveryNote
+        level: 4
+        status: partial
+        statement: A delivery note is recorded for every dispatched order.
+        counterexample: A dispatched order with no delivery note.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-check-conformance/superseded-by-dangling/expected.json b/fixtures/requirement-check-conformance/superseded-by-dangling/expected.json
new file mode 100644
index 000000000..f10bdb6a5
--- /dev/null
+++ b/fixtures/requirement-check-conformance/superseded-by-dangling/expected.json
@@ -0,0 +1,35 @@
+{
+  "diagnostics": [
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Shop.Orders.Faxed",
+      "message": "@supersededBy 'Shop.Orders.Recordd' does not name a requirement in the loaded ledger. It must name the requirement that REPLACED this one — if nothing did, drop the attribute and let `notes` carry why the capability went."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Shop.Orders.Telexed",
+      "message": "@supersededBy 'Recorded' does not name a requirement in the loaded ledger. It must name the requirement that REPLACED this one — if nothing did, drop the attribute and let `notes` carry why the capability went."
+    },
+    {
+      "severity": "error",
+      "code": "ERR_REQUIREMENT_DANGLING_REF",
+      "path": "Shop.Orders.Posted",
+      "message": "@supersededBy 'Order' does not name a requirement in the loaded ledger. It must name the requirement that REPLACED this one — if nothing did, drop the attribute and let `notes` carry why the capability went."
+    }
+  ],
+  "summary": {
+    "total": 6,
+    "functional": 6,
+    "architectural": 0,
+    "byStatus": {
+      "live": 3,
+      "retired": 3
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/superseded-by-dangling/input/meta.shop.yaml b/fixtures/requirement-check-conformance/superseded-by-dangling/input/meta.shop.yaml
new file mode 100644
index 000000000..303eab76d
--- /dev/null
+++ b/fixtures/requirement-check-conformance/superseded-by-dangling/input/meta.shop.yaml
@@ -0,0 +1,55 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Orders
+              level: 3
+              status: live
+              statement: Every placed order is kept.
+              counterexample: A placed order that is lost.
+              children:
+                - requirement.functional:
+                    name: Recorded
+                    level: 4
+                    status: live
+                    statement: An order is recorded when it is placed.
+                    counterexample: A placed order has no row.
+                    implementedBy: [Order]
+                # A misspelt path.
+                - requirement.functional:
+                    name: Faxed
+                    level: 4
+                    status: retired
+                    supersededBy: Shop.Orders.Recordd
+                    statement: An order confirmation is sent by fax.
+                    counterexample: A confirmed order with no fax.
+                # A name is not an address: the requirement is Shop.Orders.Recorded.
+                - requirement.functional:
+                    name: Telexed
+                    level: 4
+                    status: retired
+                    supersededBy: Recorded
+                    statement: An order confirmation is sent by telex.
+                    counterexample: A confirmed order with no telex.
+                # An object, not a requirement.
+                - requirement.functional:
+                    name: Posted
+                    level: 4
+                    status: retired
+                    supersededBy: Order
+                    statement: An order confirmation is sent by post.
+                    counterexample: A confirmed order with no letter.
diff --git a/fixtures/requirement-check-conformance/superseded-by-package-local/expected.json b/fixtures/requirement-check-conformance/superseded-by-package-local/expected.json
new file mode 100644
index 000000000..add0f066b
--- /dev/null
+++ b/fixtures/requirement-check-conformance/superseded-by-package-local/expected.json
@@ -0,0 +1,16 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 8,
+    "functional": 8,
+    "architectural": 0,
+    "byStatus": {
+      "live": 4,
+      "retired": 4
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 2,
+    "entitiesTotal": 2
+  }
+}
diff --git a/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.acme.yaml b/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.acme.yaml
new file mode 100644
index 000000000..8ccf2d72f
--- /dev/null
+++ b/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.acme.yaml
@@ -0,0 +1,11 @@
+metadata:
+  package: acme
+  children:
+    # Completed with this file's package: acme::shop::Orders.Recorded.
+    - requirement.functional:
+        name: Wired
+        level: 4
+        status: retired
+        supersededBy: shop::Orders.Recorded
+        statement: An order confirmation is sent by wire.
+        counterexample: A confirmed order with no wire.
diff --git a/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.archive.yaml b/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.archive.yaml
new file mode 100644
index 000000000..9ec7326e9
--- /dev/null
+++ b/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.archive.yaml
@@ -0,0 +1,11 @@
+metadata:
+  package: acme::archive
+  children:
+    # No requirement in acme::archive has this path; a bare path is looked up across the whole ledger.
+    - requirement.functional:
+        name: Telexed
+        level: 4
+        status: retired
+        supersededBy: Orders.Recorded
+        statement: An order confirmation is sent by telex.
+        counterexample: A confirmed order with no telex.
diff --git a/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.billing.yaml b/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.billing.yaml
new file mode 100644
index 000000000..eb1a13614
--- /dev/null
+++ b/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.billing.yaml
@@ -0,0 +1,30 @@
+metadata:
+  package: acme::billing
+  children:
+    - object.entity:
+        name: Invoice
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Orders
+        level: 3
+        status: live
+        statement: Every placed order is kept.
+        counterexample: A placed order that is lost.
+        children:
+          - requirement.functional:
+              name: Recorded
+              level: 4
+              status: live
+              statement: A billing order is recorded when it is raised.
+              counterexample: A raised billing order has no row.
+              implementedBy: [Invoice]
+          - requirement.functional:
+              name: Posted
+              level: 4
+              status: retired
+              supersededBy: Orders.Recorded
+              statement: An order confirmation is sent by post.
+              counterexample: A confirmed order with no letter.
diff --git a/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.shop.yaml b/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.shop.yaml
new file mode 100644
index 000000000..206152544
--- /dev/null
+++ b/fixtures/requirement-check-conformance/superseded-by-package-local/input/meta.shop.yaml
@@ -0,0 +1,32 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Orders
+        level: 3
+        status: live
+        statement: Every placed order is kept.
+        counterexample: A placed order that is lost.
+        children:
+          - requirement.functional:
+              name: Recorded
+              level: 4
+              status: live
+              statement: An order is recorded when it is placed.
+              counterexample: A placed order has no row.
+              implementedBy: [Order]
+          # Orders.Recorded is a path in acme::shop and in acme::billing. It still binds.
+          - requirement.functional:
+              name: Faxed
+              level: 4
+              status: retired
+              supersededBy: Orders.Recorded
+              statement: An order confirmation is sent by fax.
+              counterexample: A confirmed order with no fax.
diff --git a/fixtures/requirement-check-conformance/superseded-by-resolves-clean/expected.json b/fixtures/requirement-check-conformance/superseded-by-resolves-clean/expected.json
new file mode 100644
index 000000000..70b72a9f1
--- /dev/null
+++ b/fixtures/requirement-check-conformance/superseded-by-resolves-clean/expected.json
@@ -0,0 +1,16 @@
+{
+  "diagnostics": [],
+  "summary": {
+    "total": 5,
+    "functional": 5,
+    "architectural": 0,
+    "byStatus": {
+      "live": 3,
+      "retired": 2
+    },
+    "undecided": 0,
+    "deferredUntracked": 0,
+    "entitiesClaimed": 1,
+    "entitiesTotal": 1
+  }
+}
diff --git a/fixtures/requirement-check-conformance/superseded-by-resolves-clean/input/meta.shop.yaml b/fixtures/requirement-check-conformance/superseded-by-resolves-clean/input/meta.shop.yaml
new file mode 100644
index 000000000..ff79a6c0c
--- /dev/null
+++ b/fixtures/requirement-check-conformance/superseded-by-resolves-clean/input/meta.shop.yaml
@@ -0,0 +1,47 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Orders
+              level: 3
+              status: live
+              statement: Every placed order is kept.
+              counterexample: A placed order that is lost.
+              children:
+                - requirement.functional:
+                    name: Recorded
+                    level: 4
+                    status: live
+                    statement: An order is recorded when it is placed.
+                    counterexample: A placed order has no row.
+                    implementedBy: [Order]
+                # The path alone.
+                - requirement.functional:
+                    name: Faxed
+                    level: 4
+                    status: retired
+                    supersededBy: Shop.Orders.Recorded
+                    statement: An order confirmation is sent by fax.
+                    counterexample: A confirmed order with no fax.
+                # The path qualified by its package.
+                - requirement.functional:
+                    name: Telexed
+                    level: 4
+                    status: retired
+                    supersededBy: acme::shop::Shop.Orders.Recorded
+                    statement: An order confirmation is sent by telex.
+                    counterexample: A confirmed order with no telex.
diff --git a/fixtures/requirement-harness/README.md b/fixtures/requirement-harness/README.md
index de1a380ea..ba23fda6c 100644
--- a/fixtures/requirement-harness/README.md
+++ b/fixtures/requirement-harness/README.md
@@ -22,14 +22,17 @@ assert at the grain of a test.
 
 ## Every slot is skipped, and that is a decision
 
+Every port now ships a `requirement-tests` generator (ADR-0057), and this harness is not
+their output: it stays a skipped scaffold, still generated by its own script.
+
 The shipped `requirementTests()` renderer **fails** a live stub deliberately: for an
 adopter, an empty green test asserts the opposite of the claim. That rule is right
 there and wrong here, and the difference is worth stating rather than departing from
 quietly.
 
 An adopter generates a handful of stubs for capabilities nothing else checks. This
-generates 109 across five ports for a library whose conformance corpora already check
-a great many of them. Emitting 545 red tests would claim nothing is verified, which is
+generates 115 across five ports for a library whose conformance corpora already check
+a great many of them. Emitting 575 red tests would claim nothing is verified, which is
 false — and a suite red for a false reason gets silenced wholesale, taking with it the
 slots that were telling the truth.
 
diff --git a/fixtures/requirement-test-identity-conformance/README.md b/fixtures/requirement-test-identity-conformance/README.md
new file mode 100644
index 000000000..d29f1570a
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/README.md
@@ -0,0 +1,217 @@
+# Requirement-test identity conformance corpus
+
+Every port generates one test per requirement, in its own language and its own test
+framework (ADR-0057). The generated files differ between ports and are meant to. This
+corpus pins what must not differ: **which** tests a ledger yields, what each one is
+**called**, whether it is **skipped**, the **digest** of the claim it tests, and what a
+project's **filter** is shown when it chooses which requirements get a test.
+
+TypeScript is the reference. The identity function is `requirementTestIdentities` in
+`server/typescript/packages/codegen-ts/src/requirement-walk.ts`; a port reads that file
+before it writes its own, and its test suite runs this corpus so the ports cannot drift.
+
+## Fixture format
+
+Each case is a directory:
+
+- `input/` holds one or more metadata documents (`.yaml`).
+- `options.json` is optional. Its keys are `grain` (`"concern"` or `"member"`) and
+  `filter` (the **name** of one predicate from the list below). No other key is legal.
+- `expected.json` holds `{ "tests": [...], "collisions": [...] }`.
+
+A runner does three things, in this order:
+
+1. Load `input/` with the port's loader, **strict**, and assert **no load errors**. Load
+   the files in ascending file-name order, as the requirement-check corpus does. No
+   expectation here is known to depend on that order; the rule is fixed so that none can
+   come to.
+2. Compute the test identities through the port's **public** generator seams: the grain
+   option when `options.json` sets `grain`, and the filter option when it sets `filter`.
+   An option the case does not set is not passed, so the port's own default applies. Then
+   compute the witness-key collisions among those identities.
+3. Compare both with `expected.json`.
+
+### The named filters
+
+A predicate cannot be written in a file five languages read. So a case names one, and
+each port's runner implements this closed list in its own language and hands the predicate
+to the port's filter seam. A name outside the list fails the case.
+
+The predicate receives the **requirement view**: `subType`, `level`, `status`, `path`,
+`package` and `implementedByTypes`. Between them the eight filters read every field, and
+`unlevelled` asks about one that is not there.
+
+| `filter` | The predicate over the requirement view |
+|---|---|
+| `all` | always true |
+| `architectural` | `subType` is `architectural` |
+| `live` | `status` is `live` |
+| `level-5` | `level` is `5` |
+| `unlevelled` | `level` is absent |
+| `package-acme-shop` | `package` is `acme::shop` |
+| `path-under-Shop` | `path` is `Shop` or starts with `Shop.` |
+| `claims-entity` | `implementedByTypes` contains `object.entity` |
+
+- `level` is **absent** on an architectural requirement that declares none. Absent is not
+  a number: the `level-5` predicate must answer false for it without failing, and
+  `unlevelled` must answer true for it and for nothing else. A requirement that declares
+  level `0` or `-1` has a level. A view that stands a number in for "no level" cannot
+  tell the two apart.
+- `path` is the dotted chain of requirement names from the root, with no package.
+- `package` is the requirement's **effective** package: the one the node declares, else
+  the one declared by the nearest requirement it is nested under, else its file's, else
+  the empty string.
+- `implementedByTypes` is the distinct `<type>.<subType>` of the references that
+  **resolve**, in first-seen order. A reference that does not resolve contributes nothing.
+
+With no `filter`, the port's default applies: a requirement gets a test when it is
+`functional` and its `level` is 4 or above.
+
+### What is compared
+
+`tests` is compared after sorting both sides by `id`. Compare code units, not a locale
+collation; every `id` in this corpus is ASCII. Each record is one generated test:
+
+| Field | Definition |
+|---|---|
+| `package` | The requirement's effective package. `""` when it has none. |
+| `path` | The dotted chain of requirement names from the root. |
+| `unit` | What this one test stands for. Under `grain: concern` (the default), one test per **distinct** `<type>.<subType>` among the requirement's resolved references. Under `grain: member`, one test per **distinct** reference that resolves, spelt exactly as authored. In both grains a requirement with no resolved reference yields exactly one test, with unit `*`. |
+| `id` | `<address> [<unit>]`, where the address is `<package>::<path>`, or the bare path when the package is `""`. |
+| `witnessKey` | `req_` + mangle(address), then `__` + mangle(unit) unless the unit is `*`. mangle replaces each maximal run of characters outside `[A-Za-z0-9]` with one `_`. The class is ASCII and `_` is outside it: `Sales__Orders` mangles to `Sales_Orders`. |
+| `status` | The requirement's status. |
+| `skip` | `null` when the status is `live` or `partial`. Otherwise the status: `planned` or `retired`. |
+| `digest` | The requirement digest, below. The same for every test of one requirement. |
+
+`collisions` is a list of `[id, id]` pairs: two tests with one `witnessKey`. Sort each
+pair, then the list, before comparing.
+
+### The requirement digest
+
+`requirement-digest/v1`: the lowercase hex SHA-256 of the UTF-8 bytes of this text, where
+`\n` is one line feed and every line ends with one.
+
+```text
+requirement-digest/v1\n
+subType <n>\n<value>\n
+level <n>\n<value>\n
+status <n>\n<value>\n
+statement <n>\n<value>\n
+counterexample <n>\n<value>\n
+implementedBy <count>\n
+ref <n>\n<value>\n          (one per implementedBy entry, in authored order)
+```
+
+- `<n>` is the length in **bytes** of the value's UTF-8 encoding. `<count>` is the number
+  of `implementedBy` entries.
+- `level` is the decimal integer, or the empty value (`level 0\n\n`) when absent.
+- Every value is the **effective** one: a value reached through `extends` is hashed as if
+  it had been written on the node.
+- In `statement` and `counterexample`, `\r\n` and a lone `\r` each become `\n` before the
+  value is measured.
+- `implementedBy` is hashed as authored: every entry, resolved or not, duplicates included.
+- Nothing else is in the digest. Not the name, the path, the package, `title`,
+  `description`, `notes`, `disposition`, `trackedBy`, `supersededBy`, or any nested
+  requirement.
+
+The worked example hashes
+
+```text
+requirement-digest/v1\nsubType 10\nfunctional\nlevel 1\n4\nstatus 4\nlive\nstatement 39\nAn order is recorded when it is placed.\ncounterexample 26\nA placed order has no row.\nimplementedBy 1\nref 5\nOrder\n
+```
+
+to `2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a`. Passing that text
+to `printf` and piping it into `sha256sum` reproduces it.
+
+### Where the expectations come from
+
+`bun scripts/write-requirement-corpus-expected.ts identity` writes every `expected.json`
+from the TypeScript reference. Each written file is then reviewed by hand against the
+definitions above: the set of units, each `witnessKey` by applying the mangle rule, each
+`skip` against the status, and the digests against each other. A case that yields more
+than its row below says gets its **input** fixed.
+
+A committed `expected.json` is never edited to make a port pass. A port that disagrees with
+it is wrong, unless the reference is shown to be wrong first.
+
+## Things the cases pin that are easy to miss
+
+- **A filter replaces the default. It does not narrow it.** Every `filter-*` case keeps at
+  least one requirement the default would drop, so a port that applies the project's
+  predicate on top of its own default fails every one of them. So does a port that
+  ignores the option.
+- **A filter chooses requirements, not tests.** In `filter-by-claimed-concern` the
+  requirement that claims a template and an entity is kept, and its `template.prompt`
+  test is kept with it.
+- **A nested requirement takes its package from the nearest one above it that declares
+  one, before its file.** In `filter-by-package` each file holds a requirement that
+  declares the other file's package, with a child that declares none. The child goes
+  where its parent went, and its bare reference binds there.
+- **The witness key keeps ASCII letters and digits and nothing else.** An underscore is
+  replaced like any other character, so a doubled one becomes one
+  (`witness-key-collision`). A language's own word class (`\w`) keeps the underscore and
+  gives a different key.
+- **Under `grain: concern`, distinct means distinct, not adjacent.** `concern-fanout`
+  lists an entity, a template and a second entity, and yields two tests.
+- **A reference to a missing member does not fall back to its object.**
+  `member-grain-unresolved-dropped` names a member that an existing object does not
+  have. That reference yields no test.
+- **The digest is over the claim, so equal claims have equal digests wherever they sit.**
+  The worked example's `Recorded` claim is reused under other names and paths, in another
+  package and in no package, and its digest is `2714aa39…` every time.
+- **The digest hashes what was authored, the unit is what resolved.** In `planned-skip`
+  the reference `Refund` resolves to nothing, so the unit is `*`, and it is still in the
+  digest. In `member-grain-duplicate-ref` three entries are hashed and two tests come out.
+- **`unpackaged` is one document on purpose.** What a document without a package takes as
+  its default when it is loaded beside a packaged one is a loader question, and this
+  corpus does not ask it.
+- **The carriage returns in `digest-multibyte-and-crlf` are written as YAML escapes**
+  (`"\r\n"`, `"\r"`), so the value does not depend on the line endings of the file.
+
+What the corpus does **not** pin: the text of a generated test file; the warning that
+names the requirements a filter excluded; and a requirement name outside ASCII. No input
+declares such a name, because the loaders are not known to agree on one. That a letter
+outside ASCII is replaced in the witness key is pinned instead by a test of the key
+function in each port: the address `acme::shop::Café.Réglé` with unit `*` gives
+`req_acme_shop_Caf_R_gl_` (each `é` is the single code point U+00E9).
+
+## Cases
+
+| Case | What it pins |
+|---|---|
+| `default-filter` | With no `filter`, an L1 to L5 tree and two architectural policies yield two tests: the functional L4 and the functional L5. The L1 to L3 nodes get none, and neither does a policy, including one that declares level 4. |
+| `worked-example` | The reference model, which every port's generator test also renders: `Orders.Recorded` (functional, level 4, live, claiming the entity `Order`) and `Orders.Refunded` (functional, level 4, planned, no links), in `acme::shop`, under an L3 parent that gets no test. Both digests are pinned values: `2714aa39…` and `4ddcd781…`. |
+| `concern-fanout` | One requirement claiming two entities and a template yields two tests, `object.entity` and `template.prompt`, with one digest. |
+| `no-targets` | A live L4 with no `implementedBy` yields one test with unit `*`. Its key has no unit suffix. |
+| `planned-skip` | `skip` is `planned`. A planned requirement naming a node that exists keeps that node's concern as its unit; one naming only a node that does not exist has unit `*`. |
+| `retired-skip` | `skip` is `retired`, and the unit is `*`: the loader refuses `implementedBy` on a retired requirement. |
+| `partial-not-skipped` | A `partial` requirement is not skipped: `skip` is `null` and `status` is `partial`. |
+| `member-grain` | `grain: member`: one test per reference. Two entities, which are one concern, are two tests. A bare reference and a package-qualified one each keep the spelling they were authored with, in the unit and in the key, for an object and for a member. |
+| `member-grain-unresolved-dropped` | `grain: member`: a reference that does not resolve yields no test, whether its object is missing or only its member is. A requirement none of whose references resolve yields one test with unit `*`. |
+| `member-grain-duplicate-ref` | `grain: member`: an entity named three times in two spellings yields two tests, one per distinct spelling. |
+| `package-in-address` | The same path, with the same claim, in two packages: two ids and two keys, one digest. |
+| `unpackaged` | A document with no package: `package` is `""`, the address is the bare path, and the key starts `req_Orders_`. The digests are the worked example's. |
+| `nested-path` | A five-deep path. Two branches end in the same three names (`Orders.Recorded.Quotable`), and their tests are told apart by the rest of the path. |
+| `digest-claim-fields` | Two requirements that differ only in name, `title`, `description`, `notes`, `disposition` and `trackedBy` have one digest. A third that differs from the first by one word of the statement has another. Two retired requirements that differ only in name and `supersededBy` have one digest. |
+| `digest-inherited` | A requirement that declares only a counterexample and reaches its level, status, statement and `implementedBy` through `extends` has the digest of the same claim written out in full, and the unit its inherited reference resolves to. |
+| `digest-multibyte-and-crlf` | A statement holding two-byte and three-byte characters and a CR LF pair (55 characters and 76 bytes as authored; 54 and 75 as hashed), and a counterexample holding a CR LF pair and a lone CR (64 bytes as authored, 63 as hashed). Both fields are normalised. |
+| `witness-key-collision` | `Orders.Recorded` beside `Orders_Recorded`: two ids, one key, and one entry in `collisions`. A third requirement, `Sales__Orders`, has the key `req_acme_shop_Sales_Orders__object_entity` and collides with nothing. |
+| `abstract-collected` | An `abstract` functional L4 gets a test like any other requirement, and so does the concrete requirement that extends it. Pinned as the reference behaves, so that the ports cannot drift apart. The owner has not ruled on whether an abstract requirement should be tested. |
+| `filter-all` | `filter: all` over an L1 to L5 tree and one flat policy: all six requirements get a test, the L1 to L3 nodes with unit `*`. |
+| `filter-by-subtype` | `filter: architectural`: a flat policy and a levelled one get tests, and the functional L4 and L5 get none. Pins `subType`, and that a view with no `level` reaches a predicate. |
+| `filter-by-status` | `filter: live`: a `partial` and a `planned` L4 are dropped, and their live L3 parent is kept beside the live L4. Pins `status`. |
+| `filter-by-level` | `filter: level-5`: two functional L5 nodes and a levelled L5 policy get tests. Their L4 parent gets none, and neither does a flat policy, whose `level` is absent. Pins `level`. |
+| `filter-by-absent-level` | `filter: unlevelled`: two flat policies get tests. A levelled policy, a functional L4, and functional requirements that declare level `0` and level `-1` get none. Pins that an absent `level` reaches the predicate as absent. |
+| `filter-by-package` | `filter: package-acme-shop` over two files: a root requirement and a nested one take their file's package; one requirement in each file declares the other file's package, and its child, which declares none, takes that package too. The kept set follows the effective package, not the file, and a kept requirement's bare reference binds in its effective package. Pins `package`. |
+| `filter-by-path` | `filter: path-under-Shop`: `Shop` and both its descendants are kept. `Shopfront` and its child are not. Pins `path` as the whole dotted chain, without the package. |
+| `filter-by-claimed-concern` | `filter: claims-entity`: requirements claiming an entity are kept, a flat policy among them. One claiming only a template and one naming only a node that does not exist are dropped. Pins `implementedByTypes` as the concerns that resolved. |
+
+## Who asserts it
+
+| Port | Runner |
+|---|---|
+| TypeScript (reference) | `server/typescript/packages/codegen-ts/test/requirement-test-identity-conformance.test.ts` |
+| Java | `server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementTestIdentityConformanceTest.java` |
+| Kotlin | identity function inherits via Java; emitted names asserted by `server/java/codegen-kotlin/src/test/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGeneratorTest.kt` |
+| Python | `server/python/tests/conformance/test_requirement_test_identity_conformance.py` |
+| C# | `server/csharp/MetaObjects.Conformance.Tests/RequirementTestIdentityConformanceTests.cs` |
diff --git a/fixtures/requirement-test-identity-conformance/abstract-collected/expected.json b/fixtures/requirement-test-identity-conformance/abstract-collected/expected.json
new file mode 100644
index 000000000..1da7548c4
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/abstract-collected/expected.json
@@ -0,0 +1,25 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::OrderRecorded [object.entity]",
+      "package": "acme::shop",
+      "path": "OrderRecorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_OrderRecorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "8f3e0f0e75d0d4f62da5569800c771ab07863545888d513f92d7647149c96283"
+    },
+    {
+      "id": "acme::shop::Recorded [*]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Recorded",
+      "status": "live",
+      "skip": null,
+      "digest": "16cf2dd765846ea73a51075c2c886f1fa8ea1917b5fdd49079a67223cb251bf5"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/abstract-collected/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/abstract-collected/input/meta.shop.yaml
new file mode 100644
index 000000000..45e7b7074
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/abstract-collected/input/meta.shop.yaml
@@ -0,0 +1,23 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # A claim written once, for concrete requirements to extend. It names nothing.
+    - requirement.functional:
+        name: Recorded
+        abstract: true
+        level: 4
+        status: live
+        statement: A business event is recorded when it happens.
+        counterexample: An event that happened has no row.
+
+    # Takes its level, status, statement and counterexample from Recorded.
+    - requirement.functional:
+        name: OrderRecorded
+        extends: Recorded
+        implementedBy: [Order]
diff --git a/fixtures/requirement-test-identity-conformance/concern-fanout/expected.json b/fixtures/requirement-test-identity-conformance/concern-fanout/expected.json
new file mode 100644
index 000000000..32b77bb16
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/concern-fanout/expected.json
@@ -0,0 +1,25 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Confirmed [object.entity]",
+      "package": "acme::shop",
+      "path": "Confirmed",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Confirmed__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "7432d838dbd4601ec8735162f497a2cc9c100440af803568c974a88b7a85bf3c"
+    },
+    {
+      "id": "acme::shop::Confirmed [template.prompt]",
+      "package": "acme::shop",
+      "path": "Confirmed",
+      "unit": "template.prompt",
+      "witnessKey": "req_acme_shop_Confirmed__template_prompt",
+      "status": "live",
+      "skip": null,
+      "digest": "7432d838dbd4601ec8735162f497a2cc9c100440af803568c974a88b7a85bf3c"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/concern-fanout/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/concern-fanout/input/meta.shop.yaml
new file mode 100644
index 000000000..b0a3d10c8
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/concern-fanout/input/meta.shop.yaml
@@ -0,0 +1,34 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Customer
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.value:
+        name: OrderConfirmationPayload
+        children:
+          - field.string: { name: reference }
+
+    - template.prompt:
+        name: orderConfirmation
+        payloadRef: OrderConfirmationPayload
+        textRef: orders/confirmation
+        format: xml
+
+    # Three references, two concerns. The entities are not adjacent in the list.
+    - requirement.functional:
+        name: Confirmed
+        level: 4
+        status: live
+        statement: A customer is told their order was placed.
+        counterexample: A placed order nobody confirmed.
+        implementedBy: [Order, orderConfirmation, Customer]
diff --git a/fixtures/requirement-test-identity-conformance/default-filter/expected.json b/fixtures/requirement-test-identity-conformance/default-filter/expected.json
new file mode 100644
index 000000000..cece5683b
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/default-filter/expected.json
@@ -0,0 +1,25 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Shop.Sales.Orders.Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Shop.Sales.Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Shop_Sales_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    },
+    {
+      "id": "acme::shop::Shop.Sales.Orders.Recorded.Quotable [field.string]",
+      "package": "acme::shop",
+      "path": "Shop.Sales.Orders.Recorded.Quotable",
+      "unit": "field.string",
+      "witnessKey": "req_acme_shop_Shop_Sales_Orders_Recorded_Quotable__field_string",
+      "status": "live",
+      "skip": null,
+      "digest": "b5d7fb7a9657bfda7b30e2629617bf5c56e4337ef7a06abfe55715613ecdda63"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/default-filter/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/default-filter/input/meta.shop.yaml
new file mode 100644
index 000000000..da1efb432
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/default-filter/input/meta.shop.yaml
@@ -0,0 +1,64 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # L1 to L3 are organisational: no test. L4 and L5 each get one.
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Sales
+              level: 2
+              status: live
+              statement: Sales are taken through the shop.
+              counterexample: A sale made outside the shop.
+              children:
+                - requirement.functional:
+                    name: Orders
+                    level: 3
+                    status: live
+                    statement: Every placed order is kept.
+                    counterexample: A placed order that is lost.
+                    children:
+                      - requirement.functional:
+                          name: Recorded
+                          level: 4
+                          status: live
+                          statement: An order is recorded when it is placed.
+                          counterexample: A placed order has no row.
+                          implementedBy: [Order]
+                          children:
+                            - requirement.functional:
+                                name: Quotable
+                                level: 5
+                                status: live
+                                statement: An order carries a reference the customer can quote.
+                                counterexample: An order nobody can quote back.
+                                implementedBy: [Order.reference]
+
+    # A flat policy: architectural, so no test.
+    - requirement.architectural:
+        name: Identified
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [Order]
+
+    # A levelled policy at L4: the level alone does not earn a test.
+    - requirement.architectural:
+        name: Addressable
+        level: 4
+        status: live
+        statement: An order is addressed by one stable key.
+        counterexample: An order that cannot be pointed at.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-test-identity-conformance/digest-claim-fields/expected.json b/fixtures/requirement-test-identity-conformance/digest-claim-fields/expected.json
new file mode 100644
index 000000000..6f374c259
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/digest-claim-fields/expected.json
@@ -0,0 +1,55 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Annotated [object.entity]",
+      "package": "acme::shop",
+      "path": "Annotated",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Annotated__object_entity",
+      "status": "partial",
+      "skip": null,
+      "digest": "9c7f098dc9a7c74fd9c13cc705bf174c306a3259208abb2a7acca0d577c4e262"
+    },
+    {
+      "id": "acme::shop::Faxed [*]",
+      "package": "acme::shop",
+      "path": "Faxed",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Faxed",
+      "status": "retired",
+      "skip": "retired",
+      "digest": "ef38b10d440646c90a3f9a0a1fd0b331a0c6326ca23eab7462f3e10a961881fa"
+    },
+    {
+      "id": "acme::shop::FaxedThenReplaced [*]",
+      "package": "acme::shop",
+      "path": "FaxedThenReplaced",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_FaxedThenReplaced",
+      "status": "retired",
+      "skip": "retired",
+      "digest": "ef38b10d440646c90a3f9a0a1fd0b331a0c6326ca23eab7462f3e10a961881fa"
+    },
+    {
+      "id": "acme::shop::Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Recorded__object_entity",
+      "status": "partial",
+      "skip": null,
+      "digest": "9c7f098dc9a7c74fd9c13cc705bf174c306a3259208abb2a7acca0d577c4e262"
+    },
+    {
+      "id": "acme::shop::Reworded [object.entity]",
+      "package": "acme::shop",
+      "path": "Reworded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Reworded__object_entity",
+      "status": "partial",
+      "skip": null,
+      "digest": "f3f4a5ffca04e3257f91c228e77603f35bb7ad638f19fda6d41aee15e6aa6b7a"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/digest-claim-fields/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/digest-claim-fields/input/meta.shop.yaml
new file mode 100644
index 000000000..6ded25996
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/digest-claim-fields/input/meta.shop.yaml
@@ -0,0 +1,56 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: partial
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    # The same claim under another name, with everything a ledger entry can carry
+    # that is not the claim.
+    - requirement.functional:
+        name: Annotated
+        level: 4
+        status: partial
+        title: Orders are recorded
+        description: Covers orders placed through the shop.
+        notes: Orders placed by telephone are keyed in the next morning.
+        disposition: deferred
+        trackedBy: ["acme/shop#12"]
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    # The same entry as Recorded with one word of the statement changed.
+    - requirement.functional:
+        name: Reworded
+        level: 4
+        status: partial
+        statement: An order is recorded when it is paid.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    # A retired entry, and the same entry again saying what replaced it.
+    - requirement.functional:
+        name: Faxed
+        level: 4
+        status: retired
+        statement: An order confirmation is sent by fax.
+        counterexample: A confirmed order with no fax.
+
+    - requirement.functional:
+        name: FaxedThenReplaced
+        level: 4
+        status: retired
+        supersededBy: Recorded
+        statement: An order confirmation is sent by fax.
+        counterexample: A confirmed order with no fax.
diff --git a/fixtures/requirement-test-identity-conformance/digest-inherited/expected.json b/fixtures/requirement-test-identity-conformance/digest-inherited/expected.json
new file mode 100644
index 000000000..7b257dd76
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/digest-inherited/expected.json
@@ -0,0 +1,35 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Kept [object.entity]",
+      "package": "acme::shop",
+      "path": "Kept",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Kept__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "f747d4c611a478cf73bc9b58ae7f477b9625483d42f1bc9b1282f385c3620e75"
+    },
+    {
+      "id": "acme::shop::KeptInFull [object.entity]",
+      "package": "acme::shop",
+      "path": "KeptInFull",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_KeptInFull__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "f747d4c611a478cf73bc9b58ae7f477b9625483d42f1bc9b1282f385c3620e75"
+    },
+    {
+      "id": "acme::shop::Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/digest-inherited/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/digest-inherited/input/meta.shop.yaml
new file mode 100644
index 000000000..ba55e1f45
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/digest-inherited/input/meta.shop.yaml
@@ -0,0 +1,32 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    # Declares one attribute. Its level, status, statement and implementedBy are
+    # Recorded's, reached through extends.
+    - requirement.functional:
+        name: Kept
+        extends: Recorded
+        counterexample: A placed order is gone the next morning.
+
+    # What Kept effectively says, written out in full.
+    - requirement.functional:
+        name: KeptInFull
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order is gone the next morning.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-test-identity-conformance/digest-multibyte-and-crlf/expected.json b/fixtures/requirement-test-identity-conformance/digest-multibyte-and-crlf/expected.json
new file mode 100644
index 000000000..c3cc71694
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/digest-multibyte-and-crlf/expected.json
@@ -0,0 +1,15 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "807e7fd24cbe12c69f9e8d1d053a843ebbd2b8b523fb000321207cfc273fe695"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/digest-multibyte-and-crlf/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/digest-multibyte-and-crlf/input/meta.shop.yaml
new file mode 100644
index 000000000..11384ec0e
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/digest-multibyte-and-crlf/input/meta.shop.yaml
@@ -0,0 +1,19 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # The statement holds two-byte and three-byte characters and a CR LF pair. The
+    # counterexample holds a CR LF pair and a lone CR. Each is written as an escape, so
+    # that the value does not depend on this file's own line endings.
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: "Une commande passée au café est enregistrée.\r\n注文は記録される。"
+        counterexample: "A placed order has no row.\r\nIts total reads ¥0.\rNobody is told."
+        implementedBy: [Order]
diff --git a/fixtures/requirement-test-identity-conformance/filter-all/expected.json b/fixtures/requirement-test-identity-conformance/filter-all/expected.json
new file mode 100644
index 000000000..f3d5c3d52
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-all/expected.json
@@ -0,0 +1,65 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Identified [object.entity]",
+      "package": "acme::shop",
+      "path": "Identified",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Identified__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "1665da033b2ecf14f717530ac11fd4927dad2b573c1a48e9ed261135d951e410"
+    },
+    {
+      "id": "acme::shop::Shop [*]",
+      "package": "acme::shop",
+      "path": "Shop",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Shop",
+      "status": "live",
+      "skip": null,
+      "digest": "edc8a9b8159eb03a08d020427683253d6d1471032e0cf48115956362fc121653"
+    },
+    {
+      "id": "acme::shop::Shop.Sales [*]",
+      "package": "acme::shop",
+      "path": "Shop.Sales",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Shop_Sales",
+      "status": "live",
+      "skip": null,
+      "digest": "5af1c1f490460147c7f5680c62348910f3c90065703b0ec696b4250e102f68e0"
+    },
+    {
+      "id": "acme::shop::Shop.Sales.Orders [*]",
+      "package": "acme::shop",
+      "path": "Shop.Sales.Orders",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Shop_Sales_Orders",
+      "status": "live",
+      "skip": null,
+      "digest": "e84c69fda54cb9f04f3949af069c2c5d56027e008be3198a08c4ee4fbcad8be6"
+    },
+    {
+      "id": "acme::shop::Shop.Sales.Orders.Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Shop.Sales.Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Shop_Sales_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    },
+    {
+      "id": "acme::shop::Shop.Sales.Orders.Recorded.Quotable [field.string]",
+      "package": "acme::shop",
+      "path": "Shop.Sales.Orders.Recorded.Quotable",
+      "unit": "field.string",
+      "witnessKey": "req_acme_shop_Shop_Sales_Orders_Recorded_Quotable__field_string",
+      "status": "live",
+      "skip": null,
+      "digest": "b5d7fb7a9657bfda7b30e2629617bf5c56e4337ef7a06abfe55715613ecdda63"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-all/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/filter-all/input/meta.shop.yaml
new file mode 100644
index 000000000..cea5af793
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-all/input/meta.shop.yaml
@@ -0,0 +1,53 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Sales
+              level: 2
+              status: live
+              statement: Sales are taken through the shop.
+              counterexample: A sale made outside the shop.
+              children:
+                - requirement.functional:
+                    name: Orders
+                    level: 3
+                    status: live
+                    statement: Every placed order is kept.
+                    counterexample: A placed order that is lost.
+                    children:
+                      - requirement.functional:
+                          name: Recorded
+                          level: 4
+                          status: live
+                          statement: An order is recorded when it is placed.
+                          counterexample: A placed order has no row.
+                          implementedBy: [Order]
+                          children:
+                            - requirement.functional:
+                                name: Quotable
+                                level: 5
+                                status: live
+                                statement: An order carries a reference the customer can quote.
+                                counterexample: An order nobody can quote back.
+                                implementedBy: [Order.reference]
+
+    - requirement.architectural:
+        name: Identified
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-test-identity-conformance/filter-all/options.json b/fixtures/requirement-test-identity-conformance/filter-all/options.json
new file mode 100644
index 000000000..425a0186e
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-all/options.json
@@ -0,0 +1,3 @@
+{
+  "filter": "all"
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-absent-level/expected.json b/fixtures/requirement-test-identity-conformance/filter-by-absent-level/expected.json
new file mode 100644
index 000000000..280fc1e93
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-absent-level/expected.json
@@ -0,0 +1,25 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Audited [*]",
+      "package": "acme::shop",
+      "path": "Audited",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Audited",
+      "status": "planned",
+      "skip": "planned",
+      "digest": "b798d2149134120f6039d88e8306642c5b1ff9fdc87e4b38bf8a00d689d1ce1c"
+    },
+    {
+      "id": "acme::shop::Identified [object.entity]",
+      "package": "acme::shop",
+      "path": "Identified",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Identified__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "1665da033b2ecf14f717530ac11fd4927dad2b573c1a48e9ed261135d951e410"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-absent-level/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/filter-by-absent-level/input/meta.shop.yaml
new file mode 100644
index 000000000..03908c66f
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-absent-level/input/meta.shop.yaml
@@ -0,0 +1,56 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Two flat policies: neither declares a level.
+    - requirement.architectural:
+        name: Identified
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [Order]
+
+    - requirement.architectural:
+        name: Audited
+        status: planned
+        statement: Every row records who last changed it.
+        counterexample: A changed row with no author.
+
+    # A levelled policy.
+    - requirement.architectural:
+        name: Addressable
+        level: 4
+        status: live
+        statement: An order is addressed by one stable key.
+        counterexample: An order that cannot be pointed at.
+        implementedBy: [Order]
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    # Levels 0 and -1 are out of range, and verify reports them. They load, and they
+    # are here because they are the two values most often used to stand for "no
+    # level". Each of these requirements declares a level, so neither is unlevelled.
+    - requirement.functional:
+        name: Shelved
+        level: 0
+        status: planned
+        statement: An order can be set aside and resumed.
+        counterexample: A shelved order that cannot be reopened.
+
+    - requirement.functional:
+        name: Gifted
+        level: -1
+        status: planned
+        statement: An order can be sent to someone else as a gift.
+        counterexample: A gift order that shows its price.
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-absent-level/options.json b/fixtures/requirement-test-identity-conformance/filter-by-absent-level/options.json
new file mode 100644
index 000000000..4a9bf65fd
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-absent-level/options.json
@@ -0,0 +1,3 @@
+{
+  "filter": "unlevelled"
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-claimed-concern/expected.json b/fixtures/requirement-test-identity-conformance/filter-by-claimed-concern/expected.json
new file mode 100644
index 000000000..b5c5bdade
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-claimed-concern/expected.json
@@ -0,0 +1,45 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Announced [object.entity]",
+      "package": "acme::shop",
+      "path": "Announced",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Announced__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "be7e196cc97f87f5e9742f57fb2254b82e2cfc1a713be57d2424dea9188325cf"
+    },
+    {
+      "id": "acme::shop::Announced [template.prompt]",
+      "package": "acme::shop",
+      "path": "Announced",
+      "unit": "template.prompt",
+      "witnessKey": "req_acme_shop_Announced__template_prompt",
+      "status": "live",
+      "skip": null,
+      "digest": "be7e196cc97f87f5e9742f57fb2254b82e2cfc1a713be57d2424dea9188325cf"
+    },
+    {
+      "id": "acme::shop::Identified [object.entity]",
+      "package": "acme::shop",
+      "path": "Identified",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Identified__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "1665da033b2ecf14f717530ac11fd4927dad2b573c1a48e9ed261135d951e410"
+    },
+    {
+      "id": "acme::shop::Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-claimed-concern/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/filter-by-claimed-concern/input/meta.shop.yaml
new file mode 100644
index 000000000..e5496a974
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-claimed-concern/input/meta.shop.yaml
@@ -0,0 +1,63 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.value:
+        name: OrderConfirmationPayload
+        children:
+          - field.string: { name: reference }
+
+    - template.prompt:
+        name: orderConfirmation
+        payloadRef: OrderConfirmationPayload
+        textRef: orders/confirmation
+        format: xml
+
+    # Claims an entity.
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    # Claims only a template.
+    - requirement.functional:
+        name: Confirmed
+        level: 4
+        status: live
+        statement: A customer is told their order was placed.
+        counterexample: A placed order nobody confirmed.
+        implementedBy: [orderConfirmation]
+
+    # Claims a template and then an entity.
+    - requirement.functional:
+        name: Announced
+        level: 4
+        status: live
+        statement: The confirmation names the order it is about.
+        counterexample: A confirmation that names no order.
+        implementedBy: [orderConfirmation, Order]
+
+    # Names only a node that does not exist yet. No Refund is declared.
+    - requirement.functional:
+        name: Refunded
+        level: 4
+        status: planned
+        statement: A refund is recorded against its order.
+        counterexample: A refund with no order.
+        implementedBy: [Refund]
+
+    # A flat policy that claims an entity.
+    - requirement.architectural:
+        name: Identified
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-claimed-concern/options.json b/fixtures/requirement-test-identity-conformance/filter-by-claimed-concern/options.json
new file mode 100644
index 000000000..2b30d914b
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-claimed-concern/options.json
@@ -0,0 +1,3 @@
+{
+  "filter": "claims-entity"
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-level/expected.json b/fixtures/requirement-test-identity-conformance/filter-by-level/expected.json
new file mode 100644
index 000000000..6f09f1bee
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-level/expected.json
@@ -0,0 +1,35 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Keyed [identity.primary]",
+      "package": "acme::shop",
+      "path": "Keyed",
+      "unit": "identity.primary",
+      "witnessKey": "req_acme_shop_Keyed__identity_primary",
+      "status": "live",
+      "skip": null,
+      "digest": "41eb263a291544d2c37ba4fec8ead24a1ce824ff9bcf8cba977fcbae166f4586"
+    },
+    {
+      "id": "acme::shop::Recorded.Addressable [identity.primary]",
+      "package": "acme::shop",
+      "path": "Recorded.Addressable",
+      "unit": "identity.primary",
+      "witnessKey": "req_acme_shop_Recorded_Addressable__identity_primary",
+      "status": "live",
+      "skip": null,
+      "digest": "3c0921fbc37854c7330ad43523028bd21660998d08833dde92903153c1b3573d"
+    },
+    {
+      "id": "acme::shop::Recorded.Quotable [field.string]",
+      "package": "acme::shop",
+      "path": "Recorded.Quotable",
+      "unit": "field.string",
+      "witnessKey": "req_acme_shop_Recorded_Quotable__field_string",
+      "status": "live",
+      "skip": null,
+      "digest": "b5d7fb7a9657bfda7b30e2629617bf5c56e4337ef7a06abfe55715613ecdda63"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-level/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/filter-by-level/input/meta.shop.yaml
new file mode 100644
index 000000000..037de0bc4
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-level/input/meta.shop.yaml
@@ -0,0 +1,49 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+        children:
+          - requirement.functional:
+              name: Quotable
+              level: 5
+              status: live
+              statement: An order carries a reference the customer can quote.
+              counterexample: An order nobody can quote back.
+              implementedBy: [Order.reference]
+          - requirement.functional:
+              name: Addressable
+              level: 5
+              status: live
+              statement: An order is addressed by one stable key.
+              counterexample: An order that cannot be pointed at.
+              implementedBy: [Order.pk]
+
+    # A levelled policy at L5.
+    - requirement.architectural:
+        name: Keyed
+        level: 5
+        status: live
+        statement: Every primary key is a single uuid column.
+        counterexample: A composite primary key.
+        implementedBy: [Order.pk]
+
+    # A flat policy: it has no level, which is not the same as level 5.
+    - requirement.architectural:
+        name: Identified
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-level/options.json b/fixtures/requirement-test-identity-conformance/filter-by-level/options.json
new file mode 100644
index 000000000..9bad819e9
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-level/options.json
@@ -0,0 +1,3 @@
+{
+  "filter": "level-5"
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-package/expected.json b/fixtures/requirement-test-identity-conformance/filter-by-package/expected.json
new file mode 100644
index 000000000..5705a9a4a
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-package/expected.json
@@ -0,0 +1,45 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Orders [*]",
+      "package": "acme::shop",
+      "path": "Orders",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Orders",
+      "status": "live",
+      "skip": null,
+      "digest": "e84c69fda54cb9f04f3949af069c2c5d56027e008be3198a08c4ee4fbcad8be6"
+    },
+    {
+      "id": "acme::shop::Orders.Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    },
+    {
+      "id": "acme::shop::Settled [object.entity]",
+      "package": "acme::shop",
+      "path": "Settled",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Settled__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "b8a6a5bf7873f5774105fc0ad3ee9d45994144dda20288f20d5245a4043a5461"
+    },
+    {
+      "id": "acme::shop::Settled.Timed [field.timestamp]",
+      "package": "acme::shop",
+      "path": "Settled.Timed",
+      "unit": "field.timestamp",
+      "witnessKey": "req_acme_shop_Settled_Timed__field_timestamp",
+      "status": "live",
+      "skip": null,
+      "digest": "d4e7f45daaccabffd0861b3d917f44d4f53f7973493734ec2bfd8d306edc0829"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-package/input/meta.billing.yaml b/fixtures/requirement-test-identity-conformance/filter-by-package/input/meta.billing.yaml
new file mode 100644
index 000000000..252f3f4aa
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-package/input/meta.billing.yaml
@@ -0,0 +1,39 @@
+metadata:
+  package: acme::billing
+  children:
+    - object.entity:
+        name: Invoice
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: number }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Takes this file's package.
+    - requirement.functional:
+        name: Billed
+        level: 4
+        status: live
+        statement: An invoice is recorded when it is raised.
+        counterexample: A raised invoice has no row.
+        implementedBy: [Invoice]
+
+    # Declares its own package, which is not this file's. Its bare reference binds
+    # in the package it declares.
+    - requirement.functional:
+        name: Settled
+        package: acme::shop
+        level: 4
+        status: live
+        statement: An order records when it was paid.
+        counterexample: A paid order with no payment time.
+        implementedBy: [Order]
+        children:
+          # Declares no package: it takes its parent's, not this file's. Its bare
+          # reference binds there too.
+          - requirement.functional:
+              name: Timed
+              level: 5
+              status: live
+              statement: A paid order carries the time it was paid.
+              counterexample: A paid order whose payment time is empty.
+              implementedBy: [Order.paidAt]
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-package/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/filter-by-package/input/meta.shop.yaml
new file mode 100644
index 000000000..4bfc29866
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-package/input/meta.shop.yaml
@@ -0,0 +1,44 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.timestamp: { name: paidAt }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Neither node declares a package: both take this file's.
+    - requirement.functional:
+        name: Orders
+        level: 3
+        status: live
+        statement: Every placed order is kept.
+        counterexample: A placed order that is lost.
+        children:
+          - requirement.functional:
+              name: Recorded
+              level: 4
+              status: live
+              statement: An order is recorded when it is placed.
+              counterexample: A placed order has no row.
+              implementedBy: [Order]
+
+    # Declares its own package, which is not this file's.
+    - requirement.functional:
+        name: Invoiced
+        package: acme::billing
+        level: 4
+        status: live
+        statement: An invoice is raised for every order.
+        counterexample: An order with no invoice.
+        implementedBy: [Invoice]
+        children:
+          # Declares no package: it takes its parent's, not this file's.
+          - requirement.functional:
+              name: Numbered
+              level: 5
+              status: live
+              statement: An invoice carries a number the customer can quote.
+              counterexample: An invoice nobody can quote back.
+              implementedBy: [Invoice.number]
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-package/options.json b/fixtures/requirement-test-identity-conformance/filter-by-package/options.json
new file mode 100644
index 000000000..3bd3be707
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-package/options.json
@@ -0,0 +1,3 @@
+{
+  "filter": "package-acme-shop"
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-path/expected.json b/fixtures/requirement-test-identity-conformance/filter-by-path/expected.json
new file mode 100644
index 000000000..5e848f196
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-path/expected.json
@@ -0,0 +1,35 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Shop [*]",
+      "package": "acme::shop",
+      "path": "Shop",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Shop",
+      "status": "live",
+      "skip": null,
+      "digest": "edc8a9b8159eb03a08d020427683253d6d1471032e0cf48115956362fc121653"
+    },
+    {
+      "id": "acme::shop::Shop.Orders [*]",
+      "package": "acme::shop",
+      "path": "Shop.Orders",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Shop_Orders",
+      "status": "live",
+      "skip": null,
+      "digest": "e84c69fda54cb9f04f3949af069c2c5d56027e008be3198a08c4ee4fbcad8be6"
+    },
+    {
+      "id": "acme::shop::Shop.Orders.Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Shop.Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Shop_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-path/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/filter-by-path/input/meta.shop.yaml
new file mode 100644
index 000000000..56f6112dd
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-path/input/meta.shop.yaml
@@ -0,0 +1,52 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Listing
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Orders
+              level: 3
+              status: live
+              statement: Every placed order is kept.
+              counterexample: A placed order that is lost.
+              children:
+                - requirement.functional:
+                    name: Recorded
+                    level: 4
+                    status: live
+                    statement: An order is recorded when it is placed.
+                    counterexample: A placed order has no row.
+                    implementedBy: [Order]
+
+    # Begins with the same four letters and is not under Shop.
+    - requirement.functional:
+        name: Shopfront
+        level: 1
+        status: live
+        statement: A customer can see what is for sale.
+        counterexample: A product nobody can find.
+        children:
+          - requirement.functional:
+              name: Listed
+              level: 4
+              status: live
+              statement: A product for sale has a listing.
+              counterexample: A product for sale with no listing.
+              implementedBy: [Listing]
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-path/options.json b/fixtures/requirement-test-identity-conformance/filter-by-path/options.json
new file mode 100644
index 000000000..1f7e82682
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-path/options.json
@@ -0,0 +1,3 @@
+{
+  "filter": "path-under-Shop"
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-status/expected.json b/fixtures/requirement-test-identity-conformance/filter-by-status/expected.json
new file mode 100644
index 000000000..0475877bc
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-status/expected.json
@@ -0,0 +1,25 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Orders [*]",
+      "package": "acme::shop",
+      "path": "Orders",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Orders",
+      "status": "live",
+      "skip": null,
+      "digest": "e84c69fda54cb9f04f3949af069c2c5d56027e008be3198a08c4ee4fbcad8be6"
+    },
+    {
+      "id": "acme::shop::Orders.Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-status/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/filter-by-status/input/meta.shop.yaml
new file mode 100644
index 000000000..279df6b20
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-status/input/meta.shop.yaml
@@ -0,0 +1,37 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Live, and at L3.
+    - requirement.functional:
+        name: Orders
+        level: 3
+        status: live
+        statement: Every placed order is kept.
+        counterexample: A placed order that is lost.
+        children:
+          - requirement.functional:
+              name: Recorded
+              level: 4
+              status: live
+              statement: An order is recorded when it is placed.
+              counterexample: A placed order has no row.
+              implementedBy: [Order]
+          - requirement.functional:
+              name: Shipped
+              level: 4
+              status: partial
+              statement: An order records when it left the warehouse.
+              counterexample: A shipped order with no dispatch time.
+              implementedBy: [Order]
+          - requirement.functional:
+              name: Refunded
+              level: 4
+              status: planned
+              statement: A refund is recorded against its order.
+              counterexample: A refund with no order.
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-status/options.json b/fixtures/requirement-test-identity-conformance/filter-by-status/options.json
new file mode 100644
index 000000000..015d8e1e9
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-status/options.json
@@ -0,0 +1,3 @@
+{
+  "filter": "live"
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-subtype/expected.json b/fixtures/requirement-test-identity-conformance/filter-by-subtype/expected.json
new file mode 100644
index 000000000..96652cf30
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-subtype/expected.json
@@ -0,0 +1,25 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Addressable [object.entity]",
+      "package": "acme::shop",
+      "path": "Addressable",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Addressable__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "39aa1215dbd4f3fca3f898c5eb4f390fb2fed8f6da610da87b2820b5a56194b5"
+    },
+    {
+      "id": "acme::shop::Identified [object.entity]",
+      "package": "acme::shop",
+      "path": "Identified",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Identified__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "1665da033b2ecf14f717530ac11fd4927dad2b573c1a48e9ed261135d951e410"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-subtype/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/filter-by-subtype/input/meta.shop.yaml
new file mode 100644
index 000000000..d0b1a8f42
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-subtype/input/meta.shop.yaml
@@ -0,0 +1,42 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # A flat policy: it has no level at all.
+    - requirement.architectural:
+        name: Identified
+        status: live
+        statement: Every row is addressed by a uuid.
+        counterexample: A row keyed by a name.
+        implementedBy: [Order]
+
+    # A levelled policy.
+    - requirement.architectural:
+        name: Addressable
+        level: 4
+        status: live
+        statement: An order is addressed by one stable key.
+        counterexample: An order that cannot be pointed at.
+        implementedBy: [Order]
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+        children:
+          - requirement.functional:
+              name: Quotable
+              level: 5
+              status: live
+              statement: An order carries a reference the customer can quote.
+              counterexample: An order nobody can quote back.
+              implementedBy: [Order.reference]
diff --git a/fixtures/requirement-test-identity-conformance/filter-by-subtype/options.json b/fixtures/requirement-test-identity-conformance/filter-by-subtype/options.json
new file mode 100644
index 000000000..9d195f1ec
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/filter-by-subtype/options.json
@@ -0,0 +1,3 @@
+{
+  "filter": "architectural"
+}
diff --git a/fixtures/requirement-test-identity-conformance/member-grain-duplicate-ref/expected.json b/fixtures/requirement-test-identity-conformance/member-grain-duplicate-ref/expected.json
new file mode 100644
index 000000000..dfa83fc7b
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/member-grain-duplicate-ref/expected.json
@@ -0,0 +1,25 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Recorded [Order]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "Order",
+      "witnessKey": "req_acme_shop_Recorded__Order",
+      "status": "live",
+      "skip": null,
+      "digest": "5c3e6c7754fd943dd5f00a6b55544c16cb54a47a1d64e4def334760c07c7a501"
+    },
+    {
+      "id": "acme::shop::Recorded [acme::shop::Order]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "acme::shop::Order",
+      "witnessKey": "req_acme_shop_Recorded__acme_shop_Order",
+      "status": "live",
+      "skip": null,
+      "digest": "5c3e6c7754fd943dd5f00a6b55544c16cb54a47a1d64e4def334760c07c7a501"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/member-grain-duplicate-ref/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/member-grain-duplicate-ref/input/meta.shop.yaml
new file mode 100644
index 000000000..92a86bfdb
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/member-grain-duplicate-ref/input/meta.shop.yaml
@@ -0,0 +1,17 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # One entity, named three times in two spellings.
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order, "acme::shop::Order", Order]
diff --git a/fixtures/requirement-test-identity-conformance/member-grain-duplicate-ref/options.json b/fixtures/requirement-test-identity-conformance/member-grain-duplicate-ref/options.json
new file mode 100644
index 000000000..c1d859aab
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/member-grain-duplicate-ref/options.json
@@ -0,0 +1,3 @@
+{
+  "grain": "member"
+}
diff --git a/fixtures/requirement-test-identity-conformance/member-grain-unresolved-dropped/expected.json b/fixtures/requirement-test-identity-conformance/member-grain-unresolved-dropped/expected.json
new file mode 100644
index 000000000..3298d77c6
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/member-grain-unresolved-dropped/expected.json
@@ -0,0 +1,35 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Recorded [Order]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "Order",
+      "witnessKey": "req_acme_shop_Recorded__Order",
+      "status": "planned",
+      "skip": "planned",
+      "digest": "1898440ecdffa3941b6e945b5aa0c2ad6135cb3b9d2b2b8cb734be00e00617f6"
+    },
+    {
+      "id": "acme::shop::Recorded.Quotable [Order.reference]",
+      "package": "acme::shop",
+      "path": "Recorded.Quotable",
+      "unit": "Order.reference",
+      "witnessKey": "req_acme_shop_Recorded_Quotable__Order_reference",
+      "status": "planned",
+      "skip": "planned",
+      "digest": "65dc05d07276982476601048513af90df59b0ffabc31e5e9f71b63b37fd0f0cf"
+    },
+    {
+      "id": "acme::shop::Refunded [*]",
+      "package": "acme::shop",
+      "path": "Refunded",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Refunded",
+      "status": "planned",
+      "skip": "planned",
+      "digest": "0a86fc1665ffb7a53dd99506c0ac0fbb7051311f2e214f061051fc5c60c37c57"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/member-grain-unresolved-dropped/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/member-grain-unresolved-dropped/input/meta.shop.yaml
new file mode 100644
index 000000000..6866ed910
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/member-grain-unresolved-dropped/input/meta.shop.yaml
@@ -0,0 +1,37 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Planned, so naming nodes that do not exist yet is legal. No Refund is declared.
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: planned
+        statement: An order and its refund are recorded.
+        counterexample: A refund with no row.
+        implementedBy: [Order, Refund]
+        children:
+          # One member that exists, one missing from an object that exists, and one
+          # under an object that does not.
+          - requirement.functional:
+              name: Quotable
+              level: 5
+              status: planned
+              statement: An order and its refund carry a reference the customer can quote.
+              counterexample: A refund nobody can quote back.
+              implementedBy: [Order.reference, Order.refundReference, Refund.reference]
+
+    # Nothing it names resolves.
+    - requirement.functional:
+        name: Refunded
+        level: 4
+        status: planned
+        statement: A refund is recorded against its order.
+        counterexample: A refund with no order.
+        implementedBy: [Refund]
diff --git a/fixtures/requirement-test-identity-conformance/member-grain-unresolved-dropped/options.json b/fixtures/requirement-test-identity-conformance/member-grain-unresolved-dropped/options.json
new file mode 100644
index 000000000..c1d859aab
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/member-grain-unresolved-dropped/options.json
@@ -0,0 +1,3 @@
+{
+  "grain": "member"
+}
diff --git a/fixtures/requirement-test-identity-conformance/member-grain/expected.json b/fixtures/requirement-test-identity-conformance/member-grain/expected.json
new file mode 100644
index 000000000..4e9889869
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/member-grain/expected.json
@@ -0,0 +1,45 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Recorded [Order]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "Order",
+      "witnessKey": "req_acme_shop_Recorded__Order",
+      "status": "live",
+      "skip": null,
+      "digest": "92d8d3bdfeb2f3545d489965b4e602dd617c24283bdf987d44ce6e34b53f0361"
+    },
+    {
+      "id": "acme::shop::Recorded [acme::shop::Customer]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "acme::shop::Customer",
+      "witnessKey": "req_acme_shop_Recorded__acme_shop_Customer",
+      "status": "live",
+      "skip": null,
+      "digest": "92d8d3bdfeb2f3545d489965b4e602dd617c24283bdf987d44ce6e34b53f0361"
+    },
+    {
+      "id": "acme::shop::Recorded.Quotable [Order.reference]",
+      "package": "acme::shop",
+      "path": "Recorded.Quotable",
+      "unit": "Order.reference",
+      "witnessKey": "req_acme_shop_Recorded_Quotable__Order_reference",
+      "status": "live",
+      "skip": null,
+      "digest": "fcf9ae1e3315cf0eebb22b2e4d51b8d75b518b8959d1b576a388638e5e2bc92b"
+    },
+    {
+      "id": "acme::shop::Recorded.Quotable [acme::shop::Order.pk]",
+      "package": "acme::shop",
+      "path": "Recorded.Quotable",
+      "unit": "acme::shop::Order.pk",
+      "witnessKey": "req_acme_shop_Recorded_Quotable__acme_shop_Order_pk",
+      "status": "live",
+      "skip": null,
+      "digest": "fcf9ae1e3315cf0eebb22b2e4d51b8d75b518b8959d1b576a388638e5e2bc92b"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/member-grain/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/member-grain/input/meta.shop.yaml
new file mode 100644
index 000000000..a3a89fa2f
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/member-grain/input/meta.shop.yaml
@@ -0,0 +1,33 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Customer
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Two entities are one concern and two references. Each requirement names one
+    # node by its bare name and one by its qualified name.
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded against its customer.
+        counterexample: An order with no customer.
+        implementedBy: [Order, "acme::shop::Customer"]
+        children:
+          - requirement.functional:
+              name: Quotable
+              level: 5
+              status: live
+              statement: An order carries a reference the customer can quote.
+              counterexample: An order nobody can quote back.
+              implementedBy: [Order.reference, "acme::shop::Order.pk"]
diff --git a/fixtures/requirement-test-identity-conformance/member-grain/options.json b/fixtures/requirement-test-identity-conformance/member-grain/options.json
new file mode 100644
index 000000000..c1d859aab
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/member-grain/options.json
@@ -0,0 +1,3 @@
+{
+  "grain": "member"
+}
diff --git a/fixtures/requirement-test-identity-conformance/nested-path/expected.json b/fixtures/requirement-test-identity-conformance/nested-path/expected.json
new file mode 100644
index 000000000..96ad7fb97
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/nested-path/expected.json
@@ -0,0 +1,45 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Shop.Returns.Orders.Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Shop.Returns.Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Shop_Returns_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "121f87a83cbd2575f5510c1798e08915fd48f3c9c06833693a7102b5458a1364"
+    },
+    {
+      "id": "acme::shop::Shop.Returns.Orders.Recorded.Quotable [field.string]",
+      "package": "acme::shop",
+      "path": "Shop.Returns.Orders.Recorded.Quotable",
+      "unit": "field.string",
+      "witnessKey": "req_acme_shop_Shop_Returns_Orders_Recorded_Quotable__field_string",
+      "status": "live",
+      "skip": null,
+      "digest": "c2ee5f69bad2f3c4d8cb4b1f0c299c187ff82ebd419f3ddfa8897ff947330434"
+    },
+    {
+      "id": "acme::shop::Shop.Sales.Orders.Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Shop.Sales.Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Shop_Sales_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    },
+    {
+      "id": "acme::shop::Shop.Sales.Orders.Recorded.Quotable [field.string]",
+      "package": "acme::shop",
+      "path": "Shop.Sales.Orders.Recorded.Quotable",
+      "unit": "field.string",
+      "witnessKey": "req_acme_shop_Shop_Sales_Orders_Recorded_Quotable__field_string",
+      "status": "live",
+      "skip": null,
+      "digest": "b5d7fb7a9657bfda7b30e2629617bf5c56e4337ef7a06abfe55715613ecdda63"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/nested-path/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/nested-path/input/meta.shop.yaml
new file mode 100644
index 000000000..c1f30b3cd
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/nested-path/input/meta.shop.yaml
@@ -0,0 +1,83 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - object.entity:
+        name: Return
+        children:
+          - field.uuid: { name: id }
+          - field.string: { name: reference }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Two branches end in the same three names. Only the path tells their tests apart.
+    - requirement.functional:
+        name: Shop
+        level: 1
+        status: live
+        statement: A customer can buy from the shop.
+        counterexample: A customer who cannot place an order.
+        children:
+          - requirement.functional:
+              name: Sales
+              level: 2
+              status: live
+              statement: Sales are taken through the shop.
+              counterexample: A sale made outside the shop.
+              children:
+                - requirement.functional:
+                    name: Orders
+                    level: 3
+                    status: live
+                    statement: Every placed order is kept.
+                    counterexample: A placed order that is lost.
+                    children:
+                      - requirement.functional:
+                          name: Recorded
+                          level: 4
+                          status: live
+                          statement: An order is recorded when it is placed.
+                          counterexample: A placed order has no row.
+                          implementedBy: [Order]
+                          children:
+                            - requirement.functional:
+                                name: Quotable
+                                level: 5
+                                status: live
+                                statement: An order carries a reference the customer can quote.
+                                counterexample: An order nobody can quote back.
+                                implementedBy: [Order.reference]
+          - requirement.functional:
+              name: Returns
+              level: 2
+              status: live
+              statement: Goods are taken back through the shop.
+              counterexample: A return made outside the shop.
+              children:
+                - requirement.functional:
+                    name: Orders
+                    level: 3
+                    status: live
+                    statement: Every returned order is kept.
+                    counterexample: A returned order that is lost.
+                    children:
+                      - requirement.functional:
+                          name: Recorded
+                          level: 4
+                          status: live
+                          statement: A return is recorded when it is accepted.
+                          counterexample: An accepted return has no row.
+                          implementedBy: [Return]
+                          children:
+                            - requirement.functional:
+                                name: Quotable
+                                level: 5
+                                status: live
+                                statement: A return carries a reference the customer can quote.
+                                counterexample: A return nobody can quote back.
+                                implementedBy: [Return.reference]
diff --git a/fixtures/requirement-test-identity-conformance/no-targets/expected.json b/fixtures/requirement-test-identity-conformance/no-targets/expected.json
new file mode 100644
index 000000000..b7bf11237
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/no-targets/expected.json
@@ -0,0 +1,15 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Recorded [*]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Recorded",
+      "status": "live",
+      "skip": null,
+      "digest": "09628ddb7bec2fd406e0fc69833994bb96bc283493b1484c3079b6995c3a694c"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/no-targets/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/no-targets/input/meta.shop.yaml
new file mode 100644
index 000000000..2a4e7f9cb
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/no-targets/input/meta.shop.yaml
@@ -0,0 +1,16 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Live, and it names nothing.
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
diff --git a/fixtures/requirement-test-identity-conformance/package-in-address/expected.json b/fixtures/requirement-test-identity-conformance/package-in-address/expected.json
new file mode 100644
index 000000000..7f4deee29
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/package-in-address/expected.json
@@ -0,0 +1,25 @@
+{
+  "tests": [
+    {
+      "id": "acme::billing::Orders.Recorded [object.entity]",
+      "package": "acme::billing",
+      "path": "Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_billing_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    },
+    {
+      "id": "acme::shop::Orders.Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/package-in-address/input/meta.billing.yaml b/fixtures/requirement-test-identity-conformance/package-in-address/input/meta.billing.yaml
new file mode 100644
index 000000000..1cacc91ee
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/package-in-address/input/meta.billing.yaml
@@ -0,0 +1,23 @@
+metadata:
+  package: acme::billing
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Orders
+        level: 3
+        status: live
+        statement: Every placed order is kept.
+        counterexample: A placed order that is lost.
+        children:
+          - requirement.functional:
+              name: Recorded
+              level: 4
+              status: live
+              statement: An order is recorded when it is placed.
+              counterexample: A placed order has no row.
+              implementedBy: [Order]
diff --git a/fixtures/requirement-test-identity-conformance/package-in-address/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/package-in-address/input/meta.shop.yaml
new file mode 100644
index 000000000..46bdddb77
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/package-in-address/input/meta.shop.yaml
@@ -0,0 +1,23 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Orders
+        level: 3
+        status: live
+        statement: Every placed order is kept.
+        counterexample: A placed order that is lost.
+        children:
+          - requirement.functional:
+              name: Recorded
+              level: 4
+              status: live
+              statement: An order is recorded when it is placed.
+              counterexample: A placed order has no row.
+              implementedBy: [Order]
diff --git a/fixtures/requirement-test-identity-conformance/partial-not-skipped/expected.json b/fixtures/requirement-test-identity-conformance/partial-not-skipped/expected.json
new file mode 100644
index 000000000..3ca6c3cdd
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/partial-not-skipped/expected.json
@@ -0,0 +1,15 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Recorded__object_entity",
+      "status": "partial",
+      "skip": null,
+      "digest": "9c7f098dc9a7c74fd9c13cc705bf174c306a3259208abb2a7acca0d577c4e262"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/partial-not-skipped/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/partial-not-skipped/input/meta.shop.yaml
new file mode 100644
index 000000000..c9ce26b9b
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/partial-not-skipped/input/meta.shop.yaml
@@ -0,0 +1,16 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: partial
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-test-identity-conformance/planned-skip/expected.json b/fixtures/requirement-test-identity-conformance/planned-skip/expected.json
new file mode 100644
index 000000000..cde6dfcc6
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/planned-skip/expected.json
@@ -0,0 +1,25 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Recorded__object_entity",
+      "status": "planned",
+      "skip": "planned",
+      "digest": "a3f7627d0bea3eb3af8a3a22b03a8c4bc217aac64407e62ec7fb0b1981f3cfd2"
+    },
+    {
+      "id": "acme::shop::Refunded [*]",
+      "package": "acme::shop",
+      "path": "Refunded",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Refunded",
+      "status": "planned",
+      "skip": "planned",
+      "digest": "0a86fc1665ffb7a53dd99506c0ac0fbb7051311f2e214f061051fc5c60c37c57"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/planned-skip/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/planned-skip/input/meta.shop.yaml
new file mode 100644
index 000000000..d3f2e8d5a
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/planned-skip/input/meta.shop.yaml
@@ -0,0 +1,26 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Planned, naming a node that exists: the unit is its concern.
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: planned
+        statement: An order is recorded when it is placed.
+        counterexample: A placed order has no row.
+        implementedBy: [Order]
+
+    # Planned, naming a node that does not exist yet: nothing resolves.
+    - requirement.functional:
+        name: Refunded
+        level: 4
+        status: planned
+        statement: A refund is recorded against its order.
+        counterexample: A refund with no order.
+        implementedBy: [Refund]
diff --git a/fixtures/requirement-test-identity-conformance/retired-skip/expected.json b/fixtures/requirement-test-identity-conformance/retired-skip/expected.json
new file mode 100644
index 000000000..24392cd97
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/retired-skip/expected.json
@@ -0,0 +1,15 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Faxed [*]",
+      "package": "acme::shop",
+      "path": "Faxed",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Faxed",
+      "status": "retired",
+      "skip": "retired",
+      "digest": "ef38b10d440646c90a3f9a0a1fd0b331a0c6326ca23eab7462f3e10a961881fa"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/retired-skip/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/retired-skip/input/meta.shop.yaml
new file mode 100644
index 000000000..bbbdfdcb2
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/retired-skip/input/meta.shop.yaml
@@ -0,0 +1,16 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # A retired requirement cannot carry implementedBy: the loader refuses it.
+    - requirement.functional:
+        name: Faxed
+        level: 4
+        status: retired
+        statement: An order confirmation is sent by fax.
+        counterexample: A confirmed order with no fax.
diff --git a/fixtures/requirement-test-identity-conformance/unpackaged/expected.json b/fixtures/requirement-test-identity-conformance/unpackaged/expected.json
new file mode 100644
index 000000000..b029d2e28
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/unpackaged/expected.json
@@ -0,0 +1,25 @@
+{
+  "tests": [
+    {
+      "id": "Orders.Recorded [object.entity]",
+      "package": "",
+      "path": "Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    },
+    {
+      "id": "Orders.Refunded [*]",
+      "package": "",
+      "path": "Orders.Refunded",
+      "unit": "*",
+      "witnessKey": "req_Orders_Refunded",
+      "status": "planned",
+      "skip": "planned",
+      "digest": "4ddcd781ccc2fe462bc316711d5cedb88b803af1727a0df19fe3a69487aa6f86"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/unpackaged/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/unpackaged/input/meta.shop.yaml
new file mode 100644
index 000000000..422ea2549
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/unpackaged/input/meta.shop.yaml
@@ -0,0 +1,29 @@
+# No package anywhere in this document, and it is the only document of the case.
+metadata:
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    - requirement.functional:
+        name: Orders
+        level: 3
+        status: live
+        statement: Every placed order is kept.
+        counterexample: A placed order that is lost.
+        children:
+          - requirement.functional:
+              name: Recorded
+              level: 4
+              status: live
+              statement: An order is recorded when it is placed.
+              counterexample: A placed order has no row.
+              implementedBy: [Order]
+          - requirement.functional:
+              name: Refunded
+              level: 4
+              status: planned
+              statement: A refund is recorded against its order.
+              counterexample: A refund with no order.
diff --git a/fixtures/requirement-test-identity-conformance/witness-key-collision/expected.json b/fixtures/requirement-test-identity-conformance/witness-key-collision/expected.json
new file mode 100644
index 000000000..3a00667c9
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/witness-key-collision/expected.json
@@ -0,0 +1,40 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Orders.Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    },
+    {
+      "id": "acme::shop::Orders_Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Orders_Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "c7583c32576dd584f58627cdc42a03875f9e11af6606e833b2c3a4619c50ebd7"
+    },
+    {
+      "id": "acme::shop::Sales__Orders [object.entity]",
+      "package": "acme::shop",
+      "path": "Sales__Orders",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Sales_Orders__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "b42b0be7e69633d28df90fd05ae28beb5675f778f2c719ea4f27da6b79e218a6"
+    }
+  ],
+  "collisions": [
+    [
+      "acme::shop::Orders.Recorded [object.entity]",
+      "acme::shop::Orders_Recorded [object.entity]"
+    ]
+  ]
+}
diff --git a/fixtures/requirement-test-identity-conformance/witness-key-collision/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/witness-key-collision/input/meta.shop.yaml
new file mode 100644
index 000000000..b7508c51f
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/witness-key-collision/input/meta.shop.yaml
@@ -0,0 +1,44 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # Path Orders.Recorded.
+    - requirement.functional:
+        name: Orders
+        level: 3
+        status: live
+        statement: Every placed order is kept.
+        counterexample: A placed order that is lost.
+        children:
+          - requirement.functional:
+              name: Recorded
+              level: 4
+              status: live
+              statement: An order is recorded when it is placed.
+              counterexample: A placed order has no row.
+              implementedBy: [Order]
+
+    # Path Orders_Recorded: a different address, and the same witness key.
+    - requirement.functional:
+        name: Orders_Recorded
+        level: 4
+        status: live
+        statement: An order is recorded once.
+        counterexample: Two rows for one order.
+        implementedBy: [Order]
+
+    # A doubled underscore. An underscore is outside the kept class like any other
+    # character, so the pair is one run and becomes one underscore. No other
+    # requirement here mangles to the same key.
+    - requirement.functional:
+        name: Sales__Orders
+        level: 4
+        status: live
+        statement: An order records the sale it belongs to.
+        counterexample: An order with no sale.
+        implementedBy: [Order]
diff --git a/fixtures/requirement-test-identity-conformance/worked-example/expected.json b/fixtures/requirement-test-identity-conformance/worked-example/expected.json
new file mode 100644
index 000000000..2988cb018
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/worked-example/expected.json
@@ -0,0 +1,25 @@
+{
+  "tests": [
+    {
+      "id": "acme::shop::Orders.Recorded [object.entity]",
+      "package": "acme::shop",
+      "path": "Orders.Recorded",
+      "unit": "object.entity",
+      "witnessKey": "req_acme_shop_Orders_Recorded__object_entity",
+      "status": "live",
+      "skip": null,
+      "digest": "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    },
+    {
+      "id": "acme::shop::Orders.Refunded [*]",
+      "package": "acme::shop",
+      "path": "Orders.Refunded",
+      "unit": "*",
+      "witnessKey": "req_acme_shop_Orders_Refunded",
+      "status": "planned",
+      "skip": "planned",
+      "digest": "4ddcd781ccc2fe462bc316711d5cedb88b803af1727a0df19fe3a69487aa6f86"
+    }
+  ],
+  "collisions": []
+}
diff --git a/fixtures/requirement-test-identity-conformance/worked-example/input/meta.shop.yaml b/fixtures/requirement-test-identity-conformance/worked-example/input/meta.shop.yaml
new file mode 100644
index 000000000..2932f962a
--- /dev/null
+++ b/fixtures/requirement-test-identity-conformance/worked-example/input/meta.shop.yaml
@@ -0,0 +1,30 @@
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+
+    # An L3 parent: the default filter gives it no test.
+    - requirement.functional:
+        name: Orders
+        level: 3
+        status: live
+        statement: Every placed order is kept.
+        counterexample: A placed order that is lost.
+        children:
+          - requirement.functional:
+              name: Recorded
+              level: 4
+              status: live
+              statement: An order is recorded when it is placed.
+              counterexample: A placed order has no row.
+              implementedBy: [Order]
+          - requirement.functional:
+              name: Refunded
+              level: 4
+              status: planned
+              statement: A refund is recorded against its order.
+              counterexample: A refund with no order.
diff --git a/scripts/check-positioning-claims.ts b/scripts/check-positioning-claims.ts
index a4ee0c6c2..062c29508 100644
--- a/scripts/check-positioning-claims.ts
+++ b/scripts/check-positioning-claims.ts
@@ -59,7 +59,7 @@ export const BANNED: Banned[] = [
   },
   {
     pattern: /four pillars\.\s*all shipping\./i,
-    because: "there are six, and they are not equally deep (the fifth ships test scaffolding in TypeScript only)",
+    because: "there are six, and they are not equally deep (the fifth ships its authoring lint in TypeScript only)",
     instead: 'name the depth: "the first four ship per-language across all five ports; the fifth …"',
   },
   {
diff --git a/scripts/generate-requirement-harness.ts b/scripts/generate-requirement-harness.ts
index 5a1c3f027..675d4fd4d 100644
--- a/scripts/generate-requirement-harness.ts
+++ b/scripts/generate-requirement-harness.ts
@@ -22,8 +22,8 @@
  * departing from.
  *
  * An adopter generates a handful of stubs for capabilities nothing else checks. This
- * generates 109 across five ports for a library whose conformance corpora ALREADY
- * check a great many of them. Emitting 545 red tests would claim nothing is verified,
+ * generates 115 across five ports for a library whose conformance corpora ALREADY
+ * check a great many of them. Emitting 575 red tests would claim nothing is verified,
  * which is false, and a suite red for a false reason is silenced wholesale — taking
  * with it the slots that were telling the truth. So the stub is skipped and the DRIFT
  * GATE is what has teeth: the generated set must match the ledger exactly, so a new
diff --git a/scripts/site/counts.ts b/scripts/site/counts.ts
index 975a863d0..07fe26594 100644
--- a/scripts/site/counts.ts
+++ b/scripts/site/counts.ts
@@ -40,9 +40,10 @@ export interface Counts {
  */
 export const NOT_A_CORPUS: Record<string, string> = {
   "requirement-harness":
-    "The requirement-test scaffold's own fixture, not a shared corpus: it exercises " +
-    "requirementTests(), which is TypeScript-only, so no other port runs it and it " +
-    "gates no cross-port claim.",
+    "This repository's own skipped requirement scaffold, not a shared corpus: " +
+    "scripts/generate-requirement-harness.ts writes it from the project ledger, only " +
+    "the TypeScript slot file is run, and it gates no cross-port claim. The shipped " +
+    "requirement-tests generators are held by requirement-test-identity-conformance.",
 };
 
 const dirsIn = (root: string, rel: string): string[] =>
diff --git a/scripts/write-requirement-corpus-expected.ts b/scripts/write-requirement-corpus-expected.ts
new file mode 100644
index 000000000..f4414640c
--- /dev/null
+++ b/scripts/write-requirement-corpus-expected.ts
@@ -0,0 +1,279 @@
+#!/usr/bin/env bun
+/**
+ * Write the `expected.json` of a requirement conformance corpus from the TypeScript
+ * reference.
+ *
+ *   bun scripts/write-requirement-corpus-expected.ts check
+ *   bun scripts/write-requirement-corpus-expected.ts identity
+ *
+ * ── What this is, and what it is not ───────────────────────────────────────────
+ *
+ * ADR-0057 puts the requirement gate in every port, and the corpus is what holds the
+ * other four to this one. The expectations come from the reference rather than being
+ * typed by hand, so the message text is the text the reference really prints.
+ *
+ * That makes the output a SNAPSHOT, and a snapshot is not a contract. It becomes one
+ * only when every written file is read against the tables the ports copy
+ * (the corpus README says which). So: run this, then review the diff case by case. A
+ * case that reports more than it is meant to pin gets its INPUT fixed. A disagreement
+ * between the tables and the reference is a finding about the reference — it is never
+ * settled by editing an expectation, and never by re-running this until it looks right.
+ *
+ * A case that does not load strict is refused: nothing is written for it and the run
+ * exits non-zero. Each port's runner asserts a clean load first, so an expectation
+ * computed over a model that did not load would pin nothing.
+ */
+import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+// RELATIVE, as in `generate-requirement-harness.ts`: `scripts/` sits outside the bun
+// workspace, so a bare `@metaobjectsdev/*` specifier does not resolve from here.
+import {
+  MetaDataLoader,
+  OBJECT_SUBTYPE_ENTITY,
+  TYPE_OBJECT,
+  type MetaData,
+} from "../server/typescript/packages/metadata/src/index.js";
+import {
+  REQUIREMENT_LEVEL_MEMBER,
+  REQUIREMENT_STATUSES,
+  REQUIREMENT_STATUS_LIVE,
+  REQUIREMENT_SUBTYPE_ARCHITECTURAL,
+} from "../server/typescript/packages/metadata/src/core/requirement/requirement-constants.js";
+import {
+  checkRequirements,
+  scanRequirements,
+  summariseRequirements,
+  type Diagnostic,
+  type RequirementSummary,
+} from "../server/typescript/packages/cli/src/lib/requirement-check.js";
+import {
+  requirementTestIdentities,
+  witnessKeyCollisions,
+  type RequirementTestGrain,
+  type RequirementTestIdentity,
+  type RequirementView,
+} from "../server/typescript/packages/codegen-ts/src/index.js";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+/** One conformance corpus this script can write. Adding a corpus is one more entry in
+ *  {@link CORPORA}: its directory, the option keys its cases may set, and how one loaded
+ *  case becomes the object its `expected.json` holds. */
+interface Corpus {
+  /** Repository-relative directory holding one sub-directory per case. */
+  readonly dir: string;
+  /** Every key a case's `options.json` may carry. Anything else is refused. */
+  readonly optionKeys: readonly string[];
+  expected(root: MetaData, options: Readonly<Record<string, unknown>>): unknown;
+}
+
+// ---------------------------------------------------------------------------
+// check — fixtures/requirement-check-conformance
+// ---------------------------------------------------------------------------
+
+/** Key order is fixed so a rewrite produces no diff: `path` is omitted, not nulled, on a
+ *  diagnostic that has none (object coverage names its entity in the message). */
+function diagnosticRecord(d: Diagnostic): Record<string, string> {
+  return {
+    severity: d.severity,
+    code: d.code,
+    ...(d.path === undefined ? {} : { path: d.path }),
+    message: d.message,
+  };
+}
+
+/** Statuses in their registered order, zero counts left out; the coverage pair only when
+ *  the run measured coverage, which is what its absence means to a port. */
+function summaryRecord(s: RequirementSummary): Record<string, unknown> {
+  const byStatus: Record<string, number> = {};
+  for (const status of REQUIREMENT_STATUSES) {
+    const count = s.byStatus[status];
+    if (count !== undefined) byStatus[status] = count;
+  }
+  return {
+    total: s.total,
+    functional: s.functional,
+    architectural: s.architectural,
+    byStatus,
+    undecided: s.undecided,
+    deferredUntracked: s.deferredUntracked,
+    ...(s.entitiesClaimed === undefined ? {} : { entitiesClaimed: s.entitiesClaimed }),
+    ...(s.entitiesTotal === undefined ? {} : { entitiesTotal: s.entitiesTotal }),
+  };
+}
+
+function checkExpected(root: MetaData, options: Readonly<Record<string, unknown>>): unknown {
+  const scan = scanRequirements(root, { requireImplementers: options["requireImplementers"] === true });
+  const summary = summariseRequirements(root, scan);
+  return {
+    // Emission order — the order the reference evaluates its checks in — so the file
+    // reads top to bottom against its input. Runners compare it as a multiset.
+    diagnostics: checkRequirements(root, scan).map(diagnosticRecord),
+    summary: summary === undefined ? null : summaryRecord(summary),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// identity — fixtures/requirement-test-identity-conformance
+// ---------------------------------------------------------------------------
+
+/**
+ * The corpus's closed list of filters, by the name a case's `options.json` gives.
+ *
+ * A second copy of the table in the corpus's TypeScript runner
+ * (`codegen-ts/test/requirement-test-identity-conformance.test.ts`), on purpose: every
+ * port's runner holds its own, and the runner is what fails when this one disagrees
+ * with it. The corpus README is the definition of both.
+ *
+ * A Map, not an object literal: looking `constructor` up in a literal finds
+ * `Object.prototype`'s, so a misnamed filter would be written as a predicate that keeps
+ * everything instead of being refused.
+ */
+const IDENTITY_FILTERS: ReadonlyMap<string, (r: RequirementView) => boolean> = new Map<
+  string,
+  (r: RequirementView) => boolean
+>([
+  ["all", () => true],
+  ["architectural", (r) => r.subType === REQUIREMENT_SUBTYPE_ARCHITECTURAL],
+  ["live", (r) => r.status === REQUIREMENT_STATUS_LIVE],
+  ["level-5", (r) => r.level === REQUIREMENT_LEVEL_MEMBER],
+  ["unlevelled", (r) => r.level === undefined],
+  ["package-acme-shop", (r) => r.package === "acme::shop"],
+  ["path-under-Shop", (r) => r.path === "Shop" || r.path.startsWith("Shop.")],
+  ["claims-entity", (r) => r.implementedByTypes.includes(`${TYPE_OBJECT}.${OBJECT_SUBTYPE_ENTITY}`)],
+]);
+
+/** Key order is fixed so a rewrite produces no diff. `skip` is written as `null`, not
+ *  left out, on a test that runs: that it is not skipped is a statement, not an absence. */
+function identityRecord(t: RequirementTestIdentity): Record<string, string | null> {
+  return {
+    id: t.id,
+    package: t.package,
+    path: t.path,
+    unit: t.unit,
+    witnessKey: t.witnessKey,
+    // `status` is required by the loader, so a case that loaded strict has one.
+    status: t.status ?? null,
+    skip: t.skip,
+    digest: t.digest,
+  };
+}
+
+function identityExpected(root: MetaData, options: Readonly<Record<string, unknown>>): unknown {
+  const grain = options["grain"];
+  if (grain !== undefined && typeof grain !== "string") {
+    throw new Error("'grain' in options.json must be a string");
+  }
+  const filterName = options["filter"];
+  if (filterName !== undefined && typeof filterName !== "string") {
+    throw new Error("'filter' in options.json must be a string");
+  }
+  const filter = filterName === undefined ? undefined : IDENTITY_FILTERS.get(filterName);
+  if (filterName !== undefined && filter === undefined) {
+    throw new Error(
+      `unknown filter '${filterName}' in options.json (the corpus names: ` +
+      `${[...IDENTITY_FILTERS.keys()].join(", ")})`,
+    );
+  }
+  // Each option is passed only when the case sets it, so a case without one is written
+  // from the reference's own default. A grain the reference does not know is refused
+  // by the reference, which refuses the case.
+  const tests = requirementTestIdentities(root, {
+    ...(grain === undefined ? {} : { grain: grain as RequirementTestGrain }),
+    ...(filter === undefined ? {} : { filter }),
+  });
+  return {
+    // Sorted by id, which is how the reference returns them and how runners compare.
+    tests: tests.map(identityRecord),
+    collisions: witnessKeyCollisions(tests),
+  };
+}
+
+const CORPORA: Readonly<Record<string, Corpus>> = {
+  check: {
+    dir: "fixtures/requirement-check-conformance",
+    optionKeys: ["libraries", "requireImplementers"],
+    expected: checkExpected,
+  },
+  identity: {
+    dir: "fixtures/requirement-test-identity-conformance",
+    optionKeys: ["grain", "filter"],
+    expected: identityExpected,
+  },
+};
+
+// ---------------------------------------------------------------------------
+// The part every corpus shares: find the cases, load each one, write the file.
+// ---------------------------------------------------------------------------
+
+function readOptions(caseDir: string, corpus: Corpus): Record<string, unknown> {
+  const file = join(caseDir, "options.json");
+  if (!existsSync(file)) return {};
+  const options = JSON.parse(readFileSync(file, "utf8")) as Record<string, unknown>;
+  const unknown = Object.keys(options).filter((k) => !corpus.optionKeys.includes(k));
+  if (unknown.length > 0) throw new Error(`unknown option(s) ${unknown.join(", ")} in options.json`);
+  return options;
+}
+
+function librariesOf(options: Readonly<Record<string, unknown>>): string[] {
+  const libraries = options["libraries"];
+  if (libraries === undefined) return [];
+  if (!Array.isArray(libraries) || !libraries.every((l): l is string => typeof l === "string")) {
+    throw new Error("'libraries' in options.json must be an array of strings");
+  }
+  return libraries;
+}
+
+async function main(): Promise<number> {
+  const name = process.argv[2];
+  const corpus = name === undefined ? undefined : CORPORA[name];
+  if (corpus === undefined) {
+    console.error(
+      `usage: bun scripts/write-requirement-corpus-expected.ts <corpus>\n` +
+      `  corpora: ${Object.keys(CORPORA).join(", ")}\n`,
+    );
+    return 2;
+  }
+
+  const corpusDir = join(REPO_ROOT, corpus.dir);
+  const cases = readdirSync(corpusDir).filter((n) => statSync(join(corpusDir, n)).isDirectory()).sort();
+  let written = 0;
+  let unchanged = 0;
+  let refused = 0;
+
+  for (const caseName of cases) {
+    const caseDir = join(corpusDir, caseName);
+    let content: string;
+    try {
+      const options = readOptions(caseDir, corpus);
+      const libraries = librariesOf(options);
+      const { root, errors } = await MetaDataLoader.fromDirectory(join(caseDir, "input"), {
+        strict: true,
+        ...(libraries.length > 0 ? { libraries } : {}),
+      });
+      if (errors.length > 0) throw new Error(`does not load strict:\n${errors.map((e) => `    ${String(e)}`).join("\n")}`);
+      content = JSON.stringify(corpus.expected(root, options), null, 2) + "\n";
+    } catch (err) {
+      console.error(`  REFUSED  ${caseName}: ${err instanceof Error ? err.message : String(err)}`);
+      refused++;
+      continue;
+    }
+    const target = join(caseDir, "expected.json");
+    if (existsSync(target) && readFileSync(target, "utf8") === content) {
+      unchanged++;
+      continue;
+    }
+    writeFileSync(target, content);
+    console.log(`  wrote    ${caseName}/expected.json`);
+    written++;
+  }
+
+  console.log(
+    `${corpus.dir}: ${cases.length} case(s) — ${written} written, ${unchanged} unchanged, ${refused} refused.` +
+    (written > 0 ? `\nReview every written file by hand before committing it.` : ``),
+  );
+  return refused > 0 ? 1 : 0;
+}
+
+process.exit(await main());
diff --git a/server/csharp/MetaObjects.Cli.Tests/CliProcess.cs b/server/csharp/MetaObjects.Cli.Tests/CliProcess.cs
index 51788876a..047de8a2f 100644
--- a/server/csharp/MetaObjects.Cli.Tests/CliProcess.cs
+++ b/server/csharp/MetaObjects.Cli.Tests/CliProcess.cs
@@ -14,6 +14,11 @@ internal static class CliProcess
     /// pinned to <paramref name="workingDir"/>, so the test exercises Program.cs's
     /// real Main/argument-parsing rather than any method reachable in-process.</summary>
     internal static (int ExitCode, string Stdout, string Stderr) Run(string workingDir, params string[] args)
+        => RunWithEnvironment(workingDir, new Dictionary<string, string>(), args);
+
+    /// <summary>As <see cref="Run"/>, with extra environment variables set for the child process.</summary>
+    internal static (int ExitCode, string Stdout, string Stderr) RunWithEnvironment(
+        string workingDir, IReadOnlyDictionary<string, string> environment, params string[] args)
     {
         var psi = new ProcessStartInfo("dotnet")
         {
@@ -22,6 +27,10 @@ internal static (int ExitCode, string Stdout, string Stderr) Run(string workingD
             RedirectStandardError = true,
             UseShellExecute = false,
         };
+        // The child inherits the runner's environment, so a variable that changes the CLI's behaviour
+        // is removed unless the test sets it: an exported META_REQUIRE_IMPLEMENTERS must not flip a test.
+        psi.Environment.Remove("META_REQUIRE_IMPLEMENTERS");
+        foreach (var (key, value) in environment) psi.Environment[key] = value;
         psi.ArgumentList.Add(ResolveCliDll());
         foreach (var a in args) psi.ArgumentList.Add(a);
 
diff --git a/server/csharp/MetaObjects.Cli.Tests/GenListAndSelectionTests.cs b/server/csharp/MetaObjects.Cli.Tests/GenListAndSelectionTests.cs
index e55c85bbb..15542349b 100644
--- a/server/csharp/MetaObjects.Cli.Tests/GenListAndSelectionTests.cs
+++ b/server/csharp/MetaObjects.Cli.Tests/GenListAndSelectionTests.cs
@@ -47,7 +47,7 @@ public void ListHeader_says_generators_are_owned_via_eject()
     public void ListLines_prints_all_generators_with_stable_names_and_descriptions()
     {
         var lines = GenCommand.ListLines(_tmp);
-        Assert.Equal(11, lines.Count);
+        Assert.Equal(12, lines.Count);
         foreach (var name in new[]
         {
             "entity", "db-context", "routes", "output-parser", "extractor",
@@ -56,6 +56,8 @@ public void ListLines_prints_all_generators_with_stable_names_and_descriptions()
             "callable",
             // Program A / §A5 — per-object physical database name constants.
             "names",
+            // ADR-0057 — per-requirement xUnit tests calling a project-owned witness.
+            "requirement-tests",
         })
         {
             Assert.Contains(lines, l => l.Contains($" {name} —"));
diff --git a/server/csharp/MetaObjects.Cli.Tests/VerifyRequirementsTests.cs b/server/csharp/MetaObjects.Cli.Tests/VerifyRequirementsTests.cs
new file mode 100644
index 000000000..19824bccd
--- /dev/null
+++ b/server/csharp/MetaObjects.Cli.Tests/VerifyRequirementsTests.cs
@@ -0,0 +1,393 @@
+using Xunit;
+
+namespace MetaObjects.Cli.Tests;
+
+/// <summary>
+/// <c>dotnet meta verify</c> — the requirement gate, end to end (ADR-0057). Drives the BUILT CLI
+/// (<see cref="CliProcess"/>) so this proves the wiring: what is printed, where, and what reaches the
+/// exit code. The codes, conditions and message text are gated cross-port by
+/// <c>RequirementCheckConformanceTests</c>, so these tests pin only the CLI's own surface.
+/// </summary>
+public sealed class VerifyRequirementsTests : IDisposable
+{
+    private readonly string _tmp = Directory.CreateTempSubdirectory("mo-verify-requirements-").FullName;
+
+    public void Dispose()
+    {
+        try { Directory.Delete(_tmp, recursive: true); } catch { /* best effort */ }
+    }
+
+    private const string Order = """
+        metadata:
+          package: acme::shop
+          children:
+            - object.entity:
+                name: Order
+                children:
+                  - field.uuid: { name: id }
+                  - identity.primary: { name: pk, fields: [id] }
+        """;
+
+    private static string Requirement(string name, string status, string? implementedBy) => $"""
+
+            - requirement.functional:
+                name: {name}
+                level: 4
+                status: {status}
+                statement: An order is recorded when it is placed.
+                counterexample: A placed order has no row.
+        {(implementedBy is null ? "" : $"        implementedBy: [{implementedBy}]")}
+        """;
+
+    /// <summary>Writes one metadata file and an empty templates directory; returns the verify arguments.</summary>
+    private string[] Project(string? requirement, params string[] extraArgs)
+    {
+        var model = Path.Combine(_tmp, "model");
+        Directory.CreateDirectory(model);
+        File.WriteAllText(Path.Combine(model, "meta.shop.yaml"), Order + requirement);
+        var templates = Path.Combine(_tmp, "templates");
+        Directory.CreateDirectory(templates);
+        return ["verify", model, "--templates", "--prompts", templates, .. extraArgs];
+    }
+
+    [Fact]
+    public void A_model_with_no_requirement_prints_nothing_and_changes_no_exit_code()
+    {
+        var (exitCode, stdout, stderr) = CliProcess.Run(_tmp, Project(requirement: null));
+
+        // Exactly what the templates gate printed before the requirement gate existed: nothing else,
+        // on either stream.
+        Assert.Equal(0, exitCode);
+        Assert.Equal("dotnet meta verify --templates: OK" + Environment.NewLine, stdout);
+        Assert.Equal("", stderr);
+    }
+
+    [Fact]
+    public void A_model_with_no_requirement_stays_silent_when_a_gate_fails_too()
+    {
+        // The strict load rejects the made-up attr, so verify exits 1 for its own reason. The
+        // requirement gate adds no line to either stream, and no exit code.
+        var model = Path.Combine(_tmp, "model");
+        Directory.CreateDirectory(model);
+        File.WriteAllText(Path.Combine(model, "meta.shop.yaml"), Order.Replace("name: Order", "name: Order\n        madeUpAttr: oops"));
+        var templates = Path.Combine(_tmp, "templates");
+        Directory.CreateDirectory(templates);
+
+        var (exitCode, stdout, stderr) = CliProcess.Run(_tmp, "verify", model, "--templates", "--prompts", templates);
+
+        Assert.Equal(1, exitCode);
+        Assert.Contains("FAILED", stdout);
+        Assert.DoesNotContain("requirement", stdout + stderr, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void A_dangling_live_reference_prints_its_lines_and_exits_1()
+    {
+        var (exitCode, _, stderr) = CliProcess.Run(_tmp, Project(Requirement("Recorded", "live", "Refund")));
+
+        Assert.True(exitCode == 1, $"exit={exitCode}\nstderr={stderr}");
+        var lines = stderr.Split('\n', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).ToList();
+        Assert.Contains(
+            "dotnet meta verify — requirements: 1 entries (1 functional, 0 architectural) — 1 live; " +
+            "0/1 entities claimed, counted over 1 metadata file(s).", lines);
+        Assert.Contains(
+            "ERR_REQUIREMENT_DANGLING_REF [Recorded]: 'Refund' does not resolve in the loaded model " +
+            "(status 'live' — the model moved and the requirement is stale).", lines);
+        Assert.Contains("dotnet meta verify — requirements: 1 error(s).", lines);
+        // A diagnostic line carries no command prefix, exactly as the field lint prints its findings.
+        Assert.Contains(stderr.Split('\n'), l => l.StartsWith("  ERR_REQUIREMENT_DANGLING_REF [Recorded]: "));
+        // The error count closes the gate's output.
+        Assert.Equal("dotnet meta verify — requirements: 1 error(s).", lines[^1]);
+    }
+
+    [Fact]
+    public void Warnings_alone_print_every_line_and_leave_the_exit_code_at_0()
+    {
+        var (exitCode, stdout, stderr) = CliProcess.Run(_tmp, Project(Requirement("Recorded", "live", implementedBy: null)));
+
+        Assert.True(exitCode == 0, $"exit={exitCode}\nstdout={stdout}\nstderr={stderr}");
+        Assert.Contains("  WARN_REQUIREMENT_NOTHING_IMPLEMENTS [Recorded]: is 'live' but neither it nor anything nested under it", stderr);
+        Assert.Contains("  WARN_REQUIREMENT_OBJECT_UNCLAIMED: no requirement claims 'acme::shop::Order'.", stderr);
+        Assert.DoesNotContain("error(s)", stderr);
+    }
+
+    [Fact]
+    public void A_recorded_gap_with_no_disposition_prints_its_own_line()
+    {
+        var (exitCode, _, stderr) = CliProcess.Run(_tmp, Project(Requirement("Refunded", "planned", implementedBy: null)));
+
+        Assert.Equal(0, exitCode);
+        Assert.Contains(
+            "dotnet meta verify — requirements: 1 recorded gap(s) with no @disposition. These are known problems " +
+            "nobody has ruled on — set 'accepted' or 'deferred' to close the question.", stderr);
+    }
+
+    [Fact]
+    public void An_undecided_partial_requirement_is_a_recorded_gap_too()
+    {
+        // `partial` is outstanding work as `planned` is: with no disposition it is counted and said.
+        var (exitCode, _, stderr) = CliProcess.Run(_tmp, Project(Requirement("Recorded", "partial", "Order")));
+
+        Assert.True(exitCode == 0, $"exit={exitCode}\nstderr={stderr}");
+        var lines = stderr.Split('\n', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+        Assert.Contains(
+            "dotnet meta verify — requirements: 1 entries (1 functional, 0 architectural) — 1 partial; " +
+            "1/1 entities claimed, counted over 1 metadata file(s).", lines);
+        Assert.Contains(
+            "dotnet meta verify — requirements: 1 recorded gap(s) with no @disposition. These are known problems " +
+            "nobody has ruled on — set 'accepted' or 'deferred' to close the question.", lines);
+    }
+
+    [Fact]
+    public void The_summary_line_of_a_library_only_project_says_coverage_is_not_measured()
+    {
+        // The corpus case pins the counts; this pins the sentence they are printed in. The project
+        // opts into a library and authors no requirement of its own.
+        var corpusCase = Path.Combine(RepoRoot(), "fixtures", "requirement-check-conformance", "coverage-library-only-not-measured");
+        var model = Path.Combine(_tmp, "model");
+        Directory.CreateDirectory(model);
+        foreach (var file in Directory.GetFiles(Path.Combine(corpusCase, "input")))
+            File.Copy(file, Path.Combine(model, Path.GetFileName(file)));
+        using var options = System.Text.Json.JsonDocument.Parse(File.ReadAllText(Path.Combine(corpusCase, "options.json")));
+        Directory.CreateDirectory(Path.Combine(_tmp, ".metaobjects"));
+        File.WriteAllText(Path.Combine(_tmp, ".metaobjects", "config.json"),
+            $$"""{ "schema_version": 1, "libraries": {{options.RootElement.GetProperty("libraries").GetRawText()}} }""");
+        var templates = Path.Combine(_tmp, "templates");
+        Directory.CreateDirectory(templates);
+
+        using var expected = System.Text.Json.JsonDocument.Parse(File.ReadAllText(Path.Combine(corpusCase, "expected.json")));
+        var summary = expected.RootElement.GetProperty("summary");
+        Assert.False(summary.TryGetProperty("entitiesTotal", out _)); // the case this test is about
+        var byStatus = summary.GetProperty("byStatus");
+        var statuses = string.Join(", ", new[] { "planned", "live", "partial", "retired" }
+            .Where(s => byStatus.TryGetProperty(s, out var n) && n.GetInt32() > 0)
+            .Select(s => $"{byStatus.GetProperty(s).GetInt32()} {s}"));
+
+        var (exitCode, stdout, stderr) = CliProcess.Run(_tmp, "verify", model, "--templates", "--prompts", templates);
+
+        Assert.True(exitCode == 0, $"exit={exitCode}\nstdout={stdout}\nstderr={stderr}");
+        var lines = stderr.Split('\n', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+        Assert.Contains(
+            $"dotnet meta verify — requirements: {summary.GetProperty("total").GetInt32()} entries " +
+            $"({summary.GetProperty("functional").GetInt32()} functional, {summary.GetProperty("architectural").GetInt32()} architectural) — " +
+            $"{statuses}; coverage: not measured (no project-authored requirements).", lines);
+        Assert.DoesNotContain("entities claimed", stderr);
+    }
+
+    private static string RepoRoot()
+    {
+        for (var dir = new DirectoryInfo(AppContext.BaseDirectory); dir is not null; dir = dir.Parent)
+        {
+            if (Directory.Exists(Path.Combine(dir.FullName, "fixtures", "requirement-check-conformance")) &&
+                Directory.Exists(Path.Combine(dir.FullName, "server", "csharp")))
+                return dir.FullName;
+        }
+        throw new InvalidOperationException("could not locate the repo root from " + AppContext.BaseDirectory);
+    }
+
+    [Fact]
+    public void Require_implementers_raises_only_the_existence_finding_to_an_error()
+    {
+        var (exitCode, _, stderr) = CliProcess.Run(_tmp,
+            Project(Requirement("Recorded", "live", implementedBy: null), "--require-implementers"));
+
+        Assert.True(exitCode == 1, $"exit={exitCode}\nstderr={stderr}");
+        // The code keeps its WARN_ name; only the severity moves, so the error count includes it.
+        Assert.Contains("  WARN_REQUIREMENT_NOTHING_IMPLEMENTS [Recorded]: ", stderr);
+        Assert.Contains("dotnet meta verify — requirements: 1 error(s).", stderr);
+        Assert.Contains("  WARN_REQUIREMENT_OBJECT_UNCLAIMED: ", stderr);
+    }
+
+    [Fact]
+    public void The_environment_variable_does_what_the_flag_does()
+    {
+        var (exitCode, _, stderr) = CliProcess.RunWithEnvironment(_tmp,
+            new Dictionary<string, string> { ["META_REQUIRE_IMPLEMENTERS"] = "1" },
+            Project(Requirement("Recorded", "live", implementedBy: null)));
+
+        Assert.True(exitCode == 1, $"exit={exitCode}\nstderr={stderr}");
+        Assert.Contains("dotnet meta verify — requirements: 1 error(s).", stderr);
+    }
+
+    [Fact]
+    public void Any_other_value_of_the_environment_variable_is_ignored()
+    {
+        var (exitCode, _, _) = CliProcess.RunWithEnvironment(_tmp,
+            new Dictionary<string, string> { ["META_REQUIRE_IMPLEMENTERS"] = "true" },
+            Project(Requirement("Recorded", "live", implementedBy: null)));
+
+        Assert.Equal(0, exitCode);
+    }
+
+    [Fact]
+    public void The_gate_runs_under_codegen_alone_and_its_errors_reach_the_exit_code()
+    {
+        // `--codegen` with no generators selected is clean on its own (exit 0), so the exit code here
+        // is the requirement gate's. The templates gate does not run at all.
+        var args = Project(Requirement("Recorded", "live", "Refund"));
+        var model = args[1];
+        var codegenArgs = new[] { "verify", model, "--codegen", "--out", Path.Combine(_tmp, "out") };
+
+        var (exitCode, stdout, stderr) = CliProcess.Run(_tmp, codegenArgs);
+
+        Assert.True(exitCode == 1, $"exit={exitCode}\nstdout={stdout}\nstderr={stderr}");
+        Assert.DoesNotContain("--templates", stdout);
+        Assert.Contains("ERR_REQUIREMENT_DANGLING_REF [Recorded]", stderr);
+        Assert.Contains("dotnet meta verify — requirements: 1 error(s).", stderr);
+
+        // The same selection over a model whose only findings are warnings stays at exit 0.
+        File.WriteAllText(Path.Combine(model, "meta.shop.yaml"), Order + Requirement("Recorded", "live", implementedBy: null));
+        var (warnExit, _, warnErr) = CliProcess.Run(_tmp, codegenArgs);
+        Assert.Equal(0, warnExit);
+        Assert.Contains("  WARN_REQUIREMENT_NOTHING_IMPLEMENTS [Recorded]: ", warnErr);
+    }
+
+    [Fact]
+    public void The_gate_ignores_no_field_lint()
+    {
+        var (exitCode, _, stderr) = CliProcess.Run(_tmp,
+            Project(Requirement("Recorded", "live", "Refund"), "--no-field-lint"));
+
+        Assert.Equal(1, exitCode);
+        Assert.Contains("ERR_REQUIREMENT_DANGLING_REF [Recorded]", stderr);
+    }
+
+    // ------------------------------------------------------------------------------------------
+    // A model that does not LOAD is not "a model with no requirement". When no gate that ran in
+    // this process loaded it, the requirement gate's load is the only one: it reports and fails.
+    // ------------------------------------------------------------------------------------------
+
+    /// <summary>A model the loader refuses under any strictness: <c>status</c> is a closed enum.</summary>
+    private string UnloadableModel()
+    {
+        var model = Path.Combine(_tmp, "model");
+        Directory.CreateDirectory(model);
+        File.WriteAllText(Path.Combine(model, "meta.shop.yaml"), Order + Requirement("Recorded", "bogus", "Order"));
+        return model;
+    }
+
+    /// <summary>
+    /// The options Program.cs holds once <c>verify --codegen --out</c> has run in an owned
+    /// <c>codegen/</c> project and no other subverb was selected: <c>Codegen</c> cleared and
+    /// <c>CodegenHandedOff</c> set. Reaching that state through the CLI needs a real
+    /// <c>dotnet run</c> of an owned project (see <c>EjectEndToEndTests</c>), so these tests start
+    /// from the state itself.
+    /// </summary>
+    private VerifyCommand.Options AfterCodegenHandOff(string model) => new()
+    {
+        MetadataDir = model,
+        OutDir = Path.Combine(_tmp, "out"),
+        Codegen = false,
+        CodegenHandedOff = true,
+    };
+
+    [Fact]
+    public void After_a_codegen_hand_off_a_model_that_does_not_load_is_reported_by_the_gate_and_fails()
+    {
+        var opts = AfterCodegenHandOff(UnloadableModel());
+        var result = VerifyCommand.RunSubverbs(opts);
+        // No gate ran here, so none loaded the model and none reported anything.
+        Assert.False(result.RanTemplates);
+        Assert.False(result.RanCodegen);
+        Assert.Equal(0, result.ExitCode);
+        Assert.False(result.LoadFailureReported);
+
+        var output = new StringWriter();
+        var exit = VerifyCommand.RunRequirementGate(opts, requireImplementers: false, output, result.LoadFailureReported);
+
+        Assert.Equal(1, exit);
+        Assert.Contains("  load error: ERR_BAD_ATTR_VALUE: ", output.ToString());
+        Assert.Contains("'bogus'", output.ToString());
+        Assert.DoesNotContain("requirements", output.ToString());
+    }
+
+    [Fact]
+    public void After_a_codegen_hand_off_a_mistyped_attribute_is_refused_with_the_strict_hint_unless_lax()
+    {
+        var model = Path.Combine(_tmp, "model");
+        Directory.CreateDirectory(model);
+        // `planned`, so that once it loads the gate has no finding the ambient strict switch
+        // (META_REQUIRE_IMPLEMENTERS, read in-process here) could raise to an error.
+        File.WriteAllText(Path.Combine(model, "meta.shop.yaml"),
+            Order + Requirement("Recorded", "planned", "Order").Replace("implementedBy", "implementdBy"));
+        var opts = AfterCodegenHandOff(model);
+
+        var output = new StringWriter();
+        var exit = VerifyCommand.RunRequirementGate(opts, requireImplementers: false, output, loadFailureReported: false);
+        Assert.Equal(1, exit);
+        Assert.Contains("  load error: ERR_UNKNOWN_ATTR: ", output.ToString());
+        Assert.Contains("  hint: " + VerifyCommand.UNKNOWN_ATTR_HINT, output.ToString());
+
+        // --lax loads it, and then the gate reads what loaded.
+        var lax = new StringWriter();
+        Assert.Equal(0, VerifyCommand.RunRequirementGate(opts with { Strict = false }, requireImplementers: false, lax, loadFailureReported: false));
+        Assert.DoesNotContain("load error", lax.ToString());
+        Assert.Contains("dotnet meta verify — requirements: 1 entries", lax.ToString());
+    }
+
+    [Fact]
+    public void After_a_codegen_hand_off_a_model_with_no_requirement_still_prints_nothing_and_exits_0()
+    {
+        // The other side of the boundary: the model LOADS and declares no requirement.
+        var opts = AfterCodegenHandOff(Project(requirement: null)[1]);
+        var result = VerifyCommand.RunSubverbs(opts);
+
+        var output = new StringWriter();
+        Assert.Equal(0, VerifyCommand.RunRequirementGate(opts, requireImplementers: false, output, result.LoadFailureReported));
+        Assert.Equal("", output.ToString());
+    }
+
+    [Fact]
+    public void Codegen_with_no_out_dir_never_loads_so_the_gate_reports_the_model_that_does_not_load()
+    {
+        // In-process this time, through the built CLI: `--codegen` with no `--out` stops before it
+        // loads anything, so here too the gate's load is the only one.
+        var (exitCode, stdout, stderr) = CliProcess.Run(_tmp, "verify", UnloadableModel(), "--codegen");
+
+        Assert.True(exitCode != 0, $"exit={exitCode}\nstdout={stdout}\nstderr={stderr}");
+        Assert.Contains("  load error: ERR_BAD_ATTR_VALUE: ", stderr);
+        Assert.DoesNotContain("requirements", stdout + stderr);
+    }
+
+    [Fact]
+    public void A_load_failure_a_gate_already_reported_is_not_reported_again()
+    {
+        var model = UnloadableModel();
+        var templates = Path.Combine(_tmp, "templates");
+        Directory.CreateDirectory(templates);
+
+        // The templates gate loaded it and reported it.
+        var (templatesExit, _, templatesErr) = CliProcess.Run(_tmp, "verify", model, "--templates", "--prompts", templates);
+        Assert.Equal(1, templatesExit);
+        Assert.Equal(1, CountOf(templatesErr, "ERR_BAD_ATTR_VALUE"));
+
+        // So did the in-process codegen gate, in its own form.
+        var (codegenExit, _, codegenErr) = CliProcess.Run(_tmp, "verify", model, "--codegen", "--out", Path.Combine(_tmp, "out"));
+        Assert.NotEqual(0, codegenExit);
+        Assert.Contains("verify --codegen: metadata did not load cleanly", codegenErr);
+        Assert.Equal(1, CountOf(codegenErr, "ERR_BAD_ATTR_VALUE"));
+    }
+
+    private static int CountOf(string text, string needle) => text.Split(needle).Length - 1;
+
+    [Fact]
+    public void A_model_that_did_not_load_adds_nothing_and_no_exit_code_of_its_own()
+    {
+        // Strict load rejects the made-up attr: the command's own load failure is already reported,
+        // and the gate neither repeats it nor reads a half-loaded model.
+        var args = Project(Requirement("Recorded", "live", "Refund"));
+        var file = Path.Combine(_tmp, "model", "meta.shop.yaml");
+        File.WriteAllText(file, File.ReadAllText(file).Replace("name: Order\n", "name: Order\n        madeUpAttr: oops\n"));
+
+        var (exitCode, stdout, stderr) = CliProcess.Run(_tmp, args);
+
+        Assert.Equal(1, exitCode); // the templates gate's own load failure
+        Assert.Contains("ERR_UNKNOWN_ATTR", stderr);
+        Assert.DoesNotContain("requirements", stdout + stderr);
+
+        // --lax loads it, so the gate now runs over the same model.
+        var (laxExit, _, laxErr) = CliProcess.Run(_tmp, [.. args, "--lax"]);
+        Assert.Equal(1, laxExit);
+        Assert.Contains("ERR_REQUIREMENT_DANGLING_REF [Recorded]", laxErr);
+    }
+}
diff --git a/server/csharp/MetaObjects.Cli/Program.cs b/server/csharp/MetaObjects.Cli/Program.cs
index 5c4a8a8fa..ba30e609c 100644
--- a/server/csharp/MetaObjects.Cli/Program.cs
+++ b/server/csharp/MetaObjects.Cli/Program.cs
@@ -40,6 +40,11 @@
         "                                                       --db         NOT supported in C# (migrate engine)\n" +
         "                                                       --lax        load lax (legacy); strict-by-default\n" +
         "                                                                    rejects an unregistered @attr (ADR-0023)\n" +
+        "                                                       --require-implementers\n" +
+        "                                                                    the requirement gate runs on every verify;\n" +
+        "                                                                    this raises a functional requirement nothing\n" +
+        "                                                                    implements to an error (or\n" +
+        "                                                                    META_REQUIRE_IMPLEMENTERS=1)\n" +
         "    docs <metadataDir> --out <dir> [--namespace <ns>] [--project <name>] [--model-base-url <url>]\n" +
         "                                                     emit the generated C# SDK api reference\n" +
         "                                                     (the api/csharp surface: one page per\n" +
@@ -493,7 +498,7 @@ static int RunVerify(string[] rest)
     string? generatorsCsv = null;
     string? templateRoot = null;
     string? columnNamingRaw = null;
-    bool templates = false, codegen = false, db = false, lax = false, noFieldLint = false;
+    bool templates = false, codegen = false, db = false, lax = false, noFieldLint = false, requireImplementers = false;
 
     for (int i = 0; i < rest.Length; i++)
     {
@@ -521,6 +526,9 @@ static int RunVerify(string[] rest)
         // Mutes the advisory field AUTHORING lint (FieldLint) — never a gate, so this
         // changes what is printed and nothing else. META_NO_FIELD_LINT=1 does the same.
         else if (a == "--no-field-lint") noFieldLint = true;
+        // Raises WARN_REQUIREMENT_NOTHING_IMPLEMENTS to an error (ADR-0057) — for a project whose
+        // ledger has caught up with its links. META_REQUIRE_IMPLEMENTERS=1 does the same.
+        else if (a == "--require-implementers") requireImplementers = true;
         else if (a == "--out" && i + 1 < rest.Length) outDir = rest[++i];
         else if (a == "--namespace" && i + 1 < rest.Length) { ns = rest[++i]; nsExplicit = true; }
         else if (a == "--generators" && i + 1 < rest.Length) generatorsCsv = rest[++i];
@@ -670,6 +678,17 @@ static int RunVerify(string[] rest)
     if (result.DbRejectionMessage is not null)
         Console.Error.WriteLine($"  {result.DbRejectionMessage}");
 
+    // The requirement gate (ADR-0057) — on EVERY verify, whichever gates were selected, and not
+    // muted by --no-field-lint. A model with no requirement.* node sees no line and no exit-code
+    // change. Its errors fold into the exit code like any other gate's. It runs before the
+    // advisory lint so the lint stays the last thing printed, as it was.
+    //
+    // A model that does not LOAD fails here, and is reported here unless a gate above already
+    // printed that (result.LoadFailureReported). The handed-off codegen runner is another process
+    // whose output this one cannot read, so its report is never assumed: when both it and this
+    // load refuse the metadata, each says so.
+    var requirementExit = VerifyCommand.RunRequirementGate(opts, requireImplementers, Console.Error, result.LoadFailureReported);
+
     // The field AUTHORING lint — a reference identity over a field the object lacks, a
     // field name declared twice in one children list. Both load clean on every port. Runs
     // on every `verify`, whichever gates were selected; warnings ONLY, never the exit code.
@@ -679,7 +698,8 @@ static int RunVerify(string[] rest)
     // The handed-off codegen gate already printed its own verdict (inherited console);
     // fold its exit code into the aggregate the same way every other subverb does — max,
     // non-zero on any drift.
-    return codegenHandedOff ? Math.Max(result.ExitCode, codegenHandoffExit) : result.ExitCode;
+    var gatesExit = codegenHandedOff ? Math.Max(result.ExitCode, codegenHandoffExit) : result.ExitCode;
+    return Math.Max(gatesExit, requirementExit);
 }
 
 
@@ -693,14 +713,14 @@ partial class Program
     static readonly string[] DocsValueFlags = ["--out", "--namespace", "--project", "--model-base-url"];
     static readonly string[] VerifyValueFlags =
         ["--prompts", "--out", "--namespace", "--generators", "--template-root", "--column-naming"];
-    static readonly string[] VerifyBoolFlags = ["--templates", "--codegen", "--db", "--lax", "--no-field-lint"];
+    static readonly string[] VerifyBoolFlags = ["--templates", "--codegen", "--db", "--lax", "--no-field-lint", "--require-implementers"];
 
     /// <summary>Each command's usage, printed by <c>dotnet meta &lt;command&gt; --help</c>.</summary>
     static readonly Dictionary<string, string> CommandUsage = new()
     {
         ["gen"] = "usage: dotnet meta gen <metadataDir> --out <dir> [--namespace <ns>] [--generators <a,b,c>] [--template-root <dir>] [--template-spec <json>] [--emit-abstract-shapes] [--column-naming literal|snake_case|kebab-case] [--baseline default|adopt]\n" +
                   "       dotnet meta gen --list",
-        ["verify"] = "usage: dotnet meta verify <metadataDir> [--templates [--prompts <dir>]] [--codegen --out <dir> [--namespace <ns>] [--generators <a,b,c>] [--template-root <dir>] [--column-naming literal|snake_case|kebab-case]] [--db] [--lax] [--no-field-lint]",
+        ["verify"] = "usage: dotnet meta verify <metadataDir> [--templates [--prompts <dir>]] [--codegen --out <dir> [--namespace <ns>] [--generators <a,b,c>] [--template-root <dir>] [--column-naming literal|snake_case|kebab-case]] [--db] [--lax] [--no-field-lint] [--require-implementers]",
         ["docs"] = "usage: dotnet meta docs <metadataDir> --out <dir> [--namespace <ns>] [--project <name>] [--model-base-url <url>]",
         ["fmt"] = "usage: dotnet meta fmt [<metadataDir>] [--check]",
         ["eject"] = "usage: dotnet meta eject <name>... [--force] [--root <dir>]",
diff --git a/server/csharp/MetaObjects.Cli/VerifyCommand.cs b/server/csharp/MetaObjects.Cli/VerifyCommand.cs
index 9cd680990..1c28d3d21 100644
--- a/server/csharp/MetaObjects.Cli/VerifyCommand.cs
+++ b/server/csharp/MetaObjects.Cli/VerifyCommand.cs
@@ -14,10 +14,13 @@
 //
 // Runs at the last fixed point before serve, never on the request path.
 
+using System.Globalization;
 using System.Text.Json;
 using MetaObjects.Codegen;
+using MetaObjects.Core.Requirement;
 using MetaObjects.Loader;
 using MetaObjects.Render;
+using static MetaObjects.Core.Requirement.RequirementConstants;
 using static MetaObjects.Shared.BaseTypes;
 using static MetaObjects.Template.TemplateConstants;
 
@@ -168,6 +171,14 @@ public sealed record SubverbResult
         public Codegen.CodegenDrift.Result? Codegen { get; init; }
         /// <summary>Set when <c>--db</c> was requested (rejection message).</summary>
         public string? DbRejectionMessage { get; init; }
+        /// <summary>
+        /// True when a gate that ran in THIS process loaded the metadata, found that it did not load,
+        /// and put that in its own outcome for the caller to print. False when no gate here reached
+        /// a load at all: <c>--codegen</c> handed off to an owned <c>codegen/</c> project, or stopped
+        /// for want of <c>--out</c>, or only <c>--db</c> was asked for. The requirement gate reads
+        /// this to report a failed load once, and never zero times.
+        /// </summary>
+        public bool LoadFailureReported { get; init; }
     }
 
     /// <summary>
@@ -187,17 +198,22 @@ public static SubverbResult RunSubverbs(Options opts)
 
         int exit = 0;
 
+        // Whether a gate below loaded the metadata, found it did not load, and reported that.
+        var loadFailureReported = false;
+
         Outcome? templatesOutcome = null;
         if (runTemplates)
         {
             templatesOutcome = Run(LoadMetadata(opts), opts.TemplatesRoot ?? "");
             if (!templatesOutcome.Ok) exit = Math.Max(exit, 1);
+            if (templatesOutcome.LoadErrors.Count > 0) loadFailureReported = true;
         }
 
         Codegen.CodegenDrift.Result? codegenResult = null;
         if (runCodegen)
         {
             codegenResult = RunCodegenDrift(opts, out var codegenLoadFailed);
+            if (codegenLoadFailed) loadFailureReported = true;
             // usage error (nothing to diff against) → exit 2; metadata that does not load →
             // exit 1, the code every port's gen/verify/fmt uses for it; drift → 1; clean → 0.
             int codegenExit = codegenResult.Error is null
@@ -222,6 +238,7 @@ public static SubverbResult RunSubverbs(Options opts)
             Templates = templatesOutcome,
             Codegen = codegenResult,
             DbRejectionMessage = dbMsg,
+            LoadFailureReported = loadFailureReported,
         };
     }
 
@@ -236,6 +253,94 @@ private static LoadResult LoadMetadata(Options opts) => opts.MetadataFiles is {
         ? MetaDataLoader.FromUris(files.Select(f => new Uri(f)).ToList(), opts.Libraries, opts.Strict)
         : MetaDataLoader.FromDirectory(opts.MetadataDir, opts.Libraries, strict: opts.Strict);
 
+    // ------------------------------------------------------------------------
+    // The requirement gate (ADR-0057) — runs on EVERY verify, with no subverb.
+    // ------------------------------------------------------------------------
+
+    /// <summary>Raises <c>WARN_REQUIREMENT_NOTHING_IMPLEMENTS</c> to an error, beside <c>--require-implementers</c>.</summary>
+    public const string REQUIRE_IMPLEMENTERS_ENV = "META_REQUIRE_IMPLEMENTERS";
+
+    /// <summary>The command prefix the gate's summary, recorded-gaps and error-count lines carry.</summary>
+    private const string RequirementPrefix = "dotnet meta verify — requirements: ";
+
+    /// <summary>
+    /// The requirement (capability) gate: reads the <c>requirement.*</c> nodes of the loaded model and
+    /// reports what the loader cannot. <c>requirement.*</c> is metadata, so a model declaring none is
+    /// silent, not in drift: no line is printed and the exit code is unchanged.
+    ///
+    /// <para>Prints the summary line on every run that has a requirement, clean or not (a gate that
+    /// says nothing when it passes cannot be told apart from one that checked nothing), then every
+    /// finding, uncapped, to <paramref name="output"/>. Returns 1 when any finding is an error.</para>
+    ///
+    /// <para>Returns 1 when the metadata did not load: an unloadable model is not a model with no
+    /// requirement. The load errors are printed here unless <paramref name="loadFailureReported"/>
+    /// says a gate that ran in this process already put them in front of the user
+    /// (<see cref="SubverbResult.LoadFailureReported"/>). No gate did when <c>--codegen</c> was handed
+    /// off to an owned <c>codegen/</c> project, stopped for want of <c>--out</c>, or only <c>--db</c>
+    /// was asked for: then this load is the only one in the process, and what it finds is the only
+    /// report there will be. Any other exception surfaces, so a gate that broke cannot read as a gate
+    /// that passed.</para>
+    /// </summary>
+    public static int RunRequirementGate(Options opts, bool requireImplementers, TextWriter output, bool loadFailureReported)
+    {
+        var load = LoadMetadata(opts);
+        if (load.Errors.Count > 0)
+        {
+            if (!loadFailureReported)
+            {
+                foreach (var e in load.Errors) output.WriteLine($"  load error: {e.Code}: {e.Message}");
+                if (opts.Strict && load.Errors.Any(e => e.Code == ErrorCode.ERR_UNKNOWN_ATTR))
+                    output.WriteLine($"  hint: {UNKNOWN_ATTR_HINT}");
+                output.WriteLine("dotnet meta verify: FAILED (metadata did not load cleanly)");
+            }
+            return 1;
+        }
+
+        var scan = RequirementCheck.Scan(
+            load.Root, requireImplementers: requireImplementers || Environment.GetEnvironmentVariable(REQUIRE_IMPLEMENTERS_ENV) == "1");
+        var summary = RequirementCheck.Summarise(load.Root, scan);
+        if (summary is null) return 0;
+
+        var files = opts.MetadataFiles?.Count ?? new DirectorySource(opts.MetadataDir).Expand().Count();
+        output.WriteLine(RequirementPrefix + SummaryText(summary, files));
+        if (summary.Undecided > 0)
+        {
+            output.WriteLine(RequirementPrefix + string.Create(CultureInfo.InvariantCulture,
+                $"{summary.Undecided} recorded gap(s) with no @disposition. These are known problems nobody has ") +
+                "ruled on — set 'accepted' or 'deferred' to close the question.");
+        }
+
+        var diagnostics = RequirementCheck.Check(load.Root, scan);
+        var errors = diagnostics.Where(d => d.Severity == RequirementCheck.SeverityError).ToList();
+        var warnings = diagnostics.Where(d => d.Severity != RequirementCheck.SeverityError).ToList();
+        foreach (var d in errors) output.WriteLine(FormatRequirementDiagnostic(d));
+        foreach (var d in warnings) output.WriteLine(FormatRequirementDiagnostic(d));
+        if (errors.Count == 0) return 0;
+
+        output.WriteLine(RequirementPrefix + string.Create(CultureInfo.InvariantCulture, $"{errors.Count} error(s)."));
+        return 1;
+    }
+
+    /// <summary>The summary line, minus its command prefix. Statuses in the closed enum's order, zero counts omitted.</summary>
+    private static string SummaryText(RequirementSummary summary, int files)
+    {
+        var statuses = string.Join(", ", REQUIREMENT_STATUSES
+            .Where(s => summary.ByStatus.GetValueOrDefault(s) > 0)
+            .Select(s => string.Create(CultureInfo.InvariantCulture, $"{summary.ByStatus[s]} {s}")));
+        var coverage = summary.EntitiesTotal is null
+            // The absence of the ratio is the statement that the project authored no requirement of its own.
+            ? "coverage: not measured (no project-authored requirements)."
+            // The file count is the denominator's provenance: the total is only ever taken over what loaded.
+            : string.Create(CultureInfo.InvariantCulture, $"{summary.EntitiesClaimed}/{summary.EntitiesTotal} entities claimed, counted over {files} metadata file(s).");
+        return string.Create(CultureInfo.InvariantCulture,
+                   $"{summary.Total} entries ({summary.Functional} functional, {summary.Architectural} architectural) — ") +
+               $"{statuses}; {coverage}";
+    }
+
+    /// <summary>A diagnostic line, with no command prefix: <c>  &lt;code&gt; [&lt;path&gt;]: &lt;message&gt;</c>.</summary>
+    private static string FormatRequirementDiagnostic(RequirementDiagnostic d) =>
+        $"  {d.Code}{(d.Path is null ? "" : $" [{d.Path}]")}: {d.Message}";
+
     /// <summary>
     /// Run the codegen-drift gate: load metadata, resolve the generator suite (default
     /// or the <c>--generators</c> selection), and diff a fresh regen against the
diff --git a/server/csharp/MetaObjects.Codegen.Tests/EjectableGeneratorsTests.cs b/server/csharp/MetaObjects.Codegen.Tests/EjectableGeneratorsTests.cs
index 195d85155..e3d846bfe 100644
--- a/server/csharp/MetaObjects.Codegen.Tests/EjectableGeneratorsTests.cs
+++ b/server/csharp/MetaObjects.Codegen.Tests/EjectableGeneratorsTests.cs
@@ -66,6 +66,19 @@ public void Embedded_resource_set_matches_the_registry_ejectable_set_exactly()
         Assert.Equal(registryNames, embeddedNames);
     }
 
+    [Fact]
+    public void Requirement_tests_is_ejectable_and_its_source_is_one_file_in_the_packaged_namespace()
+    {
+        var entry = Assert.Single(EjectableGenerators.Entries(), e => e.Name == "requirement-tests");
+        Assert.Equal("RequirementTestsGenerator.cs", entry.SourceFileName);
+        var source = EjectableGenerators.ReadSource("requirement-tests")!;
+        Assert.Contains("namespace MetaObjects.Codegen.Generators;", source);
+        Assert.Contains("class RequirementTestsGenerator", source);
+        // The default rendering lives in this one file, so one eject takes the generator and its renderer together.
+        Assert.Contains("DefaultTest(", source);
+        Assert.Contains("WitnessInterface(", source);
+    }
+
     [Fact]
     public void ReadSource_resolves_by_stable_registry_name()
     {
diff --git a/server/csharp/MetaObjects.Codegen.Tests/EjectedGeneratorCompileTests.cs b/server/csharp/MetaObjects.Codegen.Tests/EjectedGeneratorCompileTests.cs
index 5fc91aaf1..53d4cc901 100644
--- a/server/csharp/MetaObjects.Codegen.Tests/EjectedGeneratorCompileTests.cs
+++ b/server/csharp/MetaObjects.Codegen.Tests/EjectedGeneratorCompileTests.cs
@@ -16,6 +16,8 @@
 using System.Reflection;
 using Microsoft.CodeAnalysis;
 using Microsoft.CodeAnalysis.CSharp;
+using MetaObjects.Codegen.Generators;
+using MetaObjects.Core.Requirement;
 using MetaObjects.Loader;
 using MetaObjects.Meta;
 using Xunit;
@@ -189,4 +191,126 @@ public void Ejected_render_helper_compiles_and_matches_the_packaged_generator()
         for (int i = 0; i < packagedFiles.Count; i++)
             Assert.Equal(packagedFiles[i].Content, ejectedFiles[i].Content);
     }
+
+    /// <summary>
+    /// <c>requirement-tests</c>, over the identity corpus's <c>worked-example</c>: <c>meta.fitness.json</c> has
+    /// no requirement, so the parameterless theory above compares two empty lists for this generator and
+    /// proves nothing. Both generators are set to NON-default options so a copy that ignored a property, or
+    /// that fell back to its own defaults, could not agree with the packaged one by accident.
+    /// </summary>
+    [Fact]
+    public void Ejected_requirement_tests_compiles_against_the_public_API_and_matches_the_packaged_generator_over_the_worked_example()
+    {
+        var input = Path.Combine(CorpusPaths.RepoRoot(), "fixtures", "requirement-test-identity-conformance", "worked-example", "input");
+        var load = MetaDataLoader.FromDirectory(input, strict: true);
+        Assert.Empty(load.Errors.Select(e => e.Code + ": " + e.Message));
+
+        const string testNamespace = "Acme.Owned.Req";
+        const string witnessClass = "Acme.Owned.Witnesses";
+        var ejected = CompileAndInstantiate("requirement-tests", "RequirementTestsGenerator", []);
+        Assert.Equal("Codegen.Generators", ejected.GetType().Namespace);
+        foreach (var (property, value) in new (string, object)[]
+                 {
+                     ("TestNamespace", testNamespace),
+                     ("WitnessClass", witnessClass),
+                     ("Grain", RequirementTestGrain.Member),
+                     ("WarnUncovered", true),
+                 })
+            ejected.GetType().GetProperty(property)!.SetValue(ejected, value);
+
+        var packaged = new RequirementTestsGenerator
+        {
+            TestNamespace = testNamespace,
+            WitnessClass = witnessClass,
+            Grain = RequirementTestGrain.Member,
+            WarnUncovered = true,
+        };
+
+        List<EmittedFile> Run(IGenerator generator, List<string> warnings) =>
+            generator.Generate(new GenContext
+            {
+                Entities = load.Root.Objects(),
+                Root = load.Root,
+                Config = new GenConfig { OutDir = "/tmp", Namespace = "Acme.Generated" },
+                Warn = warnings.Add,
+            }).OrderBy(f => f.Path, StringComparer.Ordinal).ToList();
+
+        var ejectedWarnings = new List<string>();
+        var packagedWarnings = new List<string>();
+        var ejectedFiles = Run(ejected, ejectedWarnings);
+        var packagedFiles = Run(packaged, packagedWarnings);
+
+        Assert.Equal(2, packagedFiles.Count);
+        Assert.Contains($"namespace {testNamespace};", packagedFiles[0].Content);
+        Assert.Contains("req_acme_shop_Orders_Recorded__Order", packagedFiles[0].Content + packagedFiles[1].Content);
+        Assert.Equal(packagedFiles.Select(f => f.Path), ejectedFiles.Select(f => f.Path));
+        for (var i = 0; i < packagedFiles.Count; i++)
+            Assert.Equal(packagedFiles[i].Content, ejectedFiles[i].Content);
+        // The worked example has one requirement the default filter drops, so each says so, in the same words.
+        Assert.Single(packagedWarnings);
+        Assert.Equal(packagedWarnings, ejectedWarnings);
+    }
+
+    /// <summary>A project's own filter: keeps everything, the L1 to L3 requirements too.</summary>
+    public sealed class ProjectKeepEverythingFilter : IRequirementTestFilter
+    {
+        public bool Include(RequirementView view) => true;
+    }
+
+    /// <summary>A project's own renderer: replaces one test, and keeps the default for the rest.</summary>
+    public sealed class ProjectRenderer : IRequirementTestRenderer
+    {
+        public RenderedTest? Render(RequirementTestArgs args) =>
+            args.Identity.Path == "Orders.Recorded"
+                ? new RenderedTest(
+                    ["System.Linq"],
+                    $"[Fact]\npublic void {args.Identity.WitnessKey}()\n{{\n    Assert.True(new[] {{ 1 }}.Any(), \"{args.Identity.Digest}\");\n}}")
+                : null;
+    }
+
+    /// <summary>
+    /// An OWNED copy works with a project's own hooks. The hook types stay in the package, so a project class
+    /// implementing <see cref="IRequirementTestFilter"/> or <see cref="IRequirementTestRenderer"/> is accepted by the
+    /// copy, and the copy emits the same bytes as the packaged generator given the same hooks. (A port that
+    /// defined the hook types inside the ejected file would fail here: the project's class would implement the
+    /// package's interface and the copy would want its own.)
+    /// </summary>
+    [Fact]
+    public void Ejected_requirement_tests_accepts_a_project_filter_and_renderer_and_matches_the_packaged_generator()
+    {
+        var input = Path.Combine(CorpusPaths.RepoRoot(), "fixtures", "requirement-test-identity-conformance", "worked-example", "input");
+        var load = MetaDataLoader.FromDirectory(input, strict: true);
+        Assert.Empty(load.Errors.Select(e => e.Code + ": " + e.Message));
+
+        var ejected = CompileAndInstantiate("requirement-tests", "RequirementTestsGenerator", []);
+        var ejectedType = ejected.GetType();
+        ejectedType.GetProperty("Filter")!.SetValue(ejected, new ProjectKeepEverythingFilter());
+        ejectedType.GetProperty("Renderer")!.SetValue(ejected, new ProjectRenderer());
+        ejectedType.GetProperty("WarnUncovered")!.SetValue(ejected, false);
+        var packaged = new RequirementTestsGenerator
+        {
+            Filter = new ProjectKeepEverythingFilter(),
+            Renderer = new ProjectRenderer(),
+            WarnUncovered = false,
+        };
+
+        List<EmittedFile> Run(IGenerator generator) =>
+            generator.Generate(new GenContext
+            {
+                Entities = load.Root.Objects(),
+                Root = load.Root,
+                Config = new GenConfig { OutDir = "/tmp", Namespace = "Acme.Generated" },
+            }).OrderBy(f => f.Path, StringComparer.Ordinal).ToList();
+
+        var ejectedFiles = Run(ejected);
+        var packagedFiles = Run(packaged);
+        var tests = packagedFiles.Single(f => f.Path.EndsWith("_Tests.g.cs", StringComparison.Ordinal)).Content;
+        // Both hooks took effect: the filter kept the L3 requirement the default drops, the renderer replaced one test.
+        Assert.Contains("// acme::shop::Orders [*]", tests);
+        Assert.Contains("using System.Linq;", tests);
+        Assert.Contains("Assert.True(new[] { 1 }.Any(), \"2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a\");", tests);
+        Assert.Equal(packagedFiles.Select(f => f.Path), ejectedFiles.Select(f => f.Path));
+        for (var i = 0; i < packagedFiles.Count; i++)
+            Assert.Equal(packagedFiles[i].Content, ejectedFiles[i].Content);
+    }
 }
diff --git a/server/csharp/MetaObjects.Codegen.Tests/GeneratorRegistryTests.cs b/server/csharp/MetaObjects.Codegen.Tests/GeneratorRegistryTests.cs
index 3df637bd4..19eabc758 100644
--- a/server/csharp/MetaObjects.Codegen.Tests/GeneratorRegistryTests.cs
+++ b/server/csharp/MetaObjects.Codegen.Tests/GeneratorRegistryTests.cs
@@ -22,6 +22,8 @@ public sealed class GeneratorRegistryTests
         "callable",
         // Program A / §A5 — per-object physical database name constants.
         "names",
+        // ADR-0057 — per-requirement xUnit tests calling a project-owned witness.
+        "requirement-tests",
     ];
 
     [Fact]
diff --git a/server/csharp/MetaObjects.Codegen.Tests/RequirementTestsGeneratorTests.cs b/server/csharp/MetaObjects.Codegen.Tests/RequirementTestsGeneratorTests.cs
new file mode 100644
index 000000000..5cfdd57d1
--- /dev/null
+++ b/server/csharp/MetaObjects.Codegen.Tests/RequirementTestsGeneratorTests.cs
@@ -0,0 +1,854 @@
+using System.Reflection;
+using System.Text;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using MetaObjects.Codegen;
+using MetaObjects.Codegen.Generators;
+using MetaObjects.Core.Requirement;
+using MetaObjects.Loader;
+using MetaObjects.Meta;
+using Xunit;
+
+namespace MetaObjects.Codegen.Tests;
+
+/// <summary>
+/// <see cref="RequirementTestsGenerator"/>: the files it writes for the identity corpus's
+/// <c>worked-example</c>, that the output COMPILES and behaves (a live test with no witness fails, with
+/// one it passes), that author prose cannot break it, and every refusal and seam of Table I. The tests
+/// this generator WRITES are xUnit, like the tests in this file.
+/// </summary>
+public sealed class RequirementTestsGeneratorTests : IDisposable
+{
+    private const string TestNamespace = "Acme.Req";
+    private const string WitnessClass = "Acme.Witnesses";
+
+    private readonly List<string> _temp = [];
+
+    public void Dispose()
+    {
+        foreach (var dir in _temp)
+        {
+            try { Directory.Delete(dir, recursive: true); } catch (IOException) { } catch (UnauthorizedAccessException) { }
+        }
+    }
+
+    // ---------------------------------------------------------------- fixtures
+
+    private string NewDir()
+    {
+        var dir = Directory.CreateTempSubdirectory("mo-req-tests-gen-").FullName;
+        _temp.Add(dir);
+        return dir;
+    }
+
+    private static string WorkedExampleInput() =>
+        Path.Combine(CorpusPaths.RepoRoot(), "fixtures", "requirement-test-identity-conformance", "worked-example", "input");
+
+    private static MetaRoot LoadDir(string dir)
+    {
+        var load = MetaDataLoader.FromDirectory(dir, strict: true);
+        Assert.Empty(load.Errors.Select(e => e.Code + ": " + e.Message));
+        return load.Root;
+    }
+
+    private MetaRoot LoadYaml(string yaml)
+    {
+        var dir = NewDir();
+        File.WriteAllText(Path.Combine(dir, "meta.shop.yaml"), yaml, new UTF8Encoding(false));
+        return LoadDir(dir);
+    }
+
+    private static string Requirement(string name, int level, string status, string statement, string counterexample, string? implementedBy) =>
+        $"    - requirement.functional:\n        name: {name}\n        level: {level}\n        status: {status}\n" +
+        $"        statement: {statement}\n        counterexample: {counterexample}\n" +
+        (implementedBy is null ? "" : $"        implementedBy: [{implementedBy}]\n");
+
+    private const string OrderEntity =
+        "    - object.entity:\n        name: Order\n        children:\n" +
+        "          - field.uuid: { name: id }\n          - field.string: { name: total }\n" +
+        "          - identity.primary: { name: pk, fields: [id] }\n";
+
+    private static string Shop(params string[] requirements) =>
+        "metadata:\n  package: acme::shop\n  children:\n" + OrderEntity + string.Concat(requirements);
+
+    /// <summary>
+    /// A generator with the uncovered warning OFF: the worked example has an L3 requirement the default
+    /// filter drops, so most tests would otherwise warn, and test output must be pristine. Only the tests
+    /// about the warning switch it on.
+    /// </summary>
+    private static RequirementTestsGenerator Generator(
+        RequirementTestGrain grain = RequirementTestGrain.Concern,
+        IRequirementTestFilter? filter = null,
+        IRequirementTestRenderer? renderer = null,
+        bool warnUncovered = false,
+        string? testNamespace = TestNamespace,
+        string? witnessClass = WitnessClass) =>
+        new()
+        {
+            TestNamespace = testNamespace,
+            WitnessClass = witnessClass,
+            Grain = grain,
+            Filter = filter,
+            Renderer = renderer,
+            WarnUncovered = warnUncovered,
+        };
+
+    private static GenContext Context(MetaRoot root, List<string>? warnings = null, string runNamespace = "Acme.Generated") => new()
+    {
+        Entities = root.Objects(),
+        Root = root,
+        Config = new GenConfig { OutDir = Path.Combine(Path.GetTempPath(), "unused-requirement-tests"), Namespace = runNamespace },
+        Warn = (warnings ?? []).Add,
+    };
+
+    private static Dictionary<string, string> Run(MetaRoot root, RequirementTestsGenerator? generator = null, List<string>? warnings = null) =>
+        (generator ?? Generator()).Generate(Context(root, warnings)).ToDictionary(f => f.Path, f => f.Content);
+
+    private const string Interface = "Requirements_acme_shop_Witnesses.g.cs";
+    private const string Tests = "Requirements_acme_shop_Tests.g.cs";
+
+    // ---------------------------------------------------------------- compile and run
+
+    private const string WitnessNone =
+        "namespace Acme { public class Witnesses : Acme.Req.Requirements_acme_shop_Witnesses { } }";
+
+    // The form the generated header recommends: an EXPLICIT interface implementation, so a member the
+    // interface loses (its requirement retired or deleted) stops compiling.
+    private const string WitnessRecorded =
+        "namespace Acme { public class Witnesses : Acme.Req.Requirements_acme_shop_Witnesses {\n" +
+        "  void Acme.Req.Requirements_acme_shop_Witnesses.req_acme_shop_Orders_Recorded__object_entity() { }\n} }";
+
+    private static List<MetadataReference> References()
+    {
+        var refs = DbContextCompileTests.BuildReferences();
+        foreach (var type in new[] { typeof(FactAttribute), typeof(Xunit.Sdk.XunitException) })
+        {
+            var location = type.Assembly.Location;
+            if (!refs.Any(r => r is PortableExecutableReference p && p.FilePath == location))
+                refs.Add(MetadataReference.CreateFromFile(location));
+        }
+        return refs;
+    }
+
+    /// <summary>
+    /// Compile the generated tree beside a hand-written witness class with the real compiler, nullable
+    /// enabled. Returns the assembly (null when it did not build), the errors and the warnings.
+    /// </summary>
+    private static (Assembly? Assembly, List<Diagnostic> Errors, List<Diagnostic> Warnings) TryCompile(
+        Dictionary<string, string> generated, string witnessSource)
+    {
+        var parse = new CSharpParseOptions(LanguageVersion.CSharp12);
+        var trees = generated.OrderBy(kv => kv.Key, StringComparer.Ordinal)
+            .Select(kv => CSharpSyntaxTree.ParseText(kv.Value, parse, path: kv.Key))
+            .Append(CSharpSyntaxTree.ParseText(witnessSource, parse, path: "Witnesses.cs"))
+            .ToList();
+        var compilation = CSharpCompilation.Create(
+            "requirement_tests_" + Guid.NewGuid().ToString("N"), trees, References(),
+            new CSharpCompilationOptions(OutputKind.DynamicallyLinkedLibrary, nullableContextOptions: NullableContextOptions.Enable));
+        using var ms = new MemoryStream();
+        var emit = compilation.Emit(ms);
+        var errors = emit.Diagnostics.Where(d => d.Severity == DiagnosticSeverity.Error).ToList();
+        var warnings = emit.Diagnostics.Where(d => d.Severity == DiagnosticSeverity.Warning).ToList();
+        return (emit.Success ? Assembly.Load(ms.ToArray()) : null, errors, warnings);
+    }
+
+    /// <summary>Compile and demand NO error and NO warning: a generated test that warns warns in every adopter's build.</summary>
+    private static Assembly Compile(Dictionary<string, string> generated, string witnessSource)
+    {
+        var (assembly, errors, warnings) = TryCompile(generated, witnessSource);
+        var problems = errors.Concat(warnings).Select(d => d.ToString()).ToList();
+        Assert.True(assembly is not null && problems.Count == 0, "generated requirement tests failed to compile cleanly:\n" + string.Join("\n", problems));
+        return assembly!;
+    }
+
+    /// <summary>Invoke one generated test method; returns the exception it threw, or null.</summary>
+    private static Exception? Invoke(Assembly assembly, string className, string method, string testNamespace = TestNamespace)
+    {
+        var type = assembly.GetType($"{testNamespace}.{className}") ?? throw new InvalidOperationException($"no type {className}");
+        var instance = Activator.CreateInstance(type)!;
+        try
+        {
+            type.GetMethod(method)!.Invoke(instance, null);
+            return null;
+        }
+        catch (TargetInvocationException e)
+        {
+            return e.InnerException;
+        }
+    }
+
+    // ---------------------------------------------------------------- the worked example
+
+    [Fact]
+    public void The_worked_example_emits_the_witness_interface_and_the_test_class()
+    {
+        var files = Run(LoadDir(WorkedExampleInput()));
+        Assert.Equal([Tests, Interface], files.Keys.Order(StringComparer.Ordinal));
+        Assert.Contains($"namespace {TestNamespace};", files[Interface]);
+        Assert.Contains($"namespace {TestNamespace};", files[Tests]);
+        Assert.Contains("public interface Requirements_acme_shop_Witnesses", files[Interface]);
+        Assert.Contains("public class Requirements_acme_shop_Tests", files[Tests]);
+    }
+
+    [Fact]
+    public void Both_files_say_they_are_generated_and_name_the_witness_class_in_their_header()
+    {
+        var files = Run(LoadDir(WorkedExampleInput()));
+        Assert.StartsWith("// <auto-generated/>\n// GENERATED by metaobjects (requirement-tests). DO NOT EDIT: this file is rewritten whole.\n", files[Interface]);
+        Assert.StartsWith("// <auto-generated/>\n// GENERATED by metaobjects (requirement-tests). DO NOT EDIT: this file is rewritten whole.\n", files[Tests]);
+        Assert.Contains("// The witnesses are project-owned, in Acme.Witnesses.\n", files[Tests]);
+    }
+
+    [Fact]
+    public void The_header_steers_the_project_to_explicit_implementation_with_a_real_member_and_says_why()
+    {
+        var files = Run(LoadDir(WorkedExampleInput()));
+        Assert.Contains(
+            "// Witnesses are project-owned: implement this interface in Acme.Witnesses, one EXPLICIT member per witness, e.g.\n" +
+            "//     void Acme.Req.Requirements_acme_shop_Witnesses.req_acme_shop_Orders_Recorded__object_entity() { ... }\n" +
+            "// Explicit, so that a member whose requirement is retired or deleted stops compiling instead of going stale silently.\n",
+            files[Interface]);
+        Assert.DoesNotContain("override", files[Interface], StringComparison.Ordinal);
+        // The test file points at the same rule.
+        Assert.Contains("explicit", files[Tests], StringComparison.OrdinalIgnoreCase);
+
+        // With no member to show (every test skipped) the pattern stands in for a real name.
+        var allSkipped = Run(LoadYaml(Shop(Requirement("Gone", 4, "retired", "Old.", "Old returns.", null))))[Interface];
+        Assert.Contains("//     void Acme.Req.Requirements_acme_shop_Witnesses.req_<address>__<unit>() { ... }\n", allSkipped);
+    }
+
+    [Fact]
+    public void The_headers_example_line_compiles_as_written_in_a_witness_class_outside_the_test_namespace()
+    {
+        // The witness class is in another namespace than the interface by default, so the line a
+        // person copies out of the header must name the interface in a way that resolves from there.
+        var files = Run(LoadDir(WorkedExampleInput()));
+        var example = files[Interface].Split('\n').Single(l => l.StartsWith("//     void ", StringComparison.Ordinal));
+        var member = example["//".Length..].Replace("{ ... }", "{ }");
+
+        Compile(files, Witness(member));
+    }
+
+    [Fact]
+    public void Tests_are_emitted_sorted_by_id_in_code_units_whatever_order_they_are_declared_in()
+    {
+        // Declared alpha, Zeta, Beta: in neither id order. Ordinal order puts the upper case first
+        // (Beta, Zeta, alpha); a culture collation would give alpha, Beta, Zeta.
+        var root = LoadYaml(Shop(
+            Requirement("alpha", 4, "live", "A.", "A!", "Order"),
+            Requirement("Zeta", 4, "live", "Z.", "Z!", "Order"),
+            Requirement("Beta", 4, "live", "B.", "B!", "Order")));
+        var files = Run(root);
+        foreach (var file in new[] { Interface, Tests })
+        {
+            var source = files[file];
+            var beta = source.IndexOf("// acme::shop::Beta [object.entity]", StringComparison.Ordinal);
+            var zeta = source.IndexOf("// acme::shop::Zeta [object.entity]", StringComparison.Ordinal);
+            var alpha = source.IndexOf("// acme::shop::alpha [object.entity]", StringComparison.Ordinal);
+            Assert.True(beta >= 0 && zeta >= 0 && alpha >= 0, file + ": all three present");
+            Assert.True(beta < zeta && zeta < alpha, file + ": Beta, Zeta, alpha in that order");
+        }
+    }
+
+    [Fact]
+    public void The_interface_has_a_member_for_the_live_test_and_none_for_the_skipped_one()
+    {
+        var iface = Run(LoadDir(WorkedExampleInput()))[Interface];
+        Assert.Contains("void req_acme_shop_Orders_Recorded__object_entity()", iface);
+        Assert.DoesNotContain("req_acme_shop_Orders_Refunded", iface);
+    }
+
+    [Fact]
+    public void The_skipped_test_carries_the_reason_of_table_H_and_an_empty_body()
+    {
+        var tests = Run(LoadDir(WorkedExampleInput()))[Tests];
+        Assert.Contains("    [Fact(Skip = \"planned - not built yet\")]\n    public void req_acme_shop_Orders_Refunded()\n    {\n    }\n", tests);
+        Assert.Contains("    private readonly Requirements_acme_shop_Witnesses witnesses = new global::Acme.Witnesses();", tests);
+        Assert.Contains("        witnesses.req_acme_shop_Orders_Recorded__object_entity();", tests);
+        // The comments above a test: id, statement, counterexample, status, claims, digest.
+        Assert.Contains(
+            "    // acme::shop::Orders.Recorded [object.entity]\n" +
+            "    // An order is recorded when it is placed.\n" +
+            "    // Counterexample: A placed order has no row.\n" +
+            "    // Status: live\n" +
+            "    // Claims: Order  (object.entity)\n" +
+            "    // Digest: 2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a\n", tests);
+        Assert.Contains("// Claims: (none)", tests);
+    }
+
+    [Fact]
+    public void A_retired_test_says_the_capability_must_stay_removed_and_the_package_interface_is_empty()
+    {
+        var root = LoadYaml(Shop(Requirement("Gone", 4, "retired", "Old thing.", "Old thing returns.", null)));
+        var files = Run(root);
+        Assert.Contains("[Fact(Skip = \"retired - the capability was deliberately removed; assert it stays removed\")]", files[Tests]);
+        // Every test of the package is skipped: no witness member at all.
+        Assert.DoesNotContain("req_acme_shop_Gone", files[Interface]);
+    }
+
+    [Fact]
+    public void The_output_imports_only_Xunit_and_names_nothing_of_MetaObjects()
+    {
+        var files = Run(LoadDir(WorkedExampleInput()));
+        foreach (var (path, source) in files)
+        {
+            foreach (var line in source.Split('\n').Where(l => l.StartsWith("using ", StringComparison.Ordinal)))
+                Assert.Equal("using Xunit;", line);
+            Assert.DoesNotContain("MetaObjects", source, StringComparison.Ordinal);
+            Assert.DoesNotContain("RequirementTestsGenerator", source, StringComparison.Ordinal);
+            Assert.DoesNotContain("Codegen", source, StringComparison.Ordinal);
+            // The witness interface needs no import: it names XunitException in full.
+            if (path == Interface) Assert.DoesNotContain("using ", source, StringComparison.Ordinal);
+        }
+        Assert.Contains("using Xunit;", files[Tests]);
+    }
+
+    [Fact]
+    public void Output_is_byte_identical_on_a_rerun()
+    {
+        var root = LoadDir(WorkedExampleInput());
+        Assert.Equal(Run(root), Run(root));
+    }
+
+    [Fact]
+    public void A_live_test_with_no_witness_fails_naming_the_counterexample()
+    {
+        var assembly = Compile(Run(LoadDir(WorkedExampleInput())), WitnessNone);
+        var failure = Invoke(assembly, "Requirements_acme_shop_Tests", "req_acme_shop_Orders_Recorded__object_entity");
+        Assert.IsAssignableFrom<Xunit.Sdk.XunitException>(failure);
+        Assert.Equal(
+            "unimplemented requirement: acme::shop::Orders.Recorded [object.entity] - write Acme.Witnesses." +
+            "req_acme_shop_Orders_Recorded__object_entity() so that it fails when: A placed order has no row.",
+            failure!.Message);
+    }
+
+    [Fact]
+    public void A_live_test_passes_when_the_witness_class_implements_it_and_a_skipped_test_is_skipped()
+    {
+        var assembly = Compile(Run(LoadDir(WorkedExampleInput())), WitnessRecorded);
+        Assert.Null(Invoke(assembly, "Requirements_acme_shop_Tests", "req_acme_shop_Orders_Recorded__object_entity"));
+
+        // The skipped test is a real [Fact(Skip = ...)] that xUnit will report as skipped, and runs empty.
+        var skipped = assembly.GetType($"{TestNamespace}.Requirements_acme_shop_Tests")!.GetMethod("req_acme_shop_Orders_Refunded")!;
+        var fact = skipped.GetCustomAttribute<FactAttribute>()!;
+        Assert.Equal("planned - not built yet", fact.Skip);
+        Assert.Null(Invoke(assembly, "Requirements_acme_shop_Tests", "req_acme_shop_Orders_Refunded"));
+        var live = assembly.GetType($"{TestNamespace}.Requirements_acme_shop_Tests")!.GetMethod("req_acme_shop_Orders_Recorded__object_entity")!;
+        Assert.Null(live.GetCustomAttribute<FactAttribute>()!.Skip);
+    }
+
+    // ---------------------------------------------------------------- the orphan-witness signal
+
+    private const string LiveRecorded = "req_acme_shop_Recorded__object_entity";
+
+    private static string Witness(string members, string testNamespace = TestNamespace, string witnessNamespace = "Acme", string witnessName = "Witnesses") =>
+        $"namespace {witnessNamespace} {{ public class {witnessName} : global::{testNamespace}.Requirements_acme_shop_Witnesses {{\n{members}\n}} }}";
+
+    private const string ExplicitRecorded =
+        "  void Acme.Req.Requirements_acme_shop_Witnesses.req_acme_shop_Recorded__object_entity() { throw new System.InvalidOperationException(\"witnessed\"); }";
+
+    private Dictionary<string, string> RecordedLive() =>
+        Run(LoadYaml(Shop(Requirement("Recorded", 4, "live", "S.", "C.", "Order"))));
+
+    [Fact]
+    public void A_live_explicit_witness_compiles_and_the_test_reaches_it_through_the_interface()
+    {
+        var assembly = Compile(RecordedLive(), Witness(ExplicitRecorded));
+        var failure = Invoke(assembly, "Requirements_acme_shop_Tests", LiveRecorded);
+        Assert.IsType<InvalidOperationException>(failure);
+        Assert.Equal("witnessed", failure!.Message);
+    }
+
+    [Fact]
+    public void A_stale_explicit_witness_for_a_retired_requirement_stops_compiling_with_CS0539()
+    {
+        // The requirement is retired: its test is skipped and the interface loses the member.
+        var retired = Run(LoadYaml(Shop(Requirement("Recorded", 4, "retired", "S.", "C.", null))));
+        Assert.DoesNotContain(LiveRecorded, retired[Interface]);
+        var (assembly, errors, _) = TryCompile(retired, Witness(ExplicitRecorded));
+        Assert.Null(assembly);
+        var error = Assert.Single(errors, e => e.Id == "CS0539");
+        Assert.Contains("req_acme_shop_Recorded__object_entity", error.GetMessage());
+    }
+
+    [Fact]
+    public void A_stale_explicit_witness_for_a_deleted_requirement_stops_compiling_with_CS0539()
+    {
+        var deleted = Run(LoadYaml(Shop(Requirement("Other", 4, "live", "S.", "C.", "Order"))));
+        Assert.DoesNotContain(LiveRecorded, deleted[Interface]);
+        var (assembly, errors, _) = TryCompile(deleted, Witness(ExplicitRecorded));
+        Assert.Null(assembly);
+        Assert.Contains(errors, e => e.Id == "CS0539");
+    }
+
+    /// <summary>
+    /// THE KNOWN LIMIT of the witness model, pinned so the docs can state it: a witness that implements a
+    /// member IMPLICITLY (<c>public void req_...()</c>) is an ordinary method once the interface drops the
+    /// member, so it keeps compiling and goes stale silently. Only the explicit form, which the generated
+    /// header recommends, gives the signal.
+    /// </summary>
+    [Fact]
+    public void Known_limit_a_stale_IMPLICIT_witness_keeps_compiling_so_only_the_explicit_form_gives_the_signal()
+    {
+        var retired = Run(LoadYaml(Shop(Requirement("Recorded", 4, "retired", "S.", "C.", null))));
+        var (assembly, errors, _) = TryCompile(retired, Witness("  public void req_acme_shop_Recorded__object_entity() { }"));
+        Assert.Empty(errors);
+        Assert.NotNull(assembly);
+    }
+
+    /// <summary>
+    /// A method that LOOKS like the witness but does not implement the interface member (no access modifier,
+    /// a static, another return type, a parameter) is not an implementation: it compiles, nothing warns, and the
+    /// default member runs, so the test fails with the unimplemented message. That red test is the signal.
+    /// </summary>
+    [Theory]
+    [InlineData("  void req_acme_shop_Recorded__object_entity() { }")]
+    [InlineData("  private void req_acme_shop_Recorded__object_entity() { }")]
+    [InlineData("  public static void req_acme_shop_Recorded__object_entity() { }")]
+    [InlineData("  public int req_acme_shop_Recorded__object_entity() => 1;")]
+    [InlineData("  public void req_acme_shop_Recorded__object_entity(int unused) { }")]
+    public void A_method_that_does_not_implement_the_member_is_not_mistaken_for_a_witness(string lookAlike)
+    {
+        var assembly = Compile(RecordedLive(), Witness(lookAlike));
+        var failure = Invoke(assembly, "Requirements_acme_shop_Tests", LiveRecorded);
+        Assert.IsAssignableFrom<Xunit.Sdk.XunitException>(failure);
+        Assert.Equal(
+            "unimplemented requirement: acme::shop::Recorded [object.entity] - write Acme.Witnesses." + LiveRecorded +
+            "() so that it fails when: C.",
+            failure!.Message);
+    }
+
+    // ---------------------------------------------------------------- names in generated source
+
+    [Fact]
+    public void Names_are_emitted_with_global_so_a_namespace_segment_named_Xunit_or_like_the_witness_cannot_capture_them()
+    {
+        // Inside Acme.Xunit.Acme.Req an unqualified `Xunit` binds to Acme.Xunit and `Acme` to Acme.Xunit.Acme.
+        const string ns = "Acme.Xunit.Acme.Req";
+        var files = Run(LoadYaml(Shop(Requirement("Recorded", 4, "live", "S.", "C.", "Order"))), Generator(testNamespace: ns));
+        Assert.Contains("throw new global::Xunit.Sdk.XunitException(", files[Interface]);
+        Assert.Contains("new global::Acme.Witnesses();", files[Tests]);
+        var assembly = Compile(files, Witness("", ns));
+        var failure = Invoke(assembly, "Requirements_acme_shop_Tests", LiveRecorded, ns);
+        Assert.IsAssignableFrom<Xunit.Sdk.XunitException>(failure);
+        Assert.StartsWith("unimplemented requirement:", failure!.Message);
+    }
+
+    [Fact]
+    public void A_keyword_segment_is_escaped_with_an_at_sign_where_the_name_is_emitted_and_the_output_compiles()
+    {
+        var root = LoadYaml(Shop(Requirement("Recorded", 4, "live", "S.", "C.", "Order")));
+        var files = Run(root, Generator(testNamespace: "Acme.event.Req", witnessClass: "Acme.event.Witnesses"));
+        Assert.Contains("namespace Acme.@event.Req;", files[Tests]);
+        Assert.Contains("new global::Acme.@event.Witnesses();", files[Tests]);
+        var assembly = Compile(files, Witness("", "Acme.@event.Req", "Acme.@event"));
+        var failure = Invoke(assembly, "Requirements_acme_shop_Tests", LiveRecorded, "Acme.event.Req");
+        Assert.IsAssignableFrom<Xunit.Sdk.XunitException>(failure);
+        // The words of the message and the header say the name as it was written, not its escaped spelling.
+        Assert.Contains("write Acme.event.Witnesses." + LiveRecorded, failure!.Message);
+
+        // A verbatim identifier in the option means the same thing and is not escaped twice.
+        Assert.Equal(files, Run(root, Generator(testNamespace: "Acme.@event.Req", witnessClass: "Acme.@event.Witnesses")));
+    }
+
+    [Fact]
+    public void A_global_prefix_on_the_test_namespace_is_refused_and_on_the_witness_class_is_not_doubled()
+    {
+        var root = LoadDir(WorkedExampleInput());
+        var refused = Assert.Throws<InvalidOperationException>(() => Generator(testNamespace: "global::Acme.Req").Generate(Context(root)).ToList());
+        Assert.Contains("TestNamespace", refused.Message);
+        Assert.Contains("global::", refused.Message);
+        var files = Run(root, Generator(witnessClass: "global::Acme.Witnesses"));
+        Assert.Contains("new global::Acme.Witnesses();", files[Tests]);
+        Assert.DoesNotContain("global::global::", files[Tests]);
+        Assert.Contains("implement this interface in Acme.Witnesses,", files[Interface]);
+    }
+
+    [Theory]
+    [InlineData("Acme.1x")]
+    [InlineData("Acme..Req")]
+    [InlineData("Acme.")]
+    [InlineData(".Acme")]
+    [InlineData("")]
+    [InlineData("Acme Req")]
+    [InlineData("Acme; using Evil")]
+    [InlineData("Acme.Req-1")]
+    public void A_name_that_is_not_a_dotted_C_sharp_name_is_refused_for_both_options(string bad)
+    {
+        var root = LoadDir(WorkedExampleInput());
+        Assert.Throws<InvalidOperationException>(() => Generator(testNamespace: bad).Generate(Context(root)).ToList());
+        Assert.Throws<InvalidOperationException>(() => Generator(witnessClass: bad).Generate(Context(root)).ToList());
+    }
+
+    [Fact]
+    public void Legal_non_ASCII_identifiers_are_accepted_and_the_output_compiles()
+    {
+        var root = LoadYaml(Shop(Requirement("Recorded", 4, "live", "S.", "C.", "Order")));
+        const string ns = "Café.Req";
+        var files = Run(root, Generator(testNamespace: ns, witnessClass: "Café.Témoin"));
+        var assembly = Compile(files, Witness("", ns, "Café", "Témoin"));
+        var failure = Invoke(assembly, "Requirements_acme_shop_Tests", LiveRecorded, ns);
+        Assert.StartsWith("unimplemented requirement:", failure!.Message);
+    }
+
+    [Fact]
+    public void A_default_derived_from_a_non_ASCII_run_namespace_is_accepted()
+    {
+        var root = LoadDir(WorkedExampleInput());
+        var files = new RequirementTestsGenerator().Generate(Context(root, runNamespace: "Café.Généré")).ToDictionary(f => f.Path, f => f.Content);
+        Assert.Contains("namespace Café.Généré.Requirements;", files[Tests]);
+        Assert.Contains("new global::Café.Généré.RequirementWitnesses();", files[Tests]);
+    }
+
+    // ---------------------------------------------------------------- the root package
+
+    [Fact]
+    public void A_requirement_in_no_package_is_written_under_the_root_key_with_a_bare_address()
+    {
+        const string yaml =
+            "metadata:\n  children:\n" + OrderEntity +
+            "    - requirement.functional:\n        name: Recorded\n        level: 4\n        status: live\n" +
+            "        statement: S.\n        counterexample: C.\n        implementedBy: [Order]\n";
+        var files = Run(LoadYaml(yaml));
+        Assert.Equal(["Requirements_root_Tests.g.cs", "Requirements_root_Witnesses.g.cs"], files.Keys.Order(StringComparer.Ordinal));
+        Assert.Contains("// Recorded [object.entity]\n", files["Requirements_root_Tests.g.cs"]);
+        Assert.Contains("void req_Recorded__object_entity()", files["Requirements_root_Witnesses.g.cs"]);
+        var assembly = Compile(files,
+            "namespace Acme { public class Witnesses : global::Acme.Req.Requirements_root_Witnesses { } }");
+        var failure = Invoke(assembly, "Requirements_root_Tests", "req_Recorded__object_entity");
+        Assert.StartsWith("unimplemented requirement: Recorded [object.entity] - write Acme.Witnesses.req_Recorded__object_entity()", failure!.Message);
+    }
+
+    // ---------------------------------------------------------------- a reference authored twice
+
+    private sealed class ObservingRenderer : IRequirementTestRenderer
+    {
+        public List<RequirementTestArgs> Seen { get; } = [];
+
+        public RenderedTest? Render(RequirementTestArgs args)
+        {
+            Seen.Add(args);
+            return null;
+        }
+    }
+
+    [Fact]
+    public void Member_grain_lists_a_reference_authored_twice_once_in_the_claims_comment_and_in_the_renderer_targets()
+    {
+        // The corpus's member-grain-duplicate-ref input: Order, "acme::shop::Order", Order.
+        var input = Path.Combine(CorpusPaths.RepoRoot(), "fixtures", "requirement-test-identity-conformance", "member-grain-duplicate-ref", "input");
+        var renderer = new ObservingRenderer();
+        var tests = Run(LoadDir(input), Generator(grain: RequirementTestGrain.Member, renderer: renderer))[Tests];
+
+        Assert.Equal(1, CountOf(tests, "// Claims: Order  (object.entity)\n"));
+        Assert.Equal(1, CountOf(tests, "// Claims: acme::shop::Order  (object.entity)\n"));
+        Assert.DoesNotContain("(object.entity), ", tests);
+        Assert.Equal(2, renderer.Seen.Count);
+        Assert.All(renderer.Seen, args => Assert.Single(args.Targets));
+        Assert.Equal(["Order", "acme::shop::Order"], renderer.Seen.Select(a => a.Targets[0].Ref).Order(StringComparer.Ordinal));
+    }
+
+    private static int CountOf(string haystack, string needle)
+    {
+        var count = 0;
+        for (var i = haystack.IndexOf(needle, StringComparison.Ordinal); i >= 0; i = haystack.IndexOf(needle, i + needle.Length, StringComparison.Ordinal)) count++;
+        return count;
+    }
+
+    // ---------------------------------------------------------------- escaping
+
+    [Fact]
+    public void Prose_with_quotes_backslashes_newlines_and_comment_terminators_still_compiles_and_is_carried()
+    {
+        // YAML double-quoted scalars: the statement decodes to  say "hi" to C:\dir<LF>second line */ end \u000a not an escape<CR>lone cr
+        // and the counterexample to  it breaks "here" at C:\tmp<LF>then */ and \u000a
+        const string statement = """ "say \"hi\" to C:\\dir\nsecond line */ end \\u000a not an escape\rlone cr" """;
+        const string counterexample = """ "it breaks \"here\" at C:\\tmp\nthen */ and \\u000a" """;
+        var root = LoadYaml(Shop(Requirement("Recorded", 4, "live", statement.Trim(), counterexample.Trim(), "Order")));
+        var files = Run(root);
+        var assembly = Compile(files, WitnessNone);
+
+        var failure = Invoke(assembly, "Requirements_acme_shop_Tests", "req_acme_shop_Recorded__object_entity");
+        Assert.IsAssignableFrom<Xunit.Sdk.XunitException>(failure);
+        Assert.EndsWith("so that it fails when: it breaks \"here\" at C:\\tmp\nthen */ and \\u000a", failure!.Message);
+
+        var tests = files[Tests];
+        Assert.Contains("    // say \"hi\" to C:\\dir\n", tests);
+        Assert.Contains("    // second line * / end \\u000a not an escape\n", tests);
+        Assert.Contains("    // lone cr\n", tests);
+        Assert.Contains("    // Counterexample: it breaks \"here\" at C:\\tmp\n    // then * / and \\u000a\n", tests);
+    }
+
+    [Fact]
+    public void Carriage_returns_in_a_counterexample_are_escaped_in_the_literal_and_split_in_the_comment()
+    {
+        // YAML escapes: CR LF, then a lone CR. A raw CR in a string literal would end the line.
+        var root = LoadYaml(Shop(Requirement("Recorded", 4, "live", "S.", "\"first\\r\\nsecond\\rthird\"", "Order")));
+        var files = Run(root);
+        Assert.All(files.Values, source => Assert.DoesNotContain('\r', source));
+        Assert.Contains("so that it fails when: first\\r\\nsecond\\rthird\");", files[Interface]);
+        Assert.Contains("    // Counterexample: first\n    // second\n    // third\n", files[Tests]);
+
+        var assembly = Compile(files, WitnessNone);
+        var failure = Invoke(assembly, "Requirements_acme_shop_Tests", "req_acme_shop_Recorded__object_entity");
+        Assert.NotNull(failure);
+        Assert.EndsWith("so that it fails when: first\r\nsecond\rthird", failure!.Message);
+    }
+
+    [Fact]
+    public void The_other_line_terminators_of_the_language_cannot_end_a_literal_or_a_comment_early()
+    {
+        // U+0085, U+2028 and U+2029 end a C# line as a line feed does.
+        var root = LoadYaml(Shop(Requirement("Recorded", 4, "live", "S.", "\"a\\u2028b\\u0085c\\u2029d\"", "Order")));
+        var files = Run(root);
+        var assembly = Compile(files, WitnessNone);
+        Assert.All(files.Values, source => Assert.DoesNotContain("\u2028", source));
+        Assert.Contains("    // Counterexample: a\n    // b\n    // c\n    // d\n", files[Tests]);
+        var failure = Invoke(assembly, "Requirements_acme_shop_Tests", "req_acme_shop_Recorded__object_entity");
+        Assert.EndsWith("so that it fails when: a\u2028b\u0085c\u2029d", failure!.Message);
+    }
+
+    // ---------------------------------------------------------------- refusals
+
+    [Fact]
+    public void Two_requirements_with_one_witness_key_are_refused_naming_the_code_and_both_ids()
+    {
+        // A name cannot hold a dot, so Orders.Recorded is a requirement nested under Orders.
+        var root = LoadYaml(Shop(
+            Requirement("Orders", 3, "live", "P.", "Q.", null)
+                + "        children:\n          - requirement.functional:\n"
+                + "              name: Recorded\n              level: 4\n              status: live\n"
+                + "              statement: A.\n              counterexample: B.\n              implementedBy: [Order]\n",
+            Requirement("Orders_Recorded", 4, "live", "C.", "D.", "Order")));
+        var refused = Assert.Throws<InvalidOperationException>(() => Generator().Generate(Context(root)).ToList());
+        Assert.Contains("ERR_REQUIREMENT_WITNESS_KEY_COLLISION", refused.Message);
+        Assert.Contains("acme::shop::Orders.Recorded [object.entity]", refused.Message);
+        Assert.Contains("acme::shop::Orders_Recorded [object.entity]", refused.Message);
+        Assert.Contains("req_acme_shop_Orders_Recorded__object_entity", refused.Message);
+    }
+
+    [Fact]
+    public void An_unknown_grain_is_refused_with_a_clear_error_whatever_the_model_holds()
+    {
+        var undefined = (RequirementTestGrain)7;
+        foreach (var root in new[] { LoadDir(WorkedExampleInput()), LoadYaml(Shop()) })
+        {
+            var refused = Assert.Throws<ArgumentException>(() => Generator(grain: undefined).Generate(Context(root)).ToList());
+            Assert.Contains("unknown requirement-test grain 7", refused.Message);
+            Assert.Contains("\"concern\" or \"member\"", refused.Message);
+        }
+    }
+
+    [Fact]
+    public void A_test_namespace_or_witness_class_that_is_not_a_C_sharp_name_is_refused_rather_than_spliced_into_source()
+    {
+        var root = LoadDir(WorkedExampleInput());
+        var badClass = Assert.Throws<InvalidOperationException>(() =>
+            Generator(witnessClass: "Acme.W(); System.Environment.Exit(1").Generate(Context(root)).ToList());
+        Assert.Contains("WitnessClass", badClass.Message);
+        var badNamespace = Assert.Throws<InvalidOperationException>(() =>
+            Generator(testNamespace: "Acme; using Evil").Generate(Context(root)).ToList());
+        Assert.Contains("TestNamespace", badNamespace.Message);
+    }
+
+    [Fact]
+    public void A_model_with_no_requirement_writes_nothing_and_warns_nothing_even_with_options_that_would_be_refused()
+    {
+        var warnings = new List<string>();
+        var root = LoadYaml(Shop());
+        Assert.Empty(Run(root, Generator(testNamespace: "not a name", witnessClass: "also not", warnUncovered: true), warnings));
+        Assert.Empty(warnings);
+    }
+
+    // ---------------------------------------------------------------- defaults
+
+    [Fact]
+    public void With_no_option_at_all_the_names_are_derived_from_the_run_namespace()
+    {
+        // `dotnet meta gen --generators requirement-tests`: the registry builds it with nothing set.
+        var generator = GeneratorRegistry.Get("requirement-tests")!.Factory(new GeneratorBuildContext());
+        var files = generator.Generate(Context(LoadDir(WorkedExampleInput()))).ToDictionary(f => f.Path, f => f.Content);
+        Assert.Contains("namespace Acme.Generated.Requirements;", files[Tests]);
+        Assert.Contains("new global::Acme.Generated.RequirementWitnesses();", files[Tests]);
+        Assert.Contains("implement this interface in Acme.Generated.RequirementWitnesses", files[Interface]);
+    }
+
+    [Fact]
+    public void The_registry_lists_requirement_tests_as_a_native_capability_generator_with_an_ejectable_source()
+    {
+        var entry = GeneratorRegistry.Get("requirement-tests")!;
+        Assert.Equal(GeneratorTier.Native, entry.Tier);
+        Assert.Equal(GeneratorLayer.Capability, entry.Layer);
+        Assert.Equal("RequirementTestsGenerator.cs", entry.SourceFileName);
+        Assert.Equal("requirement-tests", entry.Factory(new GeneratorBuildContext()).Name);
+    }
+
+    // ---------------------------------------------------------------- grain, filter, renderer
+
+    [Fact]
+    public void Member_grain_writes_one_test_per_resolving_reference()
+    {
+        var root = LoadYaml(Shop(Requirement("Recorded", 4, "live", "S.", "C.", "Order, acme::shop::Order.total")));
+        var tests = Run(root, Generator(grain: RequirementTestGrain.Member))[Tests];
+        Assert.Contains("public void req_acme_shop_Recorded__Order()", tests);
+        Assert.Contains("public void req_acme_shop_Recorded__acme_shop_Order_total()", tests);
+        Assert.DoesNotContain("object_entity", tests);
+    }
+
+    private sealed class KeepEverything : IRequirementTestFilter
+    {
+        public bool Include(RequirementView view) => true;
+    }
+
+    [Fact]
+    public void A_filter_keeps_an_L3_requirement_the_default_drops_and_it_renders_with_unit_star()
+    {
+        var root = LoadDir(WorkedExampleInput());
+        Assert.DoesNotContain("req_acme_shop_Orders()", Run(root)[Tests]);
+        var tests = Run(root, Generator(filter: new KeepEverything()))[Tests];
+        Assert.Contains("// acme::shop::Orders [*]", tests);
+        Assert.Contains("public void req_acme_shop_Orders()", tests);
+    }
+
+    private sealed class RecordingRenderer : IRequirementTestRenderer
+    {
+        public List<RequirementTestArgs> Seen { get; } = [];
+
+        public RenderedTest? Render(RequirementTestArgs args)
+        {
+            Seen.Add(args);
+            if (args.Identity.Path != "Orders.Recorded") return null;
+            return new RenderedTest(
+                ["System.Linq"],
+                $"[Fact]\npublic void {args.Identity.WitnessKey}()\n{{\n    Assert.True(new[] {{ 1 }}.Any(), \"digest {args.Identity.Digest}\");\n}}");
+        }
+    }
+
+    [Fact]
+    public void A_renderer_replaces_one_test_and_receives_the_digest_while_the_others_keep_the_default()
+    {
+        var renderer = new RecordingRenderer();
+        var files = Run(LoadDir(WorkedExampleInput()), Generator(renderer: renderer));
+        var tests = files[Tests];
+        Assert.Contains("using System.Linq;\nusing Xunit;\n", tests);
+        Assert.Contains("        Assert.True(new[] { 1 }.Any(), \"digest 2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a\");", tests);
+        Assert.DoesNotContain("witnesses.req_acme_shop_Orders_Recorded__object_entity();", tests);
+        Assert.Contains("[Fact(Skip = \"planned - not built yet\")]", tests);
+
+        Assert.Equal(2, renderer.Seen.Count);
+        var recorded = renderer.Seen.Single(a => a.Identity.Path == "Orders.Recorded");
+        Assert.Equal("An order is recorded when it is placed.", recorded.Statement);
+        Assert.Equal("A placed order has no row.", recorded.Counterexample);
+        Assert.Equal(new RequirementTestClaim("Order", "object.entity"), Assert.Single(recorded.Targets));
+        Assert.Equal("2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a", recorded.Identity.Digest);
+        // The interface keeps its member whatever the renderer wrote.
+        Assert.Contains("void req_acme_shop_Orders_Recorded__object_entity()", files[Interface]);
+    }
+
+    // ---------------------------------------------------------------- the uncovered warning
+
+    [Fact]
+    public void Excluded_requirements_produce_one_capped_warning_and_the_switch_silences_it()
+    {
+        var requirements = Enumerable.Range(1, 7).Select(i => Requirement($"Area{i}", 3, "live", "S.", "C.", null)).ToList();
+        requirements.Add(Requirement("Recorded", 4, "live", "S.", "C.", "Order"));
+        var root = LoadYaml(Shop([.. requirements]));
+
+        var warnings = new List<string>();
+        Run(root, Generator(warnUncovered: true), warnings);
+        // Diagnostics name the PATH, never the package-qualified address, so the same model gives the
+        // same names in every port.
+        Assert.Equal(
+            ["7 requirement(s) matched no filter and get no test. If that is deliberate, set WarnUncovered = false to silence this. " +
+             "Uncovered: Area1, Area2, Area3, Area4, Area5, and 2 more."],
+            warnings);
+
+        var quiet = new List<string>();
+        Run(root, Generator(warnUncovered: false), quiet);
+        Assert.Empty(quiet);
+    }
+
+    [Fact]
+    public void Five_or_fewer_excluded_requirements_are_all_named_and_no_more_is_said()
+    {
+        var root = LoadDir(WorkedExampleInput());
+        var warnings = new List<string>();
+        Run(root, Generator(warnUncovered: true), warnings);
+        Assert.Equal(
+            ["1 requirement(s) matched no filter and get no test. If that is deliberate, set WarnUncovered = false to silence this. Uncovered: Orders."],
+            warnings);
+
+        // Exactly five: all named, and no "and 0 more".
+        var five = LoadYaml(Shop([.. Enumerable.Range(1, 5).Select(i => Requirement($"Area{i}", 3, "live", "S.", "C.", null))]));
+        var fiveWarnings = new List<string>();
+        Run(five, Generator(warnUncovered: true), fiveWarnings);
+        Assert.Equal(
+            ["5 requirement(s) matched no filter and get no test. If that is deliberate, set WarnUncovered = false to silence this. " +
+             "Uncovered: Area1, Area2, Area3, Area4, Area5."],
+            fiveWarnings);
+    }
+
+    [Fact]
+    public void Nothing_excluded_means_nothing_said()
+    {
+        var root = LoadYaml(Shop(Requirement("Recorded", 4, "live", "S.", "C.", "Order")));
+        var warnings = new List<string>();
+        Run(root, Generator(warnUncovered: true), warnings);
+        Assert.Empty(warnings);
+    }
+
+    // ---------------------------------------------------------------- stale files
+
+    [Fact]
+    public void Stale_file_gen_never_removes_the_files_of_a_package_that_lost_its_last_requirement_and_verify_codegen_reports_them()
+    {
+        const string billing =
+            "metadata:\n  package: acme::billing\n  children:\n" +
+            "    - object.entity:\n        name: Invoice\n        children:\n" +
+            "          - field.uuid: { name: id }\n          - identity.primary: { name: pk, fields: [id] }\n";
+        var billed = Requirement("Billed", 4, "live", "S.", "C.", "Invoice");
+        var dir = NewDir();
+        File.WriteAllText(Path.Combine(dir, "meta.billing.yaml"), billing + billed, new UTF8Encoding(false));
+        File.WriteAllText(Path.Combine(dir, "meta.shop.yaml"), Shop(Requirement("Recorded", 4, "live", "S.", "C.", "Order")), new UTF8Encoding(false));
+
+        var outDir = Path.Combine(NewDir(), "generated");
+        var config = new GenConfig { OutDir = outDir, Namespace = "Acme.Generated" };
+        IReadOnlyList<IGenerator> generators = [Generator()];
+        CodegenRunner.Run(config, LoadDir(dir), generators);
+        string[] both =
+        [
+            "Requirements_acme_billing_Tests.g.cs", "Requirements_acme_billing_Witnesses.g.cs",
+            "Requirements_acme_shop_Tests.g.cs", "Requirements_acme_shop_Witnesses.g.cs",
+        ];
+        Assert.Equal(both, Directory.GetFiles(outDir).Select(Path.GetFileName).Order(StringComparer.Ordinal));
+        Assert.True(CodegenDrift.Compute(config, LoadDir(dir), generators).Clean);
+
+        // The billing package loses its requirement.
+        File.WriteAllText(Path.Combine(dir, "meta.billing.yaml"), billing, new UTF8Encoding(false));
+        var after = LoadDir(dir);
+        CodegenRunner.Run(config, after, generators);
+
+        // What gen does, as for every generator of this port: it does not delete. The two files stay...
+        Assert.Equal(both, Directory.GetFiles(outDir).Select(Path.GetFileName).Order(StringComparer.Ordinal));
+        // ...and `dotnet meta verify --codegen` reports each of them.
+        var drift = CodegenDrift.Compute(config, after, generators);
+        Assert.False(drift.Clean);
+        Assert.Equal(["Requirements_acme_billing_Tests.g.cs", "Requirements_acme_billing_Witnesses.g.cs"], drift.DriftedFiles);
+        Assert.All(drift.Lines, line => Assert.Contains("committed but a fresh regen would not emit it", line));
+    }
+
+    [Fact]
+    public void A_change_to_a_claim_makes_verify_codegen_go_red_through_the_digest_in_the_file()
+    {
+        var dir = NewDir();
+        File.WriteAllText(Path.Combine(dir, "meta.shop.yaml"), Shop(Requirement("Recorded", 4, "live", "S.", "C.", "Order")), new UTF8Encoding(false));
+        var outDir = Path.Combine(NewDir(), "generated");
+        var config = new GenConfig { OutDir = outDir, Namespace = "Acme.Generated" };
+        IReadOnlyList<IGenerator> generators = [Generator()];
+        CodegenRunner.Run(config, LoadDir(dir), generators);
+
+        File.WriteAllText(Path.Combine(dir, "meta.shop.yaml"), Shop(Requirement("Recorded", 4, "live", "S, reworded.", "C.", "Order")), new UTF8Encoding(false));
+        var drift = CodegenDrift.Compute(config, LoadDir(dir), generators);
+        Assert.Contains("Requirements_acme_shop_Tests.g.cs", drift.DriftedFiles);
+    }
+}
diff --git a/server/csharp/MetaObjects.Codegen/GeneratorRegistry.cs b/server/csharp/MetaObjects.Codegen/GeneratorRegistry.cs
index 9558eb23e..23ac988ff 100644
--- a/server/csharp/MetaObjects.Codegen/GeneratorRegistry.cs
+++ b/server/csharp/MetaObjects.Codegen/GeneratorRegistry.cs
@@ -254,6 +254,22 @@ private static IGenerator RenderHelper(GeneratorBuildContext ctx) =>
                 Factory = _ => new CallableGenerator(),
                 SourceFileName = "CallableGenerator.cs",
             },
+            // ADR-0057 — one xUnit test per declared requirement, calling a project-owned witness.
+            // Its six options (TestNamespace, WitnessClass, Grain, Filter, Renderer, WarnUncovered) are
+            // public init properties: this port has no per-generator option channel, and a project sets
+            // them where it constructs the generator (its owned codegen/Program.cs). With none set, a
+            // run derives the namespace and witness class name from the run namespace.
+            ["requirement-tests"] = new()
+            {
+                Name = "requirement-tests",
+                Description = "Per-package xUnit tests, one per requirement, calling a project-owned witness class through a generated interface.",
+                Tier = GeneratorTier.Native,
+                Layer = GeneratorLayer.Capability,
+                Factory = _ => new RequirementTestsGenerator(),
+                Options = "TestNamespace, WitnessClass, Grain, Filter, Renderer, WarnUncovered (properties on the generator, set in an owned codegen/Program.cs; none needed)",
+                Note = "Writes nothing for a model with no requirement. The project class named by WitnessClass must exist for the tests to compile.",
+                SourceFileName = "RequirementTestsGenerator.cs",
+            },
         };
 
     /// <summary>All entries, native first then neutral, alphabetical within tier.</summary>
diff --git a/server/csharp/MetaObjects.Codegen/Generators/RequirementTestsGenerator.cs b/server/csharp/MetaObjects.Codegen/Generators/RequirementTestsGenerator.cs
new file mode 100644
index 000000000..637fcbf35
--- /dev/null
+++ b/server/csharp/MetaObjects.Codegen/Generators/RequirementTestsGenerator.cs
@@ -0,0 +1,422 @@
+// requirement-tests — one xUnit test per declared requirement, calling a project-owned witness (ADR-0057).
+//
+// For each metamodel package that holds a tested requirement this writes two files, rewritten whole on
+// every run: Requirements_<pkgKey>_Witnesses.g.cs (an interface with one default member per NON-skipped
+// test, which fails with `unimplemented requirement: ...`) and Requirements_<pkgKey>_Tests.g.cs (one
+// [Fact] per requirement, calling the member through the interface on the project's witness class). The
+// project owns the witnesses: it writes a class implementing every generated witness interface and
+// implements the members it has witnesses for. A requirement that becomes live adds a failing member, a
+// red test and no compile break; one that is retired or deleted removes the member.
+//
+// THE DRIFT SIGNAL NEEDS THE EXPLICIT FORM. A witness that implements a member EXPLICITLY
+//
+//     void Requirements_acme_shop_Witnesses.req_acme_shop_Orders_Recorded__object_entity() { ... }
+//
+// stops compiling (CS0539) once the member is removed, which is how an orphan witness is found. The same
+// witness written IMPLICITLY (`public void req_...() { ... }`) is an ordinary method after the member is
+// gone and goes stale silently, so the generated header tells the project to write the explicit form. A
+// method that merely looks like a witness (no `public`, another return type, a parameter, `static`) is not
+// an implementation: it compiles, and the default member runs and fails the test.
+//
+// Which tests exist, what each is called, whether it is skipped and its digest come from
+// MetaObjects.Core.Requirement.RequirementTestIdentities, which every language port shares and a
+// conformance corpus pins. This class decides only how they are WRITTEN. It is a reference helper
+// (ADR-0034 Amendment 3): `dotnet meta eject requirement-tests` copies this one file into your project,
+// and the default rendering is in it, so an owned copy changes the output freely.
+//
+// OPTIONS are public init properties, because this port has no per-generator option channel: the packaged
+// `dotnet meta gen --generators requirement-tests` builds the generator with none set, and a project that
+// wants any sets them where it constructs the generator, in its owned codegen/Program.cs:
+//
+//     new RequirementTestsGenerator { WitnessClass = "MyApp.Tests.Witnesses", Grain = RequirementTestGrain.Member }
+//
+// The generated tests are xUnit; the project that compiles them needs a reference to xunit. They import
+// nothing from MetaObjects.
+
+using System.Globalization;
+using System.Text;
+using System.Text.RegularExpressions;
+using MetaObjects.Core.Requirement;
+using MetaObjects.Meta;
+
+namespace MetaObjects.Codegen.Generators;
+
+/// <summary>Generates one xUnit test per requirement, calling a project-owned witness (ADR-0057).</summary>
+public class RequirementTestsGenerator : IGenerator
+{
+    /// <summary>The refusal code when two tests map to one witness key.</summary>
+    public const string ErrWitnessKeyCollision = "ERR_REQUIREMENT_WITNESS_KEY_COLLISION";
+
+    /// <summary>How many uncovered requirements to name before "and N more".</summary>
+    private const int MaxNamedUncovered = 5;
+
+    private const string SkipPlanned = "planned - not built yet";
+    private const string SkipRetired = "retired - the capability was deliberately removed; assert it stays removed";
+
+    public string Name => "requirement-tests";
+
+    /// <summary>
+    /// The namespace the generated tests are written into: a dotted C# name, without <c>global::</c>. A keyword
+    /// segment is escaped with <c>@</c> where it is emitted. Default: <c>&lt;run namespace&gt;.Requirements</c>,
+    /// so a run with no option set needs none.
+    /// </summary>
+    public string? TestNamespace { get; init; }
+
+    /// <summary>
+    /// The project class that implements every generated witness interface, by its full name (it is emitted as
+    /// <c>global::&lt;name&gt;</c>, so no namespace of the tests can capture it). It should implement each member
+    /// EXPLICITLY; see the file comment. The generated tests construct it with <c>new</c>, so it needs a public
+    /// parameterless constructor. Default:
+    /// <c>&lt;run namespace&gt;.RequirementWitnesses</c>. If that class does not exist the test project does not
+    /// compile: a one-time setup, and the only by-name binding is a static one (ADR-0001).
+    /// </summary>
+    public string? WitnessClass { get; init; }
+
+    /// <summary>
+    /// The fan-out unit: one test per distinct concern (the default) or per distinct reference. Anything else
+    /// is refused, never run as a hybrid.
+    /// </summary>
+    public RequirementTestGrain Grain { get; init; } = RequirementTestGrain.Concern;
+
+    /// <summary>
+    /// Which requirements get a test. It REPLACES the default of functional requirements at level 4 or above;
+    /// it does not narrow it.
+    /// </summary>
+    public IRequirementTestFilter? Filter { get; init; }
+
+    /// <summary>Replaces the default text of individual tests; see <see cref="IRequirementTestRenderer"/>.</summary>
+    public IRequirementTestRenderer? Renderer { get; init; }
+
+    /// <summary>Name the requirements the filter excluded, once per run. Default on.</summary>
+    public bool WarnUncovered { get; init; } = true;
+
+    /// <summary>One test to write: its identity and the data its rendering is built from.</summary>
+    private sealed record Planned(RequirementTestIdentity Identity, RequirementTestArgs Args);
+
+    public IEnumerable<EmittedFile> Generate(GenContext ctx)
+    {
+        // The grain is checked first (Select does it), so a bad one is refused whatever the model holds.
+        // Selection is the very function the identity corpus pins: this generator selects nothing itself.
+        var selection = RequirementTestIdentities.Select(ctx.Root, Grain, Filter);
+        // No requirement, no change: nothing is written and nothing is said.
+        if (selection.RequirementCount == 0) return [];
+
+        var testNamespace = ParsedName(nameof(TestNamespace), TestNamespace ?? ctx.Config.Namespace + ".Requirements", allowGlobal: false);
+        var witnessClass = ParsedName(nameof(WitnessClass), WitnessClass ?? ctx.Config.Namespace + ".RequirementWitnesses", allowGlobal: true);
+
+        var planned = selection.Tests
+            .Select(t => new Planned(t.Identity, ArgsFor(t.Requirement.Node, t.Identity, t.Unit.Targets)))
+            .ToList();
+        RefuseCollisions(planned);
+        if (WarnUncovered && selection.ExcludedPaths.Count > 0) ctx.Warn(UncoveredWarning(selection.ExcludedPaths));
+
+        // One pair of files per package key. Two packages that mangle alike share a pair: their tests
+        // keep distinct keys, which the collision check above has just proven.
+        var byPackage = new SortedDictionary<string, List<Planned>>(StringComparer.Ordinal);
+        foreach (var p in planned)
+        {
+            var key = PackageKey(p.Identity.Package);
+            if (!byPackage.TryGetValue(key, out var group)) byPackage[key] = group = [];
+            group.Add(p);
+        }
+
+        var files = new List<EmittedFile>();
+        foreach (var (key, tests) in byPackage)
+        {
+            var witnesses = $"Requirements_{key}_Witnesses";
+            var testClass = $"Requirements_{key}_Tests";
+            files.Add(new EmittedFile(witnesses + ".g.cs", WitnessInterface(testNamespace, witnesses, witnessClass, tests)));
+            files.Add(new EmittedFile(testClass + ".g.cs", TestClass(testNamespace, testClass, witnesses, witnessClass, tests, Renderer)));
+        }
+        return files;
+    }
+
+    // ------------------------------------------------------------------
+    // options
+    // ------------------------------------------------------------------
+
+    /// <summary>
+    /// A dotted name that is spliced into generated source: the segments without any <c>@</c>, so a comment or a
+    /// message can say the name as it was written, and the spelling that is emitted as code, where a segment that
+    /// is a C# keyword is escaped with <c>@</c>.
+    /// </summary>
+    private sealed record DottedName(IReadOnlyList<string> Segments)
+    {
+        public string Plain => string.Join('.', Segments);
+
+        public string Code => string.Join('.', Segments.Select(s => Keywords.Contains(s) ? "@" + s : s));
+    }
+
+    private const string GlobalPrefix = "global::";
+
+    /// <summary>
+    /// Parse an option that names a namespace or a class. Each segment must be a legal C# identifier (non-ASCII
+    /// letters included), optionally written verbatim with a leading <c>@</c>. A <c>global::</c> prefix is refused
+    /// on a namespace, which cannot carry one, and accepted and removed on a class, since the generator emits
+    /// <c>global::</c> itself.
+    /// </summary>
+    private static DottedName ParsedName(string option, string value, bool allowGlobal)
+    {
+        var text = value.Trim();
+        if (text.StartsWith(GlobalPrefix, StringComparison.Ordinal))
+        {
+            if (!allowGlobal)
+                throw new InvalidOperationException(
+                    $"requirement-tests: {option} must not start with '{GlobalPrefix}': a namespace declaration cannot be " +
+                    $"qualified. Write '{text[GlobalPrefix.Length..]}', not '{value}'.");
+            text = text[GlobalPrefix.Length..];
+        }
+        var segments = text.Split('.').Select(s => s.StartsWith('@') ? s[1..] : s).ToList();
+        if (!segments.All(IsIdentifier))
+            throw new InvalidOperationException(
+                $"requirement-tests: {option} must be a dotted C# name, not '{value}'. Set it on the generator " +
+                "(new RequirementTestsGenerator { " + option + " = \"...\" }); its default is derived from the run namespace.");
+        return new DottedName(segments);
+    }
+
+    /// <summary>
+    /// A C# identifier: a letter, a letter number or <c>_</c>, then those and combining marks, decimal digits,
+    /// connector punctuation and formatting characters (ECMA-334, "Identifiers"). The check is by Unicode category,
+    /// so a legal non-ASCII name is accepted.
+    /// </summary>
+    private static bool IsIdentifier(string s)
+    {
+        if (s.Length == 0) return false;
+        for (var i = 0; i < s.Length; i += char.IsSurrogatePair(s, i) ? 2 : 1)
+        {
+            if (char.IsSurrogate(s, i) && !char.IsSurrogatePair(s, i)) return false;
+            var category = char.GetUnicodeCategory(s, i);
+            var start = category is UnicodeCategory.UppercaseLetter or UnicodeCategory.LowercaseLetter
+                or UnicodeCategory.TitlecaseLetter or UnicodeCategory.ModifierLetter or UnicodeCategory.OtherLetter
+                or UnicodeCategory.LetterNumber || s[i] == '_';
+            var part = start || category is UnicodeCategory.NonSpacingMark or UnicodeCategory.SpacingCombiningMark
+                or UnicodeCategory.DecimalDigitNumber or UnicodeCategory.ConnectorPunctuation or UnicodeCategory.Format;
+            if (i == 0 ? !start : !part) return false;
+        }
+        return true;
+    }
+
+    /// <summary>The C# keywords: a segment spelt like one is escaped with <c>@</c> where it is emitted.</summary>
+    private static readonly HashSet<string> Keywords = new(StringComparer.Ordinal)
+    {
+        "abstract", "as", "base", "bool", "break", "byte", "case", "catch", "char", "checked", "class", "const",
+        "continue", "decimal", "default", "delegate", "do", "double", "else", "enum", "event", "explicit", "extern",
+        "false", "finally", "fixed", "float", "for", "foreach", "goto", "if", "implicit", "in", "int", "interface",
+        "internal", "is", "lock", "long", "namespace", "new", "null", "object", "operator", "out", "override",
+        "params", "private", "protected", "public", "readonly", "ref", "return", "sbyte", "sealed", "short",
+        "sizeof", "stackalloc", "static", "string", "struct", "switch", "this", "throw", "true", "try", "typeof",
+        "uint", "ulong", "unchecked", "unsafe", "ushort", "using", "virtual", "void", "volatile", "while",
+    };
+
+    // ------------------------------------------------------------------
+    // planning
+    // ------------------------------------------------------------------
+
+    private static RequirementTestArgs ArgsFor(
+        MetaRequirement node, RequirementTestIdentity identity, IReadOnlyList<ResolvedClaim> targets) =>
+        new(
+            identity,
+            node.Attr(RequirementConstants.REQUIREMENT_ATTR_STATEMENT) as string ?? "",
+            node.Attr(RequirementConstants.REQUIREMENT_ATTR_COUNTEREXAMPLE) as string ?? "",
+            targets.Select(t => new RequirementTestClaim(t.Ref, t.Concern)).ToList(),
+            node.Disposition,
+            node.TrackedBy);
+
+    /// <summary><c>root</c> for the empty package, otherwise the package with each run of non-ASCII-alphanumerics as one underscore.</summary>
+    private static string PackageKey(string package) =>
+        package.Length == 0 ? "root" : RequirementTestIdentities.Mangle(package);
+
+    /// <summary>Two tests with one witness key cannot be told apart by a witness: refuse, naming both.</summary>
+    private static void RefuseCollisions(List<Planned> planned)
+    {
+        var pairs = RequirementTestIdentities.WitnessKeyCollisions(planned.Select(p => p.Identity));
+        if (pairs.Count == 0) return;
+        var keyById = planned.ToDictionary(p => p.Identity.Id, p => p.Identity.WitnessKey, StringComparer.Ordinal);
+        var sb = new StringBuilder(ErrWitnessKeyCollision)
+            .Append(": two requirement tests map to one witness key, so one witness could not serve both. ")
+            .Append("Rename one so the names differ in more than punctuation:");
+        foreach (var (first, second) in pairs)
+            sb.Append("\n  '").Append(first).Append("' and '").Append(second).Append("' (witness key ").Append(keyById[first]).Append(')');
+        throw new InvalidOperationException(sb.ToString());
+    }
+
+    private static string UncoveredWarning(IReadOnlyList<string> uncovered)
+    {
+        var shown = string.Join(", ", uncovered.Take(MaxNamedUncovered));
+        var more = uncovered.Count > MaxNamedUncovered
+            ? ", and " + (uncovered.Count - MaxNamedUncovered).ToString(CultureInfo.InvariantCulture) + " more"
+            : "";
+        return uncovered.Count.ToString(CultureInfo.InvariantCulture) + " requirement(s) matched no filter and get no test. " +
+               "If that is deliberate, set WarnUncovered = false to silence this. Uncovered: " + shown + more + ".";
+    }
+
+    // ------------------------------------------------------------------
+    // rendering: the default rendering lives here, in this one file, so an eject takes it too
+    // ------------------------------------------------------------------
+
+    private const string GeneratedHeader =
+        "// <auto-generated/>\n" +
+        "// GENERATED by metaobjects (requirement-tests). DO NOT EDIT: this file is rewritten whole.\n";
+
+    private static string WitnessInterface(DottedName testNamespace, string name, DottedName witnessClass, List<Planned> tests)
+    {
+        // A real member shows the shape; with none (every test skipped) the pattern stands in for a name.
+        var example = tests.FirstOrDefault(t => t.Identity.Skip is null)?.Identity.WitnessKey ?? "req_<address>__<unit>";
+        // The interface is named with its namespace: the witness class is in another one by default,
+        // so the bare name would not resolve where this line is pasted.
+        var sb = new StringBuilder(GeneratedHeader)
+            .Append("// Witnesses are project-owned: implement this interface in ").Append(CommentText(witnessClass.Plain))
+            .Append(", one EXPLICIT member per witness, e.g.\n")
+            .Append("//     void ").Append(testNamespace.Code).Append('.').Append(name).Append('.').Append(example).Append("() { ... }\n")
+            .Append("// Explicit, so that a member whose requirement is retired or deleted stops compiling instead of going stale silently.\n")
+            .Append("namespace ").Append(testNamespace.Code).Append(";\n\n")
+            .Append("public interface ").Append(name).Append("\n{");
+        foreach (var p in tests)
+        {
+            var id = p.Identity;
+            if (id.Skip is not null) continue; // a skipped test claims nothing works yet: no member
+            sb.Append('\n').Append(Indent(TestComments(p.Args))).Append('\n')
+              .Append("    void ").Append(id.WitnessKey).Append("()\n    {\n")
+              .Append("        throw new global::Xunit.Sdk.XunitException(\"")
+              .Append(StringLiteral(
+                  "unimplemented requirement: " + id.Id + " - write " + witnessClass.Plain + "." + id.WitnessKey +
+                  "() so that it fails when: " + p.Args.Counterexample))
+              .Append("\");\n    }\n");
+        }
+        return sb.Append("}\n").ToString();
+    }
+
+    private static string TestClass(
+        DottedName testNamespace, string name, string witnesses, DottedName witnessClass, List<Planned> tests, IRequirementTestRenderer? renderer)
+    {
+        var usings = new SortedSet<string>(StringComparer.Ordinal) { "Xunit" };
+        var body = new StringBuilder();
+        foreach (var p in tests)
+        {
+            var rendered = renderer?.Render(p.Args);
+            string source;
+            if (rendered is not null)
+            {
+                foreach (var u in rendered.Usings) usings.Add(u);
+                source = rendered.Source;
+            }
+            else
+            {
+                source = DefaultTest(p);
+            }
+            body.Append('\n').Append(Indent(source.TrimEnd())).Append('\n');
+        }
+        var sb = new StringBuilder(GeneratedHeader)
+            .Append("// The witnesses are project-owned, in ").Append(CommentText(witnessClass.Plain)).Append(".\n")
+            .Append("// Implement each member explicitly, as the witness interface shows, so that a stale one stops compiling.\n");
+        foreach (var u in usings) sb.Append("using ").Append(u).Append(";\n");
+        return sb.Append("\nnamespace ").Append(testNamespace.Code).Append(";\n\n")
+            .Append("public class ").Append(name).Append("\n{\n")
+            .Append("    private readonly ").Append(witnesses).Append(" witnesses = new global::").Append(witnessClass.Code).Append("();\n")
+            .Append(body).Append("}\n").ToString();
+    }
+
+    /// <summary>The default rendering of one test: its comments, then a <c>[Fact]</c> calling the witness.</summary>
+    private static string DefaultTest(Planned p)
+    {
+        var id = p.Identity;
+        var sb = new StringBuilder(TestComments(p.Args)).Append('\n');
+        if (id.Skip is null)
+        {
+            sb.Append("[Fact]\npublic void ").Append(id.WitnessKey).Append("()\n{\n    witnesses.").Append(id.WitnessKey).Append("();\n}");
+        }
+        else
+        {
+            sb.Append("[Fact(Skip = \"").Append(StringLiteral(SkipReason(id.Skip))).Append("\")]\n")
+              .Append("public void ").Append(id.WitnessKey).Append("()\n{\n}");
+        }
+        return sb.ToString();
+    }
+
+    private static string SkipReason(string skip) => skip switch
+    {
+        RequirementConstants.REQUIREMENT_STATUS_PLANNED => SkipPlanned,
+        RequirementConstants.REQUIREMENT_STATUS_RETIRED => SkipRetired,
+        _ => skip + " - skipped",
+    };
+
+    /// <summary>The comment block above a test: id, statement, counterexample, status, claims, digest.</summary>
+    private static string TestComments(RequirementTestArgs a)
+    {
+        var id = a.Identity;
+        var claims = a.Targets.Count == 0
+            ? "(none)"
+            : string.Join(", ", a.Targets.Select(c => $"{c.Ref}  ({c.Concern})"));
+        return CommentLines(id.Id) + "\n"
+            + CommentLines(a.Statement) + "\n"
+            + CommentLines("Counterexample: " + a.Counterexample) + "\n"
+            + CommentLines("Status: " + (id.Status ?? "(none)")) + "\n"
+            + CommentLines("Claims: " + claims) + "\n"
+            + CommentLines("Digest: " + id.Digest);
+    }
+
+    // ------------------------------------------------------------------
+    // escaping: author prose lands in string literals and comments, and must not break either
+    // ------------------------------------------------------------------
+
+    private static string Indent(string block)
+    {
+        var sb = new StringBuilder();
+        foreach (var line in block.Split('\n'))
+        {
+            if (sb.Length > 0) sb.Append('\n');
+            if (line.Length > 0) sb.Append("    ").Append(line);
+        }
+        return sb.ToString();
+    }
+
+    // A C# line ends at a line feed, a carriage return, a CR LF pair, or U+0085, U+2028 or U+2029.
+    private static readonly Regex LineTerminator = new("\r\n|[\r\n\u0085\u2028\u2029]", RegexOptions.CultureInvariant);
+
+    /// <summary>
+    /// One <c>//</c> marker per line: every line terminator of the language splits, so none can end the comment
+    /// early and leave the rest of the prose as code. <c>*</c><c>/</c> is broken as <c>* /</c> by contract. C# does
+    /// not process a Unicode escape inside a comment, so <c>\u000a</c> stays as written.
+    /// </summary>
+    private static string CommentLines(string text) =>
+        string.Join("\n", LineTerminator.Split(text).Select(line => "// " + CommentText(line)));
+
+    private static string CommentText(string line) => line.Replace("*/", "* /", StringComparison.Ordinal);
+
+    /// <summary>
+    /// The text of a regular string literal. Every control character, and the three line terminators beyond
+    /// <c>\n</c> and <c>\r</c>, is escaped, so no value can end the literal. A lone surrogate is escaped too: it has
+    /// no UTF-8 spelling and would not survive being written to the file.
+    /// </summary>
+    private static string StringLiteral(string s)
+    {
+        var sb = new StringBuilder();
+        for (var i = 0; i < s.Length; i++)
+        {
+            var c = s[i];
+            switch (c)
+            {
+                case '\\': sb.Append("\\\\"); break;
+                case '"': sb.Append("\\\""); break;
+                case '\n': sb.Append("\\n"); break;
+                case '\r': sb.Append("\\r"); break;
+                case '\t': sb.Append("\\t"); break;
+                default:
+                    if (char.IsHighSurrogate(c) && i + 1 < s.Length && char.IsLowSurrogate(s[i + 1]))
+                    {
+                        sb.Append(c).Append(s[++i]);
+                    }
+                    else if (c < 0x20 || c == 0x7f || c == '\u0085' || c == '\u2028' || c == '\u2029' || char.IsSurrogate(c))
+                    {
+                        sb.Append("\\u").Append(((int)c).ToString("x4", CultureInfo.InvariantCulture));
+                    }
+                    else
+                    {
+                        sb.Append(c);
+                    }
+                    break;
+            }
+        }
+        return sb.ToString();
+    }
+}
diff --git a/server/csharp/MetaObjects.Codegen/MetaObjects.Codegen.csproj b/server/csharp/MetaObjects.Codegen/MetaObjects.Codegen.csproj
index 9784e4c9d..5cb170274 100644
--- a/server/csharp/MetaObjects.Codegen/MetaObjects.Codegen.csproj
+++ b/server/csharp/MetaObjects.Codegen/MetaObjects.Codegen.csproj
@@ -50,6 +50,7 @@
     <EmbeddedResource Include="Generators/FilterAllowlistGenerator.cs" />
     <EmbeddedResource Include="Generators/NamesGenerator.cs" />
     <EmbeddedResource Include="Generators/CallableGenerator.cs" />
+    <EmbeddedResource Include="Generators/RequirementTestsGenerator.cs" />
   </ItemGroup>
   <!--
     The HELPER RUNTIME (HelperRuntime.cs) — the Runtime/ files generated routes import.
diff --git a/server/csharp/MetaObjects.Codegen/RequirementTestHooks.cs b/server/csharp/MetaObjects.Codegen/RequirementTestHooks.cs
new file mode 100644
index 000000000..e72f344ef
--- /dev/null
+++ b/server/csharp/MetaObjects.Codegen/RequirementTestHooks.cs
@@ -0,0 +1,61 @@
+// The renderer hook of the requirement-test generator (ADR-0057, Table I of the plan).
+//
+// These types stay in the package when a project ejects the generator: an owned copy of
+// `RequirementTestsGenerator` and a project's own `IRequirementTestRenderer` both use them from
+// here, like the walk, the claim resolver and the identity function in MetaObjects.Core.Requirement.
+// The default rendering is NOT here: it is in Generators/RequirementTestsGenerator.cs, so one eject
+// takes the generator and its renderer together.
+
+using MetaObjects.Core.Requirement;
+
+namespace MetaObjects.Codegen;
+
+/// <summary>One resolved <c>implementedBy</c> reference: as authored, and the concern it resolved to.</summary>
+/// <param name="Ref">The reference exactly as authored.</param>
+/// <param name="Concern"><c>&lt;type&gt;.&lt;subType&gt;</c> of the node it names.</param>
+public sealed record RequirementTestClaim(string Ref, string Concern);
+
+/// <summary>
+/// Everything a <see cref="IRequirementTestRenderer"/> is given about one test: its identity (the same
+/// record in every language port), and the prose and claims the default rendering is built from. The
+/// library supplies DATA; a renderer supplies SYNTAX.
+/// </summary>
+/// <param name="Identity">The test's identity: package, path, unit, id, witness key, status, skip reason (or null) and digest.</param>
+/// <param name="Statement">What the capability is, or the empty string.</param>
+/// <param name="Counterexample">What breaking it looks like, or the empty string.</param>
+/// <param name="Targets">The claims this test covers, as authored plus the concern each resolved to.</param>
+/// <param name="Disposition">What was decided about outstanding work, or null (undecided).</param>
+/// <param name="TrackedBy">Issue references for outstanding work; empty when none.</param>
+public sealed record RequirementTestArgs(
+    RequirementTestIdentity Identity,
+    string Statement,
+    string Counterexample,
+    IReadOnlyList<RequirementTestClaim> Targets,
+    string? Disposition,
+    IReadOnlyList<string> TrackedBy);
+
+/// <summary>
+/// What an <see cref="IRequirementTestRenderer"/> returns for one test: the C# source of that test and
+/// the namespaces it needs.
+/// </summary>
+/// <param name="Usings">
+/// Namespaces to import, each without <c>using</c> and the semicolon (<c>System.Linq</c>). Empty when
+/// the source needs none beyond the <c>Xunit</c> the generated file always imports.
+/// </param>
+/// <param name="Source">
+/// The whole member that replaces the default one: any comments, attributes and the method. The
+/// generator indents every line and places it in the test class, where <c>witnesses</c> is the field
+/// holding the project's witness class, typed as that package's generated witness interface. The
+/// interface keeps a member for every non-skipped test whatever a renderer writes, so a renderer that
+/// wants the project's witness calls <c>witnesses.&lt;WitnessKey&gt;()</c>.
+/// </param>
+public sealed record RenderedTest(IReadOnlyList<string> Usings, string Source);
+
+/// <summary>
+/// Replaces the default text of individual tests. Return <c>null</c> to keep the default rendering of
+/// that one test.
+/// </summary>
+public interface IRequirementTestRenderer
+{
+    RenderedTest? Render(RequirementTestArgs args);
+}
diff --git a/server/csharp/MetaObjects.Conformance.Tests/LibraryLoadTests.cs b/server/csharp/MetaObjects.Conformance.Tests/LibraryLoadTests.cs
index e702b0657..5d0660042 100644
--- a/server/csharp/MetaObjects.Conformance.Tests/LibraryLoadTests.cs
+++ b/server/csharp/MetaObjects.Conformance.Tests/LibraryLoadTests.cs
@@ -107,6 +107,40 @@ public void KnownPackagesNamesWhatThisBuildShips()
         Assert.Equal(known.OrderBy(k => k, StringComparer.Ordinal).ToList(), known);
     }
 
+    /// <summary>
+    /// <c>LibraryPackages()</c> decides whether a requirement came from a shipped library, and so
+    /// whether object coverage is measured at all. It is read from the embedded manifests; this
+    /// holds it to exactly the packages of the manifests the repository ships under
+    /// <c>library/*/library.json</c>.
+    /// </summary>
+    [Fact]
+    public void LibraryPackagesIsExactlyThePackagesOfTheShippedManifests()
+    {
+        var libraryDir = RepoLibraryDir();
+        var manifests = Directory.GetFiles(libraryDir, "library.json", SearchOption.AllDirectories);
+        Assert.NotEmpty(manifests);
+
+        var expected = new SortedSet<string>(StringComparer.Ordinal);
+        foreach (var manifest in manifests)
+        {
+            using var doc = System.Text.Json.JsonDocument.Parse(File.ReadAllText(manifest));
+            foreach (var p in doc.RootElement.GetProperty("packages").EnumerateArray()) expected.Add(p.GetString()!);
+        }
+        Assert.NotEmpty(expected); // a manifest that declares no package would make this vacuous
+
+        Assert.Equal(expected, new SortedSet<string>(LibrarySources.LibraryPackages(), StringComparer.Ordinal));
+    }
+
+    private static string RepoLibraryDir()
+    {
+        for (var dir = new DirectoryInfo(AppContext.BaseDirectory); dir is not null; dir = dir.Parent)
+        {
+            if (Directory.Exists(Path.Combine(dir.FullName, "library")) && Directory.Exists(Path.Combine(dir.FullName, "server")))
+                return Path.Combine(dir.FullName, "library");
+        }
+        throw new InvalidOperationException("could not locate the repo-root library/ directory from " + AppContext.BaseDirectory);
+    }
+
     /// <summary>
     /// The freshness gate: the embed must equal the canonical tree byte for byte.
     ///
diff --git a/server/csharp/MetaObjects.Conformance.Tests/RequirementCheckConformanceTests.cs b/server/csharp/MetaObjects.Conformance.Tests/RequirementCheckConformanceTests.cs
new file mode 100644
index 000000000..7e6bedd01
--- /dev/null
+++ b/server/csharp/MetaObjects.Conformance.Tests/RequirementCheckConformanceTests.cs
@@ -0,0 +1,268 @@
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using MetaObjects.Core.Requirement;
+using MetaObjects.Loader;
+using Xunit;
+
+namespace MetaObjects.Conformance.Tests;
+
+/// <summary>
+/// Cross-port requirement-gate conformance corpus: <c>fixtures/requirement-check-conformance/</c>.
+/// See that directory's README.md for the fixture format. Every case is LOADED strict first, so
+/// "this model loads today" is proven by the fixture, and only then checked. Mirrors the TypeScript
+/// reference (<c>requirement-check-conformance.test.ts</c>); a mismatch here is a bug in THIS
+/// port's gate, never in the fixture, and a committed <c>expected.json</c> is never edited to make
+/// this port pass.
+/// </summary>
+public class RequirementCheckConformanceTests
+{
+    private static readonly string CorpusDir = ResolveCorpusDir();
+
+    /// <summary>
+    /// The whole of <c>options.json</c>. A key outside this list, or a value of the wrong type, is
+    /// refused rather than ignored: a misspelt <c>requireImplementers</c>, or one written as the
+    /// string "true", would otherwise run the case without the strict switch and pin the wrong
+    /// severity.
+    /// </summary>
+    private static readonly string[] OptionKeys = ["libraries", "requireImplementers"];
+
+    /// <summary>A case whose <c>input/</c> must be, file for file and byte for byte, another case's.</summary>
+    private static readonly Dictionary<string, string> SameInputAs = new()
+    {
+        ["require-implementers"] = "nothing-implements-subtree",
+    };
+
+    private static string ResolveCorpusDir()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null)
+        {
+            var candidate = Path.Combine(dir.FullName, "fixtures", "requirement-check-conformance");
+            if (Directory.Exists(candidate)) return candidate;
+            dir = dir.Parent;
+        }
+        throw new DirectoryNotFoundException(
+            "Could not locate fixtures/requirement-check-conformance/ by walking up from " + AppContext.BaseDirectory);
+    }
+
+    private static List<string> Cases() =>
+        Directory.GetDirectories(CorpusDir).Select(d => Path.GetFileName(d)!).OrderBy(n => n, StringComparer.Ordinal).ToList();
+
+    public static IEnumerable<object[]> Fixtures() => Cases().Select(n => new object[] { n });
+
+    private sealed record Options(string[] Libraries, bool RequireImplementers);
+
+    private static Options ReadOptions(string caseDir)
+    {
+        var file = Path.Combine(caseDir, "options.json");
+        if (!File.Exists(file)) return new Options([], false);
+
+        using var doc = JsonDocument.Parse(File.ReadAllText(file));
+        Assert.Equal(JsonValueKind.Object, doc.RootElement.ValueKind);
+        var unknown = doc.RootElement.EnumerateObject().Select(p => p.Name).Except(OptionKeys).Order().ToList();
+        Assert.True(unknown.Count == 0, $"{file}: unknown option(s) {string.Join(", ", unknown)}");
+
+        var libraries = Array.Empty<string>();
+        if (doc.RootElement.TryGetProperty("libraries", out var libs))
+        {
+            Assert.True(
+                libs.ValueKind == JsonValueKind.Array && libs.EnumerateArray().All(x => x.ValueKind == JsonValueKind.String),
+                $"{file}: 'libraries' must be an array of strings");
+            libraries = libs.EnumerateArray().Select(x => x.GetString()!).ToArray();
+        }
+
+        var require = false;
+        if (doc.RootElement.TryGetProperty("requireImplementers", out var req))
+        {
+            Assert.True(
+                req.ValueKind is JsonValueKind.True or JsonValueKind.False,
+                $"{file}: 'requireImplementers' must be a boolean");
+            require = req.GetBoolean();
+        }
+        return new Options(libraries, require);
+    }
+
+    private static Dictionary<string, string> InputFiles(string name) =>
+        Directory.GetFiles(Path.Combine(CorpusDir, name, "input"))
+            .OrderBy(f => f, StringComparer.Ordinal)
+            .ToDictionary(f => Path.GetFileName(f)!, File.ReadAllText);
+
+    /// <summary>The corpus's JSON shape: <c>entities*</c> are absent unless coverage was measured.</summary>
+    private static string SummaryJson(RequirementSummary? summary)
+    {
+        if (summary is null) return "null";
+        var obj = new SortedDictionary<string, object>(StringComparer.Ordinal)
+        {
+            ["total"] = summary.Total,
+            ["functional"] = summary.Functional,
+            ["architectural"] = summary.Architectural,
+            ["byStatus"] = new SortedDictionary<string, int>(summary.ByStatus.ToDictionary(kv => kv.Key, kv => kv.Value), StringComparer.Ordinal),
+            ["undecided"] = summary.Undecided,
+            ["deferredUntracked"] = summary.DeferredUntracked,
+        };
+        if (summary.EntitiesTotal is not null)
+        {
+            obj["entitiesClaimed"] = summary.EntitiesClaimed!.Value;
+            obj["entitiesTotal"] = summary.EntitiesTotal.Value;
+        }
+        return JsonSerializer.Serialize(obj);
+    }
+
+    /// <summary>The expected summary, re-serialized through the same sorted shape so the two compare as text.</summary>
+    private static string CanonicalJson(JsonElement element)
+    {
+        object? Convert(JsonElement e) => e.ValueKind switch
+        {
+            JsonValueKind.Null => null,
+            JsonValueKind.Object => new SortedDictionary<string, object?>(
+                e.EnumerateObject().ToDictionary(p => p.Name, p => Convert(p.Value)), StringComparer.Ordinal),
+            JsonValueKind.Number => e.GetInt32(),
+            _ => throw new InvalidOperationException($"unexpected {e.ValueKind} in a summary"),
+        };
+        return JsonSerializer.Serialize(Convert(element));
+    }
+
+    private static List<string> DocumentedCases()
+    {
+        var readme = File.ReadAllText(Path.Combine(CorpusDir, "README.md"));
+        var section = Regex.Split(readme, "^## ", RegexOptions.Multiline).FirstOrDefault(s => s.StartsWith("Cases\n", StringComparison.Ordinal));
+        Assert.NotNull(section);
+        return Regex.Matches(section!, @"^\| `([^`]+)` \|", RegexOptions.Multiline).Select(m => m.Groups[1].Value).ToList();
+    }
+
+    [Fact]
+    public void Discovers_the_corpus() => Assert.NotEmpty(Cases());
+
+    [Fact]
+    public void Every_case_on_disk_is_documented_in_the_readme_and_nothing_else_is() =>
+        Assert.Equal(Cases(), DocumentedCases().Order(StringComparer.Ordinal).ToList());
+
+    /// <summary>
+    /// Table A: the effective package is the node's own declared package, else the nearest
+    /// enclosing node's, else the file's default, else "". A NESTED requirement without a package of
+    /// its own takes its PARENT's, not the file's. The corpus's gate cases cannot see a wrong answer
+    /// here unless a bare reference happens to resolve differently, so it is asserted directly.
+    /// </summary>
+    [Fact]
+    public void Effective_package_of_a_nested_requirement_is_its_parents_not_the_files()
+    {
+        const string shop = """
+            metadata:
+              package: acme::shop
+              children:
+                - requirement.functional:
+                    name: Orders
+                    level: 3
+                    status: planned
+                    statement: Every placed order is kept.
+                    counterexample: A placed order that is lost.
+                    children:
+                      - requirement.functional:
+                          name: Recorded
+                          level: 4
+                          status: planned
+                          statement: An order is recorded when it is placed.
+                          counterexample: A placed order has no row.
+                - requirement.functional:
+                    name: Invoiced
+                    package: acme::billing
+                    level: 3
+                    status: planned
+                    statement: An invoice is raised for every order.
+                    counterexample: An order with no invoice.
+                    children:
+                      - requirement.functional:
+                          name: Numbered
+                          level: 4
+                          status: planned
+                          statement: An invoice carries a number.
+                          counterexample: An invoice nobody can quote back.
+            """;
+        var dir = Directory.CreateTempSubdirectory("mo-req-effective-package-").FullName;
+        try
+        {
+            File.WriteAllText(Path.Combine(dir, "meta.shop.yaml"), shop);
+            var load = MetaDataLoader.FromDirectory(dir, strict: true);
+            Assert.Empty(load.Errors.Select(e => e.Code + ": " + e.Message));
+
+            var packages = RequirementCheck.CollectAddressed(load.Root)
+                .ToDictionary(a => a.Path, a => RequirementCheck.EffectivePackage(a.Node));
+            Assert.Equal("acme::shop", packages["Orders"]);
+            Assert.Equal("acme::shop", packages["Orders.Recorded"]);
+            Assert.Equal("acme::billing", packages["Invoiced"]);
+            Assert.Equal("acme::billing", packages["Invoiced.Numbered"]);
+        }
+        finally
+        {
+            Directory.Delete(dir, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void Effective_package_of_a_requirement_in_a_packageless_file_is_empty()
+    {
+        const string bare = """
+            metadata:
+              children:
+                - requirement.functional:
+                    name: Orders
+                    level: 3
+                    status: planned
+                    statement: Every placed order is kept.
+                    counterexample: A placed order that is lost.
+                    children:
+                      - requirement.functional:
+                          name: Recorded
+                          level: 4
+                          status: planned
+                          statement: An order is recorded when it is placed.
+                          counterexample: A placed order has no row.
+            """;
+        var dir = Directory.CreateTempSubdirectory("mo-req-effective-package-").FullName;
+        try
+        {
+            File.WriteAllText(Path.Combine(dir, "meta.bare.yaml"), bare);
+            var load = MetaDataLoader.FromDirectory(dir, strict: true);
+            Assert.Empty(load.Errors.Select(e => e.Code + ": " + e.Message));
+
+            Assert.All(RequirementCheck.CollectAddressed(load.Root), a => Assert.Equal("", RequirementCheck.EffectivePackage(a.Node)));
+        }
+        finally
+        {
+            Directory.Delete(dir, recursive: true);
+        }
+    }
+
+    [Theory]
+    [MemberData(nameof(Fixtures))]
+    public void Fixture(string name)
+    {
+        var caseDir = Path.Combine(CorpusDir, name);
+        using var doc = JsonDocument.Parse(File.ReadAllText(Path.Combine(caseDir, "expected.json")));
+        var options = ReadOptions(caseDir);
+
+        if (SameInputAs.TryGetValue(name, out var twin))
+            Assert.Equal(InputFiles(twin), InputFiles(name));
+
+        // Strict, with the libraries options.json names; the files load in ascending file-name order.
+        var load = MetaDataLoader.FromDirectory(Path.Combine(caseDir, "input"), options.Libraries, strict: true);
+        Assert.Empty(load.Errors.Select(e => e.Code + ": " + e.Message));
+
+        // No scope predicate and no forced coverage answer: both are the port's defaults.
+        var scan = RequirementCheck.Scan(load.Root, requireImplementers: options.RequireImplementers);
+
+        var actual = RequirementCheck.Check(load.Root, scan)
+            .Select(d => (d.Severity, d.Code, d.Path ?? "", d.Message))
+            .Order().ToList();
+        var wanted = doc.RootElement.GetProperty("diagnostics").EnumerateArray()
+            .Select(d => (
+                d.GetProperty("severity").GetString()!,
+                d.GetProperty("code").GetString()!,
+                d.TryGetProperty("path", out var p) ? p.GetString()! : "",
+                d.GetProperty("message").GetString()!))
+            .Order().ToList();
+        Assert.Equal(wanted, actual);
+
+        Assert.Equal(CanonicalJson(doc.RootElement.GetProperty("summary")), SummaryJson(RequirementCheck.Summarise(load.Root, scan)));
+    }
+}
diff --git a/server/csharp/MetaObjects.Conformance.Tests/RequirementLevelTests.cs b/server/csharp/MetaObjects.Conformance.Tests/RequirementLevelTests.cs
new file mode 100644
index 000000000..9360da25f
--- /dev/null
+++ b/server/csharp/MetaObjects.Conformance.Tests/RequirementLevelTests.cs
@@ -0,0 +1,114 @@
+using System.Globalization;
+using MetaObjects.Core.Requirement;
+using MetaObjects.Loader;
+using MetaObjects.Meta;
+using Xunit;
+
+namespace MetaObjects.Conformance.Tests;
+
+/// <summary>
+/// The requirement <c>@level</c> read, and the gate's message about it. An integer outside the range of
+/// <c>int</c> must be reported as itself (TypeScript does), and a message is the same bytes whatever the
+/// machine's culture.
+/// </summary>
+public class RequirementLevelTests
+{
+    private static string Model(string level, string? nestedLevel = null) => $$"""
+        metadata:
+          package: acme::shop
+          children:
+            - requirement.functional:
+                name: Orders
+                level: {{level}}
+                status: planned
+                statement: Every placed order is kept.
+                counterexample: A placed order that is lost.
+        {{(nestedLevel is null ? "" : $$"""
+                children:
+                  - requirement.functional:
+                      name: Recorded
+                      level: {{nestedLevel}}
+                      status: planned
+                      statement: An order is recorded when it is placed.
+                      counterexample: A placed order has no row.
+        """)}}
+        """;
+
+    private static (MetaData Root, RequirementScan Scan) Load(string yaml)
+    {
+        var dir = Directory.CreateTempSubdirectory("mo-req-level-").FullName;
+        try
+        {
+            File.WriteAllText(Path.Combine(dir, "meta.shop.yaml"), yaml);
+            var load = MetaDataLoader.FromDirectory(dir, strict: true);
+            Assert.Empty(load.Errors.Select(e => e.Code + ": " + e.Message));
+            return (load.Root, RequirementCheck.Scan(load.Root));
+        }
+        finally
+        {
+            Directory.Delete(dir, recursive: true);
+        }
+    }
+
+    private static MetaRequirement Orders(MetaData root) =>
+        (MetaRequirement)root.Children().Single(c => c.Type == TYPE_REQUIREMENT);
+
+    [Theory]
+    [InlineData("4294967300")]   // wraps to 4 in a 32-bit narrowing: a valid level
+    [InlineData("4294967297")]   // wraps to 1
+    [InlineData("-4294967292")]  // wraps to 4
+    [InlineData("9223372036854775807")]
+    public void An_integer_beyond_int_is_a_bad_level_printed_as_authored(string authored)
+    {
+        var (root, scan) = Load(Model(authored));
+
+        var diagnostic = Assert.Single(RequirementCheck.Check(root, scan), d => d.Code == RequirementCheck.ERR_REQUIREMENT_BAD_LEVEL);
+        Assert.Equal(
+            $"level must be an integer 1-5 (got {authored}). L1 solution, L2 segment (app/library), L3 service, L4 object, L5 member.",
+            diagnostic.Message);
+    }
+
+    [Fact]
+    public void Level_saturates_rather_than_wrapping_and_RawLevel_is_the_number_as_authored()
+    {
+        var (root, _) = Load(Model("4294967300"));
+        Assert.Equal(int.MaxValue, Orders(root).Level);
+        Assert.Equal(4294967300L, Orders(root).RawLevel);
+
+        var (valid, _) = Load(Model("4"));
+        Assert.Equal(4, Orders(valid).Level);
+        Assert.Equal(4L, Orders(valid).RawLevel);
+    }
+
+    [Fact]
+    public void Messages_are_the_same_bytes_under_a_culture_with_a_non_ASCII_minus_and_digit_grouping()
+    {
+        var odd = (CultureInfo)CultureInfo.InvariantCulture.Clone();
+        odd.NumberFormat.NegativeSign = "−";
+        odd.NumberFormat.NumberGroupSeparator = " ";
+        odd.NumberFormat.NumberGroupSizes = [1];
+
+        var saved = CultureInfo.CurrentCulture;
+        try
+        {
+            CultureInfo.CurrentCulture = odd;
+            // Guard the premise: the culture really would change a naive format.
+            Assert.Equal("−1", (-1).ToString(CultureInfo.CurrentCulture));
+
+            var (root, scan) = Load(Model("-1", nestedLevel: "-2"));
+            var messages = RequirementCheck.Check(root, scan).Select(d => d.Message).ToList();
+
+            Assert.Contains(
+                "level must be an integer 1-5 (got -1). L1 solution, L2 segment (app/library), L3 service, L4 object, L5 member.",
+                messages);
+            Assert.Contains(
+                "nested under \"Orders\" (level -1) but declares level -2. Nesting is the hierarchy — a child sits strictly below its parent.",
+                messages);
+            Assert.DoesNotContain(messages, m => m.Contains('−'));
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = saved;
+        }
+    }
+}
diff --git a/server/csharp/MetaObjects.Conformance.Tests/RequirementTestIdentityConformanceTests.cs b/server/csharp/MetaObjects.Conformance.Tests/RequirementTestIdentityConformanceTests.cs
new file mode 100644
index 000000000..509994e86
--- /dev/null
+++ b/server/csharp/MetaObjects.Conformance.Tests/RequirementTestIdentityConformanceTests.cs
@@ -0,0 +1,255 @@
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using MetaObjects.Core.Requirement;
+using MetaObjects.Loader;
+using Xunit;
+
+namespace MetaObjects.Conformance.Tests;
+
+/// <summary>
+/// Cross-port requirement-test identity corpus: <c>fixtures/requirement-test-identity-conformance/</c>.
+/// See that directory's README.md for the fixture format. Every case is LOADED strict first (in
+/// file-name order, asserting no load error), and only then are its test identities computed through
+/// the port's PUBLIC seams: the grain when <c>options.json</c> sets one, and the filter when it names
+/// one. An option the case does not set is not passed, so the port's own default applies. Mirrors the
+/// TypeScript reference (<c>requirement-test-identity-conformance.test.ts</c>); a mismatch here is a
+/// bug in THIS port, never in the fixture, and a committed <c>expected.json</c> is never edited to make
+/// this port pass.
+/// </summary>
+public class RequirementTestIdentityConformanceTests
+{
+    /// <summary>
+    /// The corpus holds 26 cases. A floor, asserted in this class, so an empty or mislocated corpus
+    /// (a walk that found some other directory, a checkout that lost the fixtures) cannot pass by
+    /// running nothing.
+    /// </summary>
+    private const int ExpectedCaseFloor = 26;
+
+    /// <summary>
+    /// The whole of <c>options.json</c>. A key outside this list is refused rather than ignored: a
+    /// misspelt <c>grain</c> would otherwise run the case under the default and pin the wrong tests.
+    /// </summary>
+    private static readonly string[] OptionKeys = ["grain", "filter"];
+
+    private static readonly string CorpusDir = ResolveCorpusDir();
+
+    private static string ResolveCorpusDir()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null)
+        {
+            var candidate = Path.Combine(dir.FullName, "fixtures", "requirement-test-identity-conformance");
+            if (Directory.Exists(candidate)) return candidate;
+            dir = dir.Parent;
+        }
+        throw new DirectoryNotFoundException(
+            "Could not locate fixtures/requirement-test-identity-conformance/ by walking up from " + AppContext.BaseDirectory);
+    }
+
+    private static List<string> Cases() =>
+        Directory.GetDirectories(CorpusDir).Select(d => Path.GetFileName(d)!).OrderBy(n => n, StringComparer.Ordinal).ToList();
+
+    public static IEnumerable<object[]> Fixtures() => Cases().Select(n => new object[] { n });
+
+    /// <summary>The closed list of named predicates of the corpus README: exactly eight rows.</summary>
+    private sealed class NamedFilter(string name, Func<RequirementView, bool> predicate) : IRequirementTestFilter
+    {
+        public string Name { get; } = name;
+        public bool Include(RequirementView view) => predicate(view);
+    }
+
+    private static readonly Dictionary<string, Func<RequirementView, bool>> Predicates = new(StringComparer.Ordinal)
+    {
+        ["all"] = _ => true,
+        ["architectural"] = v => v.SubType == "architectural",
+        ["live"] = v => v.Status == "live",
+        ["level-5"] = v => v.Level == 5,
+        ["package-acme-shop"] = v => v.Package == "acme::shop",
+        ["path-under-Shop"] = v => v.Path == "Shop" || v.Path.StartsWith("Shop.", StringComparison.Ordinal),
+        ["claims-entity"] = v => v.ImplementedByTypes.Contains("object.entity"),
+        ["unlevelled"] = v => v.Level is null,
+    };
+
+    private static IRequirementTestFilter FilterNamed(string name)
+    {
+        Assert.True(Predicates.TryGetValue(name, out var predicate), $"unknown named filter '{name}': the corpus names one of {string.Join(", ", Predicates.Keys)}");
+        return new NamedFilter(name, predicate!);
+    }
+
+    private sealed record Options(RequirementTestGrain? Grain, IRequirementTestFilter? Filter);
+
+    private static Options ReadOptions(string caseDir)
+    {
+        var file = Path.Combine(caseDir, "options.json");
+        if (!File.Exists(file)) return new Options(null, null);
+
+        using var doc = JsonDocument.Parse(File.ReadAllText(file));
+        Assert.Equal(JsonValueKind.Object, doc.RootElement.ValueKind);
+        var unknown = doc.RootElement.EnumerateObject().Select(p => p.Name).Except(OptionKeys).Order().ToList();
+        Assert.True(unknown.Count == 0, $"{file}: unknown option(s) {string.Join(", ", unknown)}");
+
+        RequirementTestGrain? grain = null;
+        if (doc.RootElement.TryGetProperty("grain", out var g))
+        {
+            Assert.True(g.ValueKind == JsonValueKind.String, $"{file}: 'grain' must be a string");
+            grain = RequirementTestGrains.Parse(g.GetString());
+        }
+        IRequirementTestFilter? filter = null;
+        if (doc.RootElement.TryGetProperty("filter", out var f))
+        {
+            Assert.True(f.ValueKind == JsonValueKind.String, $"{file}: 'filter' must be a string");
+            filter = FilterNamed(f.GetString()!);
+        }
+        return new Options(grain, filter);
+    }
+
+    private static List<string> DocumentedCases()
+    {
+        var readme = File.ReadAllText(Path.Combine(CorpusDir, "README.md"));
+        var section = Regex.Split(readme, "^## ", RegexOptions.Multiline).FirstOrDefault(s => s.StartsWith("Cases\n", StringComparison.Ordinal));
+        Assert.NotNull(section);
+        return Regex.Matches(section!, @"^\| `([^`]+)` \|", RegexOptions.Multiline).Select(m => m.Groups[1].Value).ToList();
+    }
+
+    [Theory]
+    [InlineData("""{ "grain": "member", "fliter": "all" }""", "unknown option(s) fliter")]
+    [InlineData("""{ "Grain": "member" }""", "unknown option(s) Grain")]
+    [InlineData("""{ "grain": 1 }""", "'grain' must be a string")]
+    [InlineData("""{ "filter": ["all"] }""", "'filter' must be a string")]
+    public void The_runner_refuses_an_option_file_it_does_not_understand(string optionsJson, string expectedMessage)
+    {
+        var dir = Directory.CreateTempSubdirectory("mo-req-identity-options-").FullName;
+        try
+        {
+            File.WriteAllText(Path.Combine(dir, "options.json"), optionsJson);
+            var refused = Assert.ThrowsAny<Xunit.Sdk.XunitException>(() => ReadOptions(dir));
+            Assert.Contains(expectedMessage, refused.Message);
+        }
+        finally
+        {
+            Directory.Delete(dir, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void The_corpus_has_at_least_the_26_cases_it_was_built_with()
+    {
+        var cases = Cases();
+        Assert.True(cases.Count >= ExpectedCaseFloor, $"found {cases.Count} case(s) in {CorpusDir}, expected at least {ExpectedCaseFloor}");
+    }
+
+    [Fact]
+    public void Every_case_on_disk_is_documented_in_the_readme_and_nothing_else_is() =>
+        Assert.Equal(Cases(), DocumentedCases().Order(StringComparer.Ordinal).ToList());
+
+    [Fact]
+    public void A_filter_name_outside_the_closed_list_fails_the_case()
+    {
+        Assert.Equal(8, Predicates.Count);
+        Assert.ThrowsAny<Xunit.Sdk.XunitException>(() => FilterNamed("no-such-filter"));
+    }
+
+    [Theory]
+    [MemberData(nameof(Fixtures))]
+    public void Fixture(string name)
+    {
+        var caseDir = Path.Combine(CorpusDir, name);
+        using var doc = JsonDocument.Parse(File.ReadAllText(Path.Combine(caseDir, "expected.json")));
+        var options = ReadOptions(caseDir);
+
+        // Strict, files in ascending file-name order, and no load error.
+        var load = MetaDataLoader.FromDirectory(Path.Combine(caseDir, "input"), strict: true);
+        Assert.Empty(load.Errors.Select(e => e.Code + ": " + e.Message));
+
+        // The grain and the filter go in only when the case sets them.
+        var actual = RequirementTestIdentities.Identities(load.Root, options.Grain, options.Filter);
+
+        static string Line(string id, string pkg, string path, string unit, string key, string? status, string? skip, string digest) =>
+            $"{id} | package={pkg} | path={path} | unit={unit} | key={key} | status={status ?? "<none>"} | skip={skip ?? "<none>"} | digest={digest}";
+
+        var actualLines = actual
+            .OrderBy(t => t.Id, StringComparer.Ordinal)
+            .Select(t => Line(t.Id, t.Package, t.Path, t.Unit, t.WitnessKey, t.Status, t.Skip, t.Digest))
+            .ToList();
+        var wantedLines = doc.RootElement.GetProperty("tests").EnumerateArray()
+            .Select(t => (
+                Id: t.GetProperty("id").GetString()!,
+                Line: Line(
+                    t.GetProperty("id").GetString()!,
+                    t.GetProperty("package").GetString()!,
+                    t.GetProperty("path").GetString()!,
+                    t.GetProperty("unit").GetString()!,
+                    t.GetProperty("witnessKey").GetString()!,
+                    t.GetProperty("status").GetString(),
+                    t.GetProperty("skip").GetString(),
+                    t.GetProperty("digest").GetString()!)))
+            .OrderBy(t => t.Id, StringComparer.Ordinal)
+            .Select(t => t.Line)
+            .ToList();
+        Assert.Equal(wantedLines, actualLines);
+
+        var actualCollisions = RequirementTestIdentities.WitnessKeyCollisions(actual)
+            .Select(p => $"{p.First} <> {p.Second}").ToList();
+        var wantedCollisions = doc.RootElement.GetProperty("collisions").EnumerateArray()
+            .Select(p =>
+            {
+                var pair = p.EnumerateArray().Select(x => x.GetString()!).Order(StringComparer.Ordinal).ToList();
+                return (First: pair[0], Second: pair[1]);
+            })
+            .OrderBy(p => p.First, StringComparer.Ordinal).ThenBy(p => p.Second, StringComparer.Ordinal)
+            .Select(p => $"{p.First} <> {p.Second}")
+            .ToList();
+        Assert.Equal(wantedCollisions, actualCollisions);
+    }
+
+    // ----------------------------------------------------------------------------------------
+    // What the corpus cannot pin: the loaders are not known to agree on a non-ASCII requirement name,
+    // so no input declares one. The key function is held to the rule directly instead.
+    // ----------------------------------------------------------------------------------------
+
+    /// <summary>
+    /// The mangle class is ASCII <c>[A-Za-z0-9]</c> and excludes <c>_</c>. <c>char.IsLetterOrDigit</c>
+    /// (and Regex's <c>\w</c>) keep an accented letter, so a port that used either gives
+    /// <c>req_acme_shop_Café_Réglé</c> here and nothing else in the suite would notice.
+    /// </summary>
+    [Fact]
+    public void The_witness_key_replaces_a_non_ASCII_letter_like_any_other_character()
+    {
+        // each é is the single code point U+00E9
+        Assert.Equal("req_acme_shop_Caf_R_gl_", RequirementTestIdentities.WitnessKeyOf("acme::shop::Café.Réglé", "*"));
+        Assert.Equal("req_acme_shop_Orders_Recorded__object_entity",
+            RequirementTestIdentities.WitnessKeyOf("acme::shop::Orders.Recorded", "object.entity"));
+        Assert.Equal("req_Sales_Orders", RequirementTestIdentities.WitnessKeyOf("Sales__Orders", "*"));
+    }
+
+    [Fact]
+    public void An_unknown_grain_is_refused_with_a_clear_error_wherever_it_enters()
+    {
+        var text = Assert.Throws<ArgumentException>(() => RequirementTestGrains.Parse("hybrid"));
+        Assert.Contains("unknown requirement-test grain \"hybrid\"", text.Message);
+        Assert.Contains("\"concern\" or \"member\"", text.Message);
+        Assert.Throws<ArgumentException>(() => RequirementTestGrains.Parse(null));
+        Assert.Throws<ArgumentException>(() => RequirementTestGrains.Parse("Concern"));
+
+        // An undefined enum value is legal C#, and the branch that tests for Member would run it as a
+        // hybrid. It is refused over any model, even one with no requirement at all.
+        var undefined = (RequirementTestGrain)5;
+        var load = MetaDataLoader.FromDirectory(Path.Combine(CorpusDir, "worked-example", "input"), strict: true);
+        Assert.Empty(load.Errors);
+        var refused = Assert.Throws<ArgumentException>(() => RequirementTestIdentities.Identities(load.Root, undefined));
+        Assert.Contains("unknown requirement-test grain 5", refused.Message);
+        var walked = RequirementTestIdentities.Walk(load.Root)[0];
+        Assert.Throws<ArgumentException>(() => RequirementTestIdentities.Units(walked, undefined));
+    }
+
+    [Fact]
+    public void A_view_level_is_absent_for_an_unlevelled_requirement_and_a_number_for_level_0_and_minus_1()
+    {
+        var load = MetaDataLoader.FromDirectory(Path.Combine(CorpusDir, "filter-by-absent-level", "input"), strict: true);
+        Assert.Empty(load.Errors);
+        var levels = RequirementTestIdentities.Walk(load.Root).ToDictionary(w => w.View.Path, w => w.View.Level);
+        Assert.Contains(levels, kv => kv.Value is null);
+        Assert.Contains(levels, kv => kv.Value == 0);
+        Assert.Contains(levels, kv => kv.Value == -1);
+    }
+}
diff --git a/server/csharp/MetaObjects/Core/Requirement/RequirementCheck.cs b/server/csharp/MetaObjects/Core/Requirement/RequirementCheck.cs
new file mode 100644
index 000000000..7eae9bf1d
--- /dev/null
+++ b/server/csharp/MetaObjects/Core/Requirement/RequirementCheck.cs
@@ -0,0 +1,572 @@
+// RequirementCheck — the requirement (capability) gate `dotnet meta verify` runs.
+//
+// Requirements are METADATA: `requirement.functional` / `requirement.architectural` are
+// registered metamodel types. So this file parses NOTHING. It reads `requirement.*` nodes
+// off the already-loaded model and checks the things the loader cannot (ADR-0057).
+//
+// Division of labour:
+//
+//   LOADER (unconditional)   the `@status` enum, required attrs, child rules, levels
+//                            being integers.
+//   VERIFY  (conditional)    `@implementedBy` resolution, whose SEVERITY DEPENDS ON
+//                            `@status`: a `planned` requirement names nodes that do not
+//                            exist YET, so a loader reference descriptor, which always
+//                            errors, would make every recorded intention fail to load.
+//
+// Ported 1:1 from the TypeScript reference, server/typescript/packages/cli/src/lib/
+// requirement-check.ts. The codes, their conditions, their ORDER and their message text are
+// copied from it, and fixtures/requirement-check-conformance/ holds this port to it.
+//
+// What a clean run proves is referential integrity. It never proves that a status is true,
+// or that a claimed node implements the requirement claiming it.
+
+using System.Globalization;
+using MetaObjects.Library;
+using MetaObjects.Meta;
+
+namespace MetaObjects.Core.Requirement;
+
+/// <summary>One finding of the requirement gate.</summary>
+/// <param name="Severity"><c>error</c> or <c>warn</c>.</param>
+/// <param name="Code">The diagnostic code.</param>
+/// <param name="Path">
+/// The subject's ADDRESS, the dotted chain of requirement names with no package. Two branches of
+/// a ledger may reuse a NAME, so a bare name does not locate the node. Null when the subject is
+/// an entity (object coverage names the entity in its message instead).
+/// </param>
+/// <param name="Message">The message text.</param>
+public sealed record RequirementDiagnostic(string Severity, string Code, string? Path, string Message);
+
+/// <summary>A requirement paired with its ADDRESS: the dotted chain of requirement names from the root.</summary>
+public sealed record AddressedRequirement(MetaRequirement Node, string Path);
+
+/// <summary>
+/// What one run computes once and both the gate and the summary read, so the printed summary
+/// cannot disagree with the diagnostics beneath it.
+/// </summary>
+public sealed record RequirementScan(
+    IReadOnlyList<AddressedRequirement> Addressed,
+    IReadOnlySet<string> ClaimedObjects,
+    bool MeasureCoverage,
+    bool RequireImplementers);
+
+/// <summary>
+/// Counts behind the summary line printed on every run, clean or not. <c>EntitiesTotal</c> and
+/// <c>EntitiesClaimed</c> are null when coverage was not measured: absence is the honest reading
+/// of "this project authored no requirement of its own, so it asked to be held to none".
+/// </summary>
+public sealed record RequirementSummary(
+    int Total,
+    int Functional,
+    int Architectural,
+    IReadOnlyDictionary<string, int> ByStatus,
+    int Undecided,
+    int DeferredUntracked,
+    int? EntitiesClaimed,
+    int? EntitiesTotal);
+
+/// <summary>The requirement gate: the walk, the scan, the checks and the summary.</summary>
+public static class RequirementCheck
+{
+    public const string SeverityError = "error";
+    public const string SeverityWarn = "warn";
+
+    public const string ERR_REQUIREMENT_LINK_ABOVE_FLOOR = "ERR_REQUIREMENT_LINK_ABOVE_FLOOR";
+    public const string ERR_REQUIREMENT_DANGLING_REF = "ERR_REQUIREMENT_DANGLING_REF";
+    public const string ERR_REQUIREMENT_BAD_LEVEL = "ERR_REQUIREMENT_BAD_LEVEL";
+    public const string ERR_REQUIREMENT_LEVEL_NESTING = "ERR_REQUIREMENT_LEVEL_NESTING";
+    public const string ERR_REQUIREMENT_L4_NOT_OBJECT = "ERR_REQUIREMENT_L4_NOT_OBJECT";
+    public const string ERR_REQUIREMENT_L5_NOT_MEMBER = "ERR_REQUIREMENT_L5_NOT_MEMBER";
+    public const string ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS = "ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS";
+    public const string WARN_REQUIREMENT_OBJECT_UNCLAIMED = "WARN_REQUIREMENT_OBJECT_UNCLAIMED";
+    public const string WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE = "WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE";
+    public const string WARN_REQUIREMENT_DEFERRED_UNTRACKED = "WARN_REQUIREMENT_DEFERRED_UNTRACKED";
+    public const string WARN_REQUIREMENT_NOTHING_IMPLEMENTS = "WARN_REQUIREMENT_NOTHING_IMPLEMENTS";
+
+    /// <summary>
+    /// Severity of the object-coverage gate. It stays a warning: on a real estate carrying a
+    /// single requirement it reports every entity, and at error a project adopting requirements
+    /// incrementally would fail its first <c>verify</c> after authoring one entry.
+    /// </summary>
+    public const string OBJECT_COVERAGE_SEVERITY = SeverityWarn;
+
+    // -- the walk and the address -----------------------------------------------------------
+
+    /// <summary>
+    /// Every <c>requirement.*</c> node in the tree, at any nesting depth, each with its dotted
+    /// path. Hierarchy IS nesting, so this is a walk. It descends through EVERY node, not only
+    /// through requirements: a requirement somewhere the child rules did not anticipate is
+    /// still gated, which is the fail-closed direction for a gate. Only a requirement
+    /// contributes a path segment.
+    /// </summary>
+    public static IReadOnlyList<AddressedRequirement> CollectAddressed(MetaData root)
+    {
+        var output = new List<AddressedRequirement>();
+        Walk(root, "", output);
+        return output;
+    }
+
+    private static void Walk(MetaData node, string prefix, List<AddressedRequirement> output)
+    {
+        foreach (var c in node.Children())
+        {
+            // Only a requirement contributes a path segment; an intervening non-requirement
+            // node is walked THROUGH, so the address stays the requirement hierarchy.
+            var isReq = c.Type == TYPE_REQUIREMENT;
+            var path = isReq ? (prefix.Length == 0 ? c.Name : $"{prefix}.{c.Name}") : prefix;
+            if (isReq) output.Add(new AddressedRequirement((MetaRequirement)c, path));
+            Walk(c, path, output);
+        }
+    }
+
+    /// <summary>
+    /// The package a requirement resolves references in. The node's own declared package, else
+    /// that of the nearest enclosing node that declares one, else the file's default package,
+    /// else <c>""</c>.
+    /// </summary>
+    /// <remarks>
+    /// Read through <see cref="NamingRefs.EffectivePackage"/>, which cuts the node's
+    /// <see cref="MetaData.ResolutionKey"/>: its own package, else its file-default package, else the
+    /// package of the nearest ancestor that declares one. That is Table A's wording, and it is what
+    /// the Java port does. It agrees with TypeScript on every shape the corpus pins (a nested
+    /// requirement takes its parent's package, not the file's, because the C# parser hands each
+    /// child the nearest declaring node's package as its file-default) and on a package-less
+    /// document loaded after a packaged one (both parsers fall back to the accumulating root's
+    /// package). It differs in one known shape: a child merged into a package-declaring node from a
+    /// package-less document. C# takes the declaring ancestor's package; TypeScript takes none.
+    /// That is a loader-level difference outside the gate, recorded for the owner.
+    /// </remarks>
+    public static string EffectivePackage(MetaData node) => NamingRefs.EffectivePackage(node);
+
+    // -- the scan ---------------------------------------------------------------------------
+
+    /// <summary>
+    /// Walk the model once and resolve every claim once.
+    /// </summary>
+    /// <param name="measureCoverage">
+    /// Force coverage on or off instead of deriving it from who authored the requirements.
+    /// Null derives it (see <see cref="ProjectAuthoredRequirements"/>).
+    /// </param>
+    /// <param name="requireImplementers">
+    /// The strict switch: raise <see cref="WARN_REQUIREMENT_NOTHING_IMPLEMENTS"/> to an error.
+    /// </param>
+    public static RequirementScan Scan(MetaData root, bool? measureCoverage = null, bool requireImplementers = false)
+    {
+        var addressed = CollectAddressed(root);
+        return new RequirementScan(
+            addressed,
+            ClaimedObjectKeys(root, addressed.Select(a => a.Node)),
+            measureCoverage ?? ProjectAuthoredRequirements(addressed),
+            requireImplementers);
+    }
+
+    /// <summary>
+    /// Did the ADOPTER author any of these requirements? A library ships its own ledger, and
+    /// without this, opting into a library would switch the unclaimed-entity gate on across a
+    /// project that has never written a requirement. Provenance is the library's declared
+    /// PACKAGE, a manifest fact. An overlay on a library requirement stays in the library's
+    /// package and does not activate coverage.
+    /// </summary>
+    private static bool ProjectAuthoredRequirements(IReadOnlyList<AddressedRequirement> addressed)
+    {
+        var libraryPackages = LibrarySources.LibraryPackages();
+        return addressed.Any(a => !libraryPackages.Contains(EffectivePackage(a.Node)));
+    }
+
+    /// <summary>
+    /// Resolution keys of every object claimed by a requirement. Shared by the gate and the
+    /// summary. A PLANNED requirement never contributes, so declaring an intention cannot clear
+    /// an unclaimed-entity warning. An ARCHITECTURAL claim also covers every root-level object
+    /// whose resolved super chain reaches the owner; a functional claim does not.
+    /// </summary>
+    private static HashSet<string> ClaimedObjectKeys(MetaData root, IEnumerable<MetaRequirement> requirements)
+    {
+        var claimed = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var req in requirements)
+        {
+            if (req.IsPlanned()) continue;
+            var referrerPkg = EffectivePackage(req);
+            foreach (var reference in req.ImplementedBy)
+            {
+                var split = RequirementClaims.SplitMemberRef(reference);
+                var node = RequirementClaims.ResolveClaimTarget(root, split.Owner, referrerPkg);
+                if (node is null) continue;
+                if (split.Path.Count > 0 && RequirementClaims.ResolveMember(node, split.Path) is null) continue;
+                claimed.Add(node.ResolutionKey());
+                // ARCHITECTURAL claims propagate DOWN the extends chain; functional ones do not.
+                // A policy claimed on an abstract base genuinely holds for everything extending
+                // it. A functional claim says an entity exists for a REASON, and inheriting a
+                // reason from a shared base would mean adding an entity no longer forces anyone
+                // to say what it is for.
+                if (req.IsArchitectural())
+                {
+                    foreach (var sub in SubtypesOf(root, node)) claimed.Add(sub);
+                }
+            }
+        }
+        return claimed;
+    }
+
+    /// <summary>
+    /// Resolution keys of every root-level object whose RESOLVED super chain reaches
+    /// <paramref name="ancestor"/>. Walks the resolved super pointer, never the raw
+    /// <c>extends</c> string, so a cross-package reference resolves the way the loader resolved
+    /// it.
+    /// </summary>
+    private static List<string> SubtypesOf(MetaData root, MetaData ancestor)
+    {
+        var output = new List<string>();
+        foreach (var cand in root.Children())
+        {
+            if (cand.Type != TYPE_OBJECT || ReferenceEquals(cand, ancestor)) continue;
+            var seen = new HashSet<MetaData>(ReferenceEqualityComparer.Instance);
+            var cur = cand.SuperData;
+            while (cur is not null && seen.Add(cur))
+            {
+                if (ReferenceEquals(cur, ancestor))
+                {
+                    output.Add(cand.ResolutionKey());
+                    break;
+                }
+                cur = cur.SuperData;
+            }
+        }
+        return output;
+    }
+
+    /// <summary>
+    /// The entities object coverage measures: root-level, non-abstract <c>object.entity</c>.
+    /// <c>object.value</c> and <c>object.projection</c> are exempt: a value is a shape, and a
+    /// projection is derived from an entity that is itself claimable. An abstract entity is
+    /// shape, not data.
+    /// </summary>
+    private static List<MetaData> CoverableEntities(MetaData root) =>
+        // ADR-0039 sanctioned own-only read: abstractness describes THIS declaration and is
+        // never inherited, so IsAbstract is read as the node's own flag.
+        root.Children()
+            .Where(n => n.Type == TYPE_OBJECT && n.SubType == OBJECT_SUBTYPE_ENTITY && !n.IsAbstract)
+            .ToList();
+
+    /// <summary>
+    /// True when this requirement, or anything nested beneath it, names an implementing node.
+    /// Subtree-scoped deliberately: an L1 solution that delegates everything to its children
+    /// implements nothing directly, and flagging that would fire on the correct shape of every
+    /// tree.
+    /// </summary>
+    private static bool SubtreeClaimsAnything(MetaRequirement req)
+    {
+        if (req.ImplementedBy.Count > 0) return true;
+        foreach (var child in req.Children())
+        {
+            if (child.Type != TYPE_REQUIREMENT) continue;
+            if (SubtreeClaimsAnything((MetaRequirement)child)) return true;
+        }
+        return false;
+    }
+
+    // -- the ledger -------------------------------------------------------------------------
+
+    /// <summary>
+    /// Resolve a <c>@supersededBy</c> reference to a requirement in the same ledger (FR-039).
+    ///
+    /// <para>Resolves against the LEDGER, not the model: a capability is replaced by another
+    /// capability. Pointing this at an entity would be <c>@implementedBy</c> wearing a
+    /// different name, and <c>@implementedBy</c> is exactly what a retired entry may not have.
+    /// A bare path is looked up across every package, and the first requirement in walk order
+    /// wins.</para>
+    /// </summary>
+    public static MetaRequirement? ResolveRequirementRef(
+        IReadOnlyList<AddressedRequirement> addressed, string reference, string referrerPkg)
+    {
+        var keyed = new Dictionary<string, MetaRequirement>(StringComparer.Ordinal);
+        foreach (var (node, path) in addressed)
+        {
+            var pkg = EffectivePackage(node);
+            if (pkg.Length > 0) keyed[$"{pkg}{PACKAGE_SEPARATOR}{path}"] = node;
+            // The bare path is registered too, so a single-package ledger can reference without
+            // repeating its own package on every line.
+            keyed.TryAdd(path, node);
+        }
+        // An FQN binds exactly; a bare ref prefers the referrer's own package.
+        if (keyed.TryGetValue(reference, out var exact)) return exact;
+        if (referrerPkg.Length > 0 && keyed.TryGetValue($"{referrerPkg}{PACKAGE_SEPARATOR}{reference}", out var local))
+            return local;
+        return null;
+    }
+
+    // -- the gate ---------------------------------------------------------------------------
+
+    /// <summary>
+    /// Check the requirement tree against the loaded model. No requirements: no diagnostics.
+    /// Rows are evaluated per requirement in the order of the reference's code table; object
+    /// coverage runs once, after every requirement.
+    /// </summary>
+    public static IReadOnlyList<RequirementDiagnostic> Check(MetaData root, RequirementScan scan)
+    {
+        var output = new List<RequirementDiagnostic>();
+        if (scan.Addressed.Count == 0) return output; // opt-in by declaration
+
+        foreach (var (req, reqPath) in scan.Addressed)
+        {
+            var architectural = req.IsArchitectural();
+            // The number as authored: an integer beyond `int` must be reported as itself, not wrapped.
+            var level = req.RawLevel;
+            var refs = req.ImplementedBy;
+
+            // -- the level rules ------------------------------------------------------------
+            // A functional requirement MUST be levelled. An architectural one MAY be, and
+            // levelling is the OPT-IN: unlevelled it is a flat policy these rules must not touch.
+            var levelled = level is not null;
+            if (!architectural || levelled)
+            {
+                if (level is null || level < REQUIREMENT_MIN_LEVEL || level > REQUIREMENT_MAX_LEVEL)
+                {
+                    output.Add(Error(ERR_REQUIREMENT_BAD_LEVEL, reqPath, Invariant(
+                        $"level must be an integer {REQUIREMENT_MIN_LEVEL}-{REQUIREMENT_MAX_LEVEL} (got {Show(level)}). ") +
+                        "L1 solution, L2 segment (app/library), L3 service, L4 object, L5 member." +
+                        (architectural
+                            ? " On an architectural requirement the level is optional — omit it for a flat policy."
+                            : "")));
+                }
+                // Nesting IS the hierarchy, so a child must sit strictly below its parent.
+                if (req.Parent is { Type: TYPE_REQUIREMENT } parent)
+                {
+                    var parentLevel = ((MetaRequirement)parent).RawLevel;
+                    if (parentLevel is not null && level is not null && level <= parentLevel)
+                    {
+                        output.Add(Error(ERR_REQUIREMENT_LEVEL_NESTING, reqPath, Invariant(
+                            $"nested under \"{parent.Name}\" (level {parentLevel}) but declares level {level}. ") +
+                            "Nesting is the hierarchy — a child sits strictly below its parent."));
+                    }
+                }
+            }
+
+            // -- the link boundary ----------------------------------------------------------
+            if (refs.Count > 0 && !req.MayReferenceModel())
+            {
+                output.Add(Error(ERR_REQUIREMENT_LINK_ABOVE_FLOOR, reqPath,
+                    $"'implementedBy' is legal at L{REQUIREMENT_LINK_FLOOR_LEVEL} (object) and " +
+                    $"L{REQUIREMENT_MAX_LEVEL} (member) only. L1-L3 are organisational and never reference " +
+                    $"the model — move the links to a nested L{REQUIREMENT_LINK_FLOOR_LEVEL} child."));
+                continue;
+            }
+
+            var referrerPkg = EffectivePackage(req);
+            foreach (var reference in refs)
+            {
+                var split = RequirementClaims.SplitMemberRef(reference);
+                var node = RequirementClaims.ResolveClaimTarget(root, split.Owner, referrerPkg);
+                var isObjectRef = split.Path.Count == 0;
+
+                // GRAIN stays functional-only DELIBERATELY. On a functional requirement L4 and
+                // L5 MEAN "an object" and "a member". On a levelled architectural one the upper
+                // tiers are a quality taxonomy and L4/L5 retain only their link-floor meaning,
+                // so a policy whose claim set legitimately mixes grains must not be forced to
+                // split by grain to say so.
+                if (!architectural && level == REQUIREMENT_LINK_FLOOR_LEVEL && !isObjectRef)
+                {
+                    output.Add(Error(ERR_REQUIREMENT_L4_NOT_OBJECT, reqPath,
+                        $"L{REQUIREMENT_LINK_FLOOR_LEVEL} references an object; '{reference}' names a member. " +
+                        $"Move it to a nested L{REQUIREMENT_LEVEL_MEMBER} child, or reference the object itself."));
+                    continue;
+                }
+                if (!architectural && level == REQUIREMENT_LEVEL_MEMBER && isObjectRef)
+                {
+                    output.Add(Error(ERR_REQUIREMENT_L5_NOT_MEMBER, reqPath,
+                        $"L{REQUIREMENT_LEVEL_MEMBER} references a member (field, view or identity); " +
+                        $"'{reference}' names an object. Move it to its L{REQUIREMENT_LINK_FLOOR_LEVEL} parent."));
+                    continue;
+                }
+
+                var resolved = node is not null
+                    && (isObjectRef || RequirementClaims.ResolveMember(node, split.Path) is not null);
+                // Severity is CONDITIONAL ON STATUS. On `planned` the nodes do not exist YET:
+                // that is the entry doing its job, and the reason this check cannot live in the
+                // loader.
+                if (!resolved && req.RequiresLiveNodes())
+                {
+                    // The did-you-mean hint answers an OBJECT that failed to resolve. When the
+                    // object resolved and only the member is gone, name the member instead.
+                    // The hint builder is given the OWNER alone: it cuts a reference at the first
+                    // `.` of the whole string, which is right only once the reference is split.
+                    var hint = node is null
+                        ? NamingRefs.DidYouMeanHint(root, split.Owner)
+                        : MissingMemberHint(node, split.Path);
+                    output.Add(Error(ERR_REQUIREMENT_DANGLING_REF, reqPath,
+                        $"'{reference}' does not resolve in the loaded model (status '{Show(req.Status)}' — " +
+                        "the model moved and the requirement is stale)." + hint));
+                }
+            }
+
+            // -- @supersededBy resolution (FR-039) ------------------------------------------
+            // Resolution is what makes a supersession CHAIN survive: a prose note points one
+            // hop and rots when that hop is itself retired, while a resolved reference does not.
+            var superseded = req.SupersededBy;
+            if (superseded is not null
+                && ResolveRequirementRef(scan.Addressed, superseded, referrerPkg) is null)
+            {
+                output.Add(Error(ERR_REQUIREMENT_DANGLING_REF, reqPath,
+                    $"@supersededBy '{superseded}' does not name a requirement in the loaded " +
+                    "ledger. It must name the requirement that REPLACED this one — if nothing did, " +
+                    "drop the attribute and let `notes` carry why the capability went."));
+            }
+
+            // -- architectural universality, v1: claim-set arithmetic -----------------------
+            // A live policy claimed by nothing is declared and applied to nothing. Two
+            // exemptions, both structural: `planned` is SUPPOSED to be applied to nothing yet,
+            // and an ORGANISATIONAL node of a levelled architectural tree names nothing, exactly
+            // as an L1 functional node does (MayReferenceModel encodes "is this tier allowed to
+            // name the model at all").
+            var status = req.Status;
+            var live = req.RequiresLiveNodes();
+            if (architectural && live && refs.Count == 0 && req.MayReferenceModel())
+            {
+                output.Add(Error(ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS, reqPath,
+                    $"architectural requirement is '{Show(status)}' but nothing implements it. " +
+                    "Its check is universality — a claim set of zero means the policy is declared and unapplied."));
+            }
+
+            // -- disposition: the decision, not the state -----------------------------------
+            var disposition = req.Disposition;
+            if (disposition is not null && !req.HasOutstandingWork())
+            {
+                output.Add(Warn(WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE, reqPath,
+                    $"carries @disposition '{disposition}' but its status is '{Show(status)}', which has no " +
+                    "outstanding work to decide about. A disposition is meaningful on 'planned' and 'partial' only — " +
+                    "on any other status the decision IS the status."));
+            }
+
+            // -- functional existence, SUBTREE-scoped ---------------------------------------
+            // The strict switch raises the SEVERITY only. The code keeps its WARN_ name on
+            // purpose: it identifies the finding, and one finding under two codes would split
+            // every suppression and corpus case that keys on it.
+            if (!architectural && live && !SubtreeClaimsAnything(req))
+            {
+                output.Add(new RequirementDiagnostic(
+                    scan.RequireImplementers ? SeverityError : SeverityWarn,
+                    WARN_REQUIREMENT_NOTHING_IMPLEMENTS, reqPath,
+                    $"is '{Show(status)}' but neither it nor anything nested under it names an " +
+                    "implementing node. A functional requirement's check is existence — a subtree that claims " +
+                    "nothing is a capability nobody built."));
+            }
+
+            if (disposition == REQUIREMENT_DISPOSITION_DEFERRED && req.TrackedBy.Count == 0)
+            {
+                output.Add(Warn(WARN_REQUIREMENT_DEFERRED_UNTRACKED, reqPath,
+                    "is deferred but names no @trackedBy issue. Deferring without a ticket is how a known gap " +
+                    "becomes an unknown one — nothing will raise it again."));
+            }
+        }
+
+        // -- object coverage: adding an entity forces a requirement --------------------------
+        // Binary per entity, never a ratio. Entities only, object grain only, and ADOPTER-
+        // AUTHORED requirements only: a library's ledger is counted and checked, but it cannot
+        // volunteer you for coverage.
+        if (scan.MeasureCoverage)
+        {
+            foreach (var ent in CoverableEntities(root))
+            {
+                var key = ent.ResolutionKey();
+                if (scan.ClaimedObjects.Contains(key)) continue;
+                output.Add(new RequirementDiagnostic(
+                    OBJECT_COVERAGE_SEVERITY, WARN_REQUIREMENT_OBJECT_UNCLAIMED, null,
+                    $"no requirement claims '{key}'. Add it to an L{REQUIREMENT_LINK_FLOOR_LEVEL} requirement's 'implementedBy'."));
+            }
+        }
+
+        return output;
+    }
+
+    private static RequirementDiagnostic Error(string code, string path, string message) =>
+        new(SeverityError, code, path, message);
+
+    private static RequirementDiagnostic Warn(string code, string path, string message) =>
+        new(SeverityWarn, code, path, message);
+
+    /// <summary>The reference prints a missing value as <c>undefined</c>.</summary>
+    private static string Show(object? value) => value switch
+    {
+        null => "undefined",
+        // Invariant: a message is bytes the other ports reproduce, whatever the machine's culture.
+        IFormattable f => f.ToString(null, CultureInfo.InvariantCulture),
+        _ => value.ToString() ?? "undefined",
+    };
+
+    private static string Invariant(FormattableString text) => text.ToString(CultureInfo.InvariantCulture);
+
+    /// <summary>
+    /// Names the FIRST segment of a non-empty, unresolvable <paramref name="path"/> under
+    /// <paramref name="obj"/>, and the node it was looked for under:
+    /// <c>acme::shop::Order.reference.display</c> with <c>reference</c> still present reads
+    /// "'acme::shop::Order.reference' has no member 'display'", not the whole tail.
+    /// </summary>
+    private static string MissingMemberHint(MetaData obj, IReadOnlyList<string> path)
+    {
+        var found = 0;
+        while (found < path.Count - 1 && RequirementClaims.ResolveMember(obj, path.Take(found + 1).ToList()) is not null)
+            found++;
+        var parent = string.Join(CHILD_REF_SEPARATOR, new[] { obj.ResolutionKey() }.Concat(path.Take(found)));
+        return $" '{parent}' has no member '{path[found]}'.";
+    }
+
+    // -- the summary ------------------------------------------------------------------------
+
+    /// <summary>
+    /// Count what the ledger contains, for the line <c>verify</c> prints on EVERY run, clean or
+    /// not. Silence is ambiguous: a run that prints nothing cannot be told apart from a run that
+    /// checked nothing. Null when the model declares no requirement.
+    /// </summary>
+    public static RequirementSummary? Summarise(MetaData root, RequirementScan scan)
+    {
+        var reqs = scan.Addressed;
+        if (reqs.Count == 0) return null; // opt-in by declaration
+
+        int functional = 0, architectural = 0, undecided = 0, deferredUntracked = 0;
+        var byStatus = new Dictionary<string, int>(StringComparer.Ordinal);
+
+        // `undecided` counts only the requirements a `@disposition` could actually SETTLE. A
+        // parent is `partial` because a descendant is, so a disposition on it would settle
+        // nothing and name no work. EVERY ancestor of a node with outstanding work is excluded
+        // (real ledgers are five deep), and it marks its ancestors whether or not it is itself
+        // DISPOSED: once the only outstanding leaf under a parent has been ruled on, nothing
+        // beneath that parent is owed, so the parent must not be resurrected as a fresh
+        // decision by the roll-up status the ruled-on child gave it. Ancestry comes from the
+        // scan's own dotted PATHS, so it cannot disagree with how every other check addresses
+        // a node; `::` carries no dot, so splitting on "." keeps a package-qualified segment.
+        var rollUpAncestors = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var (node, path) in reqs)
+        {
+            if (!node.HasOutstandingWork()) continue;
+            var segments = path.Split('.');
+            for (var i = 1; i < segments.Length; i++)
+                rollUpAncestors.Add(string.Join('.', segments.Take(i)));
+        }
+
+        foreach (var (req, path) in reqs)
+        {
+            if (req.IsArchitectural()) architectural++; else functional++;
+
+            // byStatus is UNCHANGED by the roll-up on purpose: a roll-up parent is still
+            // genuinely `partial`. Only the "decisions owed" count narrows.
+            if (req.Status is { } status) byStatus[status] = byStatus.GetValueOrDefault(status) + 1;
+
+            if (req.HasOutstandingWork() && req.Disposition is null && !rollUpAncestors.Contains(path))
+                undecided++;
+            if (req.Disposition == REQUIREMENT_DISPOSITION_DEFERRED && req.TrackedBy.Count == 0)
+                deferredUntracked++;
+        }
+
+        // Both sides of the ratio come from the SAME scan the gate read.
+        int? entitiesClaimed = null, entitiesTotal = null;
+        if (scan.MeasureCoverage)
+        {
+            var entities = CoverableEntities(root);
+            entitiesTotal = entities.Count;
+            entitiesClaimed = entities.Count(e => scan.ClaimedObjects.Contains(e.ResolutionKey()));
+        }
+
+        return new RequirementSummary(
+            reqs.Count, functional, architectural, byStatus, undecided, deferredUntracked,
+            entitiesClaimed, entitiesTotal);
+    }
+}
diff --git a/server/csharp/MetaObjects/Core/Requirement/RequirementClaims.cs b/server/csharp/MetaObjects/Core/Requirement/RequirementClaims.cs
new file mode 100644
index 000000000..dcc723b1c
--- /dev/null
+++ b/server/csharp/MetaObjects/Core/Requirement/RequirementClaims.cs
@@ -0,0 +1,106 @@
+// RequirementClaims — resolve an `@implementedBy` reference to the node it names.
+//
+// Ported 1:1 from
+//   server/typescript/packages/metadata/src/core/requirement/resolve-claim.ts
+// plus `splitMemberRef` from the TypeScript gate (cli/src/lib/requirement-check.ts).
+//
+// ONE resolver, shared by the requirement gate (RequirementCheck) and the
+// requirement-test generator, so the ADR-0042 package-local binding contract has a
+// single owner and a second name scan never forks it.
+
+using MetaObjects.Meta;
+
+namespace MetaObjects.Core.Requirement;
+
+/// <summary>Resolves requirement claims (<c>@implementedBy</c> references) against the loaded model.</summary>
+public static class RequirementClaims
+{
+    /// <summary>A reference split into its owning root-level node and the dotted member path under it.</summary>
+    public sealed record MemberRef(string Owner, IReadOnlyList<string> Path);
+
+    /// <summary>
+    /// Split a member reference into its owning ref and the dotted member path. <c>::</c>
+    /// qualifies the ROOT-level node only, so the owner ends at the first <c>.</c> after
+    /// the last <c>::</c>: <c>acme::sales::Order.total.display</c> gives owner
+    /// <c>acme::sales::Order</c> and path <c>[total, display]</c>.
+    /// </summary>
+    public static MemberRef SplitMemberRef(string reference)
+    {
+        int pkgEnd = reference.LastIndexOf(PACKAGE_SEPARATOR, StringComparison.Ordinal);
+        int from = pkgEnd == -1 ? 0 : pkgEnd + PACKAGE_SEPARATOR.Length;
+        int dot = reference.IndexOf(CHILD_REF_SEPARATOR, from, StringComparison.Ordinal);
+        if (dot == -1) return new MemberRef(reference, []);
+        return new MemberRef(
+            reference[..dot],
+            reference[(dot + CHILD_REF_SEPARATOR.Length)..].Split(CHILD_REF_SEPARATOR));
+    }
+
+    /// <summary>
+    /// Resolve the owner segment of an <c>@implementedBy</c> reference to the node it names.
+    ///
+    /// <para>OBJECTS FIRST, through the loader's own resolver
+    /// (<see cref="NamingRefs.ResolveObjectRef"/>), so package-local binding stays the ADR-0042
+    /// contract and never a parallel name scan (#228). Then ROOT-LEVEL NON-OBJECT nodes: a
+    /// <c>template.prompt</c> and its siblings. Requirements are excluded: hierarchy is nesting,
+    /// and a requirement claiming a requirement would be a second, contradictory parent
+    /// mechanism.</para>
+    /// </summary>
+    /// <param name="referrerPkg">The effective package of the requirement making the claim.</param>
+    /// <returns>The node, or null when nothing matches or the match is ambiguous.</returns>
+    public static MetaData? ResolveClaimTarget(MetaData root, string owner, string referrerPkg)
+    {
+        var obj = NamingRefs.ResolveObjectRef(root, owner, referrerPkg);
+        if (obj is not null) return obj;
+
+        var candidates = root.Children()
+            .Where(c => c.Type != TYPE_OBJECT && c.Type != TYPE_REQUIREMENT)
+            .ToList();
+
+        // A fully-qualified reference binds exactly, like every other FQN in the model.
+        if (owner.Contains(PACKAGE_SEPARATOR, StringComparison.Ordinal))
+            return candidates.FirstOrDefault(c => c.ResolutionKey() == owner);
+
+        // A bare reference prefers the referrer's own package, then a root-level node of that
+        // bare name. An ambiguous bare name binds NOTHING: the same fail-closed rule objects use.
+        if (referrerPkg.Length > 0)
+        {
+            var localKey = $"{referrerPkg}{PACKAGE_SEPARATOR}{owner}";
+            var local = candidates.Where(c => c.ResolutionKey() == localKey).ToList();
+            if (local.Count == 1) return local[0];
+        }
+        // Root-level (unpackaged) only, matching ResolveObjectRef's own bare fallback.
+        var bare = candidates.Where(c => c.Name == owner && c.ResolutionKey() == owner).ToList();
+        return bare.Count == 1 ? bare[0] : null;
+    }
+
+    /// <summary>
+    /// Walk dotted member segments by CHILD NAME from a node, to full depth. Exposed beside
+    /// <see cref="ResolveClaimTarget"/> because the gate's coverage pass needs the OWNER node's
+    /// key while using member resolution only as a yes/no validity test.
+    /// </summary>
+    public static MetaData? ResolveMember(MetaData obj, IReadOnlyList<string> path)
+    {
+        MetaData? cur = obj;
+        foreach (var seg in path)
+        {
+            if (cur is null) return null;
+            cur = cur.Children().FirstOrDefault(c => c.Name == seg);
+        }
+        return cur;
+    }
+
+    /// <summary>
+    /// Resolve a full <c>@implementedBy</c> reference, owner plus any dotted member segments, to
+    /// the node it names, or null. Resolution walks to the FULL depth of the reference, so
+    /// <c>Council.slug.display</c> yields the view node rather than stopping at the field.
+    /// </summary>
+    public static MetaData? ResolveClaim(MetaData root, string reference, string referrerPkg)
+    {
+        // Segments split on every dot, as the reference does: a package qualifies the root
+        // node only and carries no dot, so the first segment is the whole owner.
+        var segs = reference.Split(CHILD_REF_SEPARATOR);
+        var owner = ResolveClaimTarget(root, segs[0], referrerPkg);
+        if (owner is null || segs.Length == 1) return owner;
+        return ResolveMember(owner, segs[1..]);
+    }
+}
diff --git a/server/csharp/MetaObjects/Core/Requirement/RequirementTestIdentities.cs b/server/csharp/MetaObjects/Core/Requirement/RequirementTestIdentities.cs
new file mode 100644
index 000000000..aa4af1fde
--- /dev/null
+++ b/server/csharp/MetaObjects/Core/Requirement/RequirementTestIdentities.cs
@@ -0,0 +1,360 @@
+// RequirementTestIdentities — which tests a requirement ledger yields, what each is called,
+// whether it is skipped, and a fingerprint of the claim it tests (ADR-0057).
+//
+// Everything here is what every language port agrees on and the shared
+// fixtures/requirement-test-identity-conformance/ corpus pins; how a test is WRITTEN is the
+// generator's business and differs per port.
+//
+// Ported 1:1 from `requirementTestIdentities` and its helpers in the TypeScript reference,
+// server/typescript/packages/codegen-ts/src/requirement-walk.ts (the Java port is
+// com.metaobjects.requirement.RequirementTestIdentities). It lives here, in the core library
+// beside the walk and the claim resolver, rather than in the generator, because an application
+// that owns its generator (`dotnet meta eject requirement-tests`) still uses it from the
+// package: an owned copy changes how a test is written and keeps agreeing with every other tool
+// about which tests exist.
+
+using System.Globalization;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.RegularExpressions;
+using MetaObjects.Meta;
+
+namespace MetaObjects.Core.Requirement;
+
+/// <summary>
+/// The fan-out unit: what one generated test stands for.
+/// <see cref="Concern"/> (the default): one test per distinct <c>&lt;type&gt;.&lt;subType&gt;</c> a
+/// requirement claims. <see cref="Member"/>: one test per distinct <c>implementedBy</c> reference
+/// that resolves, spelt exactly as authored.
+/// </summary>
+public enum RequirementTestGrain
+{
+    Concern,
+    Member,
+}
+
+/// <summary>The spelling a grain has outside code, and the refusal of anything that is not one.</summary>
+public static class RequirementTestGrains
+{
+    /// <summary>
+    /// Refuse anything that is not a grain. A grain that arrives as text (an option file, a
+    /// config) would otherwise be picked by accident, and not even one grain: each place that
+    /// branches on it would fall to its own default.
+    /// </summary>
+    /// <exception cref="ArgumentException">for any value other than <c>concern</c> or <c>member</c>.</exception>
+    public static RequirementTestGrain Parse(string? value) => value switch
+    {
+        "concern" => RequirementTestGrain.Concern,
+        "member" => RequirementTestGrain.Member,
+        _ => throw new ArgumentException(Refusal(value is null ? "null" : $"\"{value}\"")),
+    };
+
+    /// <summary>
+    /// Refuse an enum value that names no grain: <c>(RequirementTestGrain)5</c> is a legal
+    /// C# value, and the branch that tests for <see cref="RequirementTestGrain.Member"/> would
+    /// run it as a hybrid of the two.
+    /// </summary>
+    /// <exception cref="ArgumentException">when <paramref name="grain"/> is not a defined member.</exception>
+    public static void Require(RequirementTestGrain grain)
+    {
+        if (!Enum.IsDefined(grain))
+            throw new ArgumentException(Refusal(((int)grain).ToString(CultureInfo.InvariantCulture)));
+    }
+
+    private static string Refusal(string shown) =>
+        $"unknown requirement-test grain {shown}: expected \"concern\" or \"member\".";
+}
+
+/// <summary>
+/// What a filter receives; never the node. <see cref="Level"/> is <c>null</c> on a requirement that
+/// declares none (an unlevelled architectural requirement), which is not a number: a requirement
+/// declared at level 0 or -1 has that level. <see cref="Package"/> is the EFFECTIVE package.
+/// </summary>
+public sealed record RequirementView(
+    string SubType,
+    int? Level,
+    string? Status,
+    string Path,
+    string Package,
+    IReadOnlyList<string> ImplementedByTypes);
+
+/// <summary>A predicate over the requirement view: which requirements get a test. It REPLACES the default.</summary>
+public interface IRequirementTestFilter
+{
+    bool Include(RequirementView view);
+}
+
+/// <summary>One generated test. The same record in every language port.</summary>
+/// <param name="Package">The requirement's effective package.</param>
+/// <param name="Path">The requirement's dotted path, without the package.</param>
+/// <param name="Unit"><c>&lt;type&gt;.&lt;subType&gt;</c> under the concern grain, the reference as authored under the member grain, and <c>*</c> for a requirement that resolves no target.</param>
+/// <param name="Id"><c>&lt;qualified address&gt; [&lt;unit&gt;]</c>, unique per test.</param>
+/// <param name="WitnessKey">An identifier-safe spelling of <paramref name="Id"/>.</param>
+/// <param name="Status">The requirement's status.</param>
+/// <param name="Skip">Why the test is skipped, or <c>null</c> when the requirement claims the capability works right now.</param>
+/// <param name="Digest">The requirement digest, the same for each test of one requirement.</param>
+public sealed record RequirementTestIdentity(
+    string Package,
+    string Path,
+    string Unit,
+    string Id,
+    string WitnessKey,
+    string? Status,
+    string? Skip,
+    string Digest);
+
+/// <summary>A resolved <c>implementedBy</c> reference: as authored, the node it names, and its concern.</summary>
+public sealed record ResolvedClaim(string Ref, MetaData Node, string Concern);
+
+/// <summary>One requirement, projected for a filter, with the targets its references resolved to.</summary>
+public sealed record WalkedRequirement(MetaRequirement Node, RequirementView View, IReadOnlyList<ResolvedClaim> Targets);
+
+/// <summary>One fan-out unit of a requirement: the unit's name and the targets it stands for.</summary>
+public sealed record RequirementTestUnit(string Unit, IReadOnlyList<ResolvedClaim> Targets);
+
+/// <summary>One test: the requirement it belongs to, its unit with that unit's targets, and its identity.</summary>
+public sealed record RequirementTestPlan(WalkedRequirement Requirement, RequirementTestUnit Unit, RequirementTestIdentity Identity);
+
+/// <summary>
+/// What a grain and a filter select: how many requirements the model holds, the tests in id order, and the
+/// paths of the requirements the filter excluded.
+/// </summary>
+public sealed record RequirementTestSelection(
+    int RequirementCount,
+    IReadOnlyList<RequirementTestPlan> Tests,
+    IReadOnlyList<string> ExcludedPaths);
+
+/// <summary>The identity function: walk, units, identity, digest, witness key.</summary>
+public static class RequirementTestIdentities
+{
+    /// <summary>The unit a test stands for when the requirement resolves no target.</summary>
+    public const string NoUnit = "*";
+
+    private const string DigestVersion = "requirement-digest/v1";
+
+    /// <summary><c>&lt;type&gt;.&lt;subType&gt;</c>: the key a renderer or a filter reasons about.</summary>
+    public static string ConcernOf(MetaData node) => $"{node.Type}.{node.SubType}";
+
+    /// <summary>
+    /// RECOMMENDATION, not a rule: functional requirements at or below the link floor.
+    /// Architectural requirements are excluded by default because <c>verify</c>'s universality
+    /// check already proves them structurally. It is overridable.
+    /// </summary>
+    public static bool DefaultFilter(RequirementView view) =>
+        view.SubType == RequirementConstants.REQUIREMENT_SUBTYPE_FUNCTIONAL
+        && (view.Level ?? 0) >= RequirementConstants.REQUIREMENT_LINK_FLOOR_LEVEL;
+
+    // -- the walk ---------------------------------------------------------------------------
+
+    /// <summary>
+    /// Every requirement in walk order with its view and resolved targets. An
+    /// <c>implementedBy</c> reference that does not resolve is skipped rather than reported: its
+    /// severity depends on <c>@status</c> and belongs to <c>verify</c>, and codegen must not
+    /// fail a build over a diagnostic another command owns.
+    /// </summary>
+    public static IReadOnlyList<WalkedRequirement> Walk(MetaData root)
+    {
+        var output = new List<WalkedRequirement>();
+        foreach (var addressed in RequirementCheck.CollectAddressed(root))
+        {
+            var node = addressed.Node;
+            // One effective package, shared with the gate.
+            var package = RequirementCheck.EffectivePackage(node);
+            var targets = new List<ResolvedClaim>();
+            foreach (var reference in node.ImplementedBy)
+            {
+                var target = RequirementClaims.ResolveClaim(root, reference, package);
+                if (target is not null) targets.Add(new ResolvedClaim(reference, target, ConcernOf(target)));
+            }
+            var concerns = targets.Select(t => t.Concern).Distinct(StringComparer.Ordinal).ToList();
+            output.Add(new WalkedRequirement(
+                node,
+                new RequirementView(node.SubType, node.Level, node.Status, addressed.Path, package, concerns),
+                targets));
+        }
+        return output;
+    }
+
+    /// <summary>
+    /// A requirement's targets grouped by fan-out unit under <paramref name="grain"/>, one entry
+    /// per test, in first-seen order. Under the member grain a reference authored twice is one
+    /// test and the bare and qualified spellings of one node are two: the unit is the reference
+    /// as written. In both grains a requirement resolving NO target still yields exactly one
+    /// entry, with unit <see cref="NoUnit"/>: the link floor forbids <c>implementedBy</c> below L4,
+    /// so every L1 to L3 requirement resolves nothing, and an application that chooses to cover
+    /// one would otherwise get silence.
+    /// </summary>
+    public static IReadOnlyList<RequirementTestUnit> Units(WalkedRequirement walked, RequirementTestGrain grain)
+    {
+        RequirementTestGrains.Require(grain);
+        var order = new List<string>();
+        var byUnit = new Dictionary<string, List<ResolvedClaim>>(StringComparer.Ordinal);
+        foreach (var target in walked.Targets)
+        {
+            var key = grain == RequirementTestGrain.Member ? target.Ref : target.Concern;
+            if (!byUnit.TryGetValue(key, out var group))
+            {
+                byUnit[key] = group = [];
+                order.Add(key);
+                group.Add(target);
+            }
+            else if (grain == RequirementTestGrain.Concern)
+            {
+                group.Add(target);
+            }
+        }
+        if (order.Count == 0) return [new RequirementTestUnit(NoUnit, [])];
+        return order.Select(key => new RequirementTestUnit(key, byUnit[key])).ToList();
+    }
+
+    /// <summary>The qualified address: <c>&lt;package&gt;::&lt;path&gt;</c>, or the bare path when the package is empty.</summary>
+    public static string AddressOf(string package, string path) =>
+        package.Length == 0 ? path : package + PACKAGE_SEPARATOR + path;
+
+    /// <summary>The identity of the one test <paramref name="unit"/> stands for (a unit of <see cref="Units"/>).</summary>
+    public static RequirementTestIdentity IdentityOf(WalkedRequirement walked, string unit)
+    {
+        var view = walked.View;
+        var address = AddressOf(view.Package, view.Path);
+        // Derived from the loader's status list rather than naming the two skipped statuses:
+        // a status that does not claim the capability works right now is skipped by
+        // construction, so a status added later cannot be left failing by omission.
+        var skips = view.Status is not null
+            && !RequirementConstants.REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES.Contains(view.Status);
+        return new RequirementTestIdentity(
+            view.Package,
+            view.Path,
+            unit,
+            $"{address} [{unit}]",
+            WitnessKeyOf(address, unit),
+            view.Status,
+            skips ? view.Status : null,
+            Digest(walked.Node));
+    }
+
+    /// <summary>
+    /// Every test the generator would emit, sorted by id (UTF-16 code units, never a culture
+    /// collation: this order is pinned by a corpus every port runs).
+    /// </summary>
+    /// <param name="grain"><c>null</c> means <see cref="RequirementTestGrain.Concern"/>.</param>
+    /// <param name="filter"><c>null</c> means <see cref="DefaultFilter"/>; a filter REPLACES the default.</param>
+    public static IReadOnlyList<RequirementTestIdentity> Identities(
+        MetaData root, RequirementTestGrain? grain = null, IRequirementTestFilter? filter = null) =>
+        Select(root, grain, filter).Tests.Select(t => t.Identity).ToList();
+
+    /// <summary>
+    /// The one selection both <see cref="Identities"/> (which the corpus pins) and a generator use: every test
+    /// the grain and the filter yield, each with its requirement and the targets of its unit, sorted by id, and
+    /// the paths of the requirements the filter excluded. A generator that selected for itself could disagree
+    /// with the function the corpus pins.
+    /// </summary>
+    /// <param name="grain"><c>null</c> means <see cref="RequirementTestGrain.Concern"/>.</param>
+    /// <param name="filter"><c>null</c> means <see cref="DefaultFilter"/>; a filter REPLACES the default.</param>
+    public static RequirementTestSelection Select(
+        MetaData root, RequirementTestGrain? grain = null, IRequirementTestFilter? filter = null)
+    {
+        // Checked here as well as per requirement, so a bad grain is refused even over a ledger
+        // the filter empties: the answer must not depend on what the model holds.
+        var g = grain ?? RequirementTestGrain.Concern;
+        RequirementTestGrains.Require(g);
+        var walked = Walk(root);
+        var tests = new List<RequirementTestPlan>();
+        var excluded = new List<string>();
+        foreach (var requirement in walked)
+        {
+            var keep = filter is null ? DefaultFilter(requirement.View) : filter.Include(requirement.View);
+            if (!keep)
+            {
+                // The PATH, not the qualified address: diagnostics name paths, in every port.
+                excluded.Add(requirement.View.Path);
+                continue;
+            }
+            foreach (var unit in Units(requirement, g))
+                tests.Add(new RequirementTestPlan(requirement, unit, IdentityOf(requirement, unit.Unit)));
+        }
+        // A stable sort: two tests with one id (a collision the caller refuses) keep their walk order.
+        var sorted = tests.OrderBy(t => t.Identity.Id, StringComparer.Ordinal).ToList();
+        return new RequirementTestSelection(walked.Count, sorted, excluded);
+    }
+
+    // -- witness key ------------------------------------------------------------------------
+
+    // ASCII [A-Za-z0-9] and nothing else: `_` is outside the class, so `Orders__Recorded` mangles
+    // to `Orders_Recorded`. char.IsLetterOrDigit and Regex's \w both keep accented letters (and
+    // \w keeps the underscore), and are wrong here.
+    private static readonly Regex NotAsciiAlphanumeric = new("[^A-Za-z0-9]+", RegexOptions.CultureInvariant);
+
+    /// <summary>
+    /// Every maximal run of characters outside ASCII <c>[A-Za-z0-9]</c> becomes one <c>_</c>. Public so a
+    /// generator derives a file name from a package by the one rule the witness keys follow.
+    /// </summary>
+    public static string Mangle(string s) => NotAsciiAlphanumeric.Replace(s, "_");
+
+    /// <summary>
+    /// An identifier-safe key for one test: <c>req_&lt;address&gt;</c>, then <c>__&lt;unit&gt;</c> unless the
+    /// requirement resolves no target. Mangling is lossy (<c>Orders.Recorded</c> and
+    /// <c>Orders_Recorded</c> give one key), which is what <see cref="WitnessKeyCollisions"/> reports.
+    /// </summary>
+    public static string WitnessKeyOf(string qualifiedAddress, string unit)
+    {
+        var baseKey = "req_" + Mangle(qualifiedAddress);
+        return unit == NoUnit ? baseKey : baseKey + "__" + Mangle(unit);
+    }
+
+    /// <summary>Pairs of ids that share a witness key, each pair and the list sorted.</summary>
+    public static IReadOnlyList<(string First, string Second)> WitnessKeyCollisions(IEnumerable<RequirementTestIdentity> tests)
+    {
+        var byKey = new Dictionary<string, List<string>>(StringComparer.Ordinal);
+        foreach (var test in tests)
+        {
+            if (!byKey.TryGetValue(test.WitnessKey, out var ids)) byKey[test.WitnessKey] = ids = [];
+            ids.Add(test.Id);
+        }
+        var pairs = new List<(string First, string Second)>();
+        foreach (var ids in byKey.Values)
+        {
+            var sorted = ids.Order(StringComparer.Ordinal).ToList();
+            for (var i = 0; i < sorted.Count; i++)
+                for (var j = i + 1; j < sorted.Count; j++) pairs.Add((sorted[i], sorted[j]));
+        }
+        pairs.Sort((a, b) =>
+        {
+            var c = string.CompareOrdinal(a.First, b.First);
+            return c != 0 ? c : string.CompareOrdinal(a.Second, b.Second);
+        });
+        return pairs;
+    }
+
+    // -- digest -----------------------------------------------------------------------------
+
+    /// <summary><c>&lt;name&gt; &lt;byte length&gt;\n&lt;value&gt;\n</c>: length-prefixed, so no value can be confused with the field after it.</summary>
+    private static string DigestField(string name, string value) =>
+        string.Create(CultureInfo.InvariantCulture, $"{name} {Encoding.UTF8.GetByteCount(value)}\n{value}\n");
+
+    /// <summary><c>\r\n</c> and a lone <c>\r</c> become <c>\n</c>; an absent value is empty.</summary>
+    private static string Prose(string? value) =>
+        value is null ? "" : value.Replace("\r\n", "\n", StringComparison.Ordinal).Replace('\r', '\n');
+
+    /// <summary>
+    /// <c>requirement-digest/v1</c>: lowercase hex SHA-256 of the requirement's subtype, level,
+    /// status, statement, counterexample and <c>implementedBy</c> list. It answers "did the claim
+    /// change", not "did the entry move": the name, the package, the title, the notes, the
+    /// disposition, the tracking references and nested requirements are left out. Every value is the
+    /// EFFECTIVE one (resolving accessors, ADR-0039), so a requirement inheriting its statement
+    /// through <c>extends</c> hashes what it effectively says. The level is the decimal integer as
+    /// authored (<see cref="MetaRequirement.RawLevel"/>, which does not saturate).
+    /// </summary>
+    public static string Digest(MetaRequirement node)
+    {
+        var refs = node.ImplementedBy;
+        var text = new StringBuilder(DigestVersion).Append('\n')
+            .Append(DigestField("subType", node.SubType))
+            .Append(DigestField("level", node.RawLevel?.ToString(CultureInfo.InvariantCulture) ?? ""))
+            .Append(DigestField("status", node.Status ?? ""))
+            .Append(DigestField("statement", Prose(node.Attr(RequirementConstants.REQUIREMENT_ATTR_STATEMENT) as string)))
+            .Append(DigestField("counterexample", Prose(node.Attr(RequirementConstants.REQUIREMENT_ATTR_COUNTEREXAMPLE) as string)))
+            .Append(string.Create(CultureInfo.InvariantCulture, $"implementedBy {refs.Count}\n"));
+        foreach (var reference in refs) text.Append(DigestField("ref", reference));
+        return Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(text.ToString()))).ToLowerInvariant();
+    }
+}
diff --git a/server/csharp/MetaObjects/Library/LibrarySources.cs b/server/csharp/MetaObjects/Library/LibrarySources.cs
index 48cce9161..2c86d6c28 100644
--- a/server/csharp/MetaObjects/Library/LibrarySources.cs
+++ b/server/csharp/MetaObjects/Library/LibrarySources.cs
@@ -105,6 +105,36 @@ public static IReadOnlyList<string> KnownTokens() =>
     public static IReadOnlyList<string> KnownPackages() =>
         LayersByLibrary.Keys.OrderBy(k => k, StringComparer.Ordinal).ToList();
 
+    /// <summary>Resolved once per process: the union of <c>packages</c> across the embedded manifests.</summary>
+    private static readonly Lazy<IReadOnlySet<string>> LibraryPackageSet = new(BuildLibraryPackages);
+
+    private static IReadOnlySet<string> BuildLibraryPackages()
+    {
+        var packages = new SortedSet<string>(StringComparer.Ordinal);
+        foreach (var text in EmbeddedLibrary.Manifests.Values)
+        {
+            using var doc = JsonDocument.Parse(text);
+            if (!doc.RootElement.TryGetProperty("packages", out var el)) continue;
+            foreach (var p in el.EnumerateArray())
+            {
+                if (p.GetString() is { } s) packages.Add(s);
+            }
+        }
+        return packages;
+    }
+
+    /// <summary>
+    /// The union of <c>packages</c> across every shipped library manifest: the metamodel
+    /// packages the libraries own (<c>metaobjects::iam</c>, <c>metaobjects::ai</c>).
+    ///
+    /// <para>The provenance key for requirement-coverage activation (FR-043 §5.4): a
+    /// requirement whose effective package is in this set came from a shipped library, not
+    /// from the adopter. Read from the embedded manifests, never from a node's source id,
+    /// which differs between a checkout (a path) and an installed package
+    /// (<c>library:&lt;ref&gt;.yaml</c>). Mirrors the TypeScript <c>libraryPackages</c>.</para>
+    /// </summary>
+    public static IReadOnlySet<string> LibraryPackages() => LibraryPackageSet.Value;
+
     /// <summary>
     /// Locate the repo-root <c>library/</c> directory by walking up from this assembly's
     /// location until a directory contains BOTH <c>library/</c> and <c>server/</c> — the two
diff --git a/server/csharp/MetaObjects/Meta/MetaRequirement.cs b/server/csharp/MetaObjects/Meta/MetaRequirement.cs
index 273a887ce..23ae358c3 100644
--- a/server/csharp/MetaObjects/Meta/MetaRequirement.cs
+++ b/server/csharp/MetaObjects/Meta/MetaRequirement.cs
@@ -26,20 +26,27 @@ public class MetaRequirement(TypeId typeId, string name) : MetaData(typeId, name
     /// present opts the node into a levelled tree (e.g. a quality taxonomy).
     /// ADR-0039: resolving — @level may be inherited via extends.
     /// </summary>
-    public int? Level
+    public int? Level => RawLevel switch
     {
-        get
+        // Saturating, never wrapping: an out-of-range integer must not read as a valid level.
+        // Callers that need the number as authored (the gate's message) read RawLevel.
+        long l => (int)Math.Clamp(l, int.MinValue, int.MaxValue),
+        _ => null,
+    };
+
+    /// <summary>
+    /// <c>@level</c> as authored, without narrowing: the number a diagnostic must print, and the one
+    /// range checks compare, so a value beyond <c>int</c> is reported as itself.
+    /// ADR-0039: resolving — @level may be inherited via extends.
+    /// </summary>
+    public long? RawLevel =>
+        // An `int`-typed attr arrives as long OR int (ValueMatchesType accepts both).
+        Attr(REQUIREMENT_ATTR_LEVEL) switch
         {
-            // An `int`-typed attr arrives as long OR int (ValueMatchesType accepts both).
-            var v = Attr(REQUIREMENT_ATTR_LEVEL);
-            return v switch
-            {
-                int i => i,
-                long l => (int)l,
-                _ => null,
-            };
-        }
-    }
+            int i => i,
+            long l => l,
+            _ => null,
+        };
 
     /// <summary>
     /// The lifecycle status (a closed enum: planned / live / partial).
@@ -90,6 +97,22 @@ public IReadOnlyList<string> TrackedBy
     /// </summary>
     public bool IsPlanned() => Status == REQUIREMENT_STATUS_PLANNED;
 
+    /// <summary>
+    /// Built, then deliberately removed. Exempt from every check that assumes a built
+    /// thing, never counts toward object coverage, and may not carry
+    /// <c>@implementedBy</c> (the loader refuses it).
+    /// </summary>
+    public bool IsRetired() => Status == REQUIREMENT_STATUS_RETIRED;
+
+    /// <summary>
+    /// The requirement that REPLACED this one (FR-039). Legal on <c>retired</c> only;
+    /// <c>verify</c> resolves it against the ledger, so a supersession chain stays
+    /// walkable. A blank value is absent, as in the TypeScript reference.
+    /// ADR-0039: resolving — inheritable via extends.
+    /// </summary>
+    public string? SupersededBy =>
+        Attr(REQUIREMENT_ATTR_SUPERSEDED_BY) is string v && v.Trim() != "" ? v : null;
+
     /// <summary>True when there is outstanding work, so a <c>@disposition</c> says something.</summary>
     public bool HasOutstandingWork()
     {
diff --git a/server/java/README.md b/server/java/README.md
index fc9dd296d..99fe7c53f 100644
--- a/server/java/README.md
+++ b/server/java/README.md
@@ -6,7 +6,7 @@ For the standard itself (metamodel, conformance corpora, ADRs) see the [reposito
 
 ## What ships
 
-The first four MetaObjects pillars ship across all five language ports — TypeScript, Java, Kotlin, C#, Python; the fifth (requirements and testing) ships its vocabulary and `verify` checks in every port and its test scaffolding in TypeScript only. Java's contributions:
+The first four MetaObjects pillars ship across all five language ports — TypeScript, Java, Kotlin, C#, Python; the fifth (requirements and testing) ships its vocabulary, `verify` checks and a `requirement-tests` generator in every port, and its authoring lint in TypeScript only. Java's contributions:
 
 Only the loader and registry, runtime metadata access and the drift gates are a MetaObjects
 guarantee. The generators are reference helpers: copy one into your build with
diff --git a/server/java/codegen-base/src/main/java/com/metaobjects/generator/ProjectClassLoaderAware.java b/server/java/codegen-base/src/main/java/com/metaobjects/generator/ProjectClassLoaderAware.java
new file mode 100644
index 000000000..a00624e99
--- /dev/null
+++ b/server/java/codegen-base/src/main/java/com/metaobjects/generator/ProjectClassLoaderAware.java
@@ -0,0 +1,22 @@
+package com.metaobjects.generator;
+
+/**
+ * Implemented by a generator that must load a class the PROJECT names in one of its args (a
+ * renderer or a filter, say). The Maven plugin hands such a generator the project's class
+ * loader right after constructing it.
+ *
+ * <p>It exists because a packaged generator is found through the plugin's own class loader,
+ * which cannot see the project's classes: the project loader is a child that delegates to its
+ * parent first, so a generator that loads a named class through its own loader never finds one
+ * that lives only in the project. A generator that needs no project class does not implement
+ * this, and every generator is still constructed the same way.</p>
+ */
+public interface ProjectClassLoaderAware {
+
+    /**
+     * The loader that sees the project's classpath as the running goal builds it: runtime and
+     * compile elements in {@code generate-sources}, and the test classpath and compiled
+     * classes as well in the test-source and cli phases. Never {@code null}.
+     */
+    void setProjectClassLoader(ClassLoader projectClassLoader);
+}
diff --git a/server/java/codegen-base/src/main/java/com/metaobjects/generator/requirement/RenderedTest.java b/server/java/codegen-base/src/main/java/com/metaobjects/generator/requirement/RenderedTest.java
new file mode 100644
index 000000000..15fb1386b
--- /dev/null
+++ b/server/java/codegen-base/src/main/java/com/metaobjects/generator/requirement/RenderedTest.java
@@ -0,0 +1,26 @@
+package com.metaobjects.generator.requirement;
+
+import java.util.List;
+
+/**
+ * What a {@link RequirementTestRenderer} returns for one test: the source of that test in the
+ * language of the generator that asked (Java for the Java generator, Kotlin for the Kotlin one),
+ * and the imports it needs.
+ *
+ * @param imports names to import in that language, each without {@code import} and any trailing
+ *                semicolon ({@code org.junit.jupiter.api.Assertions}; the Java generator also
+ *                accepts {@code static org.x.Y.z}). May be empty.
+ * @param source  the whole member that replaces the default one: any comments, annotations and
+ *                the method. The generator indents every line and places it in the test class,
+ *                where {@code witnesses} is the field holding the project's witness class, typed
+ *                as that package's generated witness interface. The witness interface keeps a
+ *                member for every non-skipped test whatever a renderer writes, so a renderer
+ *                that wants the project's witness calls {@code witnesses.<witnessKey>()}.
+ */
+public record RenderedTest(List<String> imports, String source) {
+
+    public RenderedTest {
+        imports = imports == null ? List.of() : List.copyOf(imports);
+        if (source == null) throw new IllegalArgumentException("a rendered test needs source");
+    }
+}
diff --git a/server/java/codegen-base/src/main/java/com/metaobjects/generator/requirement/RequirementTestArgs.java b/server/java/codegen-base/src/main/java/com/metaobjects/generator/requirement/RequirementTestArgs.java
new file mode 100644
index 000000000..1ff840b7c
--- /dev/null
+++ b/server/java/codegen-base/src/main/java/com/metaobjects/generator/requirement/RequirementTestArgs.java
@@ -0,0 +1,31 @@
+package com.metaobjects.generator.requirement;
+
+import com.metaobjects.requirement.RequirementTestIdentities;
+
+import java.util.List;
+
+/**
+ * Everything a {@link RequirementTestRenderer} is given about one test: its identity (the same
+ * record in every language port), and the prose and claims the default rendering is built from.
+ * The library supplies DATA; a renderer supplies SYNTAX.
+ *
+ * @param identity       the test's identity: package, path, unit, id, witness key, status,
+ *                       skip reason (or {@code null}) and digest
+ * @param statement      what the capability is, or the empty string
+ * @param counterexample what breaking it looks like, or the empty string
+ * @param targets        the claims this test covers, as authored plus the concern each resolved to
+ * @param disposition    what was decided about outstanding work, or {@code null} (undecided)
+ * @param trackedBy      issue references for outstanding work; empty when none
+ */
+public record RequirementTestArgs(RequirementTestIdentities.Identity identity, String statement,
+                                  String counterexample, List<Claim> targets, String disposition,
+                                  List<String> trackedBy) {
+
+    /** One resolved {@code implementedBy} reference. */
+    public record Claim(String ref, String concern) {}
+
+    public RequirementTestArgs {
+        targets = List.copyOf(targets);
+        trackedBy = List.copyOf(trackedBy);
+    }
+}
diff --git a/server/java/codegen-base/src/main/java/com/metaobjects/generator/requirement/RequirementTestRenderer.java b/server/java/codegen-base/src/main/java/com/metaobjects/generator/requirement/RequirementTestRenderer.java
new file mode 100644
index 000000000..d73079fb7
--- /dev/null
+++ b/server/java/codegen-base/src/main/java/com/metaobjects/generator/requirement/RequirementTestRenderer.java
@@ -0,0 +1,20 @@
+package com.metaobjects.generator.requirement;
+
+/**
+ * Replaces the default rendering of a requirement's test (ADR-0057). Name an implementation in
+ * the {@code renderer} arg of the {@code requirement-tests} generator: a public class with a
+ * public no-argument constructor, found on the project's classpath. The generators for the
+ * JVM languages share this type: a renderer returns source in the language of the generator that
+ * calls it, so a project that runs both writes one renderer for each.
+ *
+ * <p>The identity of a test, which tests exist and what each is called, is not the renderer's to
+ * change: it receives them in {@link RequirementTestArgs}. An application that wants different
+ * identities owns the generator itself ({@code mvn metaobjects:eject}).</p>
+ */
+public interface RequirementTestRenderer {
+
+    /**
+     * @return the rendered test, or {@code null} to keep the default rendering of this one test
+     */
+    RenderedTest render(RequirementTestArgs args);
+}
diff --git a/server/java/codegen-kotlin/pom.xml b/server/java/codegen-kotlin/pom.xml
index 6c8324d0f..6afafe46d 100644
--- a/server/java/codegen-kotlin/pom.xml
+++ b/server/java/codegen-kotlin/pom.xml
@@ -243,6 +243,7 @@
                     <include>KotlinSpringConfigGenerator.kt</include>
                     <include>KotlinStoredProcGenerator.kt</include>
                     <include>KotlinValidatorGenerator.kt</include>
+                    <include>KotlinRequirementTestsGenerator.kt</include>
                   </includes>
                 </resource>
               </resources>
diff --git a/server/java/codegen-kotlin/src/main/kotlin/com/metaobjects/generator/kotlin/GeneratorRegistry.kt b/server/java/codegen-kotlin/src/main/kotlin/com/metaobjects/generator/kotlin/GeneratorRegistry.kt
index fdf3a5dcf..2e8431c52 100644
--- a/server/java/codegen-kotlin/src/main/kotlin/com/metaobjects/generator/kotlin/GeneratorRegistry.kt
+++ b/server/java/codegen-kotlin/src/main/kotlin/com/metaobjects/generator/kotlin/GeneratorRegistry.kt
@@ -14,11 +14,12 @@
 // Stable names mirror the canonical manifest exactly for the kotlin slice:
 //   entity, routes, output-parser, output-prompt, render-helper, extractor,
 //   filter-allowlist, names, exposed-table, relations, spring-config,
-//   stored-proc, validator. (Kotlin has NO `template` generator — the manifest
+//   stored-proc, validator, requirement-tests. (Kotlin has NO `template` generator — the manifest
 //   deliberately omits kotlin from it.)
 
 package com.metaobjects.generator.kotlin
 
+import com.metaobjects.generator.Generator
 import com.metaobjects.generator.direct.MultiFileDirectGeneratorBase
 
 /** Tier of a registered generator (ADR-0020 / ADR-0021 D1). */
@@ -80,8 +81,12 @@ data class GeneratorInfo(
     val tier: GeneratorTier,
     /** The selection axis — see [GeneratorLayer]. Gated cross-port. */
     val layer: GeneratorLayer,
-    /** Constructs the generator with sensible defaults. Calling it must not throw. */
-    val factory: () -> MultiFileDirectGeneratorBase<*>,
+    /**
+     * Constructs the generator with sensible defaults. Calling it must not throw. Typed as
+     * [Generator], not [MultiFileDirectGeneratorBase]: a generator that returns its files
+     * (`FileEmittingGenerator`, ADR-0034 Amendment 4) is not a per-object one.
+     */
+    val factory: () -> Generator,
     /**
      * Classpath location of this generator's reference source, as shipped inside this jar
      * (e.g. `META-INF/metaobjects/reference/kotlin/KotlinEntityGenerator.kt`), or `null`
@@ -224,6 +229,17 @@ val GENERATOR_REGISTRY: Map<String, GeneratorInfo> = linkedMapOf(
         factory = ::KotlinValidatorGenerator,
         ejectResourcePath = ejectPath("KotlinValidatorGenerator"),
     ),
+    "requirement-tests" to GeneratorInfo(
+        name = "requirement-tests",
+        description = "Per-package JUnit Jupiter tests, one per declared requirement, each calling a " +
+            "project-owned witness through a generated witness interface. [The project's test " +
+            "classpath needs org.junit.jupiter:junit-jupiter-api, and the `testPackage` and " +
+            "`witnessClass` args name where the tests go and the class that implements the witnesses.]",
+        tier = GeneratorTier.NATIVE,
+        layer = GeneratorLayer.CAPABILITY,
+        factory = ::KotlinRequirementTestsGenerator,
+        ejectResourcePath = ejectPath("KotlinRequirementTestsGenerator"),
+    ),
 )
 
 /** All entries, native-first then neutral, alphabetical within tier. */
diff --git a/server/java/codegen-kotlin/src/main/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGenerator.kt b/server/java/codegen-kotlin/src/main/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGenerator.kt
new file mode 100644
index 000000000..9b638cc65
--- /dev/null
+++ b/server/java/codegen-kotlin/src/main/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGenerator.kt
@@ -0,0 +1,419 @@
+package com.metaobjects.generator.kotlin
+
+import com.metaobjects.generator.FileEmittingGenerator
+import com.metaobjects.generator.FileEmittingGenerator.EmittedFile
+import com.metaobjects.generator.GeneratorException
+import com.metaobjects.generator.ProjectClassLoaderAware
+import com.metaobjects.generator.requirement.RequirementTestArgs
+import com.metaobjects.generator.requirement.RequirementTestRenderer
+import com.metaobjects.loader.MetaDataLoader
+import com.metaobjects.requirement.MetaRequirement
+import com.metaobjects.requirement.RequirementTestFilter
+import com.metaobjects.requirement.RequirementTestIdentities
+import com.metaobjects.requirement.RequirementTestIdentities.Grain
+import com.metaobjects.requirement.RequirementTestIdentities.Identity
+import com.metaobjects.requirement.RequirementTestIdentities.Target
+import org.slf4j.LoggerFactory
+import java.lang.reflect.InvocationTargetException
+import java.util.TreeMap
+import java.util.TreeSet
+
+/**
+ * One JUnit Jupiter test per declared requirement, written in Kotlin, calling a project-owned
+ * witness (ADR-0057). The Kotlin sibling of the JVM `JUnitRequirementTestsGenerator`.
+ *
+ * For each metamodel package that holds a tested requirement this writes two files into
+ * `testPackage`, rewritten whole on every run: `Requirements_<pkgKey>_Witnesses.kt` (an
+ * interface with one default member per NON-skipped test, which fails with
+ * `unimplemented requirement: ...`) and `Requirements_<pkgKey>_Test.kt` (one `@Test` per
+ * requirement, calling the member on the project's `witnessClass`). The project owns the
+ * witnesses: it writes a class implementing every generated witness interface and overrides
+ * the members it has witnesses for. A requirement that becomes live adds a failing member, a
+ * red test and no compile break; one that is retired or deleted removes the member, so a
+ * stale override stops compiling.
+ *
+ * Which tests exist, what each is called, whether it is skipped and its digest come from
+ * [RequirementTestIdentities], which every language port shares and a conformance corpus
+ * pins. This class decides only how they are WRITTEN. It is a reference helper
+ * (ADR-0034 Amendment 3): `mvn metaobjects:eject` copies this one file into your project,
+ * and the default rendering is in it, so an owned copy changes the output freely.
+ *
+ * Args: `outputDir`, `testPackage` and `witnessClass` (the last two required once the model
+ * holds a requirement), `grain` (`concern`, the default, or `member`), `filter` (a
+ * [RequirementTestFilter] class name that REPLACES the default of functional requirements at
+ * level 4 or above), `renderer` (a [RequirementTestRenderer] class name; for this generator
+ * the source it returns is Kotlin and its imports are Kotlin import names), and
+ * `warnUncovered` (`true` by default: name the requirements the filter excluded).
+ *
+ * The generated tests are JUnit Jupiter; the project's test classpath needs
+ * `org.junit.jupiter:junit-jupiter-api`. They import nothing from MetaObjects.
+ */
+open class KotlinRequirementTestsGenerator : FileEmittingGenerator(), ProjectClassLoaderAware {
+
+    private var projectClassLoader: ClassLoader? = null
+    private val warningLog = mutableListOf<String>()
+
+    override fun setProjectClassLoader(projectClassLoader: ClassLoader) {
+        this.projectClassLoader = projectClassLoader
+    }
+
+    /** What the last run warned about (each message was also logged). */
+    fun warnings(): List<String> = warningLog.toList()
+
+    /** One test to write: its identity and the data its rendering is built from. */
+    private class Planned(val identity: Identity, val args: RequirementTestArgs)
+
+    override fun generate(loader: MetaDataLoader): List<EmittedFile> {
+        warningLog.clear()
+        // The optional args are checked first, so a typo is refused whatever the model holds.
+        val grain = grain()
+        val filter = loadOptional(ARG_FILTER, RequirementTestFilter::class.java)
+        val renderer = loadOptional(ARG_RENDERER, RequirementTestRenderer::class.java)
+        val warnUncovered = warnUncovered()
+
+        val walked = RequirementTestIdentities.walk(loader.root)
+        // No requirement, no change: nothing is written and nothing is said.
+        if (walked.isEmpty()) return emptyList()
+
+        val testPackage = requiredName(ARG_TEST_PACKAGE)
+        val witnessClass = requiredName(ARG_WITNESS_CLASS)
+
+        val planned = mutableListOf<Planned>()
+        val uncovered = mutableListOf<String>()
+        for (w in walked) {
+            val keep = filter?.include(w.view()) ?: RequirementTestIdentities.defaultFilter(w.view())
+            if (!keep) {
+                // The PATH, not the qualified address: diagnostics name paths, in every port.
+                uncovered += w.view().path()
+                continue
+            }
+            for ((unit, targets) in RequirementTestIdentities.units(w, grain)) {
+                val identity = RequirementTestIdentities.identity(w, unit)
+                planned += Planned(identity, argsFor(w.node(), identity, targets))
+            }
+        }
+        planned.sortBy { it.identity.id() }
+        refuseCollisions(planned)
+        warnUncovered(uncovered, warnUncovered)
+
+        // One pair of files per package key. Two packages that mangle alike share a pair: their
+        // tests keep distinct keys, which the collision check above has just proven.
+        val byPackage = TreeMap<String, MutableList<Planned>>()
+        for (p in planned) byPackage.getOrPut(packageKey(p.identity.pkg())) { mutableListOf() } += p
+
+        val dir = testPackage.replace('.', '/') + "/"
+        val files = mutableListOf<EmittedFile>()
+        for ((key, tests) in byPackage) {
+            val witnesses = "Requirements_${key}_Witnesses"
+            val test = "Requirements_${key}_Test"
+            files += EmittedFile("$dir$witnesses.kt", witnessInterface(testPackage, witnesses, witnessClass, tests))
+            files += EmittedFile("$dir$test.kt", testClass(testPackage, test, witnesses, witnessClass, tests, renderer))
+        }
+        return files
+    }
+
+    // ------------------------------------------------------------------
+    // args
+    // ------------------------------------------------------------------
+
+    private fun grain(): Grain {
+        if (!hasArg(ARG_GRAIN)) return Grain.CONCERN
+        try {
+            return Grain.parse(getArg(ARG_GRAIN))
+        } catch (e: IllegalArgumentException) {
+            throw GeneratorException("requirement-tests: arg '$ARG_GRAIN': ${e.message}", e)
+        }
+    }
+
+    private fun warnUncovered(): Boolean {
+        val raw = getArg(ARG_WARN_UNCOVERED, "true")
+        if (raw.equals("true", ignoreCase = true)) return true
+        if (raw.equals("false", ignoreCase = true)) return false
+        throw GeneratorException("requirement-tests: arg '$ARG_WARN_UNCOVERED' must be true or false, not '$raw'")
+    }
+
+    /** A required arg that is spliced into generated source, so it must be a dotted Kotlin name. */
+    private fun requiredName(arg: String): String {
+        val value = getArg(arg)
+        if (value.isNullOrBlank()) {
+            throw GeneratorException(
+                "requirement-tests: set '$arg' with <args><$arg>...</$arg></args>" +
+                    (if (arg == ARG_WITNESS_CLASS) " (the fully-qualified name of the project class that implements the generated witness interfaces)" else "") +
+                    (if (arg == ARG_TEST_PACKAGE) " (the package the generated tests are written into)" else ""),
+            )
+        }
+        val name = value.trim()
+        if (!KOTLIN_NAME.matches(name)) {
+            throw GeneratorException("requirement-tests: arg '$arg' must be a dotted Kotlin name (letters, digits and underscores), not '$value'")
+        }
+        return name
+    }
+
+    /**
+     * Instantiate the class an optional arg names, or `null` when the arg is absent. The
+     * project's class loader is tried first because a packaged generator's own loader cannot
+     * see the project's classes, then the context loader, then this class's own.
+     */
+    private fun <T> loadOptional(arg: String, type: Class<T>): T? {
+        val className = getArg(arg)?.trim()
+        if (className.isNullOrEmpty()) return null
+
+        val loaders = listOfNotNull(
+            projectClassLoader,
+            Thread.currentThread().contextClassLoader,
+            javaClass.classLoader,
+        ).distinct()
+        var found: Class<*>? = null
+        for (l in loaders) {
+            try {
+                found = Class.forName(className, true, l)
+                break
+            } catch (ignored: ClassNotFoundException) {
+                // not in this loader: try the next
+            } catch (e: LinkageError) {
+                // The class IS here and cannot be used (built for a newer JDK, a missing
+                // dependency, an initialiser that threw): saying it is missing would send the
+                // reader looking for the wrong problem, and the next loader would hide it.
+                throw GeneratorException(
+                    "requirement-tests: arg '$arg' names '$className', which was found but could not be loaded: $e",
+                    null, null, e, emptyMap(),
+                )
+            }
+        }
+        if (found == null) {
+            throw GeneratorException(
+                "requirement-tests: arg '$arg' names '$className', which is not on the project's classpath. " +
+                    "Name a public class implementing ${type.simpleName} from a module the build compiles before this goal runs.",
+            )
+        }
+        if (!type.isAssignableFrom(found)) {
+            throw GeneratorException("requirement-tests: arg '$arg' names '$className', which does not implement ${type.name}")
+        }
+        try {
+            return type.cast(found.getDeclaredConstructor().newInstance())
+        } catch (e: InvocationTargetException) {
+            // The class HAS the constructor, and it ran and threw. The wrapper's own message is
+            // empty, so name what was thrown: "needs a constructor" would point at the wrong problem.
+            val thrown = e.cause ?: e
+            throw GeneratorException(
+                "requirement-tests: arg '$arg' names '$className', and its constructor threw: $thrown",
+                null, null, thrown, emptyMap(),
+            )
+        } catch (e: ReflectiveOperationException) {
+            throw GeneratorException("requirement-tests: arg '$arg' names '$className', which needs a public no-argument constructor: $e", e)
+        }
+    }
+
+    // ------------------------------------------------------------------
+    // planning
+    // ------------------------------------------------------------------
+
+    private fun argsFor(node: MetaRequirement, identity: Identity, targets: List<Target>): RequirementTestArgs =
+        RequirementTestArgs(
+            identity, node.statement.orEmpty(), node.counterexample.orEmpty(),
+            targets.map { RequirementTestArgs.Claim(it.ref(), it.concern()) },
+            node.disposition, node.trackedBy,
+        )
+
+    /** `root` for the empty package, otherwise the package with each run of non-ASCII-alphanumerics as one underscore. */
+    private fun packageKey(pkg: String): String = if (pkg.isEmpty()) "root" else pkg.replace(Regex("[^A-Za-z0-9]+"), "_")
+
+    /** Two tests with one witness key cannot be told apart by a witness: refuse, naming both. */
+    private fun refuseCollisions(planned: List<Planned>) {
+        val keyById = planned.associate { it.identity.id() to it.identity.witnessKey() }
+        val pairs = RequirementTestIdentities.witnessKeyCollisions(planned.map { it.identity })
+        if (pairs.isEmpty()) return
+        val sb = StringBuilder(ERR_WITNESS_KEY_COLLISION)
+            .append(": two requirement tests map to one witness key, so one witness could not serve both. ")
+            .append("Rename one so the names differ in more than punctuation:")
+        for (pair in pairs) {
+            sb.append("\n  '").append(pair[0]).append("' and '").append(pair[1])
+                .append("' (witness key ").append(keyById[pair[0]]).append(')')
+        }
+        throw GeneratorException(sb.toString())
+    }
+
+    private fun warnUncovered(uncovered: List<String>, enabled: Boolean) {
+        if (!enabled || uncovered.isEmpty()) return
+        val shown = uncovered.take(MAX_NAMED_UNCOVERED).joinToString(", ")
+        val more = if (uncovered.size > MAX_NAMED_UNCOVERED) ", and ${uncovered.size - MAX_NAMED_UNCOVERED} more" else ""
+        val message = "${uncovered.size} requirement(s) matched no filter and get no test. " +
+            "If that is deliberate, set $ARG_WARN_UNCOVERED=false to silence this. Uncovered: $shown$more."
+        warningLog += message
+        LOG.warn(message)
+    }
+
+    // ------------------------------------------------------------------
+    // rendering: the default rendering lives here, in this one file, so an eject takes it too
+    // ------------------------------------------------------------------
+
+    private fun witnessInterface(testPackage: String, name: String, witnessClass: String, tests: List<Planned>): String {
+        val sb = StringBuilder(GENERATED_HEADER)
+            .append("// Witnesses are project-owned: implement this interface in ").append(commentText(witnessClass))
+            .append(" and override the members it has witnesses for.\n")
+            .append("package ").append(sourceName(testPackage)).append("\n\n")
+            .append("interface ").append(name).append(" {\n")
+        for (p in tests) {
+            val id = p.identity
+            if (id.skip() != null) continue // a skipped test claims nothing works yet: no member
+            sb.append('\n').append(indent(testComments(p.args))).append('\n')
+                .append("    fun ").append(id.witnessKey()).append("() {\n")
+                .append("        throw AssertionError(\"")
+                .append(
+                    stringLiteral(
+                        "unimplemented requirement: ${id.id()} - write $witnessClass.${id.witnessKey()}() " +
+                            "so that it fails when: ${p.args.counterexample()}",
+                    ),
+                )
+                .append("\")\n    }\n")
+        }
+        return sb.append("}\n").toString()
+    }
+
+    private fun testClass(
+        testPackage: String,
+        name: String,
+        witnesses: String,
+        witnessClass: String,
+        tests: List<Planned>,
+        renderer: RequirementTestRenderer?,
+    ): String {
+        val imports = TreeSet<String>()
+        imports += "org.junit.jupiter.api.Test"
+        val body = StringBuilder()
+        for (p in tests) {
+            val rendered = renderer?.render(p.args)
+            val source: String
+            if (rendered != null) {
+                imports += rendered.imports()
+                source = rendered.source()
+            } else {
+                source = defaultTest(p)
+                if (p.identity.skip() != null) imports += "org.junit.jupiter.api.Disabled"
+            }
+            body.append('\n').append(indent(source.trimEnd())).append('\n')
+        }
+        val sb = StringBuilder(GENERATED_HEADER)
+            .append("// The witnesses are project-owned, in ").append(commentText(witnessClass)).append(".\n")
+            .append("package ").append(sourceName(testPackage)).append("\n\n")
+        for (i in imports) sb.append("import ").append(i).append('\n')
+        return sb.append("\nclass ").append(name).append(" {\n\n")
+            .append("    private val witnesses: ").append(witnesses).append(" = ").append(sourceName(witnessClass)).append("()\n")
+            .append(body).append("}\n").toString()
+    }
+
+    /** The default rendering of one test: its comments, then a `@Test` calling the witness. */
+    private fun defaultTest(p: Planned): String {
+        val id = p.identity
+        val sb = StringBuilder(testComments(p.args)).append("\n@Test\n")
+        if (id.skip() == null) {
+            sb.append("fun ").append(id.witnessKey()).append("() {\n    witnesses.").append(id.witnessKey()).append("()\n}")
+        } else {
+            sb.append("@Disabled(\"").append(stringLiteral(skipReason(id.skip()))).append("\")\n")
+                .append("fun ").append(id.witnessKey()).append("() {\n}")
+        }
+        return sb.toString()
+    }
+
+    private fun skipReason(skip: String): String = when (skip) {
+        MetaRequirement.STATUS_PLANNED -> SKIP_PLANNED
+        MetaRequirement.STATUS_RETIRED -> SKIP_RETIRED
+        else -> "$skip - skipped"
+    }
+
+    /** The comment block above a test: id, statement, counterexample, status, claims, digest. */
+    private fun testComments(a: RequirementTestArgs): String {
+        val id = a.identity()
+        val claims = a.targets().joinToString(", ") { "${it.ref()}  (${it.concern()})" }
+        return commentLines(id.id()) + "\n" +
+            commentLines(a.statement()) + "\n" +
+            commentLines("Counterexample: " + a.counterexample()) + "\n" +
+            commentLines("Status: " + (id.status() ?: "(none)")) + "\n" +
+            commentLines("Claims: " + claims.ifEmpty { "(none)" }) + "\n" +
+            commentLines("Digest: " + id.digest())
+    }
+
+    // ------------------------------------------------------------------
+    // escaping: author prose lands in string literals and comments, and must not break either
+    // ------------------------------------------------------------------
+
+    /**
+     * A dotted name as it is written in Kotlin source: a segment that is a hard keyword (`in`,
+     * `is` and `as` are real country-code prefixes in a reversed domain) is wrapped in
+     * backticks, since `package in.co.acme` does not parse. The file's directory and every
+     * comment and message keep the plain name.
+     */
+    private fun sourceName(dotted: String): String =
+        dotted.split('.').joinToString(".") { if (it in HARD_KEYWORDS) "`$it`" else it }
+
+    private fun indent(block: String): String {
+        val sb = StringBuilder()
+        for (line in block.split("\n")) {
+            if (sb.isNotEmpty()) sb.append('\n')
+            if (line.isNotEmpty()) sb.append("    ").append(line)
+        }
+        return sb.toString()
+    }
+
+    /**
+     * One `//` marker per line. A carriage return ends a Kotlin line as a line feed does, so
+     * both split; the comment terminator is broken as `* /` by contract.
+     */
+    private fun commentLines(text: String): String =
+        text.split(Regex("\r\n|\r|\n")).joinToString("\n") { "// " + commentText(it) }
+
+    private fun commentText(line: String): String = line.replace("*/", "* /")
+
+    /**
+     * The text of a double-quoted string literal. Every control character is escaped, so no
+     * value can end the literal, and so is `$`, which would otherwise start a string template.
+     */
+    private fun stringLiteral(s: String): String {
+        val sb = StringBuilder()
+        for (c in s) {
+            when {
+                c == '\\' -> sb.append("\\\\")
+                c == '"' -> sb.append("\\\"")
+                c == '$' -> sb.append("\\$")
+                c == '\n' -> sb.append("\\n")
+                c == '\r' -> sb.append("\\r")
+                c == '\t' -> sb.append("\\t")
+                c.code < 0x20 || c.code == 0x7f -> sb.append("\\u%04x".format(c.code))
+                else -> sb.append(c)
+            }
+        }
+        return sb.toString()
+    }
+
+    companion object {
+        private val LOG = LoggerFactory.getLogger(KotlinRequirementTestsGenerator::class.java)
+
+        const val ARG_TEST_PACKAGE = "testPackage"
+        const val ARG_WITNESS_CLASS = "witnessClass"
+        const val ARG_GRAIN = "grain"
+        const val ARG_FILTER = "filter"
+        const val ARG_RENDERER = "renderer"
+        const val ARG_WARN_UNCOVERED = "warnUncovered"
+
+        /** The refusal code when two tests map to one witness key. */
+        const val ERR_WITNESS_KEY_COLLISION = "ERR_REQUIREMENT_WITNESS_KEY_COLLISION"
+
+        /** How many uncovered requirements to name before "and N more". */
+        private const val MAX_NAMED_UNCOVERED = 5
+
+        private const val SKIP_PLANNED = "planned - not built yet"
+        private const val SKIP_RETIRED = "retired - the capability was deliberately removed; assert it stays removed"
+
+        /** Kotlin's hard keywords: the ones that cannot be an identifier without backticks. */
+        private val HARD_KEYWORDS = setOf(
+            "as", "break", "class", "continue", "do", "else", "false", "for", "fun", "if", "in",
+            "interface", "is", "null", "object", "package", "return", "super", "this", "throw",
+            "true", "try", "typealias", "typeof", "val", "var", "when", "while",
+        )
+
+        private val KOTLIN_NAME = Regex("[A-Za-z_][A-Za-z0-9_]*(\\.[A-Za-z_][A-Za-z0-9_]*)*")
+
+        private const val GENERATED_HEADER =
+            "// GENERATED by metaobjects (requirement-tests). DO NOT EDIT: this file is rewritten whole.\n"
+    }
+}
diff --git a/server/java/codegen-kotlin/src/test/kotlin/com/metaobjects/generator/kotlin/EjectedGeneratorsCompileTest.kt b/server/java/codegen-kotlin/src/test/kotlin/com/metaobjects/generator/kotlin/EjectedGeneratorsCompileTest.kt
index 4f21134da..a6d648430 100644
--- a/server/java/codegen-kotlin/src/test/kotlin/com/metaobjects/generator/kotlin/EjectedGeneratorsCompileTest.kt
+++ b/server/java/codegen-kotlin/src/test/kotlin/com/metaobjects/generator/kotlin/EjectedGeneratorsCompileTest.kt
@@ -42,6 +42,7 @@ class EjectedGeneratorsCompileTest {
         "KotlinSpringConfigGenerator",
         "KotlinStoredProcGenerator",
         "KotlinValidatorGenerator",
+        "KotlinRequirementTestsGenerator",
     )
 
     private val packageLine = Regex("(?m)^package\\s+[\\w.]+\\s*$")
diff --git a/server/java/codegen-kotlin/src/test/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGeneratorTest.kt b/server/java/codegen-kotlin/src/test/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGeneratorTest.kt
new file mode 100644
index 000000000..fe2672b0b
--- /dev/null
+++ b/server/java/codegen-kotlin/src/test/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGeneratorTest.kt
@@ -0,0 +1,891 @@
+package com.metaobjects.generator.kotlin
+
+import ch.qos.logback.classic.spi.ILoggingEvent
+import ch.qos.logback.core.read.ListAppender
+import com.fasterxml.jackson.databind.ObjectMapper
+import com.metaobjects.generator.Generator
+import com.metaobjects.generator.GeneratorException
+import com.metaobjects.generator.requirement.RenderedTest
+import com.metaobjects.generator.requirement.RequirementTestArgs
+import com.metaobjects.generator.requirement.RequirementTestRenderer
+import com.metaobjects.generator.util.GeneratedFileWriter
+import com.metaobjects.loader.MetaDataLoader
+import com.metaobjects.metadata.ktx.loadDirectory
+import com.metaobjects.requirement.RequirementTestFilter
+import com.metaobjects.requirement.RequirementTestIdentities
+import com.tschuchort.compiletesting.KotlinCompilation
+import com.tschuchort.compiletesting.SourceFile
+import org.junit.jupiter.api.Disabled
+import org.slf4j.LoggerFactory
+import java.io.ByteArrayOutputStream
+import java.lang.reflect.InvocationTargetException
+import java.nio.file.Files
+import java.nio.file.Path
+import java.util.TreeSet
+import kotlin.io.path.isRegularFile
+import kotlin.io.path.readText
+import kotlin.test.AfterTest
+import kotlin.test.Test
+import kotlin.test.assertContains
+import kotlin.test.assertEquals
+import kotlin.test.assertFailsWith
+import kotlin.test.assertFalse
+import kotlin.test.assertIs
+import kotlin.test.assertNotNull
+import kotlin.test.assertNull
+import kotlin.test.assertTrue
+
+/**
+ * [KotlinRequirementTestsGenerator]: the files it writes for the identity corpus's
+ * `worked-example`, that the output COMPILES and behaves (a live test with no witness fails,
+ * with one it passes), that author prose cannot break it, every refusal and seam of Table I,
+ * and the eject proof (a package-renamed copy emits the same bytes). The tests this
+ * generator WRITES are JUnit Jupiter. Which tests exist and what each is called is the
+ * identity function's job, which every JVM port shares and a corpus pins: here the emitted
+ * test names are compared with that corpus's `witnessKey` values.
+ */
+@OptIn(org.jetbrains.kotlin.compiler.plugin.ExperimentalCompilerApi::class)
+class KotlinRequirementTestsGeneratorTest {
+
+    private val scratch = mutableListOf<Path>()
+
+    @AfterTest
+    fun cleanUp() {
+        scratch.forEach { it.toFile().deleteRecursively() }
+        scratch.clear()
+    }
+
+    private fun tempDir(): Path = Files.createTempDirectory("kotlin-requirement-tests-").also { scratch.add(it) }
+
+    // ---------------------------------------------------------------- fixtures
+
+    private fun repoRoot(): Path {
+        var p: Path? = Path.of("").toAbsolutePath()
+        while (p != null) {
+            if (Files.isDirectory(p.resolve("fixtures")) && Files.isDirectory(p.resolve("server"))) return p
+            p = p.parent
+        }
+        throw IllegalStateException("repo root not found")
+    }
+
+    private fun corpusCase(name: String): Path =
+        repoRoot().resolve("fixtures/requirement-test-identity-conformance/$name")
+
+    private fun workedExampleInput(): Path = corpusCase("worked-example/input")
+
+    private fun loadDir(dir: Path): MetaDataLoader {
+        val loader = loadDirectory("requirement_tests_${System.nanoTime()}", dir)
+        assertTrue(loader.errors.isEmpty(), "load: ${loader.errors}")
+        return loader
+    }
+
+    private fun loadYaml(yaml: String): MetaDataLoader {
+        val dir = tempDir()
+        Files.writeString(dir.resolve("meta.shop.yaml"), yaml)
+        return loadDir(dir)
+    }
+
+    private fun requirement(
+        name: String,
+        level: Int,
+        status: String,
+        statement: String,
+        counterexample: String,
+        implementedBy: String?,
+    ): String =
+        "    - requirement.functional:\n" +
+            "        name: $name\n        level: $level\n        status: $status\n" +
+            "        statement: $statement\n        counterexample: $counterexample\n" +
+            (if (implementedBy == null) "" else "        implementedBy: [$implementedBy]\n")
+
+    private val orderEntity =
+        "    - object.entity:\n        name: Order\n        children:\n" +
+            "          - field.uuid: { name: id }\n          - field.string: { name: total }\n" +
+            "          - identity.primary: { name: pk, fields: [id] }\n"
+
+    private fun shop(vararg requirements: String): String =
+        "metadata:\n  package: acme::shop\n  children:\n" + orderEntity + requirements.joinToString("")
+
+    /** The args of a real run, with `warnUncovered` left at its default. */
+    private fun realArgs(out: Path): Map<String, String> =
+        mapOf("outputDir" to out.toString(), "testPackage" to TEST_PACKAGE, "witnessClass" to WITNESS_CLASS)
+
+    private fun generator(out: Path, extra: Map<String, String> = emptyMap()): KotlinRequirementTestsGenerator {
+        // The worked example has an L3 requirement the default filter drops, so most tests would
+        // log the uncovered warning. Only the tests that are about it switch it on.
+        val args = realArgs(out) + ("warnUncovered" to "false") + extra
+        return KotlinRequirementTestsGenerator().also { it.setArgs(args) }
+    }
+
+    /**
+     * Runs [block] with the generator's logger diverted into a list, so a warning a test
+     * provokes neither reaches the console nor goes unchecked: returns what was logged.
+     */
+    private fun captureLog(block: () -> Unit): List<String> {
+        val logger = LoggerFactory.getLogger(KotlinRequirementTestsGenerator::class.java) as ch.qos.logback.classic.Logger
+        val appender = ListAppender<ILoggingEvent>().also { it.start() }
+        val wasAdditive = logger.isAdditive
+        logger.isAdditive = false
+        logger.addAppender(appender)
+        try {
+            block()
+        } finally {
+            logger.detachAppender(appender)
+            logger.isAdditive = wasAdditive
+        }
+        return appender.list.map { it.formattedMessage }
+    }
+
+    private fun run(loader: MetaDataLoader, extra: Map<String, String> = emptyMap()): Path {
+        val out = tempDir()
+        generator(out, extra).execute(loader)
+        return out
+    }
+
+    private fun read(out: Path, file: String): String = out.resolve("com/acme/req").resolve(file).readText()
+
+    private fun files(out: Path): Set<String> = Files.walk(out).use { s ->
+        s.filter { it.isRegularFile() }.map { out.relativize(it).toString().replace('\\', '/') }.toList().toSortedSet()
+    }
+
+    private fun testFunctionNames(source: String): List<String> =
+        Regex("(?m)^\\s*fun (req_\\w+)\\(").findAll(source).map { it.groupValues[1] }.toList()
+
+    // ---------------------------------------------------------------- compile and run
+
+    private val witnessNone =
+        "package com.acme\nclass Witnesses : com.acme.req.Requirements_acme_shop_Witnesses\n"
+
+    private val witnessRecorded =
+        "package com.acme\nclass Witnesses : com.acme.req.Requirements_acme_shop_Witnesses {\n" +
+            "    override fun req_acme_shop_Orders_Recorded__object_entity() { }\n}\n"
+
+    /** Compile the generated tree plus hand-written sources with the real compiler; return a loader over the classes. */
+    private fun compile(generated: Path, handWritten: Map<String, String>): ClassLoader {
+        val result = tryCompile(generated, handWritten)
+        assertEquals(KotlinCompilation.ExitCode.OK, result.exitCode, "generated requirement tests failed to compile:\n${result.messages}")
+        return result.classLoader
+    }
+
+    private fun tryCompile(generated: Path, handWritten: Map<String, String>): KotlinCompilation.Result {
+        val sources = mutableListOf<SourceFile>()
+        Files.walk(generated).use { s ->
+            s.filter { it.isRegularFile() && it.toString().endsWith(".kt") }
+                .forEach { sources += SourceFile.kotlin(it.fileName.toString(), it.readText()) }
+        }
+        for ((fqcn, text) in handWritten) sources += SourceFile.kotlin("${fqcn.substringAfterLast('.')}.kt", text)
+        val messages = ByteArrayOutputStream()
+        val result = KotlinCompilation().apply {
+            this.sources = sources
+            inheritClassPath = true
+            allWarningsAsErrors = true
+            messageOutputStream = messages
+        }.compile()
+        return result
+    }
+
+    /** Invoke one generated test method; returns the AssertionError it threw, or null. */
+    private fun invoke(cl: ClassLoader, testClass: String, method: String): AssertionError? {
+        val c = cl.loadClass("$TEST_PACKAGE.$testClass")
+        val instance = c.getDeclaredConstructor().newInstance()
+        val m = c.getDeclaredMethod(method)
+        try {
+            m.invoke(instance)
+            return null
+        } catch (e: InvocationTargetException) {
+            val cause = e.cause
+            if (cause is AssertionError) return cause
+            throw e
+        }
+    }
+
+    // ---------------------------------------------------------------- the worked example
+
+    @Test
+    fun `the worked example emits the witness interface and the test class in the test package`() {
+        val out = run(loadDir(workedExampleInput()))
+        assertEquals(
+            sortedSetOf("com/acme/req/Requirements_acme_shop_Test.kt", "com/acme/req/Requirements_acme_shop_Witnesses.kt"),
+            files(out),
+        )
+    }
+
+    @Test
+    fun `both files name the witness class in their header`() {
+        val out = run(loadDir(workedExampleInput()))
+        val iface = read(out, "Requirements_acme_shop_Witnesses.kt")
+        val test = read(out, "Requirements_acme_shop_Test.kt")
+        assertTrue(
+            iface.contains(
+                "// Witnesses are project-owned: implement this interface in com.acme.Witnesses" +
+                    " and override the members it has witnesses for.\n",
+            ),
+            iface,
+        )
+        assertTrue(test.contains("// The witnesses are project-owned, in com.acme.Witnesses.\n"), test)
+        assertTrue(iface.startsWith("// GENERATED by metaobjects (requirement-tests). DO NOT EDIT: this file is rewritten whole.\n"), iface)
+    }
+
+    @Test
+    fun `tests are emitted sorted by id whatever order they are declared in`() {
+        // Declared Zeta, Mid, Alpha: not in id order.
+        val loader = loadYaml(
+            shop(
+                requirement("Zeta", 4, "live", "Z.", "Z!", "Order"),
+                requirement("Mid", 4, "live", "M.", "M!", "Order"),
+                requirement("Alpha", 4, "live", "A.", "A!", "Order"),
+            ),
+        )
+        val out = run(loader)
+        for (file in listOf("Requirements_acme_shop_Test.kt", "Requirements_acme_shop_Witnesses.kt")) {
+            val src = read(out, file)
+            val alpha = src.indexOf("// acme::shop::Alpha [object.entity]")
+            val mid = src.indexOf("// acme::shop::Mid [object.entity]")
+            val zeta = src.indexOf("// acme::shop::Zeta [object.entity]")
+            assertTrue(alpha >= 0 && mid >= 0 && zeta >= 0, "$file: all three present")
+            assertTrue(alpha < mid && mid < zeta, "$file: Alpha, Mid, Zeta in that order")
+        }
+    }
+
+    @Test
+    fun `the interface has a member for the live test and none for the skipped one`() {
+        val iface = read(run(loadDir(workedExampleInput())), "Requirements_acme_shop_Witnesses.kt")
+        assertTrue(iface.contains("    fun req_acme_shop_Orders_Recorded__object_entity() {"), iface)
+        assertFalse(iface.contains("req_acme_shop_Orders_Refunded"), iface)
+        assertTrue(iface.contains("package com.acme.req\n"), iface)
+        assertTrue(iface.contains("interface Requirements_acme_shop_Witnesses {"), iface)
+    }
+
+    @Test
+    fun `the skipped test is disabled with the Table H reason and has no body`() {
+        val test = read(run(loadDir(workedExampleInput())), "Requirements_acme_shop_Test.kt")
+        assertTrue(test.contains("@Disabled(\"planned - not built yet\")\n    fun req_acme_shop_Orders_Refunded() {\n    }"), test)
+        assertTrue(test.contains("private val witnesses: Requirements_acme_shop_Witnesses = com.acme.Witnesses()"), test)
+        assertTrue(test.contains("witnesses.req_acme_shop_Orders_Recorded__object_entity()"), test)
+        // The comments above a test: id, statement, counterexample, status, claims, digest.
+        assertTrue(
+            test.contains(
+                "    // acme::shop::Orders.Recorded [object.entity]\n" +
+                    "    // An order is recorded when it is placed.\n" +
+                    "    // Counterexample: A placed order has no row.\n" +
+                    "    // Status: live\n" +
+                    "    // Claims: Order  (object.entity)\n" +
+                    "    // Digest: 2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a\n",
+            ),
+            test,
+        )
+        assertTrue(test.contains("// Claims: (none)"), test)
+    }
+
+    @Test
+    fun `a retired test says the capability must stay removed`() {
+        val loader = loadYaml(shop(requirement("Gone", 4, "retired", "Old thing.", "Old thing returns.", null)))
+        val out = run(loader)
+        assertTrue(
+            read(out, "Requirements_acme_shop_Test.kt")
+                .contains("@Disabled(\"retired - the capability was deliberately removed; assert it stays removed\")"),
+        )
+        // Every test of the package is skipped, so the interface has no member at all.
+        assertFalse(read(out, "Requirements_acme_shop_Witnesses.kt").contains("fun "))
+    }
+
+    @Test
+    fun `the output imports only junit jupiter api and nothing from MetaObjects`() {
+        val out = run(loadDir(workedExampleInput()))
+        for (file in files(out)) {
+            val src = out.resolve(file).readText()
+            for (line in src.lines().filter { it.startsWith("import ") }) {
+                assertTrue(line.startsWith("import org.junit.jupiter.api."), "$file: $line")
+            }
+            assertFalse(src.contains("com.metaobjects"), file)
+            assertFalse(src.contains("KotlinRequirementTestsGenerator"), "$file names the generator's own class")
+        }
+    }
+
+    @Test
+    fun `output carries the generated marker and is byte identical on a rerun`() {
+        val loader = loadDir(workedExampleInput())
+        val a = run(loader)
+        val b = run(loader)
+        for (file in files(a)) {
+            val src = a.resolve(file).readText()
+            assertTrue(GeneratedFileWriter.looksGenerated(src), file)
+            assertEquals(src, b.resolve(file).readText())
+        }
+    }
+
+    // ---------------------------------------------------------------- the identity contract
+
+    /** The corpus's `witnessKey` values, in the order it lists them (id order). */
+    private fun corpusWitnessKeys(case: String): List<String> =
+        ObjectMapper().readTree(corpusCase("$case/expected.json").toFile())["tests"].map { it["witnessKey"].asText() }
+
+    @Test
+    fun `emitted test names equal the witness keys of the identity corpus worked-example and concern-fanout`() {
+        for (case in listOf("worked-example", "concern-fanout")) {
+            val expected = corpusWitnessKeys(case)
+            assertTrue(expected.isNotEmpty(), "$case lists no test, so this would compare nothing")
+            val out = run(loadDir(corpusCase("$case/input")))
+            val emitted = files(out).filter { it.endsWith("_Test.kt") }.flatMap { testFunctionNames(out.resolve(it).readText()) }
+            assertEquals(expected, emitted, case)
+        }
+    }
+
+    // ---------------------------------------------------------------- compile and run
+
+    @Test
+    fun `a live test with no witness fails naming the counterexample`() {
+        val cl = compile(run(loadDir(workedExampleInput())), mapOf(WITNESS_CLASS to witnessNone))
+        val e = invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Orders_Recorded__object_entity")
+        assertNotNull(e, "a live test must fail until a witness is written")
+        assertEquals(
+            "unimplemented requirement: acme::shop::Orders.Recorded [object.entity] - write com.acme.Witnesses." +
+                "req_acme_shop_Orders_Recorded__object_entity() so that it fails when: A placed order has no row.",
+            e.message,
+        )
+    }
+
+    @Test
+    fun `a live test passes when the witness class overrides it and a skipped test is disabled and runs empty`() {
+        val cl = compile(run(loadDir(workedExampleInput())), mapOf(WITNESS_CLASS to witnessRecorded))
+        assertNull(invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Orders_Recorded__object_entity"))
+        assertNull(invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Orders_Refunded"))
+        val refunded = cl.loadClass("$TEST_PACKAGE.Requirements_acme_shop_Test").getDeclaredMethod("req_acme_shop_Orders_Refunded")
+        assertEquals("planned - not built yet", refunded.getAnnotation(Disabled::class.java).value)
+        val recorded = cl.loadClass("$TEST_PACKAGE.Requirements_acme_shop_Test")
+            .getDeclaredMethod("req_acme_shop_Orders_Recorded__object_entity")
+        assertNull(recorded.getAnnotation(Disabled::class.java))
+        // Without @Test JUnit discovers nothing and the adopter's build stays green.
+        assertNotNull(recorded.getAnnotation(org.junit.jupiter.api.Test::class.java), "the live test is a @Test")
+        assertNotNull(refunded.getAnnotation(org.junit.jupiter.api.Test::class.java), "the skipped test is a @Test too")
+    }
+
+    // ---------------------------------------------------------------- orphan witnesses
+
+    @Test
+    fun `a stale override for a retired requirement stops compiling`() {
+        val loader = loadYaml(
+            shop(
+                requirement("Recorded", 4, "live", "S.", "C.", "Order"),
+                requirement("Gone", 4, "retired", "Old thing.", "Old thing returns.", null),
+            ),
+        )
+        val out = run(loader)
+        assertFalse(read(out, "Requirements_acme_shop_Witnesses.kt").contains("req_acme_shop_Gone"), "a retired requirement has no member")
+        val head = "package com.acme\nclass Witnesses : com.acme.req.Requirements_acme_shop_Witnesses {\n" +
+            "    override fun req_acme_shop_Recorded__object_entity() { }\n"
+        // Control: the same witness without the stale method builds, so the failure below is the stale member.
+        val control = tryCompile(out, mapOf(WITNESS_CLASS to head + "}\n"))
+        assertEquals(KotlinCompilation.ExitCode.OK, control.exitCode, control.messages)
+
+        val stale = tryCompile(out, mapOf(WITNESS_CLASS to head + "    override fun req_acme_shop_Gone() { }\n}\n"))
+        assertEquals(KotlinCompilation.ExitCode.COMPILATION_ERROR, stale.exitCode, "an override of a member the interface no longer has must not compile")
+        assertContains(stale.messages, "req_acme_shop_Gone")
+    }
+
+    // ---------------------------------------------------------------- escaping
+
+    @Test
+    fun `a dollar sign in author prose is escaped and does not become a string template`() {
+        // `$name` would be a template reference, `${total}` an expression, and a trailing `$` a stray.
+        val statement = "\"Charge \$name and \${total} and \$\""
+        val counterexample = "\"it breaks \$name \\\"here\\\" at C:\\\\tmp\\nthen \${total} \$\""
+        val loader = loadYaml(shop(requirement("Recorded", 4, "live", statement, counterexample, "Order")))
+        val out = run(loader)
+        val cl = compile(out, mapOf(WITNESS_CLASS to witnessNone))
+
+        val e = invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Recorded__object_entity")
+        assertNotNull(e)
+        assertTrue(
+            e.message!!.endsWith("so that it fails when: it breaks \$name \"here\" at C:\\tmp\nthen \${total} \$"),
+            e.message,
+        )
+        val iface = read(out, "Requirements_acme_shop_Witnesses.kt")
+        assertContains(iface, "it breaks \\\$name \\\"here\\\" at C:\\\\tmp\\nthen \\\${total} \\\$\")")
+    }
+
+    @Test
+    fun `quotes backslashes newlines and comment terminators still compile and are carried`() {
+        val statement = "\"say \\\"hi\\\" to C:\\\\dir\\nsecond line */ end \\\\u000a not an escape\\rlone cr\""
+        val counterexample = "\"it breaks \\\"here\\\" at C:\\\\tmp\\nthen */ and \\\\u000a\""
+        val loader = loadYaml(shop(requirement("Recorded", 4, "live", statement, counterexample, "Order")))
+        val out = run(loader)
+        val cl = compile(out, mapOf(WITNESS_CLASS to witnessNone))
+
+        val e = invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Recorded__object_entity")
+        assertNotNull(e)
+        assertTrue(e.message!!.endsWith("so that it fails when: it breaks \"here\" at C:\\tmp\nthen */ and \\u000a"), e.message)
+
+        val test = read(out, "Requirements_acme_shop_Test.kt")
+        assertTrue(test.contains("// say \"hi\" to C:\\dir\n"), test)
+        assertTrue(test.contains("    // second line * / end \\u000a not an escape\n"), test)
+        assertTrue(test.contains("    // lone cr\n"), test)
+        assertTrue(test.contains("    // Counterexample: it breaks \"here\" at C:\\tmp\n    // then * / and \\u000a\n"), test)
+    }
+
+    @Test
+    fun `triple quotes in author prose cannot end the literal or the comment`() {
+        val statement = "\"quoted \\\"\\\"\\\" statement\""
+        val counterexample = "\"it breaks \\\"\\\"\\\" and \\\"\\\"\\\"\""
+        val loader = loadYaml(shop(requirement("Recorded", 4, "live", statement, counterexample, "Order")))
+        val out = run(loader)
+        val cl = compile(out, mapOf(WITNESS_CLASS to witnessNone))
+        val e = invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Recorded__object_entity")
+        assertNotNull(e)
+        assertTrue(e.message!!.endsWith("so that it fails when: it breaks \"\"\" and \"\"\""), e.message)
+        assertTrue(read(out, "Requirements_acme_shop_Test.kt").contains("// quoted \"\"\" statement\n"))
+        assertContains(read(out, "Requirements_acme_shop_Witnesses.kt"), "it breaks \\\"\\\"\\\" and \\\"\\\"\\\"")
+    }
+
+    @Test
+    fun `carriage returns in a counterexample are escaped in the literal and split in the comment`() {
+        // YAML escapes: CR LF, then a lone CR. A raw CR in a string literal would end the line.
+        val counterexample = "\"first\\r\\nsecond\\rthird\""
+        val loader = loadYaml(shop(requirement("Recorded", 4, "live", "S.", counterexample, "Order")))
+        val out = run(loader)
+
+        val iface = read(out, "Requirements_acme_shop_Witnesses.kt")
+        val test = read(out, "Requirements_acme_shop_Test.kt")
+        assertFalse(iface.indexOf('\r') >= 0 || test.indexOf('\r') >= 0, "no raw CR reaches either file")
+        assertTrue(iface.contains("so that it fails when: first\\r\\nsecond\\rthird\")"), iface)
+        assertTrue(test.contains("    // Counterexample: first\n    // second\n    // third\n"), test)
+
+        val cl = compile(out, mapOf(WITNESS_CLASS to witnessNone))
+        val e = invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Recorded__object_entity")
+        assertNotNull(e)
+        assertTrue(e.message!!.endsWith("so that it fails when: first\r\nsecond\rthird"), e.message)
+    }
+
+    // ---------------------------------------------------------------- refusals
+
+    @Test
+    fun `two requirements with one witness key are refused naming both and the code`() {
+        // A name cannot hold a dot, so Orders.Recorded is a requirement nested under Orders.
+        val loader = loadYaml(
+            shop(
+                requirement("Orders", 3, "live", "P.", "Q.", null) +
+                    "        children:\n          - requirement.functional:\n" +
+                    "              name: Recorded\n              level: 4\n              status: live\n" +
+                    "              statement: A.\n              counterexample: B.\n              implementedBy: [Order]\n",
+                requirement("Orders_Recorded", 4, "live", "C.", "D.", "Order"),
+            ),
+        )
+        val e = assertFailsWith<GeneratorException> { run(loader) }
+        assertContains(e.message!!, "ERR_REQUIREMENT_WITNESS_KEY_COLLISION")
+        assertContains(e.message!!, "acme::shop::Orders.Recorded [object.entity]")
+        assertContains(e.message!!, "acme::shop::Orders_Recorded [object.entity]")
+    }
+
+    @Test
+    fun `an unknown grain is refused with a clear error whatever the model holds`() {
+        for (loader in listOf(loadDir(workedExampleInput()), loadYaml(shop()))) {
+            val e = assertFailsWith<GeneratorException> { run(loader, mapOf("grain" to "hybrid")) }
+            assertContains(e.message!!, "unknown requirement-test grain \"hybrid\"")
+            assertContains(e.message!!, "\"concern\" or \"member\"")
+        }
+    }
+
+    @Test
+    fun `a missing witness class or test package is a clear error and writes nothing`() {
+        val loader = loadDir(workedExampleInput())
+        for (missing in listOf("witnessClass", "testPackage")) {
+            val out = tempDir()
+            val args = mutableMapOf("outputDir" to out.toString(), "testPackage" to TEST_PACKAGE, "witnessClass" to WITNESS_CLASS)
+            args.remove(missing)
+            val bare = KotlinRequirementTestsGenerator().also { it.setArgs(args) }
+            val e = assertFailsWith<GeneratorException> { bare.execute(loader) }
+            assertContains(e.message!!, "'$missing'")
+            assertEquals(emptySet(), files(out), "nothing is written when it refuses")
+        }
+    }
+
+    @Test
+    fun `a test package or witness class that is not a Kotlin name is refused rather than spliced into source`() {
+        val loader = loadDir(workedExampleInput())
+        val witness = assertFailsWith<GeneratorException> { run(loader, mapOf("witnessClass" to "com.acme.W(); System.exit(1")) }
+        assertContains(witness.message!!, "arg 'witnessClass' must be a dotted Kotlin name")
+        val pkg = assertFailsWith<GeneratorException> { run(loader, mapOf("testPackage" to "com.acme\nimport x")) }
+        assertContains(pkg.message!!, "arg 'testPackage' must be a dotted Kotlin name")
+        // `$` is a legal JVM name character and the one rule that differs from the Java generator:
+        // in Kotlin source it starts a template, so it is refused in both names.
+        val dollarWitness = assertFailsWith<GeneratorException> { run(loader, mapOf("witnessClass" to "com.acme.Witness\$1")) }
+        assertContains(dollarWitness.message!!, "arg 'witnessClass' must be a dotted Kotlin name")
+        val dollarPackage = assertFailsWith<GeneratorException> { run(loader, mapOf("testPackage" to "com.\$acme")) }
+        assertContains(dollarPackage.message!!, "arg 'testPackage' must be a dotted Kotlin name")
+    }
+
+    @Test
+    fun `a keyword package segment is backtick escaped so the output compiles and runs`() {
+        // `in`, `is` and `as` are real reversed-domain prefixes and Kotlin hard keywords.
+        val out = tempDir()
+        generator(out, mapOf("testPackage" to "in.co.acme.requirements", "witnessClass" to "in.co.acme.Witnesses"))
+            .execute(loadDir(workedExampleInput()))
+        val dir = out.resolve("in/co/acme/requirements")
+        val iface = dir.resolve("Requirements_acme_shop_Witnesses.kt").readText()
+        val test = dir.resolve("Requirements_acme_shop_Test.kt").readText()
+        assertContains(iface, "package `in`.co.acme.requirements\n")
+        assertContains(test, "package `in`.co.acme.requirements\n")
+        assertContains(test, "private val witnesses: Requirements_acme_shop_Witnesses = `in`.co.acme.Witnesses()")
+        // The header comment and the failure message keep the plain name.
+        assertContains(test, "// The witnesses are project-owned, in in.co.acme.Witnesses.\n")
+        assertContains(iface, "write in.co.acme.Witnesses.req_acme_shop_Orders_Recorded__object_entity()")
+
+        val witness = "package `in`.co.acme\nclass Witnesses : `in`.co.acme.requirements.Requirements_acme_shop_Witnesses {\n" +
+            "    override fun req_acme_shop_Orders_Recorded__object_entity() { }\n}\n"
+        val cl = compile(out, mapOf("in.co.acme.Witnesses" to witness))
+        val c = cl.loadClass("in.co.acme.requirements.Requirements_acme_shop_Test")
+        val instance = c.getDeclaredConstructor().newInstance()
+        c.getDeclaredMethod("req_acme_shop_Orders_Recorded__object_entity").invoke(instance)
+    }
+
+    @Test
+    fun `warnUncovered must be true or false`() {
+        val loader = loadDir(workedExampleInput())
+        val e = assertFailsWith<GeneratorException> { run(loader, mapOf("warnUncovered" to "flase")) }
+        assertContains(e.message!!, "warnUncovered")
+    }
+
+    // ---------------------------------------------------------------- grain, filter, renderer
+
+    @Test
+    fun `member grain writes one test per resolving reference`() {
+        val loader = loadYaml(shop(requirement("Recorded", 4, "live", "S.", "C.", "Order, acme::shop::Order.total")))
+        val test = read(run(loader, mapOf("grain" to "member")), "Requirements_acme_shop_Test.kt")
+        assertContains(test, "fun req_acme_shop_Recorded__Order()")
+        assertContains(test, "fun req_acme_shop_Recorded__acme_shop_Order_total()")
+        assertFalse(test.contains("object_entity"), test)
+    }
+
+    @Test
+    fun `member grain lists a reference authored twice once in the claims comment`() {
+        // `implementedBy: [Order, "acme::shop::Order", Order]`: two units, and the one authored
+        // twice claims its node once.
+        val loader = loadDir(corpusCase("member-grain-duplicate-ref/input"))
+        val test = read(run(loader, mapOf("grain" to "member")), "Requirements_acme_shop_Test.kt")
+        val claims = test.lines().map { it.trim() }.filter { it.startsWith("// Claims:") }
+        assertEquals(
+            listOf("// Claims: Order  (object.entity)", "// Claims: acme::shop::Order  (object.entity)"),
+            claims,
+        )
+    }
+
+    /** A filter that keeps everything, found by name. Public with a public constructor, as a project's would be. */
+    class KeepEverything : RequirementTestFilter {
+        override fun include(view: RequirementTestIdentities.View): Boolean = true
+    }
+
+    @Test
+    fun `a filter class keeps an L3 requirement the default drops and it renders with unit star`() {
+        val loader = loadDir(workedExampleInput())
+        assertFalse(read(run(loader), "Requirements_acme_shop_Test.kt").contains("req_acme_shop_Orders()"))
+        val test = read(run(loader, mapOf("filter" to KeepEverything::class.java.name)), "Requirements_acme_shop_Test.kt")
+        assertContains(test, "// acme::shop::Orders [*]")
+        assertContains(test, "fun req_acme_shop_Orders()")
+    }
+
+    @Test
+    fun `a filter class that cannot be loaded is a clear error`() {
+        val loader = loadDir(workedExampleInput())
+        val e = assertFailsWith<GeneratorException> { run(loader, mapOf("filter" to "com.nowhere.NoSuchFilter")) }
+        assertContains(e.message!!, "'filter'")
+        assertContains(e.message!!, "com.nowhere.NoSuchFilter")
+        assertContains(e.message!!, "not on the project's classpath")
+        val notAFilter = assertFailsWith<GeneratorException> { run(loader, mapOf("filter" to "java.lang.String")) }
+        assertContains(notAFilter.message!!, "does not implement")
+    }
+
+    /** A filter whose class loads and has a public no-argument constructor, which throws. */
+    class ThrowingConstructorFilter : RequirementTestFilter {
+        init {
+            if (System.nanoTime() != 0L) throw IllegalStateException("the price list is not configured")
+        }
+
+        override fun include(view: RequirementTestIdentities.View): Boolean = true
+    }
+
+    @Test
+    fun `a filter whose constructor throws is reported with what it threw`() {
+        val loader = loadDir(workedExampleInput())
+        val e = assertFailsWith<GeneratorException> {
+            run(loader, mapOf("filter" to ThrowingConstructorFilter::class.java.name))
+        }
+        assertContains(e.message!!, "'filter'")
+        assertContains(e.message!!, ThrowingConstructorFilter::class.java.name)
+        assertContains(e.message!!, "its constructor threw")
+        assertContains(e.message!!, "the price list is not configured")
+        // The class HAS the constructor: saying it needs one would send the reader to the wrong place.
+        assertFalse(e.message!!.contains("needs a public no-argument constructor"), e.message)
+        assertIs<IllegalStateException>(e.cause, "the cause is what the constructor threw")
+    }
+
+    /** A filter with no no-argument constructor at all: the other reflective failure keeps its wording. */
+    class NoDefaultConstructorFilter(@Suppress("UNUSED_PARAMETER") unused: String) : RequirementTestFilter {
+        override fun include(view: RequirementTestIdentities.View): Boolean = true
+    }
+
+    @Test
+    fun `a filter with no no-argument constructor is still told it needs one`() {
+        val loader = loadDir(workedExampleInput())
+        val e = assertFailsWith<GeneratorException> {
+            run(loader, mapOf("filter" to NoDefaultConstructorFilter::class.java.name))
+        }
+        assertContains(e.message!!, "needs a public no-argument constructor")
+        assertFalse(e.message!!.contains("its constructor threw"), e.message)
+    }
+
+    /** A filter that exists and cannot be used: its static initialiser throws. */
+    class ExplodingFilter : RequirementTestFilter {
+        override fun include(view: RequirementTestIdentities.View): Boolean = true
+
+        companion object {
+            init {
+                if (System.nanoTime() != 0L) throw IllegalStateException("boom from the static initialiser")
+            }
+        }
+    }
+
+    @Test
+    fun `a filter that is found but fails to link is not reported as missing`() {
+        val loader = loadDir(workedExampleInput())
+        val e = assertFailsWith<GeneratorException> { run(loader, mapOf("filter" to ExplodingFilter::class.java.name)) }
+        assertContains(e.message!!, ExplodingFilter::class.java.name)
+        assertContains(e.message!!, "was found but could not be loaded")
+        assertFalse(e.message!!.contains("not on the project's classpath"), e.message)
+        assertIs<LinkageError>(e.cause, "the error is the cause: ${e.cause}")
+        assertIs<IllegalStateException>(e.cause!!.cause)
+    }
+
+    /** Records what it is given and replaces the Recorded test. */
+    class RecordingRenderer : RequirementTestRenderer {
+        override fun render(args: RequirementTestArgs): RenderedTest? {
+            SEEN += args
+            if (args.identity().path() != "Orders.Recorded") return null
+            return RenderedTest(
+                listOf("org.junit.jupiter.api.Assertions"),
+                "@Test\nfun ${args.identity().witnessKey()}() {\n    Assertions.assertTrue(true, \"digest ${args.identity().digest()}\")\n}",
+            )
+        }
+
+        companion object {
+            val SEEN = mutableListOf<RequirementTestArgs>()
+        }
+    }
+
+    @Test
+    fun `a renderer class replaces one test and receives the digest while the others keep the default`() {
+        RecordingRenderer.SEEN.clear()
+        val out = run(loadDir(workedExampleInput()), mapOf("renderer" to RecordingRenderer::class.java.name))
+        val test = read(out, "Requirements_acme_shop_Test.kt")
+        assertContains(test, "import org.junit.jupiter.api.Assertions\n")
+        assertContains(test, "    Assertions.assertTrue(true, \"digest 2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a\")")
+        assertFalse(test.contains("witnesses.req_acme_shop_Orders_Recorded__object_entity()"), "the replaced test lost its default body")
+        assertContains(test, "@Disabled(\"planned - not built yet\")")
+
+        assertEquals(2, RecordingRenderer.SEEN.size)
+        val recorded = RecordingRenderer.SEEN.first { it.identity().path() == "Orders.Recorded" }
+        assertEquals("An order is recorded when it is placed.", recorded.statement())
+        assertEquals("A placed order has no row.", recorded.counterexample())
+        assertEquals("Order", recorded.targets()[0].ref())
+        assertEquals("object.entity", recorded.targets()[0].concern())
+        assertEquals("2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a", recorded.identity().digest())
+    }
+
+    // ---------------------------------------------------------------- the uncovered warning
+
+    /** A level 3 requirement `parent` holding a level 3 child, both excluded by the default filter. */
+    private fun withChild(parent: String, child: String): String =
+        requirement(parent, 3, "live", "P.", "Q.", null) +
+            "        children:\n          - requirement.functional:\n" +
+            "              name: $child\n              level: 3\n              status: live\n" +
+            "              statement: A.\n              counterexample: B.\n"
+
+    /** Runs [gen] over [loader] and returns what it logged. */
+    private fun logged(gen: KotlinRequirementTestsGenerator, loader: MetaDataLoader): List<String> =
+        captureLog { gen.execute(loader) }
+
+    @Test
+    fun `excluded requirements produce one capped warning and warnUncovered false silences it`() {
+        val reqs = (1..7).map { requirement("Area$it", 3, "live", "S.", "C.", null) } +
+            requirement("Recorded", 4, "live", "S.", "C.", "Order")
+        val loader = loadYaml(shop(*reqs.toTypedArray()))
+
+        val gen = generator(tempDir(), mapOf("warnUncovered" to "true"))
+        val message =
+            "7 requirement(s) matched no filter and get no test. If that is deliberate, set " +
+                "warnUncovered=false to silence this. Uncovered: Area1, Area2, Area3, Area4, Area5, and 2 more."
+        // Table A: diagnostics name the PATH, never the package-qualified address, so the same
+        // model gives the same names in every port.
+        assertEquals(listOf(message), logged(gen, loader))
+        assertEquals(listOf(message), gen.warnings())
+
+        val quiet = generator(tempDir(), mapOf("warnUncovered" to "false"))
+        assertEquals(emptyList(), logged(quiet, loader))
+        assertEquals(emptyList(), quiet.warnings())
+    }
+
+    @Test
+    fun `the uncovered warning is on by default`() {
+        // No warnUncovered arg at all: the worked example's excluded L3 parent must be named.
+        val gen = KotlinRequirementTestsGenerator().also { it.setArgs(realArgs(tempDir())) }
+        val log = logged(gen, loadDir(workedExampleInput()))
+        val message = "1 requirement(s) matched no filter and get no test. If that is deliberate, set " +
+            "warnUncovered=false to silence this. Uncovered: Orders."
+        assertEquals(listOf(message), log)
+        assertEquals(listOf(message), gen.warnings())
+    }
+
+    @Test
+    fun `five or fewer excluded requirements are all named by path including a nested one and there is no and-more tail`() {
+        // Orders.Placed is nested: its PATH is the dotted one, never its bare name and never the
+        // package-qualified address.
+        val gen = generator(tempDir(), mapOf("warnUncovered" to "true"))
+        val loader = loadYaml(
+            shop(
+                requirement("Area1", 3, "live", "S.", "C.", null),
+                withChild("Orders", "Placed"),
+                requirement("Recorded", 4, "live", "S.", "C.", "Order"),
+            ),
+        )
+        val log = logged(gen, loader)
+        val message = "3 requirement(s) matched no filter and get no test. If that is deliberate, set " +
+            "warnUncovered=false to silence this. Uncovered: Area1, Orders, Orders.Placed."
+        assertEquals(listOf(message), log)
+        assertEquals(listOf(message), gen.warnings())
+    }
+
+    // ---------------------------------------------------------------- nothing declared, nothing changes
+
+    @Test
+    fun `a model with no requirement writes nothing and warns nothing even without the required args`() {
+        val out = tempDir()
+        val gen = KotlinRequirementTestsGenerator().also { it.setArgs(mapOf("outputDir" to out.toString())) }
+        gen.execute(loadYaml(shop()))
+        assertEquals(emptySet(), files(out))
+        assertEquals(emptyList(), gen.warnings())
+    }
+
+    // ---------------------------------------------------------------- stale files
+
+    @Test
+    fun `stale file - gen never removes the files of a package that lost its last requirement`() {
+        val billing = "metadata:\n  package: acme::billing\n  children:\n" +
+            "    - object.entity:\n        name: Invoice\n        children:\n" +
+            "          - field.uuid: { name: id }\n          - identity.primary: { name: pk, fields: [id] }\n" +
+            requirement("Billed", 4, "live", "S.", "C.", "Invoice")
+        val dir = tempDir()
+        Files.writeString(dir.resolve("meta.billing.yaml"), billing)
+        Files.writeString(dir.resolve("meta.shop.yaml"), shop(requirement("Recorded", 4, "live", "S.", "C.", "Order")))
+
+        val out = tempDir()
+        generator(out).execute(loadDir(dir))
+        val both = sortedSetOf(
+            "com/acme/req/Requirements_acme_billing_Test.kt", "com/acme/req/Requirements_acme_billing_Witnesses.kt",
+            "com/acme/req/Requirements_acme_shop_Test.kt", "com/acme/req/Requirements_acme_shop_Witnesses.kt",
+        )
+        assertEquals(both, files(out))
+
+        // The billing package loses its requirement.
+        Files.writeString(dir.resolve("meta.billing.yaml"), billing.substring(0, billing.indexOf("    - requirement.functional")))
+        generator(out).execute(loadDir(dir))
+
+        // What gen does, as for every JVM generator: it does not delete, so the files stay. That
+        // is all this asserts; that the codegen-drift goal then reports them is the plugin's own
+        // behaviour for every generator, not something this generator adds.
+        assertEquals(both, files(out))
+    }
+
+    // ---------------------------------------------------------------- project class loader
+
+    @Test
+    fun `a filter only the project class loader can see is found once the loader is injected`() {
+        // Compiled into a loader that is on no ambient class path: the packaged generator's own
+        // loader cannot see it, exactly as the plugin's cannot see a project class.
+        val result = KotlinCompilation().apply {
+            sources = listOf(
+                SourceFile.kotlin(
+                    "ProjectOnlyFilter.kt",
+                    "package com.acme\nclass ProjectOnlyFilter : com.metaobjects.requirement.RequirementTestFilter {\n" +
+                        "    override fun include(view: com.metaobjects.requirement.RequirementTestIdentities.View): Boolean = true\n}\n",
+                ),
+            )
+            inheritClassPath = true
+        }.compile()
+        assertEquals(KotlinCompilation.ExitCode.OK, result.exitCode, result.messages)
+
+        val loader = loadDir(workedExampleInput())
+        val args = mapOf("filter" to "com.acme.ProjectOnlyFilter")
+        val e = assertFailsWith<GeneratorException> { run(loader, args) }
+        assertContains(e.message!!, "com.acme.ProjectOnlyFilter")
+
+        val out = tempDir()
+        val gen = generator(out, args)
+        gen.setProjectClassLoader(result.classLoader)
+        gen.execute(loader)
+        assertContains(read(out, "Requirements_acme_shop_Test.kt"), "// acme::shop::Orders [*]")
+    }
+
+    // ---------------------------------------------------------------- eject
+
+    private val packageLine = Regex("(?m)^package\\s+[\\w.]+\\s*$")
+
+    @Test
+    fun `a package-renamed copy of the generator emits the same bytes as the packaged one`() {
+        // The copy is exactly what `mvn metaobjects:eject` writes: this one source file with its
+        // package line replaced. The args are NOT the defaults (member grain, another test
+        // package), so a copy that read a default instead of its arg, or that carried the
+        // generator's own package or class name into its output, would differ.
+        val original = Path.of("src/main/kotlin/com/metaobjects/generator/kotlin/KotlinRequirementTestsGenerator.kt")
+        val source = original.readText()
+        val match = assertNotNull(packageLine.find(source), "expected a package line")
+        val rewritten = source.replaceRange(match.range, "package com.acme.owned")
+        assertTrue(rewritten.contains("package com.acme.owned"))
+
+        val result = KotlinCompilation().apply {
+            sources = listOf(SourceFile.kotlin("KotlinRequirementTestsGenerator.kt", rewritten))
+            inheritClassPath = true
+            messageOutputStream = ByteArrayOutputStream()
+        }.compile()
+        assertEquals(KotlinCompilation.ExitCode.OK, result.exitCode, result.messages)
+        val owned = result.classLoader.loadClass("com.acme.owned.KotlinRequirementTestsGenerator")
+            .getDeclaredConstructor().newInstance() as Generator
+
+        val args = mapOf(
+            "testPackage" to "com.example.requirements",
+            "witnessClass" to "com.example.Witnesses",
+            "grain" to "member",
+            "warnUncovered" to "false",
+        )
+        val loader = loadDir(workedExampleInput())
+        val packagedOut = tempDir()
+        KotlinRequirementTestsGenerator().also { it.setArgs(args + ("outputDir" to packagedOut.toString())) }.execute(loader)
+        val ownedOut = tempDir()
+        owned.setArgs(args + ("outputDir" to ownedOut.toString())).execute(loader)
+
+        val expectedFiles = sortedSetOf(
+            "com/example/requirements/Requirements_acme_shop_Test.kt",
+            "com/example/requirements/Requirements_acme_shop_Witnesses.kt",
+        )
+        assertEquals(expectedFiles, files(packagedOut))
+        assertEquals(expectedFiles, files(ownedOut), "same set of generated files")
+        for (rel in expectedFiles) {
+            val text = packagedOut.resolve(rel).readText()
+            assertEquals(text, ownedOut.resolve(rel).readText(), "content differs for $rel")
+            assertFalse(text.contains("com.acme.owned") || text.contains("KotlinRequirementTestsGenerator"), "$rel names the generator")
+        }
+        // member grain, not the default: the unit is the reference as authored.
+        assertContains(ownedOut.resolve("com/example/requirements/Requirements_acme_shop_Test.kt").readText(), "req_acme_shop_Orders_Recorded__Order()")
+    }
+
+    @Test
+    fun `requirement-tests is registered and ejectable`() {
+        val info = GENERATOR_REGISTRY.getValue("requirement-tests")
+        assertEquals("META-INF/metaobjects/reference/kotlin/KotlinRequirementTestsGenerator.kt", info.ejectResourcePath)
+        assertIs<KotlinRequirementTestsGenerator>(info.factory())
+        assertEquals(GeneratorLayer.CAPABILITY, info.layer)
+    }
+
+    private companion object {
+        const val TEST_PACKAGE = "com.acme.req"
+        const val WITNESS_CLASS = "com.acme.Witnesses"
+    }
+}
diff --git a/server/java/codegen-spring/pom.xml b/server/java/codegen-spring/pom.xml
index 1eb97d7a7..d63b1f144 100644
--- a/server/java/codegen-spring/pom.xml
+++ b/server/java/codegen-spring/pom.xml
@@ -74,6 +74,16 @@
             <scope>test</scope>
         </dependency>
 
+        <!-- compile-and-run test (JUnitRequirementTestsGeneratorTest): the generated requirement
+             tests are JUnit Jupiter, so compiling them needs the Jupiter API. This module's own
+             tests stay JUnit 4. -->
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-api</artifactId>
+            <version>5.10.2</version>
+            <scope>test</scope>
+        </dependency>
+
         <!-- compile-and-run test: generated parser imports Jackson ObjectMapper -->
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
@@ -127,6 +137,21 @@
 
     <build>
         <plugins>
+            <!-- This module's tests are JUnit 4. With junit-jupiter-api on the test classpath
+                 (for JUnitRequirementTestsGeneratorTest to compile the Jupiter tests it generates)
+                 surefire would switch to the JUnit Platform provider and ask for the vintage
+                 engine. Naming the JUnit 4 provider keeps the provider the tests were written for. -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <dependencies>
+                    <dependency>
+                        <groupId>org.apache.maven.surefire</groupId>
+                        <artifactId>surefire-junit4</artifactId>
+                        <version>${surefire.plugin.version}</version>
+                    </dependency>
+                </dependencies>
+            </plugin>
             <!-- `mvn metaobjects:eject` (FR — eject in every port, JVM section) ships the
                  verbatim source of every ejectable generator inside the jar that owns it,
                  as a classpath resource under META-INF/metaobjects/reference/java/. Copied
@@ -165,6 +190,7 @@
                                         <include>SpringValueObjectGenerator.java</include>
                                         <include>LlmTraceHelperGenerator.java</include>
                                         <include>SpringNamesGenerator.java</include>
+                                        <include>JUnitRequirementTestsGenerator.java</include>
                                     </includes>
                                 </resource>
                             </resources>
diff --git a/server/java/codegen-spring/src/main/java/com/metaobjects/generator/GeneratorRegistry.java b/server/java/codegen-spring/src/main/java/com/metaobjects/generator/GeneratorRegistry.java
index 7619e83ad..deaa58c26 100644
--- a/server/java/codegen-spring/src/main/java/com/metaobjects/generator/GeneratorRegistry.java
+++ b/server/java/codegen-spring/src/main/java/com/metaobjects/generator/GeneratorRegistry.java
@@ -2,6 +2,7 @@
 
 import com.metaobjects.generator.direct.object.javacode.ExtractorCodeGenerator;
 import com.metaobjects.generator.direct.object.javacode.JavaObjectCodeGenerator;
+import com.metaobjects.generator.spring.JUnitRequirementTestsGenerator;
 import com.metaobjects.generator.spring.LlmTraceHelperGenerator;
 import com.metaobjects.generator.spring.SpringControllerGenerator;
 import com.metaobjects.generator.spring.SpringDtoGenerator;
@@ -267,6 +268,11 @@ private static Map<String, GeneratorInfo> buildRegistry() {
                 "Per-entity typed record<Entity> LLM-trace helper (extract + buildLlmCallRow + persist; "
                     + "LlmCallBase-derived entities only).", Tier.NATIVE, Layer.CAPABILITY,
                 ejectPath(LlmTraceHelperGenerator.class));
+        register(m, "requirement-tests", JUnitRequirementTestsGenerator.class.getName(),
+                "Per-package JUnit Jupiter tests, one per tested requirement, each calling a project-owned "
+                    + "witness class through a generated interface; a live test with no witness fails and a "
+                    + "planned or retired one is @Disabled.",
+                Tier.NATIVE, Layer.CAPABILITY, ejectPath(JUnitRequirementTestsGenerator.class));
         register(m, "names", SpringNamesGenerator.class.getName(),
                 "Per-object physical database name constants (table/view/schema/column) "
                     + "for a hand-written consumer to reference instead of a string literal.", Tier.NATIVE, Layer.MODEL,
diff --git a/server/java/codegen-spring/src/main/java/com/metaobjects/generator/spring/JUnitRequirementTestsGenerator.java b/server/java/codegen-spring/src/main/java/com/metaobjects/generator/spring/JUnitRequirementTestsGenerator.java
new file mode 100644
index 000000000..782e9afa6
--- /dev/null
+++ b/server/java/codegen-spring/src/main/java/com/metaobjects/generator/spring/JUnitRequirementTestsGenerator.java
@@ -0,0 +1,423 @@
+package com.metaobjects.generator.spring;
+
+import com.metaobjects.generator.FileEmittingGenerator;
+import com.metaobjects.generator.GeneratorException;
+import com.metaobjects.generator.ProjectClassLoaderAware;
+import com.metaobjects.generator.requirement.RenderedTest;
+import com.metaobjects.generator.requirement.RequirementTestArgs;
+import com.metaobjects.generator.requirement.RequirementTestRenderer;
+import com.metaobjects.loader.MetaDataLoader;
+import com.metaobjects.requirement.MetaRequirement;
+import com.metaobjects.requirement.RequirementTestFilter;
+import com.metaobjects.requirement.RequirementTestIdentities;
+import com.metaobjects.requirement.RequirementTestIdentities.Grain;
+import com.metaobjects.requirement.RequirementTestIdentities.Identity;
+import com.metaobjects.requirement.RequirementTestIdentities.Target;
+import com.metaobjects.requirement.RequirementTestIdentities.Walked;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.lang.reflect.InvocationTargetException;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.TreeMap;
+import java.util.TreeSet;
+import java.util.regex.Pattern;
+
+/**
+ * One JUnit Jupiter test per declared requirement, calling a project-owned witness (ADR-0057).
+ *
+ * <p>For each metamodel package that holds a tested requirement this writes two files into
+ * {@code testPackage}, rewritten whole on every run: {@code Requirements_<pkgKey>_Witnesses.java}
+ * (an interface with one default member per NON-skipped test, which fails with
+ * {@code unimplemented requirement: ...}) and {@code Requirements_<pkgKey>_Test.java} (one
+ * {@code @Test} per requirement, calling the member on the project's {@code witnessClass}).
+ * The project owns the witnesses: it writes a class implementing every generated witness
+ * interface and overrides the members it has witnesses for. A requirement that becomes live
+ * adds a failing member, a red test and no compile break; one that is retired or deleted
+ * removes the member, so a stale override stops compiling. That signal depends on the project
+ * annotating each witness method {@code @Override}: a stale method without the annotation is
+ * an ordinary method and compiles, which is why the generated header asks for it.</p>
+ *
+ * <p>Which tests exist, what each is called, whether it is skipped and its digest come from
+ * {@link RequirementTestIdentities}, which every language port shares and a conformance corpus
+ * pins. This class decides only how they are WRITTEN. It is a reference helper
+ * (ADR-0034 Amendment 3): {@code mvn metaobjects:eject} copies this one file into your project,
+ * and the default rendering is in it, so an owned copy changes the output freely.</p>
+ *
+ * <p>Args: {@code outputDir}, {@code testPackage} and {@code witnessClass} (the last two required
+ * once the model holds a requirement), {@code grain} ({@code concern}, the default, or {@code member}),
+ * {@code filter} (a {@link RequirementTestFilter} class name that REPLACES the default of
+ * functional requirements at level 4 or above), {@code renderer} (a
+ * {@link RequirementTestRenderer} class name), and {@code warnUncovered} ({@code true} by
+ * default: name the requirements the filter excluded).</p>
+ *
+ * <p>The generated tests are JUnit Jupiter; the project's test classpath needs
+ * {@code org.junit.jupiter:junit-jupiter-api}. They import nothing from MetaObjects.</p>
+ */
+public class JUnitRequirementTestsGenerator extends FileEmittingGenerator implements ProjectClassLoaderAware {
+
+    private static final Logger LOG = LoggerFactory.getLogger(JUnitRequirementTestsGenerator.class);
+
+    public static final String ARG_TEST_PACKAGE = "testPackage";
+    public static final String ARG_WITNESS_CLASS = "witnessClass";
+    public static final String ARG_GRAIN = "grain";
+    public static final String ARG_FILTER = "filter";
+    public static final String ARG_RENDERER = "renderer";
+    public static final String ARG_WARN_UNCOVERED = "warnUncovered";
+
+    /** The refusal code when two tests map to one witness key. */
+    public static final String ERR_WITNESS_KEY_COLLISION = "ERR_REQUIREMENT_WITNESS_KEY_COLLISION";
+
+    /** How many uncovered requirements to name before "and N more". */
+    private static final int MAX_NAMED_UNCOVERED = 5;
+
+    private static final String SKIP_PLANNED = "planned - not built yet";
+    private static final String SKIP_RETIRED =
+        "retired - the capability was deliberately removed; assert it stays removed";
+
+    private static final Pattern JAVA_NAME = Pattern.compile("[A-Za-z_$][A-Za-z0-9_$]*(\\.[A-Za-z_$][A-Za-z0-9_$]*)*");
+
+    private ClassLoader projectClassLoader;
+    private final List<String> warnings = new ArrayList<>();
+
+    @Override
+    public void setProjectClassLoader(ClassLoader projectClassLoader) {
+        this.projectClassLoader = projectClassLoader;
+    }
+
+    /** What the last run warned about (each message was also logged). */
+    public List<String> warnings() {
+        return List.copyOf(warnings);
+    }
+
+    /** One test to write: its identity and the data its rendering is built from. */
+    private record Planned(Identity identity, RequirementTestArgs args) {}
+
+    @Override
+    protected List<EmittedFile> generate(MetaDataLoader loader) {
+        warnings.clear();
+        // The optional args are checked first, so a typo is refused whatever the model holds.
+        Grain grain = grain();
+        RequirementTestFilter filter = loadOptional(ARG_FILTER, RequirementTestFilter.class);
+        RequirementTestRenderer renderer = loadOptional(ARG_RENDERER, RequirementTestRenderer.class);
+        boolean warnUncovered = warnUncovered();
+
+        List<Walked> walked = RequirementTestIdentities.walk(loader.getRoot());
+        // No requirement, no change: nothing is written and nothing is said.
+        if (walked.isEmpty()) return List.of();
+
+        String testPackage = requiredName(ARG_TEST_PACKAGE);
+        String witnessClass = requiredName(ARG_WITNESS_CLASS);
+
+        List<Planned> planned = new ArrayList<>();
+        List<String> uncovered = new ArrayList<>();
+        for (Walked w : walked) {
+            boolean keep = filter == null ? RequirementTestIdentities.defaultFilter(w.view()) : filter.include(w.view());
+            if (!keep) {
+                // The PATH, not the qualified address: diagnostics name paths, in every port.
+                uncovered.add(w.view().path());
+                continue;
+            }
+            for (Map.Entry<String, List<Target>> unit : RequirementTestIdentities.units(w, grain).entrySet()) {
+                Identity identity = RequirementTestIdentities.identity(w, unit.getKey());
+                planned.add(new Planned(identity, argsFor(w.node(), identity, unit.getValue())));
+            }
+        }
+        planned.sort((a, b) -> a.identity().id().compareTo(b.identity().id()));
+        refuseCollisions(planned);
+        warnUncovered(uncovered, warnUncovered);
+
+        // One pair of files per package key. Two packages that mangle alike share a pair: their
+        // tests keep distinct keys, which the collision check above has just proven.
+        Map<String, List<Planned>> byPackage = new TreeMap<>();
+        for (Planned p : planned) byPackage.computeIfAbsent(packageKey(p.identity().pkg()), k -> new ArrayList<>()).add(p);
+
+        String dir = testPackage.replace('.', '/') + "/";
+        List<EmittedFile> files = new ArrayList<>();
+        for (Map.Entry<String, List<Planned>> e : byPackage.entrySet()) {
+            String witnesses = "Requirements_" + e.getKey() + "_Witnesses";
+            String test = "Requirements_" + e.getKey() + "_Test";
+            files.add(new EmittedFile(dir + witnesses + ".java", witnessInterface(testPackage, witnesses, witnessClass, e.getValue())));
+            files.add(new EmittedFile(dir + test + ".java", testClass(testPackage, test, witnesses, witnessClass, e.getValue(), renderer)));
+        }
+        return files;
+    }
+
+    // ------------------------------------------------------------------
+    // args
+    // ------------------------------------------------------------------
+
+    private Grain grain() {
+        if (!hasArg(ARG_GRAIN)) return Grain.CONCERN;
+        try {
+            return Grain.parse(getArg(ARG_GRAIN));
+        } catch (IllegalArgumentException e) {
+            throw new GeneratorException("requirement-tests: arg '" + ARG_GRAIN + "': " + e.getMessage(), e);
+        }
+    }
+
+    private boolean warnUncovered() {
+        String raw = getArg(ARG_WARN_UNCOVERED, "true");
+        if ("true".equalsIgnoreCase(raw)) return true;
+        if ("false".equalsIgnoreCase(raw)) return false;
+        throw new GeneratorException("requirement-tests: arg '" + ARG_WARN_UNCOVERED + "' must be true or false, not '" + raw + "'");
+    }
+
+    /** A required arg that is spliced into generated source, so it must be a Java name. */
+    private String requiredName(String arg) {
+        String value = getArg(arg);
+        if (value == null || value.isBlank()) {
+            throw new GeneratorException("requirement-tests: set '" + arg + "' with <args><" + arg + ">...</" + arg + "></args>"
+                + (ARG_WITNESS_CLASS.equals(arg) ? " (the fully-qualified name of the project class that implements the generated witness interfaces)" : "")
+                + (ARG_TEST_PACKAGE.equals(arg) ? " (the package the generated tests are written into)" : ""));
+        }
+        String name = value.trim();
+        if (!JAVA_NAME.matcher(name).matches()) {
+            throw new GeneratorException("requirement-tests: arg '" + arg + "' must be a dotted Java name, not '" + value + "'");
+        }
+        return name;
+    }
+
+    /**
+     * Instantiate the class an optional arg names, or {@code null} when the arg is absent. The
+     * project's class loader is tried first because a packaged generator's own loader cannot see
+     * the project's classes, then the context loader, then this class's own.
+     */
+    private <T> T loadOptional(String arg, Class<T> type) {
+        String className = getArg(arg);
+        if (className == null || className.isBlank()) return null;
+        className = className.trim();
+
+        List<ClassLoader> loaders = new ArrayList<>();
+        for (ClassLoader l : new ClassLoader[]{projectClassLoader, Thread.currentThread().getContextClassLoader(),
+            getClass().getClassLoader()}) {
+            if (l != null && !loaders.contains(l)) loaders.add(l);
+        }
+        Class<?> found = null;
+        for (ClassLoader l : loaders) {
+            try {
+                found = Class.forName(className, true, l);
+                break;
+            } catch (ClassNotFoundException ignored) {
+                // not in this loader: try the next
+            } catch (LinkageError e) {
+                // The class IS here and cannot be used (built for a newer JDK, a missing
+                // dependency, a static initialiser that threw): saying it is missing would send
+                // the reader looking for the wrong problem, and the next loader would hide it.
+                throw new GeneratorException("requirement-tests: arg '" + arg + "' names '" + className
+                    + "', which was found but could not be loaded: " + e, null, null, e, Map.of());
+            }
+        }
+        if (found == null) {
+            throw new GeneratorException("requirement-tests: arg '" + arg + "' names '" + className
+                + "', which is not on the project's classpath. Name a public class implementing "
+                + type.getSimpleName() + " from a module the build compiles before this goal runs.");
+        }
+        if (!type.isAssignableFrom(found)) {
+            throw new GeneratorException("requirement-tests: arg '" + arg + "' names '" + className
+                + "', which does not implement " + type.getName());
+        }
+        try {
+            return type.cast(found.getDeclaredConstructor().newInstance());
+        } catch (InvocationTargetException e) {
+            // The class HAS the constructor, and it ran and threw. The wrapper's own message is
+            // empty, so name what was thrown: "needs a constructor" would point at the wrong problem.
+            Throwable thrown = e.getCause() == null ? e : e.getCause();
+            throw new GeneratorException("requirement-tests: arg '" + arg + "' names '" + className
+                + "', and its constructor threw: " + thrown, null, null, thrown, Map.of());
+        } catch (ReflectiveOperationException e) {
+            throw new GeneratorException("requirement-tests: arg '" + arg + "' names '" + className
+                + "', which needs a public no-argument constructor: " + e, e);
+        }
+    }
+
+    // ------------------------------------------------------------------
+    // planning
+    // ------------------------------------------------------------------
+
+    private static RequirementTestArgs argsFor(MetaRequirement node, Identity identity, List<Target> targets) {
+        List<RequirementTestArgs.Claim> claims = new ArrayList<>();
+        for (Target t : targets) claims.add(new RequirementTestArgs.Claim(t.ref(), t.concern()));
+        return new RequirementTestArgs(identity, orEmpty(node.getStatement()), orEmpty(node.getCounterexample()),
+            claims, node.getDisposition(), node.getTrackedBy());
+    }
+
+    private static String orEmpty(String s) {
+        return s == null ? "" : s;
+    }
+
+    /** {@code root} for the empty package, otherwise the package with each run of non-ASCII-alphanumerics as one underscore. */
+    private static String packageKey(String pkg) {
+        return pkg.isEmpty() ? "root" : pkg.replaceAll("[^A-Za-z0-9]+", "_");
+    }
+
+    /** Two tests with one witness key cannot be told apart by a witness: refuse, naming both. */
+    private static void refuseCollisions(List<Planned> planned) {
+        Map<String, String> keyById = new LinkedHashMap<>();
+        for (Planned p : planned) keyById.put(p.identity().id(), p.identity().witnessKey());
+        List<String[]> pairs = RequirementTestIdentities.witnessKeyCollisions(
+            planned.stream().map(Planned::identity).toList());
+        if (pairs.isEmpty()) return;
+        StringBuilder sb = new StringBuilder(ERR_WITNESS_KEY_COLLISION)
+            .append(": two requirement tests map to one witness key, so one witness could not serve both. ")
+            .append("Rename one so the names differ in more than punctuation:");
+        for (String[] pair : pairs) {
+            sb.append("\n  '").append(pair[0]).append("' and '").append(pair[1])
+              .append("' (witness key ").append(keyById.get(pair[0])).append(')');
+        }
+        throw new GeneratorException(sb.toString());
+    }
+
+    private void warnUncovered(List<String> uncovered, boolean enabled) {
+        if (!enabled || uncovered.isEmpty()) return;
+        String shown = String.join(", ", uncovered.subList(0, Math.min(MAX_NAMED_UNCOVERED, uncovered.size())));
+        String more = uncovered.size() > MAX_NAMED_UNCOVERED ? ", and " + (uncovered.size() - MAX_NAMED_UNCOVERED) + " more" : "";
+        String message = uncovered.size() + " requirement(s) matched no filter and get no test. "
+            + "If that is deliberate, set " + ARG_WARN_UNCOVERED + "=false to silence this. Uncovered: " + shown + more + ".";
+        warnings.add(message);
+        LOG.warn(message);
+    }
+
+    // ------------------------------------------------------------------
+    // rendering: the default rendering lives here, in this one file, so an eject takes it too
+    // ------------------------------------------------------------------
+
+    private static final String GENERATED_HEADER =
+        "// GENERATED by metaobjects (requirement-tests). DO NOT EDIT: this file is rewritten whole.\n";
+
+    private static String witnessInterface(String testPackage, String name, String witnessClass, List<Planned> tests) {
+        StringBuilder sb = new StringBuilder(GENERATED_HEADER)
+            .append("// Witnesses are project-owned: implement this interface in ").append(commentText(witnessClass))
+            .append(" and override the members it has witnesses for, each annotated with @Override: a witness whose requirement")
+            .append(" is retired or deleted then stops compiling instead of going stale silently.\n")
+            .append("package ").append(testPackage).append(";\n\n")
+            .append("public interface ").append(name).append(" {\n");
+        for (Planned p : tests) {
+            Identity id = p.identity();
+            if (id.skip() != null) continue; // a skipped test claims nothing works yet: no member
+            sb.append('\n').append(indent(testComments(p.args()))).append('\n')
+              .append("    default void ").append(id.witnessKey()).append("() {\n")
+              .append("        throw new AssertionError(\"")
+              .append(stringLiteral("unimplemented requirement: " + id.id() + " - write " + witnessClass + "."
+                  + id.witnessKey() + "() so that it fails when: " + p.args().counterexample()))
+              .append("\");\n    }\n");
+        }
+        return sb.append("}\n").toString();
+    }
+
+    private static String testClass(String testPackage, String name, String witnesses, String witnessClass,
+                                    List<Planned> tests, RequirementTestRenderer renderer) {
+        TreeSet<String> imports = new TreeSet<>();
+        imports.add("org.junit.jupiter.api.Test");
+        StringBuilder body = new StringBuilder();
+        for (Planned p : tests) {
+            RenderedTest rendered = renderer == null ? null : renderer.render(p.args());
+            String source;
+            if (rendered != null) {
+                imports.addAll(rendered.imports());
+                source = rendered.source();
+            } else {
+                source = defaultTest(p);
+                if (p.identity().skip() != null) imports.add("org.junit.jupiter.api.Disabled");
+            }
+            body.append('\n').append(indent(source.stripTrailing())).append('\n');
+        }
+        StringBuilder sb = new StringBuilder(GENERATED_HEADER)
+            .append("// The witnesses are project-owned, in ").append(commentText(witnessClass)).append(".\n")
+            .append("package ").append(testPackage).append(";\n\n");
+        for (String i : imports) sb.append("import ").append(i).append(";\n");
+        return sb.append("\npublic class ").append(name).append(" {\n\n")
+            .append("    private final ").append(witnesses).append(" witnesses = new ").append(witnessClass).append("();\n")
+            .append(body).append("}\n").toString();
+    }
+
+    /** The default rendering of one test: its comments, then a {@code @Test} calling the witness. */
+    private static String defaultTest(Planned p) {
+        Identity id = p.identity();
+        StringBuilder sb = new StringBuilder(testComments(p.args())).append("\n@Test\n");
+        if (id.skip() == null) {
+            sb.append("void ").append(id.witnessKey()).append("() {\n    witnesses.").append(id.witnessKey()).append("();\n}");
+        } else {
+            sb.append("@Disabled(\"").append(stringLiteral(skipReason(id.skip()))).append("\")\n")
+              .append("void ").append(id.witnessKey()).append("() {\n}");
+        }
+        return sb.toString();
+    }
+
+    private static String skipReason(String skip) {
+        if (MetaRequirement.STATUS_PLANNED.equals(skip)) return SKIP_PLANNED;
+        if (MetaRequirement.STATUS_RETIRED.equals(skip)) return SKIP_RETIRED;
+        return skip + " - skipped";
+    }
+
+    /** The comment block above a test: id, statement, counterexample, status, claims, digest. */
+    private static String testComments(RequirementTestArgs a) {
+        Identity id = a.identity();
+        StringBuilder claims = new StringBuilder();
+        for (RequirementTestArgs.Claim c : a.targets()) {
+            if (claims.length() > 0) claims.append(", ");
+            claims.append(c.ref()).append("  (").append(c.concern()).append(')');
+        }
+        return commentLines(id.id()) + "\n"
+            + commentLines(a.statement()) + "\n"
+            + commentLines("Counterexample: " + a.counterexample()) + "\n"
+            + commentLines("Status: " + (id.status() == null ? "(none)" : id.status())) + "\n"
+            + commentLines("Claims: " + (claims.length() == 0 ? "(none)" : claims.toString())) + "\n"
+            + commentLines("Digest: " + id.digest());
+    }
+
+    // ------------------------------------------------------------------
+    // escaping: author prose lands in string literals and comments, and must not break either
+    // ------------------------------------------------------------------
+
+    private static String indent(String block) {
+        StringBuilder sb = new StringBuilder();
+        for (String line : block.split("\n", -1)) {
+            if (sb.length() > 0) sb.append('\n');
+            if (!line.isEmpty()) sb.append("    ").append(line);
+        }
+        return sb.toString();
+    }
+
+    /**
+     * One {@code //} marker per line. A carriage return ends a Java line as a line feed does, so
+     * both split; {@code *}{@code /} is broken as {@code * /} by contract. {@code \}{@code u} would be read as a
+     * Unicode escape even inside a comment, and {@code \}{@code u000a} would end it, so it is broken as
+     * {@code \ u}.
+     */
+    private static String commentLines(String text) {
+        StringBuilder sb = new StringBuilder();
+        for (String line : text.split("\r\n|\r|\n", -1)) {
+            if (sb.length() > 0) sb.append('\n');
+            sb.append("// ").append(commentText(line));
+        }
+        return sb.toString();
+    }
+
+    private static String commentText(String line) {
+        return line.replace("*/", "* /").replace("\\u", "\\ u");
+    }
+
+    /** The text of a double-quoted string literal. Every control character is escaped, so no value can end the literal. */
+    private static String stringLiteral(String s) {
+        StringBuilder sb = new StringBuilder();
+        for (int i = 0; i < s.length(); i++) {
+            char c = s.charAt(i);
+            switch (c) {
+                case '\\' -> sb.append("\\\\");
+                case '"' -> sb.append("\\\"");
+                case '\n' -> sb.append("\\n");
+                case '\r' -> sb.append("\\r");
+                case '\t' -> sb.append("\\t");
+                default -> {
+                    if (c < 0x20 || c == 0x7f) sb.append(String.format("\\u%04x", (int) c));
+                    else sb.append(c);
+                }
+            }
+        }
+        return sb.toString();
+    }
+}
diff --git a/server/java/codegen-spring/src/test/java/com/metaobjects/generator/spring/EjectedGeneratorsCompileTest.java b/server/java/codegen-spring/src/test/java/com/metaobjects/generator/spring/EjectedGeneratorsCompileTest.java
index eaeb6e14b..c45b20a48 100644
--- a/server/java/codegen-spring/src/test/java/com/metaobjects/generator/spring/EjectedGeneratorsCompileTest.java
+++ b/server/java/codegen-spring/src/test/java/com/metaobjects/generator/spring/EjectedGeneratorsCompileTest.java
@@ -54,7 +54,8 @@ public class EjectedGeneratorsCompileTest {
             "SpringDtoGenerator",
             "SpringValueObjectGenerator",
             "LlmTraceHelperGenerator",
-            "SpringNamesGenerator"
+            "SpringNamesGenerator",
+            "JUnitRequirementTestsGenerator"
     );
 
     private static final Pattern PACKAGE_LINE = Pattern.compile("(?m)^package\\s+[\\w.]+\\s*;\\s*$");
diff --git a/server/java/codegen-spring/src/test/java/com/metaobjects/generator/spring/JUnitRequirementTestsGeneratorTest.java b/server/java/codegen-spring/src/test/java/com/metaobjects/generator/spring/JUnitRequirementTestsGeneratorTest.java
new file mode 100644
index 000000000..b384dfdd2
--- /dev/null
+++ b/server/java/codegen-spring/src/test/java/com/metaobjects/generator/spring/JUnitRequirementTestsGeneratorTest.java
@@ -0,0 +1,784 @@
+package com.metaobjects.generator.spring;
+
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
+import com.metaobjects.generator.GeneratorException;
+import com.metaobjects.generator.requirement.RenderedTest;
+import com.metaobjects.generator.requirement.RequirementTestArgs;
+import com.metaobjects.generator.requirement.RequirementTestRenderer;
+import com.metaobjects.generator.util.GeneratedFileWriter;
+import com.metaobjects.loader.DirectorySource;
+import com.metaobjects.loader.LoaderOptions;
+import com.metaobjects.loader.MetaDataLoader;
+import com.metaobjects.requirement.RequirementTestFilter;
+import com.metaobjects.requirement.RequirementTestIdentities;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.TemporaryFolder;
+import org.slf4j.LoggerFactory;
+
+import javax.tools.Diagnostic;
+import javax.tools.DiagnosticCollector;
+import javax.tools.JavaCompiler;
+import javax.tools.JavaFileObject;
+import javax.tools.StandardJavaFileManager;
+import javax.tools.StandardLocation;
+import javax.tools.ToolProvider;
+import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.TreeSet;
+import java.util.stream.Stream;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * {@link JUnitRequirementTestsGenerator}: the files it writes for the identity corpus's
+ * {@code worked-example}, that the output COMPILES and behaves (a live test with no witness
+ * fails, with one it passes), that author prose cannot break it, and every refusal and seam of
+ * Table I. The repository's own tests are JUnit 4; the tests this generator WRITES are Jupiter.
+ */
+public class JUnitRequirementTestsGeneratorTest {
+
+    @Rule
+    public TemporaryFolder tmp = new TemporaryFolder();
+
+    private static final String TEST_PACKAGE = "com.acme.req";
+    private static final String WITNESS_CLASS = "com.acme.Witnesses";
+
+    // ---------------------------------------------------------------- fixtures
+
+    private static Path repoRoot() {
+        for (Path p = Path.of("").toAbsolutePath(); p != null; p = p.getParent()) {
+            if (Files.isDirectory(p.resolve("fixtures")) && Files.isDirectory(p.resolve("server"))) return p;
+        }
+        throw new IllegalStateException("repo root not found");
+    }
+
+    private static Path workedExampleInput() {
+        return repoRoot().resolve("fixtures/requirement-test-identity-conformance/worked-example/input");
+    }
+
+    private static MetaDataLoader loadDir(Path dir) throws IOException {
+        MetaDataLoader loader = new MetaDataLoader(LoaderOptions.create(false, false, true),
+            MetaDataLoader.SUBTYPE_MANUAL, "requirement_tests_" + System.nanoTime());
+        loader.init();
+        loader.load(new DirectorySource(dir, new DirectorySource.Options()).expandToList());
+        assertTrue("strict load: " + loader.getErrors(), loader.getErrors().isEmpty());
+        return loader;
+    }
+
+    private MetaDataLoader loadYaml(String yaml) throws IOException {
+        Path dir = tmp.newFolder().toPath();
+        Files.writeString(dir.resolve("meta.shop.yaml"), yaml, StandardCharsets.UTF_8);
+        return loadDir(dir);
+    }
+
+    private static String requirement(String name, int level, String status, String statement, String counterexample, String implementedBy) {
+        return "    - requirement.functional:\n"
+            + "        name: " + name + "\n        level: " + level + "\n        status: " + status + "\n"
+            + "        statement: " + statement + "\n        counterexample: " + counterexample + "\n"
+            + (implementedBy == null ? "" : "        implementedBy: [" + implementedBy + "]\n");
+    }
+
+    private static final String ORDER_ENTITY =
+        "    - object.entity:\n        name: Order\n        children:\n"
+        + "          - field.uuid: { name: id }\n          - field.string: { name: total }\n"
+        + "          - identity.primary: { name: pk, fields: [id] }\n";
+
+    private static String shop(String... requirements) {
+        return "metadata:\n  package: acme::shop\n  children:\n" + ORDER_ENTITY + String.join("", requirements);
+    }
+
+    /** The args of a real run, with {@code warnUncovered} left at its default. */
+    private Map<String, String> realArgs(Path out) {
+        Map<String, String> args = new HashMap<>();
+        args.put("outputDir", out.toString());
+        args.put("testPackage", TEST_PACKAGE);
+        args.put("witnessClass", WITNESS_CLASS);
+        return args;
+    }
+
+    /**
+     * Runs {@code block} with the generator's logger diverted into a list, so a warning a test
+     * provokes neither reaches the console nor goes unchecked: returns what was logged.
+     */
+    private static List<String> captureLog(Runnable block) {
+        ch.qos.logback.classic.Logger logger =
+            (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(JUnitRequirementTestsGenerator.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        boolean wasAdditive = logger.isAdditive();
+        logger.setAdditive(false);
+        logger.addAppender(appender);
+        try {
+            block.run();
+        } finally {
+            logger.detachAppender(appender);
+            logger.setAdditive(wasAdditive);
+        }
+        List<String> messages = new ArrayList<>();
+        for (ILoggingEvent e : appender.list) messages.add(e.getFormattedMessage());
+        return messages;
+    }
+
+    /** Runs {@code gen} over {@code loader} and returns what it logged. */
+    private static List<String> logged(JUnitRequirementTestsGenerator gen, MetaDataLoader loader) {
+        return captureLog(() -> gen.execute(loader));
+    }
+
+    private JUnitRequirementTestsGenerator generator(Path out, Map<String, String> extra) {
+        Map<String, String> args = realArgs(out);
+        // The worked example has an L3 requirement the default filter drops, so most tests would
+        // log the uncovered warning. Only the tests that are about it switch it on.
+        args.put("warnUncovered", "false");
+        args.putAll(extra);
+        JUnitRequirementTestsGenerator gen = new JUnitRequirementTestsGenerator();
+        gen.setArgs(args);
+        return gen;
+    }
+
+    private Path run(MetaDataLoader loader, Map<String, String> extra) throws IOException {
+        Path out = tmp.newFolder().toPath();
+        generator(out, extra).execute(loader);
+        return out;
+    }
+
+    private static String read(Path out, String file) throws IOException {
+        return Files.readString(out.resolve("com/acme/req").resolve(file), StandardCharsets.UTF_8);
+    }
+
+    private static TreeSet<String> files(Path out) throws IOException {
+        TreeSet<String> names = new TreeSet<>();
+        try (Stream<Path> s = Files.walk(out)) {
+            s.filter(Files::isRegularFile).forEach(p -> names.add(out.relativize(p).toString().replace('\\', '/')));
+        }
+        return names;
+    }
+
+    // ---------------------------------------------------------------- compile and run
+
+    private static final String WITNESS_NONE =
+        "package com.acme;\npublic class Witnesses implements com.acme.req.Requirements_acme_shop_Witnesses {}\n";
+
+    private static final String WITNESS_RECORDED =
+        "package com.acme;\npublic class Witnesses implements com.acme.req.Requirements_acme_shop_Witnesses {\n"
+        + "  @Override public void req_acme_shop_Orders_Recorded__object_entity() { }\n}\n";
+
+    /** What the compiler said about a tree: whether it built, its diagnostics, and where the classes went. */
+    private record Compiled(boolean ok, String errors, Path classes) {}
+
+    /** Compile the generated tree plus hand-written sources with the real compiler; return a loader over the classes. */
+    private URLClassLoader compile(Path generated, Map<String, String> handWritten) throws IOException {
+        Compiled c = tryCompile(generated, handWritten);
+        assertTrue("generated requirement tests failed to compile:\n" + c.errors(), c.ok());
+        return new URLClassLoader(new URL[]{c.classes().toUri().toURL()}, getClass().getClassLoader());
+    }
+
+    private Compiled tryCompile(Path generated, Map<String, String> handWritten) throws IOException {
+        List<java.io.File> sources = new ArrayList<>();
+        try (Stream<Path> s = Files.walk(generated)) {
+            s.filter(p -> p.toString().endsWith(".java")).forEach(p -> sources.add(p.toFile()));
+        }
+        Path hand = tmp.newFolder().toPath();
+        for (Map.Entry<String, String> e : handWritten.entrySet()) {
+            Path f = hand.resolve(e.getKey().replace('.', '/') + ".java");
+            Files.createDirectories(f.getParent());
+            Files.writeString(f, e.getValue(), StandardCharsets.UTF_8);
+            sources.add(f.toFile());
+        }
+        Path classes = tmp.newFolder().toPath();
+        JavaCompiler javac = ToolProvider.getSystemJavaCompiler();
+        DiagnosticCollector<JavaFileObject> diagnostics = new DiagnosticCollector<>();
+        try (StandardJavaFileManager fm = javac.getStandardFileManager(diagnostics, null, StandardCharsets.UTF_8)) {
+            fm.setLocation(StandardLocation.CLASS_OUTPUT, List.of(classes.toFile()));
+            boolean ok = javac.getTask(null, fm, diagnostics,
+                List.of("-classpath", System.getProperty("java.class.path"), "-encoding", "UTF-8", "-Xlint:all", "-Werror"),
+                null, fm.getJavaFileObjectsFromFiles(sources)).call();
+            StringBuilder errs = new StringBuilder();
+            for (Diagnostic<? extends JavaFileObject> d : diagnostics.getDiagnostics()) errs.append(d).append('\n');
+            return new Compiled(ok, errs.toString(), classes);
+        }
+    }
+
+    /** Invoke one generated test method; returns the AssertionError it threw, or null. */
+    private static AssertionError invoke(ClassLoader cl, String testClass, String method) throws Exception {
+        Class<?> c = cl.loadClass(TEST_PACKAGE + "." + testClass);
+        Object instance = c.getDeclaredConstructor().newInstance();
+        Method m = c.getDeclaredMethod(method);
+        m.setAccessible(true);
+        try {
+            m.invoke(instance);
+            return null;
+        } catch (InvocationTargetException e) {
+            if (e.getCause() instanceof AssertionError) return (AssertionError) e.getCause();
+            throw e;
+        }
+    }
+
+    // ---------------------------------------------------------------- the worked example
+
+    @Test
+    public void workedExampleEmitsTheWitnessInterfaceAndTheTestClassInTheTestPackage() throws Exception {
+        Path out = run(loadDir(workedExampleInput()), Map.of());
+        assertEquals(new TreeSet<>(List.of("com/acme/req/Requirements_acme_shop_Test.java",
+            "com/acme/req/Requirements_acme_shop_Witnesses.java")), files(out));
+    }
+
+    @Test
+    public void bothFilesNameTheWitnessClassInTheirHeader() throws Exception {
+        Path out = run(loadDir(workedExampleInput()), Map.of());
+        String iface = read(out, "Requirements_acme_shop_Witnesses.java");
+        String test = read(out, "Requirements_acme_shop_Test.java");
+        assertTrue(iface, iface.contains("// Witnesses are project-owned: implement this interface in com.acme.Witnesses"
+            + " and override the members it has witnesses for, each annotated with @Override: a witness whose requirement"
+            + " is retired or deleted then stops compiling instead of going stale silently.\n"));
+        assertTrue(test, test.contains("// The witnesses are project-owned, in com.acme.Witnesses.\n"));
+        assertTrue(iface, iface.startsWith("// GENERATED by metaobjects (requirement-tests). DO NOT EDIT: this file is rewritten whole.\n"));
+    }
+
+    @Test
+    public void testsAreEmittedSortedByIdWhateverOrderTheyAreDeclaredIn() throws Exception {
+        // Declared Zeta, Mid, Alpha, with Alpha's child after it: not in id order.
+        MetaDataLoader loader = loadYaml(shop(
+            requirement("Zeta", 4, "live", "Z.", "Z!", "Order"),
+            requirement("Mid", 4, "live", "M.", "M!", "Order"),
+            requirement("Alpha", 4, "live", "A.", "A!", "Order")));
+        Path out = run(loader, Map.of());
+        for (String file : List.of("Requirements_acme_shop_Test.java", "Requirements_acme_shop_Witnesses.java")) {
+            String src = read(out, file);
+            int alpha = src.indexOf("// acme::shop::Alpha [object.entity]");
+            int mid = src.indexOf("// acme::shop::Mid [object.entity]");
+            int zeta = src.indexOf("// acme::shop::Zeta [object.entity]");
+            assertTrue(file + ": all three present", alpha >= 0 && mid >= 0 && zeta >= 0);
+            assertTrue(file + ": Alpha, Mid, Zeta in that order", alpha < mid && mid < zeta);
+        }
+    }
+
+    @Test
+    public void theInterfaceHasAMemberForTheLiveTestAndNoneForTheSkippedOne() throws Exception {
+        String iface = read(run(loadDir(workedExampleInput()), Map.of()), "Requirements_acme_shop_Witnesses.java");
+        assertTrue(iface, iface.contains("default void req_acme_shop_Orders_Recorded__object_entity()"));
+        assertFalse(iface, iface.contains("req_acme_shop_Orders_Refunded"));
+        assertTrue(iface, iface.contains("package com.acme.req;"));
+    }
+
+    @Test
+    public void theSkippedTestIsDisabledWithTheTableHReasonAndHasNoBody() throws Exception {
+        String test = read(run(loadDir(workedExampleInput()), Map.of()), "Requirements_acme_shop_Test.java");
+        assertTrue(test, test.contains("@Disabled(\"planned - not built yet\")\n    void req_acme_shop_Orders_Refunded() {\n    }"));
+        assertTrue(test, test.contains("private final Requirements_acme_shop_Witnesses witnesses = new com.acme.Witnesses();"));
+        assertTrue(test, test.contains("witnesses.req_acme_shop_Orders_Recorded__object_entity();"));
+        // The comments above a test: id, statement, counterexample, status, claims, digest.
+        assertTrue(test, test.contains("    // acme::shop::Orders.Recorded [object.entity]\n"
+            + "    // An order is recorded when it is placed.\n"
+            + "    // Counterexample: A placed order has no row.\n"
+            + "    // Status: live\n"
+            + "    // Claims: Order  (object.entity)\n"
+            + "    // Digest: 2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a\n"));
+        assertTrue(test, test.contains("// Claims: (none)"));
+    }
+
+    @Test
+    public void theOutputImportsOnlyJunitJupiterApiAndNothingFromMetaObjects() throws Exception {
+        Path out = run(loadDir(workedExampleInput()), Map.of());
+        for (String file : files(out)) {
+            String src = Files.readString(out.resolve(file), StandardCharsets.UTF_8);
+            for (String line : src.split("\n")) {
+                if (line.startsWith("import ")) {
+                    assertTrue(file + ": " + line, line.startsWith("import org.junit.jupiter.api."));
+                }
+            }
+            assertFalse(file, src.contains("com.metaobjects"));
+            assertFalse(file + " names the generator's own class", src.contains("JUnitRequirementTestsGenerator"));
+        }
+    }
+
+    @Test
+    public void outputCarriesTheGeneratedMarkerAndIsByteIdenticalOnARerun() throws Exception {
+        MetaDataLoader loader = loadDir(workedExampleInput());
+        Path a = run(loader, Map.of());
+        Path b = run(loader, Map.of());
+        for (String file : files(a)) {
+            String src = Files.readString(a.resolve(file), StandardCharsets.UTF_8);
+            assertTrue(file, GeneratedFileWriter.looksGenerated(src));
+            assertEquals(src, Files.readString(b.resolve(file), StandardCharsets.UTF_8));
+        }
+    }
+
+    @Test
+    public void aLiveTestWithNoWitnessFailsNamingTheCounterexample() throws Exception {
+        URLClassLoader cl = compile(run(loadDir(workedExampleInput()), Map.of()), Map.of(WITNESS_CLASS, WITNESS_NONE));
+        AssertionError e = invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Orders_Recorded__object_entity");
+        assertNotNull("a live test must fail until a witness is written", e);
+        assertTrue(e.getMessage(), e.getMessage().contains("unimplemented requirement:"));
+        assertTrue(e.getMessage(), e.getMessage().contains("A placed order has no row."));
+        assertEquals("unimplemented requirement: acme::shop::Orders.Recorded [object.entity] - write com.acme.Witnesses."
+            + "req_acme_shop_Orders_Recorded__object_entity() so that it fails when: A placed order has no row.", e.getMessage());
+    }
+
+    @Test
+    public void aLiveTestPassesWhenTheWitnessClassOverridesItAndASkippedTestRunsEmpty() throws Exception {
+        URLClassLoader cl = compile(run(loadDir(workedExampleInput()), Map.of()), Map.of(WITNESS_CLASS, WITNESS_RECORDED));
+        assertEquals(null, invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Orders_Recorded__object_entity"));
+        assertEquals(null, invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Orders_Refunded"));
+        // Without @Test JUnit discovers nothing and the adopter's build stays green.
+        Class<?> testClass = cl.loadClass(TEST_PACKAGE + ".Requirements_acme_shop_Test");
+        assertNotNull("the live test is a @Test", testClass.getDeclaredMethod("req_acme_shop_Orders_Recorded__object_entity")
+            .getAnnotation(org.junit.jupiter.api.Test.class));
+        assertNotNull("the skipped test is a @Test too", testClass.getDeclaredMethod("req_acme_shop_Orders_Refunded")
+            .getAnnotation(org.junit.jupiter.api.Test.class));
+    }
+
+    @Test
+    public void aRetiredTestSaysTheCapabilityMustStayRemoved() throws Exception {
+        MetaDataLoader loader = loadYaml(shop(requirement("Gone", 4, "retired", "Old thing.", "Old thing returns.", null)));
+        String test = read(run(loader, Map.of()), "Requirements_acme_shop_Test.java");
+        assertTrue(test, test.contains("@Disabled(\"retired - the capability was deliberately removed; assert it stays removed\")"));
+        // Every test of the package is skipped: no witness member and no Disabled-free import drift.
+        assertFalse(read(run(loader, Map.of()), "Requirements_acme_shop_Witnesses.java").contains("default void"));
+    }
+
+    // ---------------------------------------------------------------- orphan witnesses
+
+    /** A witness for the live Recorded test and, as a stale leftover, one for Gone, which the model retired. */
+    private static String witnessWithStaleGone(String annotation) {
+        return "package com.acme;\npublic class Witnesses implements com.acme.req.Requirements_acme_shop_Witnesses {\n"
+            + "  @Override public void req_acme_shop_Recorded__object_entity() { }\n"
+            + "  " + annotation + " public void req_acme_shop_Gone() { }\n}\n";
+    }
+
+    private Path retiredGoneModelOutput() throws IOException {
+        return run(loadYaml(shop(
+            requirement("Recorded", 4, "live", "S.", "C.", "Order"),
+            requirement("Gone", 4, "retired", "Old thing.", "Old thing returns.", null))), Map.of());
+    }
+
+    @Test
+    public void aStaleOverrideForARetiredRequirementStopsCompilingWhenItIsAnnotatedOverride() throws Exception {
+        Path out = retiredGoneModelOutput();
+        assertFalse("a retired requirement has no member", read(out, "Requirements_acme_shop_Witnesses.java").contains("req_acme_shop_Gone"));
+        // Control: the same witness without the stale method builds, so the failure below is the stale member.
+        Compiled control = tryCompile(out, Map.of(WITNESS_CLASS,
+            "package com.acme;\npublic class Witnesses implements com.acme.req.Requirements_acme_shop_Witnesses {\n"
+                + "  @Override public void req_acme_shop_Recorded__object_entity() { }\n}\n"));
+        assertTrue(control.errors(), control.ok());
+
+        Compiled stale = tryCompile(out, Map.of(WITNESS_CLASS, witnessWithStaleGone("@Override")));
+        assertFalse("an @Override of a member the interface no longer has must not compile", stale.ok());
+        assertTrue(stale.errors(), stale.errors().contains("Witnesses.java"));
+    }
+
+    @Test
+    public void knownLimit_aStaleWitnessMethodWithoutOverrideStillCompilesSoTheHeaderAsksForTheAnnotation() throws Exception {
+        // The drift signal exists only because the project annotates its witnesses. Without
+        // @Override a stale method is an ordinary method; the generated header says so by
+        // asking for the annotation, and this records the limit rather than hiding it.
+        Compiled c = tryCompile(retiredGoneModelOutput(), Map.of(WITNESS_CLASS, witnessWithStaleGone("")));
+        assertTrue(c.errors(), c.ok());
+    }
+
+    // ---------------------------------------------------------------- escaping
+
+    @Test
+    public void proseWithQuotesBackslashesNewlinesAndCommentTerminatorsStillCompilesAndIsCarried() throws Exception {
+        String statement = "\"say \\\"hi\\\" to C:\\\\dir\\nsecond line */ end \\\\u000a not an escape\\rlone cr\"";
+        String counterexample = "\"it breaks \\\"here\\\" at C:\\\\tmp\\nthen */ and \\\\u000a\"";
+        MetaDataLoader loader = loadYaml(shop(requirement("Recorded", 4, "live", statement, counterexample, "Order")));
+        Path out = run(loader, Map.of());
+        URLClassLoader cl = compile(out, Map.of(WITNESS_CLASS, WITNESS_NONE));
+
+        AssertionError e = invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Recorded__object_entity");
+        assertNotNull(e);
+        String expectedCounterexample = "it breaks \"here\" at C:\\tmp\nthen */ and \\u000a";
+        assertTrue(e.getMessage(), e.getMessage().endsWith("so that it fails when: " + expectedCounterexample));
+
+        String test = read(out, "Requirements_acme_shop_Test.java");
+        assertTrue(test, test.contains("// say \"hi\" to C:\\dir\n"));
+        assertTrue(test, test.contains("    // second line * / end \\ u000a not an escape\n"));
+        assertTrue(test, test.contains("    // lone cr\n"));
+        assertTrue(test, test.contains("    // Counterexample: it breaks \"here\" at C:\\tmp\n    // then * / and \\ u000a\n"));
+    }
+
+    @Test
+    public void carriageReturnsInACounterexampleAreEscapedInTheLiteralAndSplitInTheComment() throws Exception {
+        // YAML escapes: CR LF, then a lone CR. A raw CR in a string literal would end the line.
+        String counterexample = "\"first\\r\\nsecond\\rthird\"";
+        MetaDataLoader loader = loadYaml(shop(requirement("Recorded", 4, "live", "S.", counterexample, "Order")));
+        Path out = run(loader, Map.of());
+
+        String iface = read(out, "Requirements_acme_shop_Witnesses.java");
+        String test = read(out, "Requirements_acme_shop_Test.java");
+        assertFalse("no raw CR reaches either file", iface.indexOf('\r') >= 0 || test.indexOf('\r') >= 0);
+        assertTrue(iface, iface.contains("so that it fails when: first\\r\\nsecond\\rthird\");"));
+        assertTrue(test, test.contains("    // Counterexample: first\n    // second\n    // third\n"));
+
+        URLClassLoader cl = compile(out, Map.of(WITNESS_CLASS, WITNESS_NONE));
+        AssertionError e = invoke(cl, "Requirements_acme_shop_Test", "req_acme_shop_Recorded__object_entity");
+        assertNotNull(e);
+        assertTrue(e.getMessage(), e.getMessage().endsWith("so that it fails when: first\r\nsecond\rthird"));
+    }
+
+    // ---------------------------------------------------------------- refusals
+
+    @Test
+    public void twoRequirementsWithOneWitnessKeyAreRefusedNamingBothAndTheCode() throws Exception {
+        // A name cannot hold a dot, so Orders.Recorded is a requirement nested under Orders.
+        MetaDataLoader loader = loadYaml(shop(
+            requirement("Orders", 3, "live", "P.", "Q.", null)
+                + "        children:\n          - requirement.functional:\n"
+                + "              name: Recorded\n              level: 4\n              status: live\n"
+                + "              statement: A.\n              counterexample: B.\n              implementedBy: [Order]\n",
+            requirement("Orders_Recorded", 4, "live", "C.", "D.", "Order")));
+        GeneratorException e = assertThrows(GeneratorException.class, () -> run(loader, Map.of()));
+        assertTrue(e.getMessage(), e.getMessage().contains("ERR_REQUIREMENT_WITNESS_KEY_COLLISION"));
+        assertTrue(e.getMessage(), e.getMessage().contains("acme::shop::Orders.Recorded [object.entity]"));
+        assertTrue(e.getMessage(), e.getMessage().contains("acme::shop::Orders_Recorded [object.entity]"));
+    }
+
+    @Test
+    public void anUnknownGrainIsRefusedWithAClearErrorWhateverTheModelHolds() throws Exception {
+        for (MetaDataLoader loader : List.of(loadDir(workedExampleInput()), loadYaml(shop()))) {
+            GeneratorException e = assertThrows(GeneratorException.class, () -> run(loader, Map.of("grain", "hybrid")));
+            assertTrue(e.getMessage(), e.getMessage().contains("unknown requirement-test grain \"hybrid\""));
+            assertTrue(e.getMessage(), e.getMessage().contains("\"concern\" or \"member\""));
+        }
+    }
+
+    @Test
+    public void aMissingWitnessClassOrTestPackageIsAClearError() throws Exception {
+        MetaDataLoader loader = loadDir(workedExampleInput());
+        for (String missing : List.of("witnessClass", "testPackage")) {
+            Path out = tmp.newFolder().toPath();
+            Map<String, String> args = new HashMap<>(Map.of("outputDir", out.toString(),
+                "testPackage", TEST_PACKAGE, "witnessClass", WITNESS_CLASS));
+            args.remove(missing);
+            JUnitRequirementTestsGenerator bare = new JUnitRequirementTestsGenerator();
+            bare.setArgs(args);
+            GeneratorException e = assertThrows(GeneratorException.class, () -> bare.execute(loader));
+            assertTrue(e.getMessage(), e.getMessage().contains("'" + missing + "'"));
+            assertEquals("nothing is written when it refuses", new TreeSet<String>(), files(out));
+        }
+    }
+
+    @Test
+    public void aTestPackageOrWitnessClassThatIsNotAJavaNameIsRefusedRatherThanSplicedIntoSource() throws Exception {
+        MetaDataLoader loader = loadDir(workedExampleInput());
+        assertThrows(GeneratorException.class, () -> run(loader, Map.of("witnessClass", "com.acme.W(); System.exit(1")));
+        assertThrows(GeneratorException.class, () -> run(loader, Map.of("testPackage", "com.acme;import x")));
+    }
+
+    @Test
+    public void warnUncoveredMustBeTrueOrFalse() throws Exception {
+        MetaDataLoader loader = loadDir(workedExampleInput());
+        GeneratorException e = assertThrows(GeneratorException.class, () -> run(loader, Map.of("warnUncovered", "flase")));
+        assertTrue(e.getMessage(), e.getMessage().contains("warnUncovered"));
+    }
+
+    // ---------------------------------------------------------------- grain, filter, renderer
+
+    @Test
+    public void memberGrainWritesOneTestPerResolvingReference() throws Exception {
+        MetaDataLoader loader = loadYaml(shop(
+            requirement("Recorded", 4, "live", "S.", "C.", "Order, acme::shop::Order.total")));
+        String test = read(run(loader, Map.of("grain", "member")), "Requirements_acme_shop_Test.java");
+        assertTrue(test, test.contains("void req_acme_shop_Recorded__Order()"));
+        assertTrue(test, test.contains("void req_acme_shop_Recorded__acme_shop_Order_total()"));
+        assertFalse(test, test.contains("object_entity"));
+    }
+
+    @Test
+    public void memberGrainListsAReferenceAuthoredTwiceOnceInTheClaimsComment() throws Exception {
+        // `implementedBy: [Order, "acme::shop::Order", Order]`: two units, and the one authored
+        // twice claims its node once.
+        MetaDataLoader loader = loadDir(repoRoot().resolve(
+            "fixtures/requirement-test-identity-conformance/member-grain-duplicate-ref/input"));
+        String test = read(run(loader, Map.of("grain", "member")), "Requirements_acme_shop_Test.java");
+        List<String> claims = test.lines().map(String::strip).filter(l -> l.startsWith("// Claims:")).toList();
+        assertEquals(List.of(
+            "// Claims: Order  (object.entity)",
+            "// Claims: acme::shop::Order  (object.entity)"), claims);
+    }
+
+    /** A filter that keeps everything, found by name. Public with a public constructor, as a project's would be. */
+    public static class KeepEverything implements RequirementTestFilter {
+        @Override
+        public boolean include(RequirementTestIdentities.View view) {
+            return true;
+        }
+    }
+
+    @Test
+    public void aFilterClassKeepsAnL3RequirementTheDefaultDropsAndItRendersWithUnitStar() throws Exception {
+        MetaDataLoader loader = loadDir(workedExampleInput());
+        Path withDefault = run(loader, Map.of());
+        assertFalse(read(withDefault, "Requirements_acme_shop_Test.java").contains("req_acme_shop_Orders()"));
+        Path out = tmp.newFolder().toPath();
+        generator(out, Map.of("filter", KeepEverything.class.getName())).execute(loader);
+        String test = read(out, "Requirements_acme_shop_Test.java");
+        assertTrue(test, test.contains("// acme::shop::Orders [*]"));
+        assertTrue(test, test.contains("void req_acme_shop_Orders()"));
+    }
+
+    @Test
+    public void aFilterClassThatCannotBeLoadedIsAClearError() throws Exception {
+        MetaDataLoader loader = loadDir(workedExampleInput());
+        GeneratorException e = assertThrows(GeneratorException.class,
+            () -> run(loader, Map.of("filter", "com.nowhere.NoSuchFilter")));
+        assertTrue(e.getMessage(), e.getMessage().contains("'filter'"));
+        assertTrue(e.getMessage(), e.getMessage().contains("com.nowhere.NoSuchFilter"));
+        GeneratorException notAFilter = assertThrows(GeneratorException.class,
+            () -> run(loader, Map.of("filter", "java.lang.String")));
+        assertTrue(notAFilter.getMessage(), notAFilter.getMessage().contains("does not implement"));
+    }
+
+    /** A filter that exists and cannot be used: its static initialiser throws. */
+    public static class ExplodingFilter implements RequirementTestFilter {
+        static {
+            if (true) throw new IllegalStateException("boom from the static initialiser");
+        }
+
+        @Override
+        public boolean include(RequirementTestIdentities.View view) {
+            return true;
+        }
+    }
+
+    @Test
+    public void aFilterThatIsFoundButFailsToLinkIsNotReportedAsMissing() throws Exception {
+        MetaDataLoader loader = loadDir(workedExampleInput());
+        GeneratorException e = assertThrows(GeneratorException.class,
+            () -> run(loader, Map.of("filter", ExplodingFilter.class.getName())));
+        assertTrue(e.getMessage(), e.getMessage().contains(ExplodingFilter.class.getName()));
+        assertTrue(e.getMessage(), e.getMessage().contains("was found but could not be loaded"));
+        assertFalse(e.getMessage(), e.getMessage().contains("not on the project's classpath"));
+        assertTrue("the error is the cause: " + e.getCause(), e.getCause() instanceof LinkageError);
+        assertTrue(String.valueOf(e.getCause().getCause()), e.getCause().getCause() instanceof IllegalStateException);
+    }
+
+    /** A filter whose class loads and has a public no-argument constructor, which throws. */
+    public static class ThrowingConstructorFilter implements RequirementTestFilter {
+        public ThrowingConstructorFilter() {
+            throw new IllegalStateException("the price list is not configured");
+        }
+
+        @Override
+        public boolean include(RequirementTestIdentities.View view) {
+            return true;
+        }
+    }
+
+    @Test
+    public void aFilterWhoseConstructorThrowsIsReportedWithWhatItThrew() throws Exception {
+        MetaDataLoader loader = loadDir(workedExampleInput());
+        GeneratorException e = assertThrows(GeneratorException.class,
+            () -> run(loader, Map.of("filter", ThrowingConstructorFilter.class.getName())));
+        assertTrue(e.getMessage(), e.getMessage().contains("'filter'"));
+        assertTrue(e.getMessage(), e.getMessage().contains(ThrowingConstructorFilter.class.getName()));
+        assertTrue(e.getMessage(), e.getMessage().contains("its constructor threw"));
+        assertTrue(e.getMessage(), e.getMessage().contains("the price list is not configured"));
+        // The class HAS the constructor: saying it needs one would send the reader to the wrong place.
+        assertFalse(e.getMessage(), e.getMessage().contains("needs a public no-argument constructor"));
+        assertTrue("the cause is what the constructor threw: " + e.getCause(), e.getCause() instanceof IllegalStateException);
+    }
+
+    /** A filter with no no-argument constructor at all: the other reflective failure keeps its wording. */
+    public static class NoDefaultConstructorFilter implements RequirementTestFilter {
+        public NoDefaultConstructorFilter(String unused) {
+        }
+
+        @Override
+        public boolean include(RequirementTestIdentities.View view) {
+            return true;
+        }
+    }
+
+    @Test
+    public void aFilterWithNoNoArgumentConstructorIsStillToldItNeedsOne() throws Exception {
+        MetaDataLoader loader = loadDir(workedExampleInput());
+        GeneratorException e = assertThrows(GeneratorException.class,
+            () -> run(loader, Map.of("filter", NoDefaultConstructorFilter.class.getName())));
+        assertTrue(e.getMessage(), e.getMessage().contains("needs a public no-argument constructor"));
+        assertFalse(e.getMessage(), e.getMessage().contains("its constructor threw"));
+    }
+
+    /** Records what it is given and replaces the Recorded test. */
+    public static class RecordingRenderer implements RequirementTestRenderer {
+        static final List<RequirementTestArgs> SEEN = new ArrayList<>();
+
+        @Override
+        public RenderedTest render(RequirementTestArgs args) {
+            SEEN.add(args);
+            if (!args.identity().path().equals("Orders.Recorded")) return null;
+            return new RenderedTest(List.of("org.junit.jupiter.api.Assertions"),
+                "@Test\nvoid " + args.identity().witnessKey() + "() {\n    Assertions.assertTrue(true, \"digest "
+                    + args.identity().digest() + "\");\n}");
+        }
+    }
+
+    @Test
+    public void aRendererClassReplacesOneTestAndReceivesTheDigestWhileTheOthersKeepTheDefault() throws Exception {
+        RecordingRenderer.SEEN.clear();
+        Path out = run(loadDir(workedExampleInput()), Map.of("renderer", RecordingRenderer.class.getName()));
+        String test = read(out, "Requirements_acme_shop_Test.java");
+        assertTrue(test, test.contains("import org.junit.jupiter.api.Assertions;"));
+        assertTrue(test, test.contains("    Assertions.assertTrue(true, \"digest 2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a\");"));
+        assertFalse("the replaced test lost its default body", test.contains("witnesses.req_acme_shop_Orders_Recorded__object_entity();"));
+        assertTrue("the null-returning case keeps the default", test.contains("@Disabled(\"planned - not built yet\")"));
+
+        assertEquals(2, RecordingRenderer.SEEN.size());
+        RequirementTestArgs recorded = RecordingRenderer.SEEN.stream()
+            .filter(a -> a.identity().path().equals("Orders.Recorded")).findFirst().orElseThrow();
+        assertEquals("An order is recorded when it is placed.", recorded.statement());
+        assertEquals("A placed order has no row.", recorded.counterexample());
+        assertEquals("Order", recorded.targets().get(0).ref());
+        assertEquals("object.entity", recorded.targets().get(0).concern());
+        assertEquals("2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a", recorded.identity().digest());
+    }
+
+    // ---------------------------------------------------------------- the uncovered warning
+
+    /** A level 3 requirement {@code parent} holding a level 3 child, both excluded by the default filter. */
+    private static String withChild(String parent, String child) {
+        return requirement(parent, 3, "live", "P.", "Q.", null)
+            + "        children:\n          - requirement.functional:\n"
+            + "              name: " + child + "\n              level: 3\n              status: live\n"
+            + "              statement: A.\n              counterexample: B.\n";
+    }
+
+    @Test
+    public void excludedRequirementsProduceOneCappedWarningAndWarnUncoveredFalseSilencesIt() throws Exception {
+        List<String> reqs = new ArrayList<>();
+        for (int i = 1; i <= 7; i++) reqs.add(requirement("Area" + i, 3, "live", "S.", "C.", null));
+        reqs.add(requirement("Recorded", 4, "live", "S.", "C.", "Order"));
+        MetaDataLoader loader = loadYaml(shop(reqs.toArray(new String[0])));
+
+        JUnitRequirementTestsGenerator gen = generator(tmp.newFolder().toPath(), Map.of("warnUncovered", "true"));
+        // Table A: diagnostics name the PATH, never the package-qualified address, so the same
+        // model gives the same names in every port.
+        String message = "7 requirement(s) matched no filter and get no test. If that is deliberate, set "
+            + "warnUncovered=false to silence this. Uncovered: Area1, Area2, Area3, Area4, Area5, and 2 more.";
+        assertEquals(List.of(message), logged(gen, loader));
+        assertEquals(List.of(message), gen.warnings());
+
+        JUnitRequirementTestsGenerator quiet = generator(tmp.newFolder().toPath(), Map.of("warnUncovered", "false"));
+        assertEquals(List.of(), logged(quiet, loader));
+        assertEquals(List.of(), quiet.warnings());
+    }
+
+    @Test
+    public void theUncoveredWarningIsOnByDefault() throws Exception {
+        // No warnUncovered arg at all: the worked example's excluded L3 parent must be named.
+        JUnitRequirementTestsGenerator gen = new JUnitRequirementTestsGenerator();
+        gen.setArgs(realArgs(tmp.newFolder().toPath()));
+        String message = "1 requirement(s) matched no filter and get no test. If that is deliberate, set "
+            + "warnUncovered=false to silence this. Uncovered: Orders.";
+        assertEquals(List.of(message), logged(gen, loadDir(workedExampleInput())));
+        assertEquals(List.of(message), gen.warnings());
+    }
+
+    @Test
+    public void aNestedExcludedRequirementIsNamedByItsDottedPathNotItsBareNameOrQualifiedAddress() throws Exception {
+        MetaDataLoader loader = loadYaml(shop(
+            requirement("Area1", 3, "live", "S.", "C.", null),
+            withChild("Orders", "Placed"),
+            requirement("Recorded", 4, "live", "S.", "C.", "Order")));
+        JUnitRequirementTestsGenerator gen = generator(tmp.newFolder().toPath(), Map.of("warnUncovered", "true"));
+        String message = "3 requirement(s) matched no filter and get no test. If that is deliberate, set "
+            + "warnUncovered=false to silence this. Uncovered: Area1, Orders, Orders.Placed.";
+        assertEquals(List.of(message), logged(gen, loader));
+        assertEquals(List.of(message), gen.warnings());
+    }
+
+    // ---------------------------------------------------------------- nothing declared, nothing changes
+
+    @Test
+    public void aModelWithNoRequirementWritesNothingAndWarnsNothingEvenWithoutTheRequiredArgs() throws Exception {
+        MetaDataLoader loader = loadYaml(shop());
+        Path out = tmp.newFolder().toPath();
+        JUnitRequirementTestsGenerator gen = new JUnitRequirementTestsGenerator();
+        gen.setArgs(Map.of("outputDir", out.toString()));
+        gen.execute(loader);
+        assertEquals(new TreeSet<String>(), files(out));
+        assertEquals(List.of(), gen.warnings());
+    }
+
+    // ---------------------------------------------------------------- stale files
+
+    @Test
+    public void staleFile_genNeverRemovesTheFilesOfAPackageThatLostItsLastRequirement_verifyReportsThemStaleInRepo() throws Exception {
+        String billing = "metadata:\n  package: acme::billing\n  children:\n"
+            + "    - object.entity:\n        name: Invoice\n        children:\n"
+            + "          - field.uuid: { name: id }\n          - identity.primary: { name: pk, fields: [id] }\n"
+            + requirement("Billed", 4, "live", "S.", "C.", "Invoice");
+        Path dir = tmp.newFolder().toPath();
+        Files.writeString(dir.resolve("meta.billing.yaml"), billing, StandardCharsets.UTF_8);
+        Files.writeString(dir.resolve("meta.shop.yaml"),
+            shop(requirement("Recorded", 4, "live", "S.", "C.", "Order")), StandardCharsets.UTF_8);
+
+        Path out = tmp.newFolder().toPath();
+        generator(out, Map.of()).execute(loadDir(dir));
+        assertEquals(new TreeSet<>(List.of("com/acme/req/Requirements_acme_billing_Test.java",
+            "com/acme/req/Requirements_acme_billing_Witnesses.java",
+            "com/acme/req/Requirements_acme_shop_Test.java",
+            "com/acme/req/Requirements_acme_shop_Witnesses.java")), files(out));
+
+        // The billing package loses its requirement.
+        Files.writeString(dir.resolve("meta.billing.yaml"), billing.substring(0, billing.indexOf("    - requirement.functional")), StandardCharsets.UTF_8);
+        generator(out, Map.of()).execute(loadDir(dir));
+
+        // What gen does, as for every Java generator: it does not delete. The two files stay,
+        // untouched; `mvn metaobjects:verify` then reports each as [stale-in-repo] (proved through the real goals
+        // in the maven-plugin module's RequirementTestsGeneratorMojoTest).
+        assertEquals(new TreeSet<>(List.of("com/acme/req/Requirements_acme_billing_Test.java",
+            "com/acme/req/Requirements_acme_billing_Witnesses.java",
+            "com/acme/req/Requirements_acme_shop_Test.java",
+            "com/acme/req/Requirements_acme_shop_Witnesses.java")), files(out));
+    }
+
+    // ---------------------------------------------------------------- project class loader
+
+    @Test
+    public void aFilterOnlyTheProjectClassLoaderCanSeeIsFoundOnceTheLoaderIsInjected() throws Exception {
+        // Compile a filter into a directory that is on no ambient class path: the packaged
+        // generator's own loader cannot see it, exactly as the plugin's cannot see a project class.
+        Path src = tmp.newFolder().toPath();
+        Path file = src.resolve("com/acme/ProjectOnlyFilter.java");
+        Files.createDirectories(file.getParent());
+        Files.writeString(file, "package com.acme;\npublic class ProjectOnlyFilter implements com.metaobjects.requirement.RequirementTestFilter {\n"
+            + "  public boolean include(com.metaobjects.requirement.RequirementTestIdentities.View v) { return true; }\n}\n");
+        Path classes = tmp.newFolder().toPath();
+        JavaCompiler javac = ToolProvider.getSystemJavaCompiler();
+        try (StandardJavaFileManager fm = javac.getStandardFileManager(null, null, StandardCharsets.UTF_8)) {
+            fm.setLocation(StandardLocation.CLASS_OUTPUT, List.of(classes.toFile()));
+            assertTrue(javac.getTask(null, fm, null, List.of("-classpath", System.getProperty("java.class.path")), null,
+                fm.getJavaFileObjectsFromFiles(List.of(file.toFile()))).call());
+        }
+        MetaDataLoader loader = loadDir(workedExampleInput());
+        Map<String, String> args = Map.of("filter", "com.acme.ProjectOnlyFilter");
+
+        GeneratorException e = assertThrows(GeneratorException.class, () -> run(loader, args));
+        assertTrue(e.getMessage(), e.getMessage().contains("com.acme.ProjectOnlyFilter"));
+
+        try (URLClassLoader project = new URLClassLoader(new URL[]{classes.toUri().toURL()}, getClass().getClassLoader())) {
+            Path out = tmp.newFolder().toPath();
+            JUnitRequirementTestsGenerator gen = generator(out, args);
+            gen.setProjectClassLoader(project);
+            gen.execute(loader);
+            assertTrue(read(out, "Requirements_acme_shop_Test.java").contains("// acme::shop::Orders [*]"));
+        }
+    }
+}
diff --git a/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/AbstractMetaDataMojo.java b/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/AbstractMetaDataMojo.java
index cfb20864f..9d5ea6da2 100644
--- a/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/AbstractMetaDataMojo.java
+++ b/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/AbstractMetaDataMojo.java
@@ -7,6 +7,7 @@
 import com.metaobjects.agentcontext.AgentContextScaffold;
 import com.metaobjects.generator.Generator;
 import com.metaobjects.generator.GeneratorBase;
+import com.metaobjects.generator.ProjectClassLoaderAware;
 import com.metaobjects.generator.direct.MultiFileDirectGeneratorBase;
 import com.metaobjects.generator.spring.SpringRenderHelperGenerator;
 import com.metaobjects.generator.template.TemplateScopeGenerator;
@@ -158,6 +159,11 @@ protected List<Generator> buildGenerators(ClassLoader projectClassLoader,
                     Class<?> generatorClass = projectClassLoader.loadClass(g.getClassname());
                     Constructor<?> constructor = generatorClass.getDeclaredConstructor();
                     Generator impl = (Generator) constructor.newInstance();
+                    // A generator that loads a class the project names in an arg (a requirement
+                    // test renderer or filter) must look in the project's loader, not its own.
+                    if ( impl instanceof ProjectClassLoaderAware ) {
+                        ((ProjectClassLoaderAware) impl).setProjectClassLoader( projectClassLoader );
+                    }
 
                     // Merge generator args and global args
                     Map<String, String> allargs = mergeAndOverwriteArgs(g);
diff --git a/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/MetaDataVerifyMojo.java b/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/MetaDataVerifyMojo.java
index 795ea45ae..264175b91 100644
--- a/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/MetaDataVerifyMojo.java
+++ b/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/MetaDataVerifyMojo.java
@@ -4,6 +4,7 @@
 import com.metaobjects.generator.GeneratorBase;
 import com.metaobjects.generator.verify.TemplateVerify;
 import com.metaobjects.loader.MetaDataLoader;
+import com.metaobjects.requirement.RequirementCheck;
 import org.apache.maven.plugin.MojoExecutionException;
 import org.apache.maven.plugin.MojoFailureException;
 import org.apache.maven.plugins.annotations.LifecyclePhase;
@@ -75,6 +76,9 @@ public class MetaDataVerifyMojo extends AbstractMetaDataMojo {
     /** Arg used by {@link GeneratorBase} to locate each generator's output root. */
     static final String ARG_OUTPUT_DIR = GeneratorBase.ARG_OUTPUTDIR;
 
+    /** What every line of this goal's requirement report starts with, as the field lint's does. */
+    private static final String PREFIX = "metaobjects:verify \u2014 ";
+
     /** The gen goal to suggest in the failure message ({@code groupId:artifactId:goal}). */
     private static final String GEN_GOAL = "metaobjects:generate";
 
@@ -117,6 +121,24 @@ public class MetaDataVerifyMojo extends AbstractMetaDataMojo {
     public void setNoFieldLint(boolean noFieldLint) { this.noFieldLint = noFieldLint; }
     public boolean isNoFieldLint() { return noFieldLint; }
 
+    /** Environment variable that turns {@link #requireImplementers} on for a CI job. */
+    static final String ENV_REQUIRE_IMPLEMENTERS = "META_REQUIRE_IMPLEMENTERS";
+
+    /**
+     * The strict switch of the requirement gate (ADR-0057): raise
+     * {@code WARN_REQUIREMENT_NOTHING_IMPLEMENTS} to an error, for a project whose ledger has
+     * caught up with its links. No other diagnostic changes severity.
+     * {@code META_REQUIRE_IMPLEMENTERS=1} does the same.
+     */
+    @Parameter(property = "meta.verify.requireImplementers", defaultValue = "false")
+    private boolean requireImplementers = false;
+
+    public void setRequireImplementers(boolean requireImplementers) { this.requireImplementers = requireImplementers; }
+    public boolean isRequireImplementers() { return requireImplementers; }
+
+    /** The process environment, overridable so a test can set a variable. */
+    String getEnv(String name) { return System.getenv(name); }
+
     @Override
     public void execute() throws MojoExecutionException, MojoFailureException {
         // #233: warm the global registry singletons before verify builds its loader,
@@ -186,6 +208,54 @@ private static List<Path> sourceFiles(MetaDataLoader loader) {
         return files;
     }
 
+    // ------------------------------------------------------------------------
+    // the requirement gate — every mode (ADR-0057)
+    // ------------------------------------------------------------------------
+
+    /**
+     * Runs once per {@code execute()}, whichever mode was selected, as soon as the metadata has
+     * loaded, so what it found is printed even when the drift gate then fails the build. A model
+     * that declares no {@code requirement.*} node sees no change at all: nothing is logged.
+     *
+     * @return the number of errors found; the caller fails the build once its own gate has reported
+     */
+    private int runRequirementGate(MetaDataLoader loader) {
+        RequirementCheck.Scan scan = RequirementCheck.scan(loader.getRoot(),
+                new RequirementCheck.Options(null,
+                        requireImplementers || "1".equals(getEnv(ENV_REQUIRE_IMPLEMENTERS))));
+        RequirementCheck.Summary summary = RequirementCheck.summarise(loader.getRoot(), scan);
+        if (summary == null) return 0;
+
+        // Printed on every run, clean or not: a gate that says nothing when it passes cannot be
+        // told apart from a gate that checked nothing.
+        getLog().info(PREFIX + RequirementCheck.summaryText(summary, sourceFiles(loader).size()));
+        String undecided = RequirementCheck.undecidedText(summary);
+        if (undecided != null) getLog().info(PREFIX + undecided);
+
+        // Every error, then every warning, as the reference and the other ports print them: the
+        // checks find them interleaved, and an error must not be lost among the warnings.
+        List<RequirementCheck.Diagnostic> diagnostics = RequirementCheck.check(loader.getRoot(), scan);
+        int errors = 0;
+        for (RequirementCheck.Diagnostic d : diagnostics) {
+            if (d.severity() != RequirementCheck.Severity.ERROR) continue;
+            errors++;
+            getLog().error(RequirementCheck.formatDiagnostic(d));
+        }
+        for (RequirementCheck.Diagnostic d : diagnostics) {
+            if (d.severity() == RequirementCheck.Severity.ERROR) continue;
+            getLog().warn(RequirementCheck.formatDiagnostic(d));
+        }
+        if (errors > 0) getLog().error(PREFIX + "requirements: " + errors + " error(s).");
+        return errors;
+    }
+
+    private static void failOnRequirementErrors(int errors) throws MojoFailureException {
+        if (errors > 0) {
+            throw new MojoFailureException("metaobjects:verify \u2014 requirements: " + errors
+                    + " error(s); see the lines above.");
+        }
+    }
+
     // ------------------------------------------------------------------------
     // mode=templates — template/prompt {{field}}<->payload drift (ADR-0021 D2)
     // ------------------------------------------------------------------------
@@ -200,6 +270,7 @@ private void verifyTemplates() throws MojoExecutionException, MojoFailureExcepti
         ClassLoader projectClassLoader = createProjectClassLoader();
         MetaDataLoader loader = createLoader(projectClassLoader);
         runFieldLintAdvisory(loader);
+        int requirementErrors = runRequirementGate(loader);
 
         TemplateVerify.Outcome outcome = TemplateVerify.run(loader, Paths.get(templateRoot));
 
@@ -223,6 +294,7 @@ private void verifyTemplates() throws MojoExecutionException, MojoFailureExcepti
         }
 
         getLog().info("MetaData Verify Mojo > No template/prompt drift detected.");
+        failOnRequirementErrors(requirementErrors);
     }
 
     // ------------------------------------------------------------------------
@@ -233,6 +305,7 @@ private void verifyCodegen() throws MojoExecutionException, MojoFailureException
         ClassLoader projectClassLoader = createProjectClassLoader();
         MetaDataLoader loader = createLoader(projectClassLoader);
         runFieldLintAdvisory(loader);
+        int requirementErrors = runRequirementGate(loader);
 
         // Per-generator: resolve its committed (real) outputDir from the merged args, then
         // stage an arg-override so the regenerate writes to a temp dir instead. Keep the
@@ -313,6 +386,7 @@ private void verifyCodegen() throws MojoExecutionException, MojoFailureException
         } finally {
             deleteRecursively(tempRoot);
         }
+        failOnRequirementErrors(requirementErrors);
     }
 
     /**
diff --git a/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/MetaDataEjectMojoTest.java b/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/MetaDataEjectMojoTest.java
index 2f8c1096e..eaf0b8a33 100644
--- a/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/MetaDataEjectMojoTest.java
+++ b/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/MetaDataEjectMojoTest.java
@@ -200,6 +200,41 @@ public void anExplicitKotlinPortWritesUnderSrcMainKotlin() throws Exception {
         assertTrue(pomText.contains("<kotlin.compiler.jvmTarget>21</kotlin.compiler.jvmTarget>"));
     }
 
+    @Test
+    public void ejectingRequirementTestsWithTheKotlinPortCopiesTheShippedKotlinSourceWithItsPackageRewritten() throws Exception {
+        mojo("requirement-tests", false, "kotlin", null).execute();
+        Path target = codegenRoot().resolve("src/main/kotlin/com/acme/codegen/KotlinRequirementTestsGenerator.kt");
+        assertTrue("the Kotlin generator is written under src/main/kotlin", Files.exists(target));
+        assertFalse("and nothing is written for the Java port",
+                Files.exists(codegenRoot().resolve("src/main/java")));
+        String content = Files.readString(target, StandardCharsets.UTF_8);
+        assertEquals("package com.acme.codegen", content.lines().findFirst().orElse(""));
+        assertFalse(content.contains("package com.metaobjects.generator.kotlin"));
+        // It is the real file, read from the resource the jar ships: the generator and its
+        // default rendering together.
+        assertTrue(content.contains("class KotlinRequirementTestsGenerator"));
+        assertTrue(content.contains("@Disabled("));
+        assertTrue(Files.readString(codegenRoot().resolve("pom.xml"), StandardCharsets.UTF_8)
+                .contains("metaobjects-codegen-kotlin"));
+    }
+
+    @Test
+    public void ejectingRequirementTestsWithNoPortAndNothingToInferItFromIsRefusedAsEjectableOnMoreThanOnePort() {
+        // The name is registered by both the Java and the Kotlin registry, and the project
+        // declares no dependency that says which one it uses.
+        MetaDataEjectMojo m = mojo("requirement-tests", false, null, null);
+        try {
+            m.execute();
+            fail("expected MojoFailureException");
+        } catch (MojoFailureException expected) {
+            assertTrue(expected.getMessage(), expected.getMessage().contains("\"requirement-tests\" is ejectable on more than one port (java, kotlin)"));
+            assertTrue(expected.getMessage(), expected.getMessage().contains("-Dport=java|kotlin"));
+        } catch (MojoExecutionException e) {
+            fail("expected MojoFailureException, got " + e);
+        }
+        assertFalse("nothing is written when the name is ambiguous", Files.exists(codegenRoot()));
+    }
+
     @Test
     public void aDeclaredCodegenSpringDependencyInfersJavaForAnAmbiguousName() throws Exception {
         Dependency dep = new Dependency();
diff --git a/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/MetaDataVerifyRequirementsTest.java b/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/MetaDataVerifyRequirementsTest.java
new file mode 100644
index 000000000..39b68472e
--- /dev/null
+++ b/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/MetaDataVerifyRequirementsTest.java
@@ -0,0 +1,272 @@
+package com.metaobjects.mojo;
+
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import org.apache.maven.plugin.MojoFailureException;
+import org.apache.maven.plugin.logging.SystemStreamLog;
+import org.junit.Test;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.function.Function;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * {@code metaobjects:verify} — the requirement gate, end to end: the diagnostics, the summary
+ * and the failure. The codes, paths and message text are gated cross-port by
+ * {@code RequirementCheckConformanceTest} in the metadata module; this proves the goal runs
+ * the gate, prints what it found, and fails the build on an error and on nothing else.
+ */
+public class MetaDataVerifyRequirementsTest {
+
+    private static final String PREFIX = "metaobjects:verify — ";
+
+    /** Every line the goal logs, at every level, in order. */
+    private static final class CapturingLog extends SystemStreamLog {
+        final List<String> infos = new ArrayList<>();
+        final List<String> warnings = new ArrayList<>();
+        final List<String> errors = new ArrayList<>();
+        /** Warnings and errors as they arrived, across both levels. */
+        final List<String> warningsAndErrorsInOrder = new ArrayList<>();
+
+        @Override public void info(CharSequence content) { infos.add(content.toString()); }
+        @Override public void warn(CharSequence content) {
+            warnings.add(content.toString());
+            warningsAndErrorsInOrder.add(content.toString());
+        }
+        @Override public void error(CharSequence content) {
+            errors.add(content.toString());
+            warningsAndErrorsInOrder.add(content.toString());
+        }
+
+        List<String> all() {
+            List<String> all = new ArrayList<>(infos);
+            all.addAll(warnings);
+            all.addAll(errors);
+            return all;
+        }
+
+        long count(String fragment) {
+            return all().stream().filter(l -> l.contains(fragment)).count();
+        }
+    }
+
+    /** A mojo whose environment the test controls. */
+    private static final class TestMojo extends MetaDataVerifyMojo {
+        private final Function<String, String> env;
+
+        TestMojo(Function<String, String> env) { this.env = env; }
+
+        @Override String getEnv(String name) { return env.apply(name); }
+    }
+
+    private static final String ORDER_ENTITY = """
+        { "object.entity": { "name": "Order", "children": [
+            { "field.long": { "name": "id" } },
+            { "identity.primary": { "name": "pk", "@fields": ["id"] } } ] } }""";
+
+    private static String requirement(String name, String status, String implementedBy) {
+        return """
+            { "requirement.functional": { "name": "%s", "@level": 4, "@status": "%s",
+                "@statement": "An order is recorded.", "@counterexample": "A placed order has no row."%s } }"""
+            .formatted(name, status, implementedBy == null ? "" : ", \"@implementedBy\": [\"" + implementedBy + "\"]");
+    }
+
+    private static Path model(String... children) throws IOException {
+        Path dir = Files.createTempDirectory("verify-requirements");
+        dir.toFile().deleteOnExit();
+        Path file = dir.resolve("meta.app.json");
+        file.toFile().deleteOnExit();
+        Files.writeString(file, "{ \"metadata.root\": { \"package\": \"acme::shop\", \"children\": [\n"
+            + String.join(",\n", children) + "\n] } }", StandardCharsets.UTF_8);
+        return dir;
+    }
+
+    /** One goal run: everything it logged, and the failure it ended in, if any. */
+    private record Run(CapturingLog log, MojoFailureException failure) {}
+
+    private static Run run(Path dir, String mode, boolean requireImplementers,
+                           Function<String, String> env) throws Exception {
+        return run(dir, "meta.app.json", null, mode, requireImplementers, env);
+    }
+
+    private static Run run(Path dir, String source, List<String> libraries, String mode, boolean requireImplementers,
+                           Function<String, String> env) throws Exception {
+        TestMojo mojo = new TestMojo(env);
+        LoaderParam loaderParam = LoaderParam.builder("verify-requirements-test")
+            .withClassname("com.metaobjects.loader.MetaDataLoader")
+            .withSourceDir(dir.toString())
+            .withSource(source)
+            .build();
+        loaderParam.setLibraries(libraries);
+        mojo.setLoader(loaderParam);
+        mojo.setGenerators(Collections.emptyList());
+        mojo.setGlobals(Collections.emptyMap());
+        mojo.setMode(mode);
+        mojo.setTemplateRoot(Files.createTempDirectory("verify-requirements-templates").toString());
+        mojo.setRequireImplementers(requireImplementers);
+        CapturingLog log = new CapturingLog();
+        mojo.setLog(log);
+        try {
+            mojo.execute();
+            return new Run(log, null);
+        } catch (MojoFailureException e) {
+            return new Run(log, e);
+        }
+    }
+
+    private static final Function<String, String> NO_ENV = name -> null;
+
+    @Test
+    public void aModelWithNoRequirementLogsNothingAndDoesNotFail() throws Exception {
+        for (String mode : new String[]{"templates", "codegen"}) {
+            Run run = run(model(ORDER_ENTITY), mode, false, NO_ENV);
+            assertNull(mode, run.failure());
+            assertEquals(mode + ": " + run.log().all(), 0,
+                run.log().all().stream().filter(l -> l.contains("requirements:") || l.contains("_REQUIREMENT_")).count());
+            assertTrue(mode + ": " + run.log().errors, run.log().errors.isEmpty());
+        }
+    }
+
+    @Test
+    public void aDanglingLiveReferenceFailsTheBuildAfterLoggingTheCodePathAndSummary() throws Exception {
+        Run run = run(model(ORDER_ENTITY, requirement("Recorded", "live", "Ordr")), "templates", false, NO_ENV);
+        assertNotNull("the build must fail", run.failure());
+        assertTrue(run.log().errors.toString(), run.log().errors.contains(
+            "  ERR_REQUIREMENT_DANGLING_REF [Recorded]: 'Ordr' does not resolve in the loaded model "
+                + "(status 'live' \u2014 the model moved and the requirement is stale)."));
+        assertTrue(run.log().infos.toString(), run.log().infos.contains(PREFIX
+            + "requirements: 1 entries (1 functional, 0 architectural) \u2014 1 live; "
+            + "0/1 entities claimed, counted over 1 metadata file(s)."));
+        assertTrue(run.log().errors.toString(), run.log().errors.contains(PREFIX + "requirements: 1 error(s)."));
+    }
+
+    @Test
+    public void warningsAloneDoNotFailTheBuild() throws Exception {
+        // A live L4 that names nothing: WARN_REQUIREMENT_NOTHING_IMPLEMENTS, and Order is unclaimed.
+        Run run = run(model(ORDER_ENTITY, requirement("Recorded", "live", null)), "templates", false, NO_ENV);
+        assertNull(run.failure());
+        assertTrue(run.log().warnings.toString(), run.log().warnings.stream().anyMatch(
+            w -> w.startsWith("  WARN_REQUIREMENT_NOTHING_IMPLEMENTS [Recorded]: ")));
+        assertTrue(run.log().warnings.toString(), run.log().warnings.stream().anyMatch(
+            w -> w.startsWith("  WARN_REQUIREMENT_OBJECT_UNCLAIMED: no requirement claims 'acme::shop::Order'.")));
+        assertTrue(run.log().errors.toString(), run.log().errors.isEmpty());
+    }
+
+    @Test
+    public void everyErrorIsLoggedBeforeAnyWarningWhateverOrderTheChecksFoundThemIn() throws Exception {
+        // In check order: a warning (Idle names nothing), an error (Recorded names a missing
+        // node), then the whole-model warning (Order is unclaimed). Printed: errors, then warnings.
+        Run run = run(model(ORDER_ENTITY, requirement("Idle", "live", null), requirement("Recorded", "live", "Ordr")),
+            "templates", false, NO_ENV);
+        assertNotNull("the build must fail", run.failure());
+        List<String> codes = run.log().warningsAndErrorsInOrder.stream()
+            .filter(l -> l.startsWith("  ERR_REQUIREMENT_") || l.startsWith("  WARN_REQUIREMENT_"))
+            .map(l -> l.strip().split("[ :]")[0])
+            .toList();
+        assertEquals(List.of(
+            "ERR_REQUIREMENT_DANGLING_REF",
+            "WARN_REQUIREMENT_NOTHING_IMPLEMENTS",
+            "WARN_REQUIREMENT_OBJECT_UNCLAIMED"), codes);
+        // The error count closes the gate's output, after the warnings.
+        assertEquals(PREFIX + "requirements: 1 error(s).",
+            run.log().warningsAndErrorsInOrder.get(run.log().warningsAndErrorsInOrder.size() - 1));
+    }
+
+    @Test
+    public void anUndecidedPartialRequirementLogsTheRecordedGapsLine() throws Exception {
+        Run run = run(model(ORDER_ENTITY, requirement("Recorded", "partial", "Order")), "templates", false, NO_ENV);
+        assertNull(run.failure());
+        assertTrue(run.log().infos.toString(), run.log().infos.contains(PREFIX
+            + "requirements: 1 entries (1 functional, 0 architectural) \u2014 1 partial; "
+            + "1/1 entities claimed, counted over 1 metadata file(s)."));
+        assertTrue(run.log().infos.toString(), run.log().infos.contains(PREFIX
+            + "requirements: 1 recorded gap(s) with no @disposition. These are known problems nobody has ruled on "
+            + "\u2014 set 'accepted' or 'deferred' to close the question."));
+    }
+
+    private static Path corpusCase(String name) {
+        for (Path p = Path.of("").toAbsolutePath(); p != null; p = p.getParent()) {
+            if (Files.isDirectory(p.resolve("fixtures")) && Files.isDirectory(p.resolve("server"))) {
+                return p.resolve("fixtures/requirement-check-conformance").resolve(name);
+            }
+        }
+        throw new IllegalStateException("repo root not found");
+    }
+
+    @Test
+    public void theSummaryLineOfALibraryOnlyProjectSaysCoverageIsNotMeasured() throws Exception {
+        // The corpus case pins the counts; this pins the sentence the goal logs them in. The
+        // project opts into a library and authors no requirement of its own.
+        Path corpusCase = corpusCase("coverage-library-only-not-measured");
+        JsonObject options = JsonParser.parseString(Files.readString(corpusCase.resolve("options.json"))).getAsJsonObject();
+        List<String> libraries = new ArrayList<>();
+        options.getAsJsonArray("libraries").forEach(l -> libraries.add(l.getAsString()));
+        JsonObject summary = JsonParser.parseString(Files.readString(corpusCase.resolve("expected.json")))
+            .getAsJsonObject().getAsJsonObject("summary");
+        assertTrue("the case this test is about", !summary.has("entitiesTotal"));
+        JsonObject byStatus = summary.getAsJsonObject("byStatus");
+        List<String> statuses = new ArrayList<>();
+        for (String status : List.of("planned", "live", "partial", "retired")) {
+            if (byStatus.has(status) && byStatus.get(status).getAsInt() > 0) {
+                statuses.add(byStatus.get(status).getAsInt() + " " + status);
+            }
+        }
+
+        Run run = run(corpusCase.resolve("input"), "meta.shop.yaml", libraries, "templates", false, NO_ENV);
+
+        assertNull(run.failure());
+        assertTrue(run.log().infos.toString(), run.log().infos.contains(PREFIX
+            + "requirements: " + summary.get("total").getAsInt() + " entries ("
+            + summary.get("functional").getAsInt() + " functional, "
+            + summary.get("architectural").getAsInt() + " architectural) \u2014 "
+            + String.join(", ", statuses) + "; coverage: not measured (no project-authored requirements)."));
+        assertEquals(run.log().all().toString(), 0, run.log().count("entities claimed"));
+    }
+
+    @Test
+    public void requireImplementersTurnsTheNothingImplementsWarningIntoAFailure() throws Exception {
+        Path dir = model(ORDER_ENTITY, requirement("Recorded", "live", null));
+
+        Run byParameter = run(dir, "templates", true, NO_ENV);
+        assertNotNull("the parameter must fail the build", byParameter.failure());
+        assertTrue(byParameter.log().errors.toString(), byParameter.log().errors.stream().anyMatch(
+            e -> e.startsWith("  WARN_REQUIREMENT_NOTHING_IMPLEMENTS [Recorded]: ")));
+        assertTrue(byParameter.log().errors.toString(),
+            byParameter.log().errors.contains(PREFIX + "requirements: 1 error(s)."));
+        // Only that one code is raised: the other warning keeps its severity.
+        assertTrue(byParameter.log().warnings.toString(), byParameter.log().warnings.stream().anyMatch(
+            w -> w.startsWith("  WARN_REQUIREMENT_OBJECT_UNCLAIMED: ")));
+
+        assertNotNull("META_REQUIRE_IMPLEMENTERS=1 must fail the build",
+            run(dir, "templates", false, name -> "META_REQUIRE_IMPLEMENTERS".equals(name) ? "1" : null).failure());
+        assertNull("only the value 1 turns the switch on",
+            run(dir, "templates", false, name -> "META_REQUIRE_IMPLEMENTERS".equals(name) ? "0" : null).failure());
+    }
+
+    @Test
+    public void theGateRunsOnceWhicheverGateTheModeRan() throws Exception {
+        Path dir = model(ORDER_ENTITY, requirement("Recorded", "live", "Order"));
+        for (String mode : new String[]{"templates", "codegen"}) {
+            Run run = run(dir, mode, false, NO_ENV);
+            assertNull(mode, run.failure());
+            assertEquals(mode + ": " + run.log().all(), 1, run.log().count(PREFIX + "requirements: 1 entries"));
+        }
+    }
+
+    @Test
+    public void aRequirementErrorStillFailsTheBuildInCodegenMode() throws Exception {
+        Run run = run(model(ORDER_ENTITY, requirement("Recorded", "live", "Ordr")), "codegen", false, NO_ENV);
+        assertNotNull("the build must fail", run.failure());
+        assertEquals(run.log().all().toString(), 1, run.log().count(PREFIX + "requirements: 1 error(s)."));
+    }
+}
diff --git a/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/RequirementTestsEjectRoundTripTest.java b/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/RequirementTestsEjectRoundTripTest.java
new file mode 100644
index 000000000..ae39b0597
--- /dev/null
+++ b/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/RequirementTestsEjectRoundTripTest.java
@@ -0,0 +1,159 @@
+package com.metaobjects.mojo;
+
+import com.metaobjects.generator.Generator;
+import com.metaobjects.generator.spring.JUnitRequirementTestsGenerator;
+import com.metaobjects.loader.DirectorySource;
+import com.metaobjects.loader.LoaderOptions;
+import com.metaobjects.loader.MetaDataLoader;
+import org.apache.maven.project.MavenProject;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.TemporaryFolder;
+import org.mockito.Mockito;
+
+import javax.tools.Diagnostic;
+import javax.tools.DiagnosticCollector;
+import javax.tools.JavaCompiler;
+import javax.tools.JavaFileObject;
+import javax.tools.StandardJavaFileManager;
+import javax.tools.StandardLocation;
+import javax.tools.ToolProvider;
+import java.io.IOException;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.FileVisitResult;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.SimpleFileVisitor;
+import java.nio.file.attribute.BasicFileAttributes;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.TreeSet;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * Eject proof (b) for {@code requirement-tests}: the UNCHANGED ejected copy, compiled, emits the
+ * same bytes as the packaged generator. The model is the identity corpus's {@code worked-example}
+ * and the args are NOT the defaults ({@code grain=member}, another {@code testPackage}), so a copy
+ * that read a default instead of its arg, or that carried the generator's own package or class
+ * name into its output, would differ. {@link EjectRoundTripTest} does the same for the names
+ * generator over the persistence corpus, which has no requirement.
+ */
+public class RequirementTestsEjectRoundTripTest {
+
+    @Rule
+    public TemporaryFolder tempFolder = new TemporaryFolder();
+
+    private MetaDataLoader loader;
+
+    private static final Map<String, String> ARGS = Map.of(
+        "testPackage", "com.example.requirements",
+        "witnessClass", "com.example.Witnesses",
+        "grain", "member",
+        // the L3 parent would log the uncovered warning from both generators
+        "warnUncovered", "false");
+
+    @Before
+    public void loadWorkedExample() throws IOException {
+        Path input = null;
+        for (Path p = Path.of("").toAbsolutePath(); p != null && input == null; p = p.getParent()) {
+            Path candidate = p.resolve("fixtures/requirement-test-identity-conformance/worked-example/input");
+            if (Files.isDirectory(candidate)) input = candidate;
+        }
+        assertTrue("worked-example corpus case not found", input != null);
+        loader = new MetaDataLoader(LoaderOptions.create(false, false, true),
+            MetaDataLoader.SUBTYPE_MANUAL, "requirement-tests-eject-roundtrip");
+        loader.init();
+        loader.load(new DirectorySource(input, new DirectorySource.Options()).expandToList());
+        assertTrue(loader.getErrors().toString(), loader.getErrors().isEmpty());
+    }
+
+    private Path eject(Path projectDir) throws Exception {
+        MavenProject project = Mockito.mock(MavenProject.class);
+        Mockito.when(project.getBasedir()).thenReturn(projectDir.toFile());
+        Mockito.when(project.getGroupId()).thenReturn("com.acme");
+        Mockito.when(project.getArtifactId()).thenReturn("widgets");
+        Mockito.when(project.getVersion()).thenReturn("1.0.0");
+        Mockito.when(project.getDependencies()).thenReturn(List.of());
+
+        MetaDataEjectMojo mojo = new MetaDataEjectMojo();
+        mojo.project = project;
+        mojo.names = "requirement-tests";
+        mojo.port = "java";
+        mojo.execute();
+        return projectDir.resolve("codegen/src/main/java/com/acme/codegen/JUnitRequirementTestsGenerator.java");
+    }
+
+    private Path generate(Generator gen, String label) throws IOException {
+        Path out = tempFolder.newFolder(label).toPath();
+        Map<String, String> args = new java.util.HashMap<>(ARGS);
+        args.put("outputDir", out.toString());
+        gen.setArgs(args);
+        gen.execute(loader);
+        return out;
+    }
+
+    private static Set<String> relativeFiles(Path root) throws IOException {
+        Set<String> out = new TreeSet<>();
+        Files.walkFileTree(root, new SimpleFileVisitor<>() {
+            @Override
+            public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) {
+                out.add(root.relativize(file).toString());
+                return FileVisitResult.CONTINUE;
+            }
+        });
+        return out;
+    }
+
+    @Test
+    public void anUnchangedEjectedCopyProducesByteIdenticalOutput() throws Exception {
+        Path packaged = generate(new JUnitRequirementTestsGenerator(), "packaged");
+
+        Path source = eject(tempFolder.newFolder("adopter").toPath());
+        assertTrue(Files.exists(source));
+        String copy = Files.readString(source, StandardCharsets.UTF_8);
+        assertTrue("the copy is package-renamed", copy.contains("package com.acme.codegen;"));
+        assertFalse(copy.contains("package com.metaobjects.generator.spring;"));
+
+        Path classes = tempFolder.newFolder("owned-classes").toPath();
+        JavaCompiler javac = ToolProvider.getSystemJavaCompiler();
+        DiagnosticCollector<JavaFileObject> diagnostics = new DiagnosticCollector<>();
+        try (StandardJavaFileManager fm = javac.getStandardFileManager(diagnostics, null, StandardCharsets.UTF_8)) {
+            fm.setLocation(StandardLocation.CLASS_OUTPUT, List.of(classes.toFile()));
+            boolean ok = javac.getTask(null, fm, diagnostics, List.of("-classpath", System.getProperty("java.class.path")),
+                null, fm.getJavaFileObjectsFromFiles(List.of(source.toFile()))).call();
+            StringBuilder errs = new StringBuilder();
+            for (Diagnostic<? extends JavaFileObject> d : diagnostics.getDiagnostics()) errs.append(d).append('\n');
+            assertTrue("owned copy failed to compile:\n" + errs, ok);
+        }
+
+        Path owned;
+        try (URLClassLoader child = new URLClassLoader(new URL[]{classes.toUri().toURL()},
+            Thread.currentThread().getContextClassLoader())) {
+            Generator gen = (Generator) Class.forName("com.acme.codegen.JUnitRequirementTestsGenerator", true, child)
+                .getDeclaredConstructor().newInstance();
+            owned = generate(gen, "owned");
+        }
+
+        Set<String> files = relativeFiles(packaged);
+        assertEquals(new TreeSet<>(Arrays.asList(
+            "com/example/requirements/Requirements_acme_shop_Test.java",
+            "com/example/requirements/Requirements_acme_shop_Witnesses.java")), files);
+        assertEquals("same set of generated files", files, relativeFiles(owned));
+        for (String rel : files) {
+            assertEquals("content differs for " + rel,
+                Files.readString(packaged.resolve(rel), StandardCharsets.UTF_8),
+                Files.readString(owned.resolve(rel), StandardCharsets.UTF_8));
+        }
+        // member grain, not the default: the unit is the reference as authored.
+        assertTrue(Files.readString(owned.resolve("com/example/requirements/Requirements_acme_shop_Test.java"))
+            .contains("req_acme_shop_Orders_Recorded__Order()"));
+    }
+}
diff --git a/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/RequirementTestsGeneratorMojoTest.java b/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/RequirementTestsGeneratorMojoTest.java
new file mode 100644
index 000000000..d800ff9f7
--- /dev/null
+++ b/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/RequirementTestsGeneratorMojoTest.java
@@ -0,0 +1,162 @@
+package com.metaobjects.mojo;
+
+import com.metaobjects.generator.spring.JUnitRequirementTestsGenerator;
+import org.apache.maven.plugin.MojoExecution;
+import org.apache.maven.plugin.MojoFailureException;
+import org.apache.maven.project.MavenProject;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.TemporaryFolder;
+import org.mockito.Mockito;
+
+import javax.tools.JavaCompiler;
+import javax.tools.StandardJavaFileManager;
+import javax.tools.StandardLocation;
+import javax.tools.ToolProvider;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Stream;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+/**
+ * {@code requirement-tests} through the real goals: a {@code filter} class that lives only on the
+ * PROJECT's classpath is found (the plugin's own class loader cannot see it, which is why
+ * {@code buildGenerators} hands the project loader to a {@link
+ * com.metaobjects.generator.ProjectClassLoaderAware} generator), and {@code metaobjects:verify}
+ * reports the two files of a package that lost its last requirement as {@code [stale-in-repo]}.
+ */
+public class RequirementTestsGeneratorMojoTest {
+
+    @Rule
+    public TemporaryFolder tmp = new TemporaryFolder();
+
+    private static final String ORDER_ENTITY = """
+        { "object.entity": { "name": "Order", "children": [
+            { "field.long": { "name": "id" } },
+            { "identity.primary": { "name": "pk", "@fields": ["id"] } } ] } }""";
+
+    private static final String L3_PARENT = """
+        { "requirement.functional": { "name": "Orders", "@level": 3, "@status": "live",
+            "@statement": "Every placed order is kept.", "@counterexample": "A placed order is lost." } }""";
+
+    private static final String L4_ORDER = """
+        { "requirement.functional": { "name": "Recorded", "@level": 4, "@status": "live",
+            "@statement": "An order is recorded.", "@counterexample": "A placed order has no row.",
+            "@implementedBy": ["Order"] } }""";
+
+    private Path model(String... children) throws IOException {
+        Path dir = tmp.newFolder().toPath();
+        Files.writeString(dir.resolve("meta.app.json"), "{ \"metadata.root\": { \"package\": \"acme::shop\", \"children\": [\n"
+            + String.join(",\n", children) + "\n] } }", StandardCharsets.UTF_8);
+        return dir;
+    }
+
+    private void configure(AbstractMetaDataMojo mojo, Path modelDir, Path outputDir, String... extraArgs) {
+        mojo.setLoader(LoaderParam.builder("requirement-tests-mojo")
+            .withClassname("com.metaobjects.loader.MetaDataLoader")
+            .withSourceDir(modelDir.toString())
+            .withSource("meta.app.json")
+            .build());
+        GeneratorParam.Builder gen = GeneratorParam.builder(JUnitRequirementTestsGenerator.class.getName())
+            .withArg("outputDir", outputDir.toString())
+            .withArg("testPackage", "com.acme.requirements")
+            .withArg("witnessClass", "com.acme.Witnesses")
+            .withArg("warnUncovered", "false");
+        for (int i = 0; i < extraArgs.length; i += 2) gen.withArg(extraArgs[i], extraArgs[i + 1]);
+        mojo.setGenerators(new ArrayList<>(List.of(gen.build())));
+        mojo.setGlobals(Collections.emptyMap());
+    }
+
+    /** Compile a filter into a directory that is on no ambient class path. */
+    private Path compileProjectFilter() throws IOException {
+        Path src = tmp.newFolder().toPath().resolve("com/acme/ProjectOnlyFilter.java");
+        Files.createDirectories(src.getParent());
+        Files.writeString(src, "package com.acme;\npublic class ProjectOnlyFilter implements com.metaobjects.requirement.RequirementTestFilter {\n"
+            + "  public boolean include(com.metaobjects.requirement.RequirementTestIdentities.View v) { return true; }\n}\n");
+        Path classes = tmp.newFolder().toPath();
+        JavaCompiler javac = ToolProvider.getSystemJavaCompiler();
+        try (StandardJavaFileManager fm = javac.getStandardFileManager(null, null, StandardCharsets.UTF_8)) {
+            fm.setLocation(StandardLocation.CLASS_OUTPUT, List.of(classes.toFile()));
+            assertTrue(javac.getTask(null, fm, null, List.of("-classpath", System.getProperty("java.class.path")), null,
+                fm.getJavaFileObjectsFromFiles(List.of(src.toFile()))).call());
+        }
+        return classes;
+    }
+
+    private MetaDataGeneratorMojo genMojoWithProjectClasspath(Path projectClasses) throws Exception {
+        MavenProject project = Mockito.mock(MavenProject.class);
+        Mockito.when(project.getBasedir()).thenReturn(tmp.getRoot());
+        Mockito.when(project.getRuntimeClasspathElements()).thenReturn(List.of());
+        Mockito.when(project.getCompileClasspathElements()).thenReturn(List.of(projectClasses.toString()));
+        Mockito.when(project.getTestClasspathElements()).thenReturn(List.of());
+        MojoExecution execution = Mockito.mock(MojoExecution.class);
+        Mockito.when(execution.getLifecyclePhase()).thenReturn(AbstractMetaDataMojo.PHASE_GENERATE_SOURCES);
+        MetaDataGeneratorMojo mojo = new MetaDataGeneratorMojo();
+        mojo.project = project;
+        mojo.execution = execution;
+        return mojo;
+    }
+
+    @Test
+    public void aFilterClassOnlyTheProjectClasspathHoldsIsFoundThroughTheGenerateGoal() throws Exception {
+        Path model = model(ORDER_ENTITY, L3_PARENT, L4_ORDER);
+        Path projectClasses = compileProjectFilter();
+
+        Path out = tmp.newFolder().toPath();
+        MetaDataGeneratorMojo gen = genMojoWithProjectClasspath(projectClasses);
+        configure(gen, model, out, "filter", "com.acme.ProjectOnlyFilter");
+        gen.execute();
+        String test = Files.readString(out.resolve("com/acme/requirements/Requirements_acme_shop_Test.java"), StandardCharsets.UTF_8);
+        assertTrue("the project's filter kept the L3 requirement the default drops: " + test, test.contains("// acme::shop::Orders [*]"));
+
+        // The same configuration with no project classpath: the class is not found, said plainly.
+        MetaDataGeneratorMojo bare = new MetaDataGeneratorMojo();
+        configure(bare, model, tmp.newFolder().toPath(), "filter", "com.acme.ProjectOnlyFilter");
+        Exception e = assertThrows(Exception.class, bare::execute);
+        assertTrue(e.toString(), e.toString().contains("com.acme.ProjectOnlyFilter"));
+    }
+
+    @Test
+    public void verifyReportsTheFilesOfAPackageThatLostItsLastRequirementAsStaleInRepo() throws Exception {
+        Path out = tmp.newFolder().toPath();
+        MetaDataGeneratorMojo gen = new MetaDataGeneratorMojo();
+        configure(gen, model(ORDER_ENTITY, L3_PARENT, L4_ORDER), out);
+        gen.execute();
+
+        MetaDataVerifyMojo inSync = new MetaDataVerifyMojo();
+        configure(inSync, model(ORDER_ENTITY, L3_PARENT, L4_ORDER), out);
+        inSync.setMode("codegen");
+        inSync.execute();
+
+        // The requirement is removed. gen never deletes a file, so the two are still there...
+        Path dropped = model(ORDER_ENTITY);
+        MetaDataGeneratorMojo regen = new MetaDataGeneratorMojo();
+        configure(regen, dropped, out);
+        regen.execute();
+        try (Stream<Path> files = Files.list(out.resolve("com/acme/requirements"))) {
+            assertEquals(2, files.count());
+        }
+
+        // ...and verify names them.
+        MetaDataVerifyMojo verify = new MetaDataVerifyMojo();
+        configure(verify, dropped, out);
+        verify.setMode("codegen");
+        try {
+            verify.execute();
+            fail("expected stale-in-repo drift");
+        } catch (MojoFailureException e) {
+            assertTrue(e.getMessage(), e.getMessage().contains("[stale-in-repo]"));
+            assertTrue(e.getMessage(), e.getMessage().contains("Requirements_acme_shop_Test.java"));
+            assertTrue(e.getMessage(), e.getMessage().contains("Requirements_acme_shop_Witnesses.java"));
+        }
+    }
+}
diff --git a/server/java/metadata/src/main/java/com/metaobjects/library/LibrarySources.java b/server/java/metadata/src/main/java/com/metaobjects/library/LibrarySources.java
index f2077c05e..e898fd334 100644
--- a/server/java/metadata/src/main/java/com/metaobjects/library/LibrarySources.java
+++ b/server/java/metadata/src/main/java/com/metaobjects/library/LibrarySources.java
@@ -113,6 +113,28 @@ public static List<String> generatorAnchors(String generatorName) {
         return out;
     }
 
+    /**
+     * The package names the shipped libraries declare, across every embedded manifest
+     * ({@code "packages"}), e.g. {@code metaobjects::iam} and {@code metaobjects::ai}.
+     *
+     * <p>The provenance key for requirement-coverage activation (FR-043 &sect;5.4): a
+     * requirement whose package is NOT in this set was authored by the adopter. Read from the
+     * manifests, hand-parsed for the reason {@link #parseLayers} is, and never regenerated.</p>
+     *
+     * @return the declared package names, sorted
+     */
+    public static java.util.Set<String> libraryPackages() {
+        java.util.Set<String> out = new TreeSet<>();
+        for (String manifest : EmbeddedLibrary.MANIFESTS.values()) {
+            java.util.regex.Matcher block = java.util.regex.Pattern
+                .compile("\"packages\"\\s*:\\s*\\[([^\\]]*)\\]").matcher(manifest);
+            if (!block.find()) continue;
+            java.util.regex.Matcher pkg = java.util.regex.Pattern.compile("\"([^\"]+)\"").matcher(block.group(1));
+            while (pkg.find()) out.add(pkg.group(1));
+        }
+        return out;
+    }
+
     /** One {@code "key": "value"} string field out of a flat JSON object body. */
     private static String manifestField(String objectBody, String key) {
         java.util.regex.Matcher m = java.util.regex.Pattern
diff --git a/server/java/metadata/src/main/java/com/metaobjects/loader/ValidationPhase.java b/server/java/metadata/src/main/java/com/metaobjects/loader/ValidationPhase.java
index a782a4e4a..1ef32f742 100644
--- a/server/java/metadata/src/main/java/com/metaobjects/loader/ValidationPhase.java
+++ b/server/java/metadata/src/main/java/com/metaobjects/loader/ValidationPhase.java
@@ -4214,8 +4214,13 @@ public static MetaObject resolveRootObject(MetaRoot root, String ref, String ref
 
     /** ADR-0042 §5 — a did-you-mean suffix for an UNRESOLVED object reference: the FQNs of
      *  same-short-name objects that DO exist (typically in other packages). Returns "" when
-     *  none exist. Mirrors the TS {@code didYouMeanHint}. */
-    private static String didYouMeanHint(MetaRoot root, String ref) {
+     *  none exist. Mirrors the TS {@code didYouMeanHint}.
+     *
+     *  <p>Public because the requirement gate ({@code RequirementCheck}) appends the same text
+     *  to a dangling claim: the gate and this loader pass share this one builder, so the two
+     *  cannot word it differently. It is not the only one: {@code RegisteredValidation} holds
+     *  a second, private builder of the same sentence, which does not strip a dotted tail.</p> */
+    public static String didYouMeanHint(MetaRoot root, String ref) {
         if (ref == null) return "";
         int sep = ref.lastIndexOf(MetaData.PKG_SEPARATOR);
         String shortName = (sep >= 0) ? ref.substring(sep + MetaData.PKG_SEPARATOR.length()) : ref;
diff --git a/server/java/metadata/src/main/java/com/metaobjects/requirement/ArchitecturalRequirement.java b/server/java/metadata/src/main/java/com/metaobjects/requirement/ArchitecturalRequirement.java
index 7c00e4ae1..193a787c5 100644
--- a/server/java/metadata/src/main/java/com/metaobjects/requirement/ArchitecturalRequirement.java
+++ b/server/java/metadata/src/main/java/com/metaobjects/requirement/ArchitecturalRequirement.java
@@ -26,11 +26,13 @@
  * ({@code requirement.architectural}).
  *
  * <p>Its check is UNIVERSALITY, the opposite polarity to {@link FunctionalRequirement}.
- * What the Node {@code meta verify} enforces is that a live or partial policy is applied
- * at all — one claiming nothing is an error — not that each node it claims complies. It carries NO {@code @level} and no parent:
- * levels come from object-in-focus decomposition, and an architectural requirement is
- * object-independent by definition. It therefore also admits no nested requirement
- * children.</p>
+ * What every port's {@code verify} enforces is that a live or partial policy is applied
+ * at all — one claiming nothing is an error — not that each node it claims complies. Its
+ * {@code @level} is OPTIONAL: absent, it is a flat, object-independent policy that may
+ * reference the model directly; present, it sits in a levelled tree under the rules a
+ * functional requirement follows (nesting agrees with the level, and only L4 and L5 carry
+ * {@code @implementedBy}). It admits nested requirement children, so a non-functional tree
+ * can be organised by a quality taxonomy.</p>
  */
 public class ArchitecturalRequirement extends MetaRequirement {
 
diff --git a/server/java/metadata/src/main/java/com/metaobjects/requirement/FunctionalRequirement.java b/server/java/metadata/src/main/java/com/metaobjects/requirement/FunctionalRequirement.java
index d320026a0..7d3cc9615 100644
--- a/server/java/metadata/src/main/java/com/metaobjects/requirement/FunctionalRequirement.java
+++ b/server/java/metadata/src/main/java/com/metaobjects/requirement/FunctionalRequirement.java
@@ -25,7 +25,7 @@
  * What the product does for a user, stated as one violable claim
  * ({@code requirement.functional}).
  *
- * <p>Its check is EXISTENCE, run by the Node {@code meta verify}: a live or partial claim
+ * <p>Its check is EXISTENCE, run by every port's {@code verify}: a live or partial claim
  * with no implementing node anywhere in its subtree is a warning, and a named node that no
  * longer exists is an error. Hierarchy is NESTING —
  * an L1 solution contains its L2 segments, which contain L3 services, and so on down to
diff --git a/server/java/metadata/src/main/java/com/metaobjects/requirement/MetaRequirement.java b/server/java/metadata/src/main/java/com/metaobjects/requirement/MetaRequirement.java
index d1519af5e..007c88db8 100644
--- a/server/java/metadata/src/main/java/com/metaobjects/requirement/MetaRequirement.java
+++ b/server/java/metadata/src/main/java/com/metaobjects/requirement/MetaRequirement.java
@@ -224,8 +224,13 @@ public boolean isArchitectural() {
     }
 
     /**
-     * 1 solution · 2 segment · 3 service · 4 object · 5 member. Architectural
-     * requirements carry none — they are object-independent by definition.
+     * 1 solution · 2 segment · 3 service · 4 object · 5 member. An architectural
+     * requirement carries it OPTIONALLY: absent means a flat, object-independent policy,
+     * present opts the node into a levelled tree (a quality taxonomy, for example).
+     *
+     * <p>Saturating, never wrapping: a value beyond {@code int} reads as
+     * {@link Integer#MAX_VALUE} or {@link Integer#MIN_VALUE}, so it cannot narrow to a
+     * number that looks like a valid level (4294967300 would otherwise read as 4).</p>
      *
      * @return the declared/inherited level, or {@code null} when absent
      */
@@ -235,19 +240,23 @@ public Integer getLevel() {
         }
         Object value = getMetaAttr(ATTR_LEVEL).getValue();
         if (value instanceof Number) {
-            return ((Number) value).intValue();
+            return saturate(((Number) value).longValue());
         }
         String raw = getMetaAttr(ATTR_LEVEL).getValueAsString();
         if (raw == null || raw.trim().isEmpty()) {
             return null;
         }
         try {
-            return Integer.valueOf(raw.trim());
+            return saturate(Long.parseLong(raw.trim()));
         } catch (NumberFormatException e) {
             return null;
         }
     }
 
+    private static int saturate(long level) {
+        return (int) Math.max(Integer.MIN_VALUE, Math.min(Integer.MAX_VALUE, level));
+    }
+
     /** The lifecycle status, or {@code null} when absent. */
     public String getStatus() {
         return hasMetaAttr(ATTR_STATUS) ? getMetaAttr(ATTR_STATUS).getValueAsString() : null;
@@ -278,6 +287,23 @@ public List<String> getTrackedBy() {
         return stringList(ATTR_TRACKED_BY);
     }
 
+    /**
+     * The requirement that REPLACED this one (FR-039), or {@code null} when absent or blank.
+     * Legal on {@link #STATUS_RETIRED} only; {@code verify} resolves it against the ledger.
+     */
+    public String getSupersededBy() {
+        if (!hasMetaAttr(ATTR_SUPERSEDED_BY)) {
+            return null;
+        }
+        String value = getMetaAttr(ATTR_SUPERSEDED_BY).getValueAsString();
+        return value == null || value.trim().isEmpty() ? null : value;
+    }
+
+    /** Built, then deliberately removed -- exempt from the checks that assume a built thing. */
+    public boolean isRetired() {
+        return STATUS_RETIRED.equals(getStatus());
+    }
+
     /** Intended but not built -- exempt from the checks that assume a built thing. */
     public boolean isPlanned() {
         return STATUS_PLANNED.equals(getStatus());
diff --git a/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementCheck.java b/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementCheck.java
new file mode 100644
index 000000000..ba5d532de
--- /dev/null
+++ b/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementCheck.java
@@ -0,0 +1,519 @@
+package com.metaobjects.requirement;
+
+import com.metaobjects.MetaData;
+import com.metaobjects.MetaRoot;
+import com.metaobjects.io.util.IOUtil;
+import com.metaobjects.library.LibrarySources;
+import com.metaobjects.loader.ValidationPhase;
+import com.metaobjects.object.MetaObject;
+import com.metaobjects.validation.SymbolTable;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * The requirement gate ({@code verify}): reads the {@code requirement.*} nodes of a loaded
+ * model and reports what the loader cannot (ADR-0057).
+ *
+ * <p>Java port of the TypeScript reference, {@code requirement-check.ts}. The codes, their
+ * conditions, their ORDER and their message text are copied from it, and the shared
+ * {@code fixtures/requirement-check-conformance/} corpus holds this port to it. The loader
+ * owns the {@code @status} enum, the required attributes and the child rules; this class
+ * owns {@code @implementedBy} resolution, whose severity depends on {@code @status}, and
+ * the rules that need the whole ledger.</p>
+ *
+ * <p>What a clean run proves is referential integrity. It never proves that a status is
+ * true or that a claimed node implements the requirement claiming it.</p>
+ */
+public final class RequirementCheck {
+
+    private RequirementCheck() {}
+
+    public enum Severity { ERROR, WARN }
+
+    /**
+     * One finding. {@code path} is the subject's address, the dotted chain of requirement
+     * names with no package, or {@code null} when the subject is an entity (coverage).
+     */
+    public record Diagnostic(Severity severity, String code, String path, String message) {}
+
+    /** A requirement paired with its ADDRESS: the dotted chain of requirement names from the root. */
+    public record Addressed(MetaRequirement node, String path) {}
+
+    /**
+     * @param measureCoverage force coverage on or off; {@code null} derives it from who authored
+     *                        the requirements (see {@code projectAuthoredRequirements})
+     * @param requireImplementers the strict switch: raise {@link #WARN_REQUIREMENT_NOTHING_IMPLEMENTS}
+     *                            to an error
+     */
+    public record Options(Boolean measureCoverage, boolean requireImplementers) {}
+
+    /**
+     * What one run computes once and both the gate and the summary read, so the printed
+     * summary cannot disagree with the diagnostics beneath it.
+     */
+    public record Scan(List<Addressed> addressed, Set<String> claimedObjects, boolean measureCoverage,
+                       boolean requireImplementers, SymbolTable symbols) {}
+
+    /**
+     * Counts behind the summary line printed on every run, clean or not.
+     * {@code entitiesTotal} and {@code entitiesClaimed} are {@code null} when coverage was
+     * not measured: absence is the honest reading of "this project authored no requirement".
+     */
+    public record Summary(int total, int functional, int architectural, Map<String, Integer> byStatus,
+                          int undecided, int deferredUntracked, Integer entitiesClaimed, Integer entitiesTotal) {}
+
+    public static final String ERR_REQUIREMENT_LINK_ABOVE_FLOOR = "ERR_REQUIREMENT_LINK_ABOVE_FLOOR";
+    public static final String ERR_REQUIREMENT_DANGLING_REF = "ERR_REQUIREMENT_DANGLING_REF";
+    public static final String ERR_REQUIREMENT_BAD_LEVEL = "ERR_REQUIREMENT_BAD_LEVEL";
+    public static final String ERR_REQUIREMENT_LEVEL_NESTING = "ERR_REQUIREMENT_LEVEL_NESTING";
+    public static final String ERR_REQUIREMENT_L4_NOT_OBJECT = "ERR_REQUIREMENT_L4_NOT_OBJECT";
+    public static final String ERR_REQUIREMENT_L5_NOT_MEMBER = "ERR_REQUIREMENT_L5_NOT_MEMBER";
+    public static final String ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS = "ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS";
+    public static final String WARN_REQUIREMENT_OBJECT_UNCLAIMED = "WARN_REQUIREMENT_OBJECT_UNCLAIMED";
+    public static final String WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE = "WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE";
+    public static final String WARN_REQUIREMENT_DEFERRED_UNTRACKED = "WARN_REQUIREMENT_DEFERRED_UNTRACKED";
+    public static final String WARN_REQUIREMENT_NOTHING_IMPLEMENTS = "WARN_REQUIREMENT_NOTHING_IMPLEMENTS";
+
+    /**
+     * Severity of the object-coverage gate. It stays a warning: on a real estate with a single
+     * requirement it reports every entity, and at error a project adopting requirements
+     * incrementally would fail its first verify after authoring one entry.
+     */
+    public static final Severity OBJECT_COVERAGE_SEVERITY = Severity.WARN;
+
+    // ------------------------------------------------------------------
+    // the walk
+    // ------------------------------------------------------------------
+
+    /**
+     * Every {@code requirement.*} node in the tree, at any nesting depth, each with its dotted
+     * path. Hierarchy IS nesting, so this is a walk. It descends through EVERY node, not only
+     * through requirements: a requirement somewhere the child rules did not anticipate is still
+     * gated, which is the fail-closed direction for a gate. Only a requirement contributes a
+     * path segment.
+     */
+    public static List<Addressed> collectAddressed(MetaRoot root) {
+        List<Addressed> out = new ArrayList<>();
+        walk(root, "", out);
+        return out;
+    }
+
+    private static void walk(MetaData node, String prefix, List<Addressed> out) {
+        for (MetaData c : RequirementClaims.structuralChildren(node)) {
+            boolean isReq = MetaRequirement.TYPE_REQUIREMENT.equals(c.getType());
+            // The bare name: a root-level node's getName() is package-qualified in this port.
+            String path = isReq ? (prefix.isEmpty() ? c.getShortName() : prefix + "." + c.getShortName()) : prefix;
+            if (isReq) out.add(new Addressed((MetaRequirement) c, path));
+            walk(c, path, out);
+        }
+    }
+
+    /**
+     * The package a requirement resolves references in: its own, else the package of the nearest
+     * enclosing node that carries one (nested nodes carry bare names, so the declaring root-level
+     * node holds the file's package), else {@code ""}.
+     */
+    public static String effectivePackage(MetaData node) {
+        for (MetaData n = node; n != null && !(n instanceof MetaRoot); n = n.getParent()) {
+            String pkg = n.getPackage();
+            if (pkg != null && !pkg.isEmpty()) return pkg;
+        }
+        return "";
+    }
+
+    // ------------------------------------------------------------------
+    // the scan
+    // ------------------------------------------------------------------
+
+    public static Scan scan(MetaRoot root, Options options) {
+        List<Addressed> addressed = collectAddressed(root);
+        SymbolTable symbols = SymbolTable.build(root);
+        boolean measure = options.measureCoverage() != null
+            ? options.measureCoverage()
+            : projectAuthoredRequirements(addressed);
+        return new Scan(addressed, claimedObjectKeys(root, symbols, addressed), measure,
+            options.requireImplementers(), symbols);
+    }
+
+    /**
+     * Did the ADOPTER author any of these requirements? A library ships its own ledger, and
+     * without this, opting into a library would switch the unclaimed-entity gate on across a
+     * project that has never written a requirement. Provenance is the library's declared
+     * PACKAGE. An overlay on a library requirement stays in the library's package and does not
+     * activate coverage.
+     */
+    private static boolean projectAuthoredRequirements(List<Addressed> addressed) {
+        Set<String> libraryPackages = LibrarySources.libraryPackages();
+        for (Addressed a : addressed) {
+            if (!libraryPackages.contains(effectivePackage(a.node()))) return true;
+        }
+        return false;
+    }
+
+    /**
+     * Resolution keys of every object claimed by a requirement. Shared by the gate and the
+     * summary. A PLANNED requirement never contributes. An ARCHITECTURAL claim also covers every
+     * root-level object whose resolved super chain reaches the owner; a functional claim does not.
+     */
+    private static Set<String> claimedObjectKeys(MetaRoot root, SymbolTable symbols, List<Addressed> addressed) {
+        Set<String> claimed = new HashSet<>();
+        for (Addressed a : addressed) {
+            MetaRequirement req = a.node();
+            if (req.isPlanned()) continue;
+            String referrerPkg = effectivePackage(req);
+            for (String ref : req.getImplementedBy()) {
+                RequirementClaims.MemberRef split = RequirementClaims.splitMemberRef(ref);
+                MetaData node = RequirementClaims.resolveClaimTarget(root, symbols, split.owner(), referrerPkg);
+                if (node == null) continue;
+                if (!split.path().isEmpty() && RequirementClaims.resolveMember(node, split.path()) == null) continue;
+                claimed.add(node.getName());
+                if (req.isArchitectural()) claimed.addAll(subtypesOf(root, node));
+            }
+        }
+        return claimed;
+    }
+
+    /** Resolution keys of every root-level object whose RESOLVED super chain reaches {@code ancestor}. */
+    private static List<String> subtypesOf(MetaRoot root, MetaData ancestor) {
+        List<String> out = new ArrayList<>();
+        for (MetaData cand : RequirementClaims.structuralChildren(root)) {
+            if (!MetaObject.TYPE_OBJECT.equals(cand.getType()) || cand == ancestor) continue;
+            Set<MetaData> seen = Collections.newSetFromMap(new java.util.IdentityHashMap<>());
+            MetaData cur = cand.getSuperData();
+            while (cur != null && seen.add(cur)) {
+                if (cur == ancestor) {
+                    out.add(cand.getName());
+                    break;
+                }
+                cur = cur.getSuperData();
+            }
+        }
+        return out;
+    }
+
+    /**
+     * The entities object coverage measures: root-level, non-abstract {@code object.entity}.
+     * {@code object.value} and {@code object.projection} are exempt.
+     */
+    private static List<MetaData> coverableEntities(MetaRoot root) {
+        List<MetaData> out = new ArrayList<>();
+        for (MetaData n : RequirementClaims.structuralChildren(root)) {
+            // ADR-0039 sanctioned own-only read: abstractness describes THIS declaration and is
+            // never inherited, so IOUtil.isAbstract reads @isAbstract own-only.
+            if (MetaObject.TYPE_OBJECT.equals(n.getType()) && MetaObject.SUBTYPE_ENTITY.equals(n.getSubType()) && !IOUtil.isAbstract(n)) {
+                out.add(n);
+            }
+        }
+        return out;
+    }
+
+    // ------------------------------------------------------------------
+    // the gate
+    // ------------------------------------------------------------------
+
+    /**
+     * Check the requirement tree against the loaded model. No requirements: no diagnostics.
+     * Rows are evaluated per requirement in the order of the reference's code table; object
+     * coverage runs once, after every requirement.
+     */
+    public static List<Diagnostic> check(MetaRoot root, Scan scan) {
+        List<Diagnostic> out = new ArrayList<>();
+        if (scan.addressed().isEmpty()) return out; // opt-in by declaration
+
+        Map<String, MetaRequirement> ledger = ledgerIndex(scan.addressed());
+
+        for (Addressed a : scan.addressed()) {
+            MetaRequirement req = a.node();
+            String reqPath = a.path();
+            boolean architectural = req.isArchitectural();
+            Integer level = req.getLevel();
+            List<String> refs = req.getImplementedBy();
+
+            // -- the level rules ------------------------------------------------
+            // A functional requirement MUST be levelled. An architectural one MAY be, and
+            // levelling is the opt-in: unlevelled it is a flat policy these rules do not touch.
+            boolean levelled = level != null;
+            if (!architectural || levelled) {
+                if (!levelled || level < MetaRequirement.MIN_LEVEL || level > MetaRequirement.MAX_LEVEL) {
+                    out.add(error(ERR_REQUIREMENT_BAD_LEVEL, reqPath,
+                        "level must be an integer " + MetaRequirement.MIN_LEVEL + "-" + MetaRequirement.MAX_LEVEL
+                            + " (got " + show(level) + "). "
+                            + "L1 solution, L2 segment (app/library), L3 service, L4 object, L5 member."
+                            + (architectural
+                                ? " On an architectural requirement the level is optional — omit it for a flat policy."
+                                : "")));
+                }
+                // Nesting IS the hierarchy, so a child must sit strictly below its parent.
+                MetaData parent = req.getParent();
+                if (parent instanceof MetaRequirement parentReq) {
+                    Integer pl = parentReq.getLevel();
+                    if (pl != null && level != null && level <= pl) {
+                        out.add(error(ERR_REQUIREMENT_LEVEL_NESTING, reqPath,
+                            "nested under \"" + parent.getShortName() + "\" (level " + pl + ") but declares level "
+                                + level + ". Nesting is the hierarchy — a child sits strictly below its parent."));
+                    }
+                }
+            }
+
+            // -- the link boundary ----------------------------------------------
+            if (!refs.isEmpty() && !req.mayReferenceModel()) {
+                out.add(error(ERR_REQUIREMENT_LINK_ABOVE_FLOOR, reqPath,
+                    "'implementedBy' is legal at L" + MetaRequirement.LINK_FLOOR_LEVEL + " (object) and L"
+                        + MetaRequirement.MAX_LEVEL + " (member) only. L1-L3 are organisational and never reference "
+                        + "the model — move the links to a nested L" + MetaRequirement.LINK_FLOOR_LEVEL + " child."));
+                continue;
+            }
+
+            String referrerPkg = effectivePackage(req);
+            for (String ref : refs) {
+                RequirementClaims.MemberRef split = RequirementClaims.splitMemberRef(ref);
+                MetaData node = RequirementClaims.resolveClaimTarget(root, scan.symbols(), split.owner(), referrerPkg);
+                boolean isObjectRef = split.path().isEmpty();
+
+                // GRAIN stays functional-only: on a levelled architectural requirement the upper
+                // tiers are a quality taxonomy, so a claim set may legitimately mix grains.
+                if (!architectural && level != null && level == MetaRequirement.LINK_FLOOR_LEVEL && !isObjectRef) {
+                    out.add(error(ERR_REQUIREMENT_L4_NOT_OBJECT, reqPath,
+                        "L" + MetaRequirement.LINK_FLOOR_LEVEL + " references an object; '" + ref + "' names a member. "
+                            + "Move it to a nested L" + MetaRequirement.LEVEL_MEMBER + " child, or reference the object itself."));
+                    continue;
+                }
+                if (!architectural && level != null && level == MetaRequirement.LEVEL_MEMBER && isObjectRef) {
+                    out.add(error(ERR_REQUIREMENT_L5_NOT_MEMBER, reqPath,
+                        "L" + MetaRequirement.LEVEL_MEMBER + " references a member (field, view or identity); '" + ref
+                            + "' names an object. Move it to its L" + MetaRequirement.LINK_FLOOR_LEVEL + " parent."));
+                    continue;
+                }
+
+                boolean resolved = node != null && (isObjectRef || RequirementClaims.resolveMember(node, split.path()) != null);
+                // Severity is CONDITIONAL ON STATUS: on `planned` the nodes do not exist YET.
+                if (!resolved && req.requiresLiveNodes()) {
+                    // The hint answers an OBJECT that failed to resolve; when the object resolved
+                    // and only the member is gone, name the member instead.
+                    String hint = node == null
+                        ? ValidationPhase.didYouMeanHint(root, split.owner())
+                        : missingMemberHint(node, split.path());
+                    out.add(error(ERR_REQUIREMENT_DANGLING_REF, reqPath,
+                        "'" + ref + "' does not resolve in the loaded model (status '" + show(req.getStatus())
+                            + "' — the model moved and the requirement is stale)." + hint));
+                }
+            }
+
+            // -- @supersededBy resolution (FR-039) --------------------------------
+            // Resolved against the LEDGER, not the model: a capability is replaced by another one.
+            String superseded = req.getSupersededBy();
+            if (superseded != null && resolveRequirementRef(ledger, superseded, referrerPkg) == null) {
+                out.add(error(ERR_REQUIREMENT_DANGLING_REF, reqPath,
+                    "@supersededBy '" + superseded + "' does not name a requirement in the loaded "
+                        + "ledger. It must name the requirement that REPLACED this one — if nothing did, "
+                        + "drop the attribute and let `notes` carry why the capability went."));
+            }
+
+            // -- architectural universality: claim-set arithmetic -------------------
+            String status = req.getStatus();
+            boolean live = req.requiresLiveNodes();
+            if (architectural && live && refs.isEmpty() && req.mayReferenceModel()) {
+                out.add(error(ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS, reqPath,
+                    "architectural requirement is '" + show(status) + "' but nothing implements it. "
+                        + "Its check is universality — a claim set of zero means the policy is declared and unapplied."));
+            }
+
+            // -- disposition: the decision, not the state -------------------------
+            String disposition = req.getDisposition();
+            if (disposition != null && !req.hasOutstandingWork()) {
+                out.add(warn(WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE, reqPath,
+                    "carries @disposition '" + disposition + "' but its status is '" + show(status) + "', which has no "
+                        + "outstanding work to decide about. A disposition is meaningful on 'planned' and 'partial' only — "
+                        + "on any other status the decision IS the status."));
+            }
+
+            // -- functional existence, SUBTREE-scoped -----------------------------
+            // The strict switch raises the SEVERITY only; the code keeps its WARN_ name because it
+            // identifies the finding.
+            if (!architectural && live && !subtreeClaimsAnything(req)) {
+                out.add(new Diagnostic(scan.requireImplementers() ? Severity.ERROR : Severity.WARN,
+                    WARN_REQUIREMENT_NOTHING_IMPLEMENTS, reqPath,
+                    "is '" + show(status) + "' but neither it nor anything nested under it names an "
+                        + "implementing node. A functional requirement's check is existence — a subtree that claims "
+                        + "nothing is a capability nobody built."));
+            }
+
+            if (MetaRequirement.DISPOSITION_DEFERRED.equals(disposition) && req.getTrackedBy().isEmpty()) {
+                out.add(warn(WARN_REQUIREMENT_DEFERRED_UNTRACKED, reqPath,
+                    "is deferred but names no @trackedBy issue. Deferring without a ticket is how a known gap "
+                        + "becomes an unknown one — nothing will raise it again."));
+            }
+        }
+
+        // -- object coverage: adding an entity forces a requirement ---------------
+        // Binary per entity, object grain only, adopter-authored requirements only.
+        if (scan.measureCoverage()) {
+            for (MetaData ent : coverableEntities(root)) {
+                String key = ent.getName();
+                if (!scan.claimedObjects().contains(key)) {
+                    out.add(new Diagnostic(OBJECT_COVERAGE_SEVERITY, WARN_REQUIREMENT_OBJECT_UNCLAIMED, null,
+                        "no requirement claims '" + key + "'. Add it to an L" + MetaRequirement.LINK_FLOOR_LEVEL
+                            + " requirement's 'implementedBy'."));
+                }
+            }
+        }
+        return out;
+    }
+
+    private static Diagnostic error(String code, String path, String message) {
+        return new Diagnostic(Severity.ERROR, code, path, message);
+    }
+
+    private static Diagnostic warn(String code, String path, String message) {
+        return new Diagnostic(Severity.WARN, code, path, message);
+    }
+
+    /** The reference prints a missing value as {@code undefined}. */
+    private static String show(Object value) {
+        return value == null ? "undefined" : String.valueOf(value);
+    }
+
+    /**
+     * Names the FIRST segment of a non-empty, unresolvable {@code path} under {@code obj}, and
+     * the node it was looked for under: {@code acme::shop::Order.reference.display} with
+     * {@code reference} still present reads "'acme::shop::Order.reference' has no member
+     * 'display'", not the whole tail.
+     */
+    private static String missingMemberHint(MetaData obj, List<String> path) {
+        int found = 0;
+        while (found < path.size() - 1 && RequirementClaims.resolveMember(obj, path.subList(0, found + 1)) != null) found++;
+        List<String> parent = new ArrayList<>();
+        parent.add(obj.getName());
+        parent.addAll(path.subList(0, found));
+        return " '" + String.join(".", parent) + "' has no member '" + path.get(found) + "'.";
+    }
+
+    /**
+     * True when this requirement, or anything nested beneath it, names an implementing node.
+     * Subtree-scoped deliberately: a parent that delegates everything to its children implements
+     * nothing directly, and flagging that would fire on the correct shape of every tree.
+     * Existence is about NAMING, not resolving.
+     */
+    private static boolean subtreeClaimsAnything(MetaRequirement req) {
+        if (!req.getImplementedBy().isEmpty()) return true;
+        for (MetaRequirement child : req.getChildRequirements()) {
+            if (subtreeClaimsAnything(child)) return true;
+        }
+        return false;
+    }
+
+    /**
+     * The ledger index {@code @supersededBy} resolves against: {@code <effective package>::<path>}
+     * for every packaged requirement, and the bare {@code <path>} (first one wins).
+     */
+    private static Map<String, MetaRequirement> ledgerIndex(List<Addressed> addressed) {
+        Map<String, MetaRequirement> keyed = new HashMap<>();
+        for (Addressed a : addressed) {
+            String pkg = effectivePackage(a.node());
+            if (!pkg.isEmpty()) keyed.put(pkg + MetaData.PKG_SEPARATOR + a.path(), a.node());
+            keyed.putIfAbsent(a.path(), a.node());
+        }
+        return keyed;
+    }
+
+    /** An FQN binds exactly; a bare ref prefers the referrer's own package. */
+    private static MetaRequirement resolveRequirementRef(Map<String, MetaRequirement> ledger, String ref, String referrerPkg) {
+        MetaRequirement exact = ledger.get(ref);
+        if (exact != null) return exact;
+        if (!referrerPkg.isEmpty()) return ledger.get(referrerPkg + MetaData.PKG_SEPARATOR + ref);
+        return null;
+    }
+
+    // ------------------------------------------------------------------
+    // the summary
+    // ------------------------------------------------------------------
+
+    /**
+     * Count what the ledger contains, for the line printed on EVERY run, including a clean one.
+     *
+     * @return the counts, or {@code null} when the model declares no requirement
+     */
+    public static Summary summarise(MetaRoot root, Scan scan) {
+        if (scan.addressed().isEmpty()) return null; // opt-in by declaration
+
+        // `undecided` counts only the requirements a @disposition could actually SETTLE. Every
+        // ANCESTOR of a node with outstanding work is a roll-up and is excluded, whether or not
+        // the descendant has a disposition. Ancestry is by dotted path SEGMENT, not by string
+        // prefix: `DeliveryNote` is not under `Delivery`.
+        Set<String> rollUpAncestors = new HashSet<>();
+        for (Addressed a : scan.addressed()) {
+            if (!a.node().hasOutstandingWork()) continue;
+            String[] segments = a.path().split("\\.", -1);
+            for (int i = 1; i < segments.length; i++) {
+                rollUpAncestors.add(String.join(".", java.util.Arrays.asList(segments).subList(0, i)));
+            }
+        }
+
+        int functional = 0, architectural = 0, undecided = 0, deferredUntracked = 0;
+        Map<String, Integer> byStatus = new LinkedHashMap<>();
+        for (Addressed a : scan.addressed()) {
+            MetaRequirement req = a.node();
+            if (req.isArchitectural()) architectural++;
+            else functional++;
+            if (req.getStatus() != null) byStatus.merge(req.getStatus(), 1, Integer::sum);
+            if (req.hasOutstandingWork() && req.getDisposition() == null && !rollUpAncestors.contains(a.path())) undecided++;
+            if (MetaRequirement.DISPOSITION_DEFERRED.equals(req.getDisposition()) && req.getTrackedBy().isEmpty()) deferredUntracked++;
+        }
+
+        Integer entitiesClaimed = null;
+        Integer entitiesTotal = null;
+        if (scan.measureCoverage()) {
+            int total = 0, claimedCount = 0;
+            for (MetaData ent : coverableEntities(root)) {
+                total++;
+                if (scan.claimedObjects().contains(ent.getName())) claimedCount++;
+            }
+            entitiesClaimed = claimedCount;
+            entitiesTotal = total;
+        }
+        return new Summary(scan.addressed().size(), functional, architectural, byStatus, undecided,
+            deferredUntracked, entitiesClaimed, entitiesTotal);
+    }
+
+    // ------------------------------------------------------------------
+    // what verify prints (everything after the port's own command prefix)
+    // ------------------------------------------------------------------
+
+    /**
+     * {@code requirements: <total> entries (...) — <n> <status>, ...; } then either the
+     * not-measured sentence or {@code <claimed>/<total> entities claimed, counted over <files>
+     * metadata file(s).} Statuses appear in declaration order, zero counts omitted.
+     */
+    public static String summaryText(Summary s, int metadataFiles) {
+        List<String> parts = new ArrayList<>();
+        for (String status : MetaRequirement.STATUSES) {
+            int n = s.byStatus().getOrDefault(status, 0);
+            if (n > 0) parts.add(n + " " + status);
+        }
+        return "requirements: " + s.total() + " entries (" + s.functional() + " functional, "
+            + s.architectural() + " architectural) — " + String.join(", ", parts) + "; "
+            + (s.entitiesTotal() == null
+                ? "coverage: not measured (no project-authored requirements)."
+                : s.entitiesClaimed() + "/" + s.entitiesTotal() + " entities claimed, counted over "
+                    + metadataFiles + " metadata file(s).");
+    }
+
+    /** The recorded-gaps line, or {@code null} when nothing is undecided. */
+    public static String undecidedText(Summary s) {
+        if (s.undecided() <= 0) return null;
+        return "requirements: " + s.undecided() + " recorded gap(s) with no @disposition. "
+            + "These are known problems nobody has ruled on — set 'accepted' or 'deferred' to close the question.";
+    }
+
+    /** {@code  <code> [<path>]: <message>}, or {@code  <code>: <message>} when there is no path. */
+    public static String formatDiagnostic(Diagnostic d) {
+        return "  " + d.code() + (d.path() == null ? "" : " [" + d.path() + "]") + ": " + d.message();
+    }
+}
diff --git a/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementClaims.java b/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementClaims.java
new file mode 100644
index 000000000..c74e1ad04
--- /dev/null
+++ b/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementClaims.java
@@ -0,0 +1,139 @@
+package com.metaobjects.requirement;
+
+import com.metaobjects.MetaData;
+import com.metaobjects.MetaRoot;
+import com.metaobjects.attr.MetaAttribute;
+import com.metaobjects.object.MetaObject;
+import com.metaobjects.validation.SymbolTable;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * Resolves an {@code @implementedBy} reference to the model node it names. ONE resolver,
+ * shared by the requirement gate ({@link RequirementCheck}) and the requirement-test
+ * generator, so the ADR-0042 package-local binding contract has a single owner.
+ *
+ * <p>Java port of {@code resolve-claim.ts} (and {@code splitMemberRef} from the TypeScript
+ * gate). Objects resolve through {@link SymbolTable}, the loader's own resolver, never a
+ * parallel name scan (#228).</p>
+ */
+public final class RequirementClaims {
+
+    private RequirementClaims() {}
+
+    /** A reference split into its owning root-level node and the dotted member path under it. */
+    public record MemberRef(String owner, List<String> path) {}
+
+    /**
+     * Split a member reference into its owning ref and the dotted member path. {@code ::}
+     * qualifies the ROOT-level node only, so the owner ends at the first {@code .} after the
+     * last {@code ::}: {@code acme::sales::Order.total.display} gives owner
+     * {@code acme::sales::Order} and path {@code [total, display]}.
+     */
+    public static MemberRef splitMemberRef(String ref) {
+        int pkgEnd = ref.lastIndexOf(MetaData.PKG_SEPARATOR);
+        int from = pkgEnd == -1 ? 0 : pkgEnd + MetaData.PKG_SEPARATOR.length();
+        int dot = ref.indexOf('.', from);
+        if (dot == -1) return new MemberRef(ref, List.of());
+        return new MemberRef(ref.substring(0, dot), Arrays.asList(ref.substring(dot + 1).split("\\.", -1)));
+    }
+
+    /**
+     * Resolve the owner segment of an {@code @implementedBy} reference to the node it names.
+     * OBJECTS FIRST, through the loader's symbol table; then ROOT-LEVEL NON-OBJECT nodes (a
+     * {@code template.prompt} and its siblings). Requirements are excluded: hierarchy is
+     * nesting, and a requirement claiming a requirement would be a second parent mechanism.
+     *
+     * @param referrerPkg the effective package of the requirement making the claim
+     * @return the node, or {@code null} when nothing matches or the match is ambiguous
+     */
+    public static MetaData resolveClaimTarget(MetaRoot root, String owner, String referrerPkg) {
+        return resolveClaimTarget(root, SymbolTable.build(root), owner, referrerPkg);
+    }
+
+    /** {@link #resolveClaimTarget(MetaRoot, String, String)} over a symbol table the caller built once. */
+    public static MetaData resolveClaimTarget(MetaRoot root, SymbolTable symbols, String owner, String referrerPkg) {
+        MetaData object = symbols.resolveObject(owner, referrerPkg);
+        if (object != null) return object;
+
+        List<MetaData> candidates = new ArrayList<>();
+        for (MetaData c : structuralChildren(root)) {
+            if (!MetaObject.TYPE_OBJECT.equals(c.getType()) && !MetaRequirement.TYPE_REQUIREMENT.equals(c.getType())) candidates.add(c);
+        }
+
+        // A fully-qualified reference binds exactly, like every other FQN in the model.
+        if (owner.contains(MetaData.PKG_SEPARATOR)) {
+            for (MetaData c : candidates) if (owner.equals(c.getName())) return c;
+            return null;
+        }
+        // A bare reference prefers the referrer's own package, then a root-level (unpackaged)
+        // node of that bare name. An ambiguous bare name binds NOTHING.
+        if (referrerPkg != null && !referrerPkg.isEmpty()) {
+            String localKey = referrerPkg + MetaData.PKG_SEPARATOR + owner;
+            MetaData local = null;
+            int matches = 0;
+            for (MetaData c : candidates) {
+                if (localKey.equals(c.getName())) { local = c; matches++; }
+            }
+            if (matches == 1) return local;
+        }
+        MetaData bare = null;
+        int matches = 0;
+        for (MetaData c : candidates) {
+            if (owner.equals(c.getShortName()) && owner.equals(c.getName())) { bare = c; matches++; }
+        }
+        return matches == 1 ? bare : null;
+    }
+
+    /**
+     * Walk dotted member segments by CHILD NAME from a node, to full depth. Attributes are not
+     * members: they are children in this port's tree and are not in TypeScript's.
+     *
+     * @return the node reached, or {@code null} when a segment does not resolve
+     */
+    public static MetaData resolveMember(MetaData obj, List<String> path) {
+        MetaData cur = obj;
+        for (String seg : path) {
+            if (cur == null) return null;
+            MetaData next = null;
+            for (MetaData c : structuralChildren(cur)) {
+                if (seg.equals(c.getShortName())) { next = c; break; }
+            }
+            cur = next;
+        }
+        return cur;
+    }
+
+    /**
+     * Resolve a full {@code @implementedBy} reference, owner plus any dotted member segments, to
+     * the node it names, or {@code null}. Resolution walks to the FULL depth of the reference,
+     * so {@code Council.slug.display} yields the view node rather than stopping at the field.
+     */
+    public static MetaData resolveClaim(MetaRoot root, String ref, String referrerPkg) {
+        return resolveClaim(root, SymbolTable.build(root), ref, referrerPkg);
+    }
+
+    /** {@link #resolveClaim(MetaRoot, String, String)} over a symbol table the caller built once. */
+    public static MetaData resolveClaim(MetaRoot root, SymbolTable symbols, String ref, String referrerPkg) {
+        // Segments split on every dot, as the reference does: a package qualifies the root
+        // node only and carries no dot, so the first segment is the whole owner.
+        String[] segs = ref.split("\\.", -1);
+        MetaData owner = resolveClaimTarget(root, symbols, segs[0], referrerPkg);
+        if (owner == null || segs.length == 1) return owner;
+        return resolveMember(owner, Arrays.asList(segs).subList(1, segs.length));
+    }
+
+    /**
+     * The node's EFFECTIVE children, attributes excluded: own plus inherited through
+     * {@code extends} (ADR-0039 default, the same set TypeScript's {@code children()} reads).
+     */
+    static List<MetaData> structuralChildren(MetaData node) {
+        List<MetaData> out = new ArrayList<>();
+        for (MetaData c : node.getChildren(MetaData.class, true)) {
+            if (!(c instanceof MetaAttribute)) out.add(c);
+        }
+        return out;
+    }
+}
diff --git a/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementTestFilter.java b/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementTestFilter.java
new file mode 100644
index 000000000..9a1da40d1
--- /dev/null
+++ b/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementTestFilter.java
@@ -0,0 +1,17 @@
+package com.metaobjects.requirement;
+
+/**
+ * Which requirements get a generated test: a predicate over the requirement view (ADR-0057).
+ * The same seam in every port; a project replaces the default (functional, level 4 or above)
+ * by naming an implementation in the {@code filter} arg of the {@code requirement-tests}
+ * generator.
+ *
+ * <p>It lives beside {@link RequirementTestIdentities} because the identity function applies
+ * it. The view never hands out the node: it is a projection, so an application's policy does
+ * not bind to metamodel internals.</p>
+ */
+public interface RequirementTestFilter {
+
+    /** Whether the requirement this view describes gets a test. A filter REPLACES the default. */
+    boolean include(RequirementTestIdentities.View view);
+}
diff --git a/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementTestIdentities.java b/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementTestIdentities.java
new file mode 100644
index 000000000..da96a9325
--- /dev/null
+++ b/server/java/metadata/src/main/java/com/metaobjects/requirement/RequirementTestIdentities.java
@@ -0,0 +1,279 @@
+package com.metaobjects.requirement;
+
+import com.metaobjects.MetaData;
+import com.metaobjects.MetaRoot;
+import com.metaobjects.validation.SymbolTable;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.HexFormat;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Which tests a requirement ledger yields, what each is called, whether it is skipped, and a
+ * fingerprint of the claim it tests (ADR-0057). Everything here is what every language port
+ * agrees on and the shared {@code fixtures/requirement-test-identity-conformance/} corpus
+ * pins; how a test is WRITTEN is the generator's business and differs per port.
+ *
+ * <p>Java port of {@code requirementTestIdentities} and its helpers in the TypeScript
+ * reference, {@code requirement-walk.ts}. They live here, in the core library beside the
+ * walk, rather than in the generator, because an application that owns its generator
+ * ({@code mvn metaobjects:eject}) still imports them from the package: an owned copy changes
+ * how a test is written and keeps agreeing with every other tool about which tests exist.</p>
+ */
+public final class RequirementTestIdentities {
+
+    private RequirementTestIdentities() {}
+
+    /** The unit a test stands for when the requirement resolves no target. */
+    public static final String NO_UNIT = "*";
+
+    /**
+     * The fan-out unit: what one generated test stands for.
+     * {@link #CONCERN} (default): one test per distinct {@code <type>.<subType>} a requirement
+     * claims. {@link #MEMBER}: one test per distinct {@code implementedBy} reference that
+     * resolves, spelt exactly as authored.
+     */
+    public enum Grain {
+        CONCERN("concern"), MEMBER("member");
+
+        private final String text;
+
+        Grain(String text) {
+            this.text = text;
+        }
+
+        /** The spelling a generator arg or config uses. */
+        public String text() {
+            return text;
+        }
+
+        /**
+         * Refuse anything that is not a grain. An arg arrives as a plain string, so a typo
+         * would otherwise pick a grain by accident.
+         *
+         * @throws IllegalArgumentException for any other value
+         */
+        public static Grain parse(String value) {
+            for (Grain g : values()) {
+                if (g.text.equals(value)) return g;
+            }
+            throw new IllegalArgumentException("unknown requirement-test grain "
+                + (value == null ? "null" : "\"" + value + "\"") + ": expected \"concern\" or \"member\".");
+        }
+    }
+
+    /** One generated test. The same record in every language port. */
+    public record Identity(String pkg, String path, String unit, String id, String witnessKey,
+                           String status, String skip, String digest) {}
+
+    /**
+     * What a filter receives; never the node. {@code level} and {@code status} may be
+     * {@code null}: an unlevelled architectural requirement has no level, and that is not a
+     * number.
+     */
+    public record View(String subType, Integer level, String status, String path, String pkg,
+                       List<String> implementedByTypes) {}
+
+    /** A resolved {@code implementedBy} reference: as authored, the node it names, its concern. */
+    public record Target(String ref, MetaData node, String concern) {}
+
+    /** One requirement, projected for a filter, with the targets its references resolved to. */
+    public record Walked(MetaRequirement node, View view, List<Target> targets) {}
+
+    /** {@code <type>.<subType>}: the key a renderer or filter reasons about. */
+    public static String concernOf(MetaData node) {
+        return node.getType() + "." + node.getSubType();
+    }
+
+    /**
+     * RECOMMENDATION, not a rule: functional requirements at or below the link floor.
+     * Architectural requirements are excluded by default because {@code verify}'s
+     * universality check already proves them structurally. It is overridable.
+     */
+    public static boolean defaultFilter(View view) {
+        return MetaRequirement.SUBTYPE_FUNCTIONAL.equals(view.subType())
+            && (view.level() == null ? 0 : view.level()) >= MetaRequirement.LINK_FLOOR_LEVEL;
+    }
+
+    // ------------------------------------------------------------------
+    // the walk
+    // ------------------------------------------------------------------
+
+    /**
+     * Every requirement in walk order with its view and resolved targets. An
+     * {@code implementedBy} reference that does not resolve is skipped rather than reported:
+     * its severity depends on {@code @status} and belongs to {@code verify}, and codegen must
+     * not fail a build over a diagnostic another command owns.
+     */
+    public static List<Walked> walk(MetaRoot root) {
+        SymbolTable symbols = SymbolTable.build(root);
+        List<Walked> out = new ArrayList<>();
+        for (RequirementCheck.Addressed a : RequirementCheck.collectAddressed(root)) {
+            MetaRequirement node = a.node();
+            // One effective package, shared with the gate: the node's own, else the nearest
+            // enclosing node's, else "".
+            String pkg = RequirementCheck.effectivePackage(node);
+            List<Target> targets = new ArrayList<>();
+            for (String ref : node.getImplementedBy()) {
+                MetaData target = RequirementClaims.resolveClaim(root, symbols, ref, pkg);
+                if (target != null) targets.add(new Target(ref, target, concernOf(target)));
+            }
+            LinkedHashSet<String> concerns = new LinkedHashSet<>();
+            for (Target t : targets) concerns.add(t.concern());
+            out.add(new Walked(node,
+                new View(node.getSubType(), node.getLevel(), node.getStatus(), a.path(), pkg, List.copyOf(concerns)),
+                targets));
+        }
+        return out;
+    }
+
+    /**
+     * A requirement's targets grouped by fan-out unit under the grain, one entry per test, in
+     * first-seen order. Under {@link Grain#MEMBER} a reference authored twice is one test and
+     * the bare and qualified spellings of one node are two: the unit is the reference as
+     * written. In both grains a requirement resolving NO target still yields exactly one
+     * entry, keyed {@link #NO_UNIT}: the link floor forbids {@code implementedBy} below L4,
+     * so every L1 to L3 requirement resolves nothing, and an application that chooses to
+     * cover one would otherwise get silence.
+     */
+    public static Map<String, List<Target>> units(Walked walked, Grain grain) {
+        Map<String, List<Target>> units = new LinkedHashMap<>();
+        for (Target t : walked.targets()) {
+            String key = grain == Grain.MEMBER ? t.ref() : t.concern();
+            if (grain == Grain.MEMBER) {
+                units.putIfAbsent(key, new ArrayList<>(List.of(t)));
+            } else {
+                units.computeIfAbsent(key, k -> new ArrayList<>()).add(t);
+            }
+        }
+        if (units.isEmpty()) units.put(NO_UNIT, new ArrayList<>());
+        return units;
+    }
+
+    /** The qualified address: {@code <package>::<path>}, or the bare path when the package is empty. */
+    public static String addressOf(String pkg, String path) {
+        return pkg.isEmpty() ? path : pkg + MetaData.PKG_SEPARATOR + path;
+    }
+
+    /** The identity of the one test {@code unit} stands for (a key of {@link #units}). */
+    public static Identity identity(Walked walked, String unit) {
+        View view = walked.view();
+        String address = addressOf(view.pkg(), view.path());
+        // Derived from the loader's status list rather than naming the two skipped statuses:
+        // a status that does not claim the capability works right now is skipped by
+        // construction, so a status added later cannot be left failing by omission.
+        boolean skips = view.status() != null
+            && !MetaRequirement.STATUSES_REQUIRING_LIVE_NODES.contains(view.status());
+        return new Identity(view.pkg(), view.path(), unit, address + " [" + unit + "]",
+            witnessKeyOf(address, unit), view.status(), skips ? view.status() : null, digest(walked.node()));
+    }
+
+    /**
+     * Every test the generator would emit, sorted by id (UTF-16 code units, not a locale
+     * collation).
+     *
+     * @param grain  {@code null} means {@link Grain#CONCERN}
+     * @param filter {@code null} means {@link #defaultFilter}; a filter REPLACES the default
+     */
+    public static List<Identity> identities(MetaRoot root, Grain grain, RequirementTestFilter filter) {
+        Grain g = grain == null ? Grain.CONCERN : grain;
+        RequirementTestFilter f = filter == null ? RequirementTestIdentities::defaultFilter : filter;
+        List<Identity> out = new ArrayList<>();
+        for (Walked walked : walk(root)) {
+            if (!f.include(walked.view())) continue;
+            for (String unit : units(walked, g).keySet()) out.add(identity(walked, unit));
+        }
+        out.sort((a, b) -> a.id().compareTo(b.id()));
+        return out;
+    }
+
+    // ------------------------------------------------------------------
+    // witness key
+    // ------------------------------------------------------------------
+
+    /** Every maximal run of characters outside ASCII {@code [A-Za-z0-9]} becomes one {@code _}. */
+    private static String mangle(String s) {
+        return s.replaceAll("[^A-Za-z0-9]+", "_");
+    }
+
+    /**
+     * An identifier-safe key for one test: {@code req_<address>}, then {@code __<unit>} unless
+     * the requirement resolves no target. Mangling is lossy ({@code Orders.Recorded} and
+     * {@code Orders_Recorded} give one key), which is what {@link #witnessKeyCollisions}
+     * reports. The class is ASCII and excludes {@code _}; {@code Character.isLetterOrDigit}
+     * keeps accented letters and is wrong.
+     */
+    public static String witnessKeyOf(String qualifiedAddress, String unit) {
+        String base = "req_" + mangle(qualifiedAddress);
+        return NO_UNIT.equals(unit) ? base : base + "__" + mangle(unit);
+    }
+
+    /** Pairs of ids that share a witness key, each pair and the list sorted. */
+    public static List<String[]> witnessKeyCollisions(List<Identity> tests) {
+        Map<String, List<String>> byKey = new LinkedHashMap<>();
+        for (Identity t : tests) byKey.computeIfAbsent(t.witnessKey(), k -> new ArrayList<>()).add(t.id());
+        List<String[]> pairs = new ArrayList<>();
+        for (List<String> ids : byKey.values()) {
+            List<String> sorted = new ArrayList<>(ids);
+            sorted.sort(String::compareTo);
+            for (int i = 0; i < sorted.size(); i++) {
+                for (int j = i + 1; j < sorted.size(); j++) pairs.add(new String[]{sorted.get(i), sorted.get(j)});
+            }
+        }
+        pairs.sort((a, b) -> {
+            int c = a[0].compareTo(b[0]);
+            return c != 0 ? c : a[1].compareTo(b[1]);
+        });
+        return pairs;
+    }
+
+    // ------------------------------------------------------------------
+    // digest
+    // ------------------------------------------------------------------
+
+    private static final String DIGEST_VERSION = "requirement-digest/v1";
+
+    /** {@code <name> <byte length>\n<value>\n}: length-prefixed, so no value can be confused with the field after it. */
+    private static String digestField(String name, String value) {
+        return name + " " + value.getBytes(StandardCharsets.UTF_8).length + "\n" + value + "\n";
+    }
+
+    /** {@code \r\n} and a lone {@code \r} become {@code \n}; an absent value is empty. */
+    private static String prose(String value) {
+        return value == null ? "" : value.replaceAll("\r\n?", "\n");
+    }
+
+    /**
+     * {@code requirement-digest/v1}: lowercase hex SHA-256 of the requirement's subtype, level,
+     * status, statement, counterexample and {@code implementedBy} list. It answers "did the
+     * claim change", not "did the entry move": the name, the package, the title, the notes,
+     * the disposition, the tracking references and nested requirements are left out. Every
+     * value is the EFFECTIVE one (resolving accessors, ADR-0039), so a requirement inheriting
+     * its statement through {@code extends} hashes what it effectively says.
+     */
+    public static String digest(MetaRequirement node) {
+        Integer level = node.getLevel();
+        List<String> refs = node.getImplementedBy();
+        StringBuilder text = new StringBuilder();
+        text.append(DIGEST_VERSION).append('\n')
+            .append(digestField("subType", node.getSubType()))
+            .append(digestField("level", level == null ? "" : String.valueOf(level)))
+            .append(digestField("status", node.getStatus() == null ? "" : node.getStatus()))
+            .append(digestField("statement", prose(node.getStatement())))
+            .append(digestField("counterexample", prose(node.getCounterexample())))
+            .append("implementedBy ").append(refs.size()).append('\n');
+        for (String ref : refs) text.append(digestField("ref", ref));
+        try {
+            byte[] hash = MessageDigest.getInstance("SHA-256").digest(text.toString().getBytes(StandardCharsets.UTF_8));
+            return HexFormat.of().formatHex(hash);
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException("SHA-256 is required of every Java platform", e);
+        }
+    }
+}
diff --git a/server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementCheckConformanceTest.java b/server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementCheckConformanceTest.java
new file mode 100644
index 000000000..23edd6945
--- /dev/null
+++ b/server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementCheckConformanceTest.java
@@ -0,0 +1,201 @@
+package com.metaobjects.conformance;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import com.metaobjects.MetaRoot;
+import com.metaobjects.library.LibrarySources;
+import com.metaobjects.loader.DirectorySource;
+import com.metaobjects.loader.LoaderOptions;
+import com.metaobjects.loader.MetaDataLoader;
+import com.metaobjects.loader.MetaDataSource;
+import com.metaobjects.requirement.RequirementCheck;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import java.util.TreeMap;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.stream.Stream;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * Cross-port requirement-check conformance corpus — {@code fixtures/requirement-check-conformance/}.
+ * See that directory's README.md for the fixture format and the three runner steps: load
+ * {@code input/} STRICT, in file-name order, beside the libraries {@code options.json}
+ * names; run the gate with no scope predicate and no forced coverage answer; compare the
+ * diagnostics (an unordered multiset) and the summary with {@code expected.json}.
+ *
+ * <p>Mirrors the TypeScript reference ({@code requirement-check-conformance.test.ts}). A
+ * mismatch here is a bug in THIS port's gate, never in the fixture.</p>
+ */
+@RunWith(Parameterized.class)
+public class RequirementCheckConformanceTest {
+
+    private static final Path CORPUS = CorpusRoot.locate().resolveSibling("requirement-check-conformance");
+
+    /** The whole of {@code options.json}: a key outside this list is refused, not ignored. */
+    private static final List<String> OPTION_KEYS = List.of("libraries", "requireImplementers");
+
+    /** A case whose {@code input/} must be, file for file, another case's. */
+    private static final Map<String, String> SAME_INPUT_AS = Map.of(
+        "require-implementers", "nothing-implements-subtree");
+
+    private static final Pattern DOCUMENTED_CASE = Pattern.compile("^\\| `([^`]+)` \\|", Pattern.MULTILINE);
+
+    @Parameterized.Parameters(name = "{0}")
+    public static Collection<Object[]> fixtures() throws IOException {
+        List<Object[]> params = new ArrayList<>();
+        for (String name : caseNames()) params.add(new Object[]{name});
+        return params;
+    }
+
+    private static List<String> caseNames() throws IOException {
+        try (Stream<Path> dirs = Files.list(CORPUS)) {
+            return dirs.filter(Files::isDirectory).map(d -> d.getFileName().toString()).sorted().toList();
+        }
+    }
+
+    private final String name;
+
+    public RequirementCheckConformanceTest(String name) {
+        this.name = name;
+    }
+
+    @Test
+    public void everyCaseOnDiskIsDocumentedInTheReadmeAndNothingElseIs() throws IOException {
+        String readme = Files.readString(CORPUS.resolve("README.md"), StandardCharsets.UTF_8);
+        String section = readme.substring(readme.indexOf("\n## Cases\n"));
+        int next = section.indexOf("\n## ", 1);
+        if (next > 0) section = section.substring(0, next);
+        List<String> documented = new ArrayList<>();
+        Matcher m = DOCUMENTED_CASE.matcher(section);
+        while (m.find()) documented.add(m.group(1));
+        documented.sort(Comparator.naturalOrder());
+        assertEquals(caseNames(), documented);
+    }
+
+    @Test
+    public void fixture() throws IOException {
+        Path dir = CORPUS.resolve(name);
+        Path expectedFile = dir.resolve("expected.json");
+        assertTrue(name + ": no expected.json", Files.isRegularFile(expectedFile));
+        JsonObject expected = JsonParser.parseString(Files.readString(expectedFile, StandardCharsets.UTF_8)).getAsJsonObject();
+
+        List<String> libraries = new ArrayList<>();
+        boolean requireImplementers = false;
+        Path optionsFile = dir.resolve("options.json");
+        if (Files.isRegularFile(optionsFile)) {
+            JsonObject options = JsonParser.parseString(Files.readString(optionsFile, StandardCharsets.UTF_8)).getAsJsonObject();
+            for (String key : options.keySet()) {
+                assertTrue(optionsFile + ": unknown option " + key, OPTION_KEYS.contains(key));
+            }
+            if (options.has("libraries")) {
+                for (JsonElement l : options.getAsJsonArray("libraries")) libraries.add(l.getAsString());
+            }
+            if (options.has("requireImplementers")) {
+                assertTrue(optionsFile + ": 'requireImplementers' must be a boolean",
+                    options.get("requireImplementers").getAsJsonPrimitive().isBoolean());
+                requireImplementers = options.get("requireImplementers").getAsBoolean();
+            }
+        }
+
+        String twin = SAME_INPUT_AS.get(name);
+        if (twin != null) assertEquals(name, inputFiles(twin), inputFiles(name));
+
+        // Step 1: STRICT, libraries first and then input/ in file-name order, one batch.
+        MetaDataLoader loader = new MetaDataLoader(LoaderOptions.create(false, false, true),
+            MetaDataLoader.SUBTYPE_MANUAL, "requirement_check_" + name.replace('-', '_'));
+        loader.init();
+        List<MetaDataSource> sources = new ArrayList<>(LibrarySources.librarySources(libraries));
+        sources.addAll(new DirectorySource(dir.resolve("input"), new DirectorySource.Options()).expandToList());
+        loader.load(sources);
+        assertTrue(name + ": expected a clean strict load, got: " + loader.getErrors(), loader.getErrors().isEmpty());
+
+        // Step 2: no scope predicate, no forced coverage answer.
+        MetaRoot root = loader.getRoot();
+        RequirementCheck.Scan scan = RequirementCheck.scan(root, new RequirementCheck.Options(null, requireImplementers));
+
+        // Step 3: compare.
+        assertEquals(name, multiset(expected.getAsJsonArray("diagnostics")), actualRows(RequirementCheck.check(root, scan)));
+        assertEquals(name, expectedSummary(expected.get("summary")), actualSummary(RequirementCheck.summarise(root, scan)));
+    }
+
+    private static Map<String, String> inputFiles(String caseName) throws IOException {
+        Map<String, String> out = new TreeMap<>();
+        try (Stream<Path> files = Files.list(CORPUS.resolve(caseName).resolve("input"))) {
+            for (Path f : files.toList()) out.put(f.getFileName().toString(), Files.readString(f, StandardCharsets.UTF_8));
+        }
+        return out;
+    }
+
+    /** A row is {@code severity | code | path | message}; an absent path compares as the empty string. */
+    private static List<String> multiset(JsonArray diagnostics) {
+        List<String> rows = new ArrayList<>();
+        for (JsonElement e : diagnostics) {
+            JsonObject d = e.getAsJsonObject();
+            rows.add(row(d.get("severity").getAsString(), d.get("code").getAsString(),
+                d.has("path") ? d.get("path").getAsString() : "", d.get("message").getAsString()));
+        }
+        rows.sort(Comparator.naturalOrder());
+        return rows;
+    }
+
+    private static List<String> actualRows(List<RequirementCheck.Diagnostic> diagnostics) {
+        List<String> rows = new ArrayList<>();
+        for (RequirementCheck.Diagnostic d : diagnostics) {
+            rows.add(row(d.severity().name().toLowerCase(java.util.Locale.ROOT), d.code(),
+                d.path() == null ? "" : d.path(), d.message()));
+        }
+        rows.sort(Comparator.naturalOrder());
+        return rows;
+    }
+
+    private static String row(String severity, String code, String path, String message) {
+        return severity + " | " + code + " | " + path + " | " + message;
+    }
+
+    /** The summary as a key-sorted {@code key=value} list; {@code null} for no requirement. */
+    private static List<String> expectedSummary(JsonElement summary) {
+        if (summary == null || summary.isJsonNull()) return null;
+        JsonObject s = summary.getAsJsonObject();
+        List<String> out = new ArrayList<>();
+        for (String key : s.keySet()) {
+            if (key.equals("byStatus")) {
+                for (Map.Entry<String, JsonElement> e : s.getAsJsonObject("byStatus").entrySet()) {
+                    out.add("byStatus." + e.getKey() + "=" + e.getValue().getAsInt());
+                }
+            } else {
+                out.add(key + "=" + s.get(key).getAsInt());
+            }
+        }
+        out.sort(Comparator.naturalOrder());
+        return out;
+    }
+
+    private static List<String> actualSummary(RequirementCheck.Summary s) {
+        if (s == null) return null;
+        List<String> out = new ArrayList<>(Arrays.asList(
+            "total=" + s.total(), "functional=" + s.functional(), "architectural=" + s.architectural(),
+            "undecided=" + s.undecided(), "deferredUntracked=" + s.deferredUntracked()));
+        for (Map.Entry<String, Integer> e : s.byStatus().entrySet()) out.add("byStatus." + e.getKey() + "=" + e.getValue());
+        if (s.entitiesTotal() != null) out.add("entitiesTotal=" + s.entitiesTotal());
+        if (s.entitiesClaimed() != null) out.add("entitiesClaimed=" + s.entitiesClaimed());
+        out.sort(Comparator.naturalOrder());
+        return out;
+    }
+}
diff --git a/server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementTestIdentitiesTest.java b/server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementTestIdentitiesTest.java
new file mode 100644
index 000000000..e7d636195
--- /dev/null
+++ b/server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementTestIdentitiesTest.java
@@ -0,0 +1,113 @@
+package com.metaobjects.conformance;
+
+import com.metaobjects.loader.DirectorySource;
+import com.metaobjects.loader.LoaderOptions;
+import com.metaobjects.loader.MetaDataLoader;
+import com.metaobjects.requirement.MetaRequirement;
+import com.metaobjects.requirement.RequirementCheck;
+import com.metaobjects.requirement.RequirementTestIdentities;
+import com.metaobjects.requirement.RequirementTestIdentities.Grain;
+import org.junit.Test;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.regex.Matcher;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * What {@link RequirementTestIdentityConformanceTest} cannot say per case: facts about the corpus
+ * as a whole, and the direct tests of what the corpus cannot hold. A plain class, so each runs
+ * once rather than once per parameter.
+ */
+public class RequirementTestIdentitiesTest {
+
+    /** The case count at the time of writing. A corpus that is empty or mislocated gives zero
+     *  parameters to the parameterized runner, which is a green run; this is the floor under it. */
+    private static final int CORPUS_CASE_FLOOR = 26;
+
+    @Test
+    public void theCorpusHasAtLeastTheCasesItHadAndTheRunnerRunsEveryOne() throws IOException {
+        List<String> cases = RequirementTestIdentityConformanceTest.caseNames();
+        assertTrue("found " + cases.size() + " case(s) in " + RequirementTestIdentityConformanceTest.CORPUS,
+            cases.size() >= CORPUS_CASE_FLOOR);
+        assertEquals(cases.size(), RequirementTestIdentityConformanceTest.fixtures().size());
+    }
+
+    @Test
+    public void everyCaseOnDiskIsDocumentedInTheReadmeAndNothingElseIs() throws IOException {
+        String readme = Files.readString(RequirementTestIdentityConformanceTest.CORPUS.resolve("README.md"), StandardCharsets.UTF_8);
+        String section = readme.substring(readme.indexOf("\n## Cases\n"));
+        int next = section.indexOf("\n## ", 1);
+        if (next > 0) section = section.substring(0, next);
+        List<String> documented = new ArrayList<>();
+        Matcher m = RequirementTestIdentityConformanceTest.DOCUMENTED_CASE.matcher(section);
+        while (m.find()) documented.add(m.group(1));
+        documented.sort(Comparator.naturalOrder());
+        assertEquals(RequirementTestIdentityConformanceTest.caseNames(), documented);
+    }
+
+    @Test
+    public void filterTableHoldsExactlyTheEightNamedPredicates() {
+        assertEquals(List.of("all", "architectural", "claims-entity", "level-5", "live",
+            "package-acme-shop", "path-under-Shop", "unlevelled"),
+            RequirementTestIdentityConformanceTest.FILTERS.keySet().stream().sorted().toList());
+    }
+
+    /** The corpus cannot hold a non-ASCII name (the loaders are not known to agree on one), so
+     *  the key function is pinned directly. {@code Character.isLetterOrDigit} would keep the
+     *  accents and give {@code req_acme_shop_Café_Réglé}. */
+    @Test
+    public void witnessKeyReplacesLettersOutsideAscii() {
+        assertEquals("req_acme_shop_Caf_R_gl_",
+            RequirementTestIdentities.witnessKeyOf("acme::shop::Café.Réglé", "*"));
+    }
+
+    @Test
+    public void witnessKeyKeepsNoUnderscoreAndAddsUnitSuffix() {
+        assertEquals("req_acme_shop_Sales_Orders__object_entity",
+            RequirementTestIdentities.witnessKeyOf("acme::shop::Sales__Orders", "object.entity"));
+        assertEquals("req_Orders_Recorded", RequirementTestIdentities.witnessKeyOf("Orders.Recorded", "*"));
+    }
+
+    @Test
+    public void anUnknownGrainIsRefusedWithAClearError() {
+        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () -> Grain.parse("hybrid"));
+        assertTrue(e.getMessage(), e.getMessage().contains("\"hybrid\""));
+        assertTrue(e.getMessage(), e.getMessage().contains("\"concern\" or \"member\""));
+        assertEquals(Grain.CONCERN, Grain.parse("concern"));
+        assertEquals(Grain.MEMBER, Grain.parse("member"));
+    }
+
+    /**
+     * What the loader reports for a requirement that declares its own package: the effective-package
+     * rule in {@code RequirementCheck.effectivePackage} reads {@code getPackage()} up the parent
+     * chain, so the declaring node itself must report it (and the walk then gives a nested child
+     * that declares none its parent's package, not its file's).
+     */
+    @Test
+    public void aNestedRequirementThatDeclaresItsOwnPackageReportsItFromGetPackage() throws IOException {
+        MetaDataLoader loader = new MetaDataLoader(LoaderOptions.create(false, false, true),
+            MetaDataLoader.SUBTYPE_MANUAL, "requirement_test_identity_probe");
+        loader.init();
+        loader.load(new DirectorySource(RequirementTestIdentityConformanceTest.CORPUS.resolve("filter-by-package").resolve("input"),
+            new DirectorySource.Options()).expandToList());
+        assertTrue(loader.getErrors().toString(), loader.getErrors().isEmpty());
+        Map<String, MetaRequirement> byPath = new HashMap<>();
+        for (RequirementCheck.Addressed a : RequirementCheck.collectAddressed(loader.getRoot())) byPath.put(a.path(), a.node());
+
+        assertEquals("acme::shop", byPath.get("Settled").getPackage());
+        assertEquals("acme::billing", byPath.get("Invoiced").getPackage());
+        assertEquals("acme::shop", RequirementCheck.effectivePackage(byPath.get("Settled.Timed")));
+        assertEquals("acme::billing", RequirementCheck.effectivePackage(byPath.get("Invoiced.Numbered")));
+        assertEquals("acme::billing", RequirementCheck.effectivePackage(byPath.get("Billed")));
+    }
+}
diff --git a/server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementTestIdentityConformanceTest.java b/server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementTestIdentityConformanceTest.java
new file mode 100644
index 000000000..c7cd1da89
--- /dev/null
+++ b/server/java/metadata/src/test/java/com/metaobjects/conformance/RequirementTestIdentityConformanceTest.java
@@ -0,0 +1,184 @@
+package com.metaobjects.conformance;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import com.metaobjects.MetaRoot;
+import com.metaobjects.loader.DirectorySource;
+import com.metaobjects.loader.LoaderOptions;
+import com.metaobjects.loader.MetaDataLoader;
+import com.metaobjects.loader.MetaDataSource;
+import com.metaobjects.requirement.MetaRequirement;
+import com.metaobjects.requirement.RequirementTestFilter;
+import com.metaobjects.requirement.RequirementTestIdentities;
+import com.metaobjects.requirement.RequirementTestIdentities.Grain;
+import com.metaobjects.requirement.RequirementTestIdentities.Identity;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import java.util.regex.Pattern;
+import java.util.stream.Stream;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+/**
+ * Cross-port requirement-test identity corpus —
+ * {@code fixtures/requirement-test-identity-conformance/}. See that directory's README.md for
+ * the fixture format and the three runner steps: load {@code input/} STRICT, in file-name
+ * order; compute the identities through the PUBLIC grain and filter seams, passing each only
+ * when {@code options.json} sets it; compare tests and collisions with {@code expected.json}.
+ *
+ * <p>Mirrors the TypeScript reference
+ * ({@code requirement-test-identity-conformance.test.ts}). A mismatch here is a bug in THIS
+ * port, never in the fixture.</p>
+ */
+@RunWith(Parameterized.class)
+public class RequirementTestIdentityConformanceTest {
+
+    static final Path CORPUS =
+        CorpusRoot.locate().resolveSibling("requirement-test-identity-conformance");
+
+    /** The whole of {@code options.json}: a key outside this list is refused, not ignored. */
+    private static final List<String> OPTION_KEYS = List.of("grain", "filter");
+
+    /**
+     * The corpus's closed list of filters, exactly eight rows. A predicate cannot be written in
+     * a file five languages read, so a case NAMES one and every port's runner holds this table
+     * in its own language. An unknown name fails the case.
+     */
+    static final Map<String, RequirementTestFilter> FILTERS = Map.of(
+        "all", v -> true,
+        "architectural", v -> MetaRequirement.SUBTYPE_ARCHITECTURAL.equals(v.subType()),
+        "live", v -> MetaRequirement.STATUS_LIVE.equals(v.status()),
+        "level-5", v -> v.level() != null && v.level() == MetaRequirement.LEVEL_MEMBER,
+        "unlevelled", v -> v.level() == null,
+        "package-acme-shop", v -> "acme::shop".equals(v.pkg()),
+        "path-under-Shop", v -> v.path().equals("Shop") || v.path().startsWith("Shop."),
+        "claims-entity", v -> v.implementedByTypes().contains("object.entity"));
+
+    static final Pattern DOCUMENTED_CASE = Pattern.compile("^\\| `([^`]+)` \\|", Pattern.MULTILINE);
+
+    @Parameterized.Parameters(name = "{0}")
+    public static Collection<Object[]> fixtures() throws IOException {
+        List<Object[]> params = new ArrayList<>();
+        for (String name : caseNames()) params.add(new Object[]{name});
+        return params;
+    }
+
+    static List<String> caseNames() throws IOException {
+        try (Stream<Path> dirs = Files.list(CORPUS)) {
+            return dirs.filter(Files::isDirectory).map(d -> d.getFileName().toString()).sorted().toList();
+        }
+    }
+
+    private final String name;
+
+    public RequirementTestIdentityConformanceTest(String name) {
+        this.name = name;
+    }
+
+    @Test
+    public void fixture() throws IOException {
+        Path dir = CORPUS.resolve(name);
+        Path expectedFile = dir.resolve("expected.json");
+        assertTrue(name + ": no expected.json", Files.isRegularFile(expectedFile));
+        JsonObject expected = JsonParser.parseString(Files.readString(expectedFile, StandardCharsets.UTF_8)).getAsJsonObject();
+
+        Grain grain = null;
+        RequirementTestFilter filter = null;
+        Path optionsFile = dir.resolve("options.json");
+        if (Files.isRegularFile(optionsFile)) {
+            JsonObject options = JsonParser.parseString(Files.readString(optionsFile, StandardCharsets.UTF_8)).getAsJsonObject();
+            for (String key : options.keySet()) {
+                assertTrue(optionsFile + ": unknown option " + key, OPTION_KEYS.contains(key));
+            }
+            if (options.has("grain")) grain = Grain.parse(options.get("grain").getAsString());
+            if (options.has("filter")) {
+                String filterName = options.get("filter").getAsString();
+                filter = FILTERS.get(filterName);
+                if (filter == null) {
+                    fail(optionsFile + ": unknown filter '" + filterName + "'. The corpus names: " + FILTERS.keySet());
+                }
+            }
+        }
+
+        // Step 1: STRICT, input/ in file-name order, one batch.
+        MetaDataLoader loader = new MetaDataLoader(LoaderOptions.create(false, false, true),
+            MetaDataLoader.SUBTYPE_MANUAL, "requirement_test_identity_" + name.replace('-', '_'));
+        loader.init();
+        List<MetaDataSource> sources = new DirectorySource(dir.resolve("input"), new DirectorySource.Options()).expandToList();
+        loader.load(sources);
+        assertTrue(name + ": expected a clean strict load, got: " + loader.getErrors(), loader.getErrors().isEmpty());
+        MetaRoot root = loader.getRoot();
+
+        // Step 2: each option is passed only when the case sets it (null means the default).
+        List<Identity> tests = RequirementTestIdentities.identities(root, grain, filter);
+
+        // Step 3: compare.
+        assertEquals(name, expectedTests(expected.getAsJsonArray("tests")), actualTests(tests));
+        assertEquals(name, expectedPairs(expected.getAsJsonArray("collisions")),
+            actualPairs(RequirementTestIdentities.witnessKeyCollisions(tests)));
+    }
+
+    // ---------------------------------------------------------------- comparison
+
+    private static List<String> expectedTests(JsonArray tests) {
+        List<String> rows = new ArrayList<>();
+        for (JsonElement e : tests) {
+            JsonObject t = e.getAsJsonObject();
+            rows.add(row(t.get("id").getAsString(), t.get("package").getAsString(), t.get("path").getAsString(),
+                t.get("unit").getAsString(), t.get("witnessKey").getAsString(), t.get("status").getAsString(),
+                t.get("skip").isJsonNull() ? "null" : t.get("skip").getAsString(), t.get("digest").getAsString()));
+        }
+        rows.sort(Comparator.naturalOrder());
+        return rows;
+    }
+
+    private static List<String> actualTests(List<Identity> tests) {
+        List<String> rows = new ArrayList<>();
+        for (Identity t : tests) {
+            rows.add(row(t.id(), t.pkg(), t.path(), t.unit(), t.witnessKey(), t.status(),
+                t.skip() == null ? "null" : t.skip(), t.digest()));
+        }
+        rows.sort(Comparator.naturalOrder());
+        return rows;
+    }
+
+    private static String row(String... cells) {
+        return String.join(" | ", cells);
+    }
+
+    private static List<String> expectedPairs(JsonArray pairs) {
+        List<String> out = new ArrayList<>();
+        for (JsonElement e : pairs) {
+            JsonArray pair = e.getAsJsonArray();
+            out.add(pairKey(pair.get(0).getAsString(), pair.get(1).getAsString()));
+        }
+        out.sort(Comparator.naturalOrder());
+        return out;
+    }
+
+    private static List<String> actualPairs(List<String[]> pairs) {
+        List<String> out = new ArrayList<>();
+        for (String[] pair : pairs) out.add(pairKey(pair[0], pair[1]));
+        out.sort(Comparator.naturalOrder());
+        return out;
+    }
+
+    private static String pairKey(String a, String b) {
+        return a.compareTo(b) <= 0 ? a + " || " + b : b + " || " + a;
+    }
+}
diff --git a/server/java/metadata/src/test/java/com/metaobjects/library/LibraryLoadTest.java b/server/java/metadata/src/test/java/com/metaobjects/library/LibraryLoadTest.java
index 503c42d66..1d24a2377 100644
--- a/server/java/metadata/src/test/java/com/metaobjects/library/LibraryLoadTest.java
+++ b/server/java/metadata/src/test/java/com/metaobjects/library/LibraryLoadTest.java
@@ -129,6 +129,41 @@ public void knownPackagesNamesWhatThisBuildShips() {
             known);
     }
 
+    /**
+     * {@code libraryPackages()} decides whether a requirement came from a shipped library, and
+     * so whether object coverage is measured at all. It is read from the embedded manifests;
+     * this holds it to exactly the packages of the manifests the repository ships under
+     * {@code library/<name>/library.json}.
+     */
+    @Test
+    public void libraryPackagesIsExactlyThePackagesOfTheShippedManifests() throws IOException {
+        Path libraryDir = repoLibraryDir();
+        java.util.Set<String> expected = new java.util.TreeSet<>();
+        int manifests = 0;
+        try (java.util.stream.Stream<Path> libraries = Files.list(libraryDir)) {
+            for (Path library : (Iterable<Path>) libraries::iterator) {
+                Path manifest = library.resolve("library.json");
+                if (!Files.isRegularFile(manifest)) continue;
+                manifests++;
+                com.google.gson.JsonParser.parseString(new String(Files.readAllBytes(manifest), StandardCharsets.UTF_8))
+                    .getAsJsonObject().getAsJsonArray("packages")
+                    .forEach(p -> expected.add(p.getAsString()));
+            }
+        }
+        assertTrue("no library manifest under " + libraryDir, manifests > 0);
+        assertFalse("a manifest that declares no package would make this vacuous", expected.isEmpty());
+        assertEquals(expected, LibrarySources.libraryPackages());
+    }
+
+    private static Path repoLibraryDir() {
+        for (Path p = java.nio.file.Paths.get("").toAbsolutePath(); p != null; p = p.getParent()) {
+            if (Files.isDirectory(p.resolve("library")) && Files.isDirectory(p.resolve("server"))) {
+                return p.resolve("library");
+            }
+        }
+        throw new IllegalStateException("repo-root library/ directory not found");
+    }
+
     /**
      * The freshness gate: the embed must equal the canonical tree byte for byte.
      *
diff --git a/server/java/metadata/src/test/java/com/metaobjects/requirement/RequirementTest.java b/server/java/metadata/src/test/java/com/metaobjects/requirement/RequirementTest.java
index d81f36c61..9066a01d9 100644
--- a/server/java/metadata/src/test/java/com/metaobjects/requirement/RequirementTest.java
+++ b/server/java/metadata/src/test/java/com/metaobjects/requirement/RequirementTest.java
@@ -4,6 +4,7 @@
 import com.metaobjects.MetaData;
 import com.metaobjects.MetaDataException;
 import com.metaobjects.MetaRoot;
+import com.metaobjects.attr.LongAttribute;
 import com.metaobjects.loader.InMemoryStringSource;
 import com.metaobjects.loader.LoaderOptions;
 import com.metaobjects.loader.MetaDataLoader;
@@ -309,6 +310,28 @@ public void requirement_badStatus_rejected() {
             messages.contains("abandonned"));
     }
 
+    // ---------------------------------------------------------------------------
+    // getLevel() saturates: a value beyond int never reads as a valid level
+    // ---------------------------------------------------------------------------
+
+    @Test
+    public void aLevelBeyondIntSaturatesInsteadOfWrapping() {
+        // The loader refuses such a value today, so this is the accessor's own defence:
+        // 4294967300 is 2^32 + 4, which narrows to 4 and would read as a legal object level.
+        FunctionalRequirement high = new FunctionalRequirement("tooHigh");
+        high.addMetaAttr(LongAttribute.create(MetaRequirement.ATTR_LEVEL, 4294967300L));
+        assertEquals(Integer.valueOf(Integer.MAX_VALUE), high.getLevel());
+
+        FunctionalRequirement low = new FunctionalRequirement("tooLow");
+        low.addMetaAttr(LongAttribute.create(MetaRequirement.ATTR_LEVEL, -4294967300L));
+        assertEquals(Integer.valueOf(Integer.MIN_VALUE), low.getLevel());
+
+        // A value that fits is unchanged.
+        FunctionalRequirement ordinary = new FunctionalRequirement("ordinary");
+        ordinary.addMetaAttr(LongAttribute.create(MetaRequirement.ATTR_LEVEL, 4L));
+        assertEquals(Integer.valueOf(4), ordinary.getLevel());
+    }
+
     // ---------------------------------------------------------------------------
     // (5) An unregistered attr on a requirement is ERR_UNKNOWN_ATTR (strict)
     // ---------------------------------------------------------------------------
diff --git a/server/python/src/metaobjects/cli.py b/server/python/src/metaobjects/cli.py
index 006ff222a..972779db3 100644
--- a/server/python/src/metaobjects/cli.py
+++ b/server/python/src/metaobjects/cli.py
@@ -47,6 +47,7 @@
 from __future__ import annotations
 
 import argparse
+import contextlib
 import dataclasses
 import json
 import os
@@ -54,7 +55,7 @@
 import sys
 import tempfile
 from pathlib import Path
-from typing import Callable
+from typing import Any, Callable
 
 from metaobjects import MetaDataLoader
 from metaobjects.errors import ErrorCode, MetaError, ParseError
@@ -65,7 +66,7 @@
     refuse_unowned_packages,
 )
 from metaobjects.config.neutral_config import read_neutral_config
-from metaobjects.field_lint import FieldLintFinding, lint_duplicate_fields, lint_reference_fields
+from metaobjects.field_lint import lint_duplicate_fields, lint_reference_fields
 from metaobjects.loader.meta_data_loader import LoadResult
 from metaobjects.loader.sources import FileSource
 from metaobjects.meta.core.object.meta_object import MetaObject
@@ -74,7 +75,15 @@
     agent_context_staleness,
     installed_metaobjects_version,
 )
+from metaobjects.meta.core.requirement.requirement_constants import REQUIREMENT_STATUSES
 from metaobjects.meta.meta_data import MetaData
+from metaobjects.requirement_check import (
+    SEVERITY_ERROR,
+    Diagnostic,
+    check_requirements,
+    scan_requirements,
+    summarise_requirements,
+)
 from metaobjects.codegen.config import GenConfig
 from metaobjects.codegen.overwrite_policy import has_hash_manifest, read_generated_hash
 from metaobjects.codegen.project_config import (
@@ -101,10 +110,12 @@
 from metaobjects.codegen.generator_registry import (
     GENERATOR_REGISTRY,
     GeneratorBuildContext,
+    RequirementTestsOptions,
     get_generator,
     list_generators,
     unsatisfied_requires,
 )
+from metaobjects.codegen.project_import import import_project_symbol
 from metaobjects.codegen.runner import run_gen
 from metaobjects.codegen import eject as owned
 from metaobjects.codegen.generators.render_helper_generator import (
@@ -223,17 +234,22 @@ def _find_config(args: argparse.Namespace) -> Path | None:
     return default if default.is_file() else None
 
 
-def _config_providers(config: ProjectConfig) -> tuple[list[object], bool]:
+def _resolve_config_providers(config: ProjectConfig) -> tuple[list[object], list[str]]:
     """Resolve ``config.providers`` with the config file's directory on ``sys.path``.
 
     #267: prepend the config directory so a ``module:symbol`` provider living beside
     the config imports with no ``PYTHONPATH=``. Idempotent; the entry is left in
-    place (a short-lived CLI process). Prints resolution errors; returns (providers, ok).
+    place (a short-lived CLI process). Prints nothing; returns (providers, errors).
     """
     config_dir = str(config.config_dir)
     if config_dir not in sys.path:
         sys.path.insert(0, config_dir)
-    providers, errors = _resolve_providers(config.providers)
+    return _resolve_providers(config.providers)
+
+
+def _config_providers(config: ProjectConfig) -> tuple[list[object], bool]:
+    """:func:`_resolve_config_providers`, printing resolution errors; returns (providers, ok)."""
+    providers, errors = _resolve_config_providers(config)
     if errors:
         print("error: invalid provider in config:", file=sys.stderr)
         for msg in errors:
@@ -242,6 +258,62 @@ def _config_providers(config: ProjectConfig) -> tuple[list[object], bool]:
     return providers, True
 
 
+def _import_config_symbol(spec: str, config_dir: Path) -> tuple[object | None, str | None]:
+    """Import a ``module:symbol`` named by the config, relative to *config_dir*.
+
+    The same resolver an owned generator is imported with (:func:`import_project_symbol`; its
+    docstring states the rule). In short: the config directory goes on ``sys.path`` so a module
+    beside the config imports with no ``PYTHONPATH=``; a cached module of the spec's top-level
+    name is dropped only when it is not under the config directory AND the config directory
+    offers that name; the running ``metaobjects`` package is never dropped; and a project package
+    named like a standard-library module is refused. A package the project does not provide (an
+    installed hook package) is imported once and shared by every hook that names it. Returns
+    ``(callable, None)`` or ``(None, message)``; the message names the spec, the module and the
+    real cause.
+    """
+    module_name, _sep, symbol = spec.partition(":")
+    obj, err = import_project_symbol(module_name, symbol, config_dir)
+    if err is not None:
+        return None, f"{spec!r}: {err}"
+    if not callable(obj):
+        return None, f"{spec!r}: {symbol!r} is not callable"
+    return obj, None
+
+
+def _requirement_tests_options(
+    config: ProjectConfig,
+) -> tuple[RequirementTestsOptions | None, list[str]]:
+    """The ``requirementTests`` block with its ``renderer`` and ``filter`` imported.
+
+    ``(None, [])`` when the config carries no block, so the generator's defaults apply.
+    """
+    block = config.requirement_tests
+    if block is None:
+        return None, []
+    errors: list[str] = []
+    hooks: dict[str, object | None] = {}
+    for key, spec in (("renderer", block.renderer), ("filter", block.filter)):
+        if spec is None:
+            hooks[key] = None
+            continue
+        obj, err = _import_config_symbol(spec, config.config_dir)
+        if err is not None:
+            errors.append(f"requirementTests.{key}: {err}")
+        hooks[key] = obj
+    if errors:
+        return None, errors
+    return (
+        RequirementTestsOptions(
+            witness_module=block.witness_module,
+            grain=block.grain,
+            renderer=hooks["renderer"],  # type: ignore[arg-type]
+            filter=hooks["filter"],  # type: ignore[arg-type]
+            warn_uncovered=block.warn_uncovered,
+        ),
+        [],
+    )
+
+
 def _select_targets(
     config: ProjectConfig, target_name: str | None
 ) -> tuple[list[TargetConfig], str | None]:
@@ -505,6 +577,16 @@ def _strict_load_hint() -> str:
     )
 
 
+def _load_failure_lines(errors: list[str], strict: bool) -> list[str]:
+    """The lines a ``verify`` gate prints for metadata that did not load: the heading, one
+    indented line per loader message, and the strict-load advice when an unknown attribute is
+    among them."""
+    lines = ["error: failed to load metadata:", *(f"  {msg}" for msg in errors)]
+    if strict and any("ERR_UNKNOWN_ATTR" in m for m in errors):
+        lines.append(_strict_load_hint())
+    return lines
+
+
 #: The canonical directory name for authored template bodies. Named `prompts` because
 #: that is what the Node CLI has always called it (`DEFAULT_PROMPTS_DIR`), and the Node
 #: CLI is the schema door every project meets first.
@@ -1392,12 +1474,19 @@ def _run_gen_targets(
     all_written: list[str] = []
     seen: dict[str, str] = {}  # full path -> target name
     errors: list[str] = []
+    # The `requirementTests` block reaches a generator factory (packaged or owned) through
+    # the build context, so `gen` and `verify --codegen` build it identically.
+    requirement_tests, hook_errors = _requirement_tests_options(config)
+    if hook_errors:
+        return [], hook_errors
+    ctx = dataclasses.replace(
+        build_ctx or GeneratorBuildContext(), requirement_tests=requirement_tests
+    )
     for t in targets:
         gens: list[Generator] | None = None
         if t.generators is not None:
             gens, gen_errors = _resolve_generators(
-                ",".join(t.generators), build_ctx or GeneratorBuildContext(),
-                owned_root=config.config_dir)
+                ",".join(t.generators), ctx, owned_root=config.config_dir)
             if gen_errors:
                 errors.extend(f"target '{t.name}': {m}" for m in gen_errors)
                 continue
@@ -2299,52 +2388,146 @@ def _verify_db(_args: argparse.Namespace) -> int:
 FIELD_LINT_ENV = "META_NO_FIELD_LINT"
 
 
-def _field_lint_findings(args: argparse.Namespace) -> "list[FieldLintFinding] | None":
-    """Load the metadata ``verify`` was pointed at and run the field lint over it.
+@dataclasses.dataclass(frozen=True)
+class _VerifyModel:
+    """The metadata ``verify`` was pointed at, loaded once for every pass that reads it."""
+
+    root: MetaData
+    #: The project's OWN files — a dependency artifact is not the adopter's to edit.
+    own_files: list[Path]
+    #: Every file that loaded, dependency artifacts included. The denominator's provenance.
+    loaded_files: int
+    #: ``None`` for an explicit ``<metadata_dir>``, which never resolves one.
+    collection: Collection | None
+
 
-    Returns ``None`` when there is nothing to lint: the metadata could not be located
-    or did not load. Every such failure is already reported by the gate that ran, with
-    its own message and exit code, so this stays silent.
+def _load_verify_model(
+    args: argparse.Namespace, failure: "list[str] | None" = None
+) -> "_VerifyModel | None":
+    """Load the metadata ``verify`` was pointed at, for the passes that read the model.
 
-    Loads LENIENT, deliberately: the lint must report the same findings under
-    ``--lax`` as without it, and an unknown attr is the strict gate's finding, not
-    this one's.
+    Returns ``None`` when there is nothing to read: the metadata could not be located or
+    did not load. Why not is appended to ``failure`` as the lines to print, in the form the
+    gate that normally meets that failure prints it. A gate that ran may have printed the
+    same lines already, or NOT: ``--codegen`` with no generators selected returns before it
+    loads anything, and then this load is the only one in the command. The caller decides
+    (:func:`_report_unloaded_model`); this function only says what went wrong.
+
+    Loads STRICT unless ``--lax``, as every other gate of this command does (ADR-0023), so a
+    mistyped attribute on a requirement is refused here and never read as "no such claim".
+    The field lint reads the same load, so it says nothing about a model the load refuses:
+    that model already fails the command.
     """
     from metaobjects.loader.sources import DirectorySource
 
-    providers, _errors = _resolve_providers(getattr(args, "provider", None))
-    if args.metadata_dir is not None:
-        root, _ = _load_root(args.metadata_dir, providers=providers)
-        files = [source.path for source in DirectorySource(args.metadata_dir).expand()]
-    else:
-        config_path = _find_config(args)
-        config = load_project_config(config_path) if config_path is not None else None
-        libraries: "list[str] | None" = None
-        if config is not None:
-            # Quiet on purpose: a bad provider is the gate's error to print, once.
-            providers, _errors = _resolve_providers(config.providers)
-            libraries = config.libraries
-            start = project_root_for(config.metadata_dir())
-        else:
-            start = Path.cwd()
-        collection = resolve_metadata_location(config=config, root=start)
-        root, _ = _load_root_from_collection(collection, providers=providers, libraries=libraries)
-        # The project's OWN files — a dependency artifact is not the adopter's to edit.
-        files = list(collection.own_files)
-    if root is None:
+    strict = not getattr(args, "lax", False)
+
+    def unread(*lines: str) -> "_VerifyModel | None":
+        """Nothing to read: record why, and hand back the ``None`` the caller returns."""
+        if failure is not None:
+            failure.extend(lines)
         return None
-    return [*lint_reference_fields(root), *lint_duplicate_fields(files)]
 
+    try:
+        providers, provider_errors = _resolve_providers(getattr(args, "provider", None))
+        if args.metadata_dir is not None:
+            if provider_errors:
+                return unread("error: invalid --provider:", *(f"  {m}" for m in provider_errors))
+            root, errors = _load_root(args.metadata_dir, strict=strict, providers=providers)
+            if root is None:
+                return unread(*_load_failure_lines(errors, strict))
+            files = [source.path for source in DirectorySource(args.metadata_dir).expand()]
+            collection = None
+            loaded_files = len(files)
+        else:
+            config_path = _find_config(args)
+            config = load_project_config(config_path) if config_path is not None else None
+            libraries: "list[str] | None" = None
+            if config is not None:
+                providers, provider_errors = _resolve_config_providers(config)
+                if provider_errors:
+                    return unread(
+                        "error: invalid provider in config:", *(f"  {m}" for m in provider_errors)
+                    )
+                libraries = config.libraries
+                start = project_root_for(config.metadata_dir())
+            else:
+                if provider_errors:
+                    return unread("error: invalid --provider:", *(f"  {m}" for m in provider_errors))
+                start = Path.cwd()
+            try:
+                collection = resolve_metadata_location(config=config, root=start)
+            except ParseError as exc:
+                return unread(f"error: could not resolve metadata location: {exc}")
+            root, errors = _load_root_from_collection(
+                collection, strict=strict, providers=providers, libraries=libraries
+            )
+            if root is None:
+                return unread(*_load_failure_lines(errors, strict))
+            files = list(collection.own_files)
+            loaded_files = len(collection.files)
+    except ConfigError as exc:
+        return unread(f"error: {exc}")
+    except ParseError as exc:
+        return unread(*_load_failure_lines([f"{exc.code}: {exc}"], strict))
+    except OSError as exc:
+        return unread(*_load_failure_lines([str(exc)], strict))
+    # Only the failures the loader and the config readers RAISE for input that cannot be
+    # read are caught above. Anything else is a bug, and it must not read as "no
+    # requirements declared": this result feeds a build gate, which a swallowed exception
+    # would turn off with exit 0.
+    return _VerifyModel(root=root, own_files=files, loaded_files=loaded_files, collection=collection)
+
+
+class _RecordedStderr:
+    """``sys.stderr`` for the gates ``verify`` was asked to run, remembering each line they
+    wrote, so a load failure one of them already reported is not printed a second time.
+
+    Asking what was PRINTED, and not which gate returned non-zero or reached its load, is
+    deliberate: it cannot be wrong in the direction that matters. A gate that changes its
+    wording costs a repeated message. Nothing can make a failure nobody printed look reported.
+    """
+
+    def __init__(self, inner: Any) -> None:
+        self._inner = inner
+        self._parts: list[str] = []
+
+    def write(self, text: str) -> int:
+        self._parts.append(text)
+        return int(self._inner.write(text))
+
+    def flush(self) -> None:
+        self._inner.flush()
+
+    def lines(self) -> set[str]:
+        return set("".join(self._parts).splitlines())
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._inner, name)
 
-def _run_field_lint_advisory(args: argparse.Namespace) -> None:
+
+def _report_unloaded_model(failure: list[str], printed: set[str]) -> int:
+    """The metadata did not load, so ``verify`` fails: an unloadable model is not a model with
+    no ``requirement.*`` node. Prints why, once: skipped when a gate that ran already printed
+    every one of these lines. Always returns 1."""
+    # A loader message can span lines (a YAML parse error does); compare what a terminal shows.
+    if not all(line in printed for line in "\n".join(failure).splitlines()):
+        for line in failure:
+            print(line, file=sys.stderr)
+    return 1
+
+
+def _run_field_lint_advisory(args: argparse.Namespace, model: "_VerifyModel | None") -> None:
     """The field AUTHORING lint (see :mod:`metaobjects.field_lint`) — runs on every
     ``verify``, whichever gates were selected. Warnings ONLY: it prints to stderr and
     never changes the exit code. Muted by ``--no-field-lint`` or ``META_NO_FIELD_LINT=1``.
     """
     if getattr(args, "no_field_lint", False) or os.environ.get(FIELD_LINT_ENV) == "1":
         return
+    if model is None:
+        return
     try:
-        findings = _field_lint_findings(args)
+        findings = [*lint_reference_fields(model.root), *lint_duplicate_fields(model.own_files)]
     except Exception:  # noqa: BLE001 — an advisory scan never breaks verify
         return
     if not findings:
@@ -2358,6 +2541,82 @@ def _run_field_lint_advisory(args: argparse.Namespace) -> None:
         print(f"  {finding.code} [{finding.path}]: {finding.message}", file=sys.stderr)
 
 
+#: Raises ``WARN_REQUIREMENT_NOTHING_IMPLEMENTS`` to an error, beside ``--require-implementers``
+#: (Node `meta` parity, ADR-0057).
+REQUIRE_IMPLEMENTERS_ENV = "META_REQUIRE_IMPLEMENTERS"
+
+
+def _format_requirement_diagnostic(d: Diagnostic) -> str:
+    return f"  {d.code}{'' if d.path is None else f' [{d.path}]'}: {d.message}"
+
+
+def _verify_requirements(args: argparse.Namespace, model: "_VerifyModel | None") -> int:
+    """The requirement (capability) gate (see :mod:`metaobjects.requirement_check`) — runs
+    on EVERY ``verify``, with no subverb to select it: ``requirement.*`` nodes are metadata,
+    so a model declaring none is silent, not in drift.
+
+    Prints the summary line on every run that has a requirement, clean or not (a gate that
+    says nothing when it passes cannot be told apart from one that checked nothing), then
+    every finding, uncapped. Returns 1 when any finding is an error. Returns 0 and prints
+    nothing when the metadata did not load (``model`` is ``None``): that is reported, and
+    fails the command, in :func:`_cmd_verify`, and a load that failed is not retried here.
+    """
+    if model is None:
+        return 0
+    collection = model.collection
+    scan = scan_requirements(
+        model.root,
+        coverable=collection.in_scope if collection is not None else None,
+        require_implementers=bool(getattr(args, "require_implementers", False))
+        or os.environ.get(REQUIRE_IMPLEMENTERS_ENV) == "1",
+    )
+    summary = summarise_requirements(model.root, scan)
+    if summary is None:
+        return 0
+
+    statuses = ", ".join(
+        f"{summary.by_status[k]} {k}" for k in REQUIREMENT_STATUSES if summary.by_status.get(k, 0) > 0
+    )
+    if summary.entities_total is None:
+        coverage = "coverage: not measured (no project-authored requirements)."
+    else:
+        # The file count is the DENOMINATOR'S PROVENANCE: `entities_total` is only ever taken
+        # over what actually loaded, so a spine that covers half an estate reports the
+        # covered half as fully claimed unless the count says what it was taken over.
+        from_dependencies = (
+            f", {len(collection.dependencies)} from dependencies."
+            if collection is not None and collection.dependencies
+            else "."
+        )
+        coverage = (
+            f"{summary.entities_claimed}/{summary.entities_total} entities claimed, "
+            f"counted over {model.loaded_files} metadata file(s)" + from_dependencies
+        )
+    print(
+        f"metaobjects verify — requirements: {summary.total} entries ({summary.functional} functional, "
+        f"{summary.architectural} architectural) — {statuses}; {coverage}",
+        file=sys.stderr,
+    )
+    if summary.undecided > 0:
+        print(
+            f"metaobjects verify — requirements: {summary.undecided} recorded gap(s) with no @disposition. "
+            "These are known problems nobody has ruled on — set 'accepted' or 'deferred' to close the question.",
+            file=sys.stderr,
+        )
+
+    diagnostics = check_requirements(model.root, scan)
+    errors = [d for d in diagnostics if d.severity == SEVERITY_ERROR]
+    warnings = [d for d in diagnostics if d.severity != SEVERITY_ERROR]
+    for d in errors:
+        print(_format_requirement_diagnostic(d), file=sys.stderr)
+    for d in warnings:
+        print(_format_requirement_diagnostic(d), file=sys.stderr)
+    if errors:
+        print(f"metaobjects verify — requirements: {len(errors)} error(s).", file=sys.stderr)
+        return 1
+    return 0
+
+
 def _cmd_verify(args: argparse.Namespace) -> int:
     """Subverb dispatch (ADR-0021 D2). Run each requested mode; aggregate exit =
     max (non-zero if ANY mode drifts). Bare ``verify`` (no subverb) keeps the
@@ -2380,13 +2639,21 @@ def _cmd_verify(args: argparse.Namespace) -> int:
         run_codegen = True
 
     exit_code = 0
-    if run_db:
-        exit_code = max(exit_code, _verify_db(args))
-    if run_codegen:
-        exit_code = max(exit_code, _verify_codegen(args))
-    if run_templates:
-        exit_code = max(exit_code, _verify_templates(args))
-    _run_field_lint_advisory(args)
+    gates_stderr = _RecordedStderr(sys.stderr)
+    with contextlib.redirect_stderr(gates_stderr):
+        if run_db:
+            exit_code = max(exit_code, _verify_db(args))
+        if run_codegen:
+            exit_code = max(exit_code, _verify_codegen(args))
+        if run_templates:
+            exit_code = max(exit_code, _verify_templates(args))
+    # One load for both passes that read the model. The requirement gate runs on EVERY verify.
+    load_failure: list[str] = []
+    model = _load_verify_model(args, load_failure)
+    if model is None:
+        exit_code = max(exit_code, _report_unloaded_model(load_failure, gates_stderr.lines()))
+    exit_code = max(exit_code, _verify_requirements(args, model))
+    _run_field_lint_advisory(args, model)
     return exit_code
 
 
@@ -2654,6 +2921,15 @@ def _build_parser() -> argparse.ArgumentParser:
             "build. META_NO_FIELD_LINT=1 does the same."
         ),
     )
+    verify.add_argument(
+        "--require-implementers",
+        action="store_true",
+        help=(
+            "raise WARN_REQUIREMENT_NOTHING_IMPLEMENTS (a live functional requirement whose "
+            "subtree names no implementing node) from a warning to an error. "
+            "META_REQUIRE_IMPLEMENTERS=1 does the same."
+        ),
+    )
     verify.add_argument(
         "--lax",
         action="store_true",
diff --git a/server/python/src/metaobjects/codegen/eject.py b/server/python/src/metaobjects/codegen/eject.py
index 0833b3a93..541e9d799 100644
--- a/server/python/src/metaobjects/codegen/eject.py
+++ b/server/python/src/metaobjects/codegen/eject.py
@@ -22,7 +22,6 @@
 
 import importlib
 import inspect
-import sys
 import tempfile
 from collections import Counter
 from dataclasses import dataclass
@@ -34,6 +33,7 @@
     GeneratorBuildContext,
     GeneratorEntry,
 )
+from metaobjects.codegen.project_import import import_project_symbol
 
 #: Where an owned copy lands, relative to the project root. Mirrors the TS layout.
 OWNED_DIR = Path("codegen") / "generators"
@@ -205,23 +205,9 @@ def build_owned(spec: str, root: Path, ctx: GeneratorBuildContext) -> tuple[Gene
     if not sep or not module_name or not symbol:
         return None, (f"generator {spec!r} is neither a registered name nor a "
                       "'module:symbol' reference to an owned copy")
-    root_str = str(root.resolve())
-    if root_str not in sys.path:
-        sys.path.insert(0, root_str)
-    # A module of the same name imported from another project (or an earlier copy) would
-    # be reused from the cache; drop any entry that does not live under this root.
-    top = module_name.split(".")[0]
-    for key in [k for k in sys.modules if k == top or k.startswith(top + ".")]:
-        file = getattr(sys.modules[key], "__file__", None)
-        if file is None or not str(Path(file).resolve()).startswith(root_str):
-            del sys.modules[key]
-    try:
-        module = importlib.import_module(module_name)
-    except Exception as exc:  # ImportError and anything raised at import time
-        return None, f"generator {spec!r}: cannot import {module_name!r}: {exc}"
-    obj = getattr(module, symbol, None)
-    if obj is None:
-        return None, f"generator {spec!r}: {module_name!r} has no attribute {symbol!r}"
+    obj, err = import_project_symbol(module_name, symbol, root)
+    if err is not None:
+        return None, f"generator {spec!r}: {err}"
     if not hasattr(obj, "generate") and callable(obj):
         params = inspect.signature(obj).parameters
         required = [p for p in params.values()
diff --git a/server/python/src/metaobjects/codegen/generator_registry.py b/server/python/src/metaobjects/codegen/generator_registry.py
index 20e77f82e..46376c2a8 100644
--- a/server/python/src/metaobjects/codegen/generator_registry.py
+++ b/server/python/src/metaobjects/codegen/generator_registry.py
@@ -25,6 +25,7 @@
 from typing import Callable
 
 from metaobjects.codegen.generator import Generator
+from metaobjects.codegen.project_config import DEFAULT_REQUIREMENT_WITNESS_MODULE
 from metaobjects.codegen.generators.entity_model import entity_model
 from metaobjects.codegen.generators.extractor_generator import extractor_generator
 from metaobjects.codegen.generators.filter_allowlist_generator import (
@@ -40,6 +41,9 @@
 from metaobjects.codegen.generators.render_helper_generator import (
     render_helper_generator,
 )
+from metaobjects.codegen.generators.requirement_tests_generator import (
+    requirement_tests_generator,
+)
 from metaobjects.codegen.generators.router_generator import (
     RUNTIME_MODULES as _ROUTER_RUNTIME,
     router_generator,
@@ -68,6 +72,20 @@
 GeneratorLayer = str  # one of GENERATOR_LAYERS
 
 
+@dataclass(frozen=True)
+class RequirementTestsOptions:
+    """The ``requirementTests`` config block, RESOLVED: ``renderer`` and ``filter`` are the
+    callables their ``module:symbol`` strings named. The CLI resolves them against the config
+    directory (the way ``providers`` are) so a generator factory, packaged or owned, only
+    reads attributes."""
+
+    witness_module: str = DEFAULT_REQUIREMENT_WITNESS_MODULE
+    grain: str = "concern"
+    renderer: Callable[..., object] | None = None
+    filter: Callable[..., bool] | None = None
+    warn_uncovered: bool = True
+
+
 @dataclass(frozen=True)
 class GeneratorBuildContext:
     """Extra inputs a factory may need to construct a generator.
@@ -88,6 +106,9 @@ class GeneratorBuildContext:
     #: The on-disk directory template refs resolve under. ``None`` = not supplied
     #: (``--list``, registry identity), which every factory must tolerate.
     template_root: str | None = None
+    #: The ``requirementTests`` block of ``metaobjects.config.yaml``, resolved. ``None`` =
+    #: no block (flag mode, ``--list``): the ``requirement-tests`` generator uses its defaults.
+    requirement_tests: RequirementTestsOptions | None = None
 
 
 @dataclass(frozen=True)
@@ -168,7 +189,7 @@ def _render_helper_default(ctx: GeneratorBuildContext) -> Generator:
         template_root=ctx.template_root or tempfile.gettempdir())
 
 
-#: Stable name -> GeneratorEntry. The 10 native generators whose manifest `ports`
+#: Stable name -> GeneratorEntry. The 11 native generators whose manifest `ports`
 #: include `python` (ADR-0021 D3). Set equality, tier AND layer are conformance-tested
 #: against the manifest.
 GENERATOR_REGISTRY: dict[str, GeneratorEntry] = {
@@ -233,6 +254,14 @@ def _render_helper_default(ctx: GeneratorBuildContext) -> Generator:
         requires=("entity",),
         source=extractor_generator,
     ),
+    "requirement-tests": GeneratorEntry(
+        name="requirement-tests",
+        description="Per-package pytest tests, one per tested requirement, each calling a project-owned witness function looked up by name in the witness module; a live test with no witness fails and a planned or retired one is skipped.",
+        tier="native",
+        layer="capability",
+        factory=requirement_tests_generator,
+        source=requirement_tests_generator,
+    ),
     "template": GeneratorEntry(
         name="template",
         description="Generic Mustache template primitive (walk + template -> files).",
diff --git a/server/python/src/metaobjects/codegen/generators/requirement_tests_generator.py b/server/python/src/metaobjects/codegen/generators/requirement_tests_generator.py
new file mode 100644
index 000000000..4fd703a6b
--- /dev/null
+++ b/server/python/src/metaobjects/codegen/generators/requirement_tests_generator.py
@@ -0,0 +1,378 @@
+"""One pytest file per metamodel package: one test per declared requirement (ADR-0057).
+
+A requirement ledger claims what the software DOES. This generator emits a test for each
+requirement the filter selects; the test calls a project-owned WITNESS, a function named by
+the test's witness key in the module ``requirement_tests(witness_module=...)`` names. No such
+function and the test fails, naming the requirement and the counterexample, so an empty
+generated test can never pass: a ``live`` entry claims the capability works, and a green test
+that checks nothing asserts the opposite. A ``planned`` or ``retired`` requirement is skipped,
+and never looks a witness up.
+
+The generated file is machine-owned and rewritten whole on every run: there is no hand-edited
+body to merge. Project code lives in the witnesses. Which tests exist, what each is called and
+what it fingerprints are decided in :mod:`metaobjects.codegen.requirement_walk`, which the
+shared identity corpus pins in every language port.
+
+This module is a REFERENCE HELPER (ADR-0034 Amendment 3), ejectable with
+``metaobjects eject requirement-tests``. ``eject`` copies this file whole, so it holds the
+generator and its default renderer and nothing unrelated, and it imports only absolute
+``metaobjects.*`` module paths so the copy still resolves from an adopter's tree. An owned copy
+keeps reading the ``requirementTests`` config block, because the factory it is wired by takes
+the build context.
+
+The generated file imports ``importlib`` and ``pytest`` and nothing from MetaObjects, and parses
+under the Python 3.9 grammar (the generator itself runs on the package's own floor).
+"""
+from __future__ import annotations
+
+import json
+import re
+import unicodedata
+from typing import TYPE_CHECKING
+
+from metaobjects.codegen.generator import EmittedFile, GenContext, Generator
+from metaobjects.codegen.project_config import (
+    DEFAULT_REQUIREMENT_WITNESS_MODULE,
+    DOTTED_MODULE_PATTERN,
+)
+from metaobjects.codegen.requirement_hooks import (
+    RenderedTest,
+    RequirementTestArgs,
+    RequirementTestRenderer,
+)
+from metaobjects.codegen.requirement_walk import (
+    RequirementFilter,
+    RequirementTestIdentity,
+    ResolvedClaim,
+    WalkedRequirement,
+    assert_requirement_test_grain,
+    default_requirement_test_filter,
+    mangle,
+    requirement_test_identity,
+    requirement_test_units,
+    walk_requirements,
+    witness_key_collisions,
+)
+from metaobjects.meta.core.requirement.requirement_constants import (
+    REQUIREMENT_ATTR_COUNTEREXAMPLE,
+    REQUIREMENT_ATTR_STATEMENT,
+    REQUIREMENT_STATUS_PLANNED,
+    REQUIREMENT_STATUS_RETIRED,
+)
+
+if TYPE_CHECKING:  # the registry imports this module; the type is only an annotation here
+    from metaobjects.codegen.generator_registry import GeneratorBuildContext
+
+#: The refusal code when two tests map to one witness key (identical in every port).
+ERR_REQUIREMENT_WITNESS_KEY_COLLISION = "ERR_REQUIREMENT_WITNESS_KEY_COLLISION"
+
+GENERATOR_NAME = "requirement-tests"
+
+#: The module the witnesses are looked up in when the project names none.
+DEFAULT_WITNESS_MODULE = DEFAULT_REQUIREMENT_WITNESS_MODULE
+
+#: Where the generated files land, relative to the generator's output directory.
+OUTPUT_DIR = "requirements"
+
+#: How many uncovered requirements to name before "and N more".
+MAX_NAMED_UNCOVERED = 5
+
+SKIP_REASON_PLANNED = "planned - not built yet"
+SKIP_REASON_RETIRED = "retired - the capability was deliberately removed; assert it stays removed"
+
+_DOTTED_NAME = re.compile(DOTTED_MODULE_PATTERN)
+
+_HEADER = (
+    "# @generated by metaobjects (requirement-tests). DO NOT EDIT: this file is rewritten whole.\n"
+    "# Witnesses are project-owned functions in the module named below.\n"
+)
+
+#: The imports every generated file carries. A renderer hook's imports are merged after them.
+_BASE_IMPORTS = ("import importlib", "import pytest")
+
+#: The file's prelude. A missing witness module is "no witness"; a witness module that exists
+#: and fails to import raises its OWN error, never "unimplemented requirement" on every test.
+_PRELUDE = '''
+def _witness(key):
+    try:
+        module = importlib.import_module(_WITNESS_MODULE)
+    except ModuleNotFoundError as exc:
+        missing = exc.name or ""
+        if _WITNESS_MODULE != missing and not _WITNESS_MODULE.startswith(missing + "."):
+            raise
+        return None
+    return getattr(module, key, None)
+
+
+def _run(key, test_id, counterexample):
+    witness = _witness(key)
+    if witness is None:
+        pytest.fail(
+            "unimplemented requirement: " + test_id + " - write " + _WITNESS_MODULE + "." + key
+            + "() so that it fails when: " + counterexample
+        )
+    witness()
+'''
+
+
+# ---------------------------------------------------------------------------
+# Escaping: author prose lands in a string literal and in comments, and must not break either.
+# ---------------------------------------------------------------------------
+
+
+def _string_literal(value: str) -> str:
+    """A double-quoted Python string literal holding *value* exactly.
+
+    JSON's string syntax is a subset of Python's: it escapes the backslash, the quote, the
+    newline, the carriage return and every other control character, so no value can end the
+    literal (a triple quote becomes three escaped quotes).
+    """
+    return json.dumps(value, ensure_ascii=False)
+
+
+def _comment_text(line: str) -> str:
+    """One line of prose as comment text. ``*/`` is broken as ``* /``: the rule every port's
+    generator shares (contract Table H), harmless here and what keeps the five ports' comments
+    reading alike. A control character that would break the file (a NUL makes Python refuse the
+    whole source) is written visibly as ``\\xNN``; a tab stays."""
+    line = line.replace("*/", "* /")
+    return "".join(
+        f"\\x{ord(c):02x}" if unicodedata.category(c) == "Cc" and c != "\t" else c for c in line
+    )
+
+
+def _comment_lines(text: str) -> str:
+    """One ``#`` marker per line. A carriage return ends a Python line as a line feed does, so
+    both split."""
+    return "\n".join(("# " + _comment_text(line)).rstrip() for line in re.split(r"\r\n|\r|\n", text))
+
+
+def _skip_reason(skip: str) -> str:
+    if skip == REQUIREMENT_STATUS_PLANNED:
+        return SKIP_REASON_PLANNED
+    if skip == REQUIREMENT_STATUS_RETIRED:
+        return SKIP_REASON_RETIRED
+    return f"{skip} - skipped"
+
+
+# ---------------------------------------------------------------------------
+# The default renderer.
+# ---------------------------------------------------------------------------
+
+
+def render_requirement_test(args: RequirementTestArgs) -> RenderedTest:
+    """The default rendering of one test: its comments, then a test that calls the witness
+    (or, when the requirement is skipped, a skipped test that does not look one up).
+
+    A renderer hook has this signature and may return ``None`` to keep this default.
+    """
+    identity = args.identity
+    claims = ", ".join(f"{ref}  ({concern})" for ref, concern in args.targets) or "(none)"
+    comments = "\n".join(
+        (
+            _comment_lines(identity.id),
+            _comment_lines(args.statement),
+            _comment_lines("Counterexample: " + args.counterexample),
+            _comment_lines("Status: " + (identity.status if identity.status is not None else "(none)")),
+            _comment_lines("Claims: " + claims),
+            _comment_lines("Digest: " + identity.digest),
+        )
+    )
+    name = f"test_{identity.witness_key}"
+    if identity.skip is not None:
+        body = (
+            f"@pytest.mark.skip(reason={_string_literal(_skip_reason(identity.skip))})\n"
+            f"def {name}():\n"
+            f"    pass"
+        )
+    else:
+        body = (
+            f"def {name}():\n"
+            f"    _run(\n"
+            f"        {_string_literal(identity.witness_key)},\n"
+            f"        {_string_literal(identity.id)},\n"
+            f"        {_string_literal(args.counterexample)},\n"
+            f"    )"
+        )
+    return RenderedTest(imports=(), source=f"{comments}\n{body}")
+
+
+# ---------------------------------------------------------------------------
+# The generator.
+# ---------------------------------------------------------------------------
+
+
+def _package_key(package: str) -> str:
+    """The file key of a package: each run of non-ASCII-alphanumerics as one ``_``, or ``root``
+    for the empty package. Two packages that mangle alike share a file; their tests keep
+    distinct witness keys, which the collision check has proven."""
+    return mangle(package) if package else "root"
+
+
+class _RequirementTestsGenerator:
+    # The runner treats a `filter` attribute on a generator as its ENTITY matcher, and this
+    # generator's filter selects requirements, so the predicate is kept under another name.
+    name = GENERATOR_NAME
+
+    def __init__(
+        self,
+        witness_module: str,
+        grain: str,
+        renderer: RequirementTestRenderer | None,
+        include: RequirementFilter | None,
+        warn_uncovered: bool,
+    ) -> None:
+        self._witness_module = witness_module
+        self._grain = grain
+        self._renderer = renderer
+        self._include = include if include is not None else default_requirement_test_filter
+        self._warn_uncovered = warn_uncovered
+
+    def generate(self, ctx: GenContext) -> list[EmittedFile]:
+        if ctx.loaded_root is None:
+            return []
+        planned: list[tuple[RequirementTestIdentity, RequirementTestArgs]] = []
+        uncovered: list[str] = []
+        for walked in walk_requirements(ctx.loaded_root):
+            if not self._include(walked.view):
+                # Named by PATH: diagnostics use the path (contract Table A).
+                uncovered.append(walked.view.path)
+                continue
+            for unit, targets in requirement_test_units(walked, self._grain).items():
+                identity = requirement_test_identity(walked, unit)
+                planned.append((identity, _args_for(walked, identity, targets)))
+        planned.sort(key=lambda p: p[0].id)
+        _refuse_collisions([identity for identity, _ in planned])
+        if self._warn_uncovered and uncovered:
+            shown = ", ".join(uncovered[:MAX_NAMED_UNCOVERED])
+            more = (
+                f", and {len(uncovered) - MAX_NAMED_UNCOVERED} more"
+                if len(uncovered) > MAX_NAMED_UNCOVERED
+                else ""
+            )
+            ctx.warn(
+                f"{len(uncovered)} requirement(s) matched no filter and get no test. "
+                f"If that is deliberate, set warnUncovered: false to silence this. "
+                f"Uncovered: {shown}{more}."
+            )
+
+        by_package: dict[str, list[tuple[RequirementTestIdentity, RequirementTestArgs]]] = {}
+        for item in planned:
+            by_package.setdefault(_package_key(item[0].package), []).append(item)
+        return [
+            EmittedFile(
+                path=f"{OUTPUT_DIR}/test_{key}_requirements.py",
+                content=self._file_text(items),
+            )
+            for key, items in sorted(by_package.items())
+        ]
+
+    def _file_text(self, items: list[tuple[RequirementTestIdentity, RequirementTestArgs]]) -> str:
+        rendered: list[RenderedTest] = []
+        for identity, args in items:
+            result = self._renderer(args) if self._renderer is not None else None
+            if result is not None and not (
+                isinstance(result, RenderedTest) and isinstance(result.source, str)
+            ):
+                raise ValueError(
+                    f"requirement-tests renderer {_describe(self._renderer)} returned "
+                    f"{_returned(result)} for {identity.id!r}: expected a RenderedTest "
+                    f"(from metaobjects.codegen.requirement_hooks) whose source is a string, or None."
+                )
+            rendered.append(result if result is not None else render_requirement_test(args))
+
+        extra = sorted({i for r in rendered for i in r.imports} - set(_BASE_IMPORTS))
+        imports = "\n".join(_BASE_IMPORTS[:1]) + "\n\n" + _BASE_IMPORTS[1]
+        if extra:
+            imports += "\n\n" + "\n".join(extra)
+        head = f"{_HEADER}{imports}\n\n_WITNESS_MODULE = {_string_literal(self._witness_module)}\n\n{_PRELUDE}"
+        return head + "".join("\n\n" + r.source.rstrip() + "\n" for r in rendered)
+
+
+def _describe(renderer: object) -> str:
+    module = getattr(renderer, "__module__", None)
+    name = getattr(renderer, "__qualname__", None) or repr(renderer)
+    return f"{module}.{name}" if module else name
+
+
+def _returned(result: object) -> str:
+    if isinstance(result, RenderedTest):
+        return f"a RenderedTest whose source is {type(result.source).__name__}"
+    return type(result).__name__
+
+
+def _args_for(
+    walked: WalkedRequirement, identity: RequirementTestIdentity, targets: list[ResolvedClaim]
+) -> RequirementTestArgs:
+    node = walked.node
+    statement = node.get_meta_attr(REQUIREMENT_ATTR_STATEMENT)
+    counterexample = node.get_meta_attr(REQUIREMENT_ATTR_COUNTEREXAMPLE)
+    return RequirementTestArgs(
+        identity=identity,
+        statement=statement if isinstance(statement, str) else "",
+        counterexample=counterexample if isinstance(counterexample, str) else "",
+        targets=tuple((t.ref, t.concern) for t in targets),
+        disposition=node.disposition(),
+        tracked_by=tuple(node.tracked_by()),
+    )
+
+
+def _refuse_collisions(identities: list[RequirementTestIdentity]) -> None:
+    collisions = witness_key_collisions(identities)
+    if not collisions:
+        return
+    key_by_id = {identity.id: identity.witness_key for identity in identities}
+    pairs = "".join(
+        f"\n  '{first}' and '{second}' (witness key {key_by_id[first]})" for first, second in collisions
+    )
+    raise ValueError(
+        f"{ERR_REQUIREMENT_WITNESS_KEY_COLLISION}: two requirement tests map to one witness key, so "
+        f"one witness could not serve both. Rename one so the names differ in more than punctuation:{pairs}"
+    )
+
+
+def requirement_tests(
+    *,
+    witness_module: str = DEFAULT_WITNESS_MODULE,
+    grain: str = "concern",
+    renderer: RequirementTestRenderer | None = None,
+    filter: RequirementFilter | None = None,  # noqa: A002 — the seam's published name
+    warn_uncovered: bool = True,
+) -> Generator:
+    """The ``requirement-tests`` generator.
+
+    ``witness_module`` is the dotted module the project's witness functions live in;
+    ``grain`` is ``concern`` (one test per distinct ``<type>.<subType>`` a requirement claims)
+    or ``member`` (one per distinct reference that resolves); ``renderer`` replaces the text
+    of one test and returns ``None`` to keep the default; ``filter`` chooses which requirements
+    get a test, replacing the default (functional, level 4 or above); ``warn_uncovered`` names
+    the requirements the filter excluded, once, capped.
+    """
+    # Refused here, when the generator is built, rather than on the first requirement: an
+    # unknown grain or a malformed module is a mistake in the config whatever the model holds.
+    assert_requirement_test_grain(grain)
+    if not isinstance(witness_module, str) or not _DOTTED_NAME.fullmatch(witness_module):
+        raise ValueError(
+            f"requirement-tests witness module {witness_module!r} is not a dotted module name "
+            f"such as {DEFAULT_WITNESS_MODULE!r}."
+        )
+    return _RequirementTestsGenerator(witness_module, grain, renderer, filter, warn_uncovered)
+
+
+def requirement_tests_generator(ctx: "GeneratorBuildContext") -> Generator:
+    """The registry's ``source=``, and so the symbol an ejected copy is wired by.
+
+    It takes the build context (one required positional parameter, which is what
+    ``eject.build_owned`` passes the context to) and builds :func:`requirement_tests` from the
+    ``requirementTests`` config block the context carries. With no block the defaults apply.
+    """
+    options = getattr(ctx, "requirement_tests", None)
+    if options is None:
+        return requirement_tests()
+    return requirement_tests(
+        witness_module=options.witness_module,
+        grain=options.grain,
+        renderer=options.renderer,
+        filter=options.filter,
+        warn_uncovered=options.warn_uncovered,
+    )
diff --git a/server/python/src/metaobjects/codegen/metaobjects-config.schema.json b/server/python/src/metaobjects/codegen/metaobjects-config.schema.json
index 00a7d6ca6..dfd8aa68a 100644
--- a/server/python/src/metaobjects/codegen/metaobjects-config.schema.json
+++ b/server/python/src/metaobjects/codegen/metaobjects-config.schema.json
@@ -22,6 +22,39 @@
       "items": { "type": "string" },
       "description": "MetaObjects-shipped library packages to load alongside `metadata` (e.g. [\"ai\"]). An unknown package name is refused."
     },
+    "requirementTests": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Options of the `requirement-tests` generator (one pytest file per metamodel package, one test per declared requirement). Every key is optional.",
+      "properties": {
+        "witnessModule": {
+          "type": "string",
+          "pattern": "^[A-Za-z_][A-Za-z0-9_]*(\\.[A-Za-z_][A-Za-z0-9_]*)*$",
+          "default": "tests.requirement_witnesses",
+          "description": "Dotted module holding the project-owned witness functions: one per generated test, named by the test's witness key."
+        },
+        "grain": {
+          "enum": ["concern", "member"],
+          "default": "concern",
+          "description": "What one test stands for. `concern`: one per distinct <type>.<subType> a requirement claims. `member`: one per distinct @implementedBy reference that resolves."
+        },
+        "renderer": {
+          "type": "string",
+          "pattern": "^[^:\\s]+:[^:\\s]+$",
+          "description": "A 'module:symbol' renderer hook, resolved relative to this config file's directory. It is called with the test's RequirementTestArgs and returns a RenderedTest, or None to keep the default."
+        },
+        "filter": {
+          "type": "string",
+          "pattern": "^[^:\\s]+:[^:\\s]+$",
+          "description": "A 'module:symbol' predicate over the requirement view that chooses which requirements get a test, replacing the default (functional, level 4 or above)."
+        },
+        "warnUncovered": {
+          "type": "boolean",
+          "default": true,
+          "description": "Name the requirements the filter excluded, once, capped at five. It never fails the build."
+        }
+      }
+    },
     "targets": {
       "type": "object",
       "minProperties": 1,
diff --git a/server/python/src/metaobjects/codegen/project_config.py b/server/python/src/metaobjects/codegen/project_config.py
index b3e165ebd..f3ddf7ffa 100644
--- a/server/python/src/metaobjects/codegen/project_config.py
+++ b/server/python/src/metaobjects/codegen/project_config.py
@@ -21,6 +21,7 @@
 """
 from __future__ import annotations
 
+import re
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -37,12 +38,43 @@
 #: shipped schema has always said an unknown key is invalid; naming the set here is what
 #: lets the loader — the thing that actually runs — say the same. Kept in step with the
 #: schema by ``test_schema_and_loader_accept_EXACTLY_the_same_keys``.
-TOP_LEVEL_KEYS: tuple[str, ...] = ("metadata", "providers", "libraries", "targets")
+TOP_LEVEL_KEYS: tuple[str, ...] = ("metadata", "providers", "libraries", "targets", "requirementTests")
 
 #: Every key a ``targets.<name>`` mapping may carry. Same contract as above.
 TARGET_KEYS: tuple[str, ...] = ("outDir", "generators", "entities")
 
 
+#: Every key the ``requirementTests`` block may carry (the ``requirement-tests`` generator's
+#: options). Same contract as above.
+REQUIREMENT_TESTS_KEYS: tuple[str, ...] = (
+    "witnessModule",
+    "grain",
+    "renderer",
+    "filter",
+    "warnUncovered",
+)
+
+#: The grains the ``requirementTests.grain`` key accepts. Spelled out here, in the loader
+#: that validates it, rather than imported from the generator, so this module keeps loading
+#: a config without importing the codegen engine; ``test_schema_and_loader_accept_EXACTLY_the_same_keys``
+#: and the generator's own refusal keep the two in step.
+REQUIREMENT_TEST_GRAIN_VALUES: tuple[str, ...] = ("concern", "member")
+
+#: The module the witnesses are looked up in when the project names none. The ONE spelling:
+#: the generator, the build-context options and this loader all take it from here, and a test
+#: ties the schema's ``default`` to it.
+DEFAULT_REQUIREMENT_WITNESS_MODULE = "tests.requirement_witnesses"
+
+#: A dotted module name: what ``requirementTests.witnessModule`` must be, and what the generated
+#: file interpolates into a string literal and imports. The schema's ``pattern`` is this one.
+DOTTED_MODULE_PATTERN = r"^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$"
+
+#: The ``module:symbol`` form of the ``renderer`` and ``filter`` keys: two non-empty halves with
+#: no whitespace in either (a stray newline would otherwise validate and fail later as a
+#: missing attribute). The schema's ``pattern`` for those two keys is this one.
+MODULE_SYMBOL_PATTERN = r"^[^:\s]+:[^:\s]+$"
+
+
 class ConfigError(ValueError):
     """A ``metaobjects.config.yaml`` that is missing, malformed, or invalid.
 
@@ -72,6 +104,21 @@ class TargetConfig:
     entities: list[str] | None
 
 
+@dataclass(frozen=True)
+class RequirementTestsConfig:
+    """The ``requirementTests`` block: options of the ``requirement-tests`` generator.
+
+    ``renderer`` and ``filter`` are ``module:symbol`` strings, resolved relative to the
+    config directory the way ``providers`` are (the CLI imports them; this loader never does).
+    """
+
+    witness_module: str = DEFAULT_REQUIREMENT_WITNESS_MODULE
+    grain: str = "concern"
+    renderer: str | None = None
+    filter: str | None = None
+    warn_uncovered: bool = True
+
+
 @dataclass(frozen=True)
 class ProjectConfig:
     #: Directory containing the config file — the base for resolving ``metadata``,
@@ -88,6 +135,8 @@ class ProjectConfig:
     libraries: list[str]
     #: Ordered run-specs (YAML map insertion order preserved).
     targets: list[TargetConfig]
+    #: Options of the ``requirement-tests`` generator; ``None`` => its defaults.
+    requirement_tests: RequirementTestsConfig | None = None
 
     def metadata_dir(self) -> str:
         """The metadata dir resolved against ``config_dir`` (absolute path string)."""
@@ -132,6 +181,52 @@ def _require_str_list(value: object, ctx: str) -> list[str]:
     return list(value)
 
 
+def _parse_requirement_tests(raw: object, ctx: str) -> RequirementTestsConfig:
+    if not isinstance(raw, dict):
+        raise ConfigError(f"{ctx} must be a mapping.")
+    _reject_unknown_keys(raw, REQUIREMENT_TESTS_KEYS, ctx)
+    defaults = RequirementTestsConfig()
+
+    def string(key: str, default: str | None) -> str | None:
+        if key not in raw:
+            return default
+        value = raw[key]
+        if not isinstance(value, str) or not value:
+            raise ConfigError(f"{ctx}: '{key}' must be a non-empty string.")
+        return value
+
+    def symbol(key: str) -> str | None:
+        value = string(key, None)
+        if value is not None and not re.fullmatch(MODULE_SYMBOL_PATTERN, value):
+            raise ConfigError(
+                f"{ctx}: '{key}' must be in 'module:symbol' form (e.g. codegen.requirement_{key}:{key})."
+            )
+        return value
+
+    grain = string("grain", defaults.grain)
+    if grain not in REQUIREMENT_TEST_GRAIN_VALUES:
+        raise ConfigError(
+            f"{ctx}: 'grain' must be one of {list(REQUIREMENT_TEST_GRAIN_VALUES)}, got {grain!r}."
+        )
+    warn = raw.get("warnUncovered", defaults.warn_uncovered)
+    if not isinstance(warn, bool):
+        raise ConfigError(f"{ctx}: 'warnUncovered' must be a boolean.")
+    witness = string("witnessModule", defaults.witness_module)
+    assert witness is not None and grain is not None  # the defaults are never None
+    if not re.fullmatch(DOTTED_MODULE_PATTERN, witness):
+        raise ConfigError(
+            f"{ctx}: 'witnessModule' must be a dotted module name such as "
+            f"{DEFAULT_REQUIREMENT_WITNESS_MODULE!r}, got {witness!r}."
+        )
+    return RequirementTestsConfig(
+        witness_module=witness,
+        grain=grain,
+        renderer=symbol("renderer"),
+        filter=symbol("filter"),
+        warn_uncovered=warn,
+    )
+
+
 def load_project_config(path: Path) -> ProjectConfig:
     """Parse + validate ``metaobjects.config.yaml`` at ``path``.
 
@@ -205,10 +300,17 @@ def load_project_config(path: Path) -> ProjectConfig:
             TargetConfig(name=str(name), out_dir=out_dir, generators=generators, entities=entities)
         )
 
+    requirement_tests = (
+        _parse_requirement_tests(raw["requirementTests"], f"{path}: 'requirementTests'")
+        if "requirementTests" in raw
+        else None
+    )
+
     return ProjectConfig(
         config_dir=path.parent.resolve(),
         metadata=metadata,
         providers=providers,
         libraries=libraries,
         targets=targets,
+        requirement_tests=requirement_tests,
     )
diff --git a/server/python/src/metaobjects/codegen/project_import.py b/server/python/src/metaobjects/codegen/project_import.py
new file mode 100644
index 000000000..dc9d6431b
--- /dev/null
+++ b/server/python/src/metaobjects/codegen/project_import.py
@@ -0,0 +1,90 @@
+"""Import a ``module:symbol`` the project owns, relative to a project root.
+
+ONE resolver for both places that name project code by ``module:symbol``: an owned generator
+(:func:`metaobjects.codegen.eject.build_owned`) and a config hook (``requirementTests.renderer``
+and ``requirementTests.filter``). It puts the project root on ``sys.path`` and imports.
+
+THE RULE, in one sentence: a cached module of the spec's top-level name is dropped before the
+import only when it does not live under this project's root AND this root offers that top-level
+name (``<root>/<name>/`` or ``<root>/<name>.py``), and then the project's copy is the one
+imported, except that the running ``metaobjects`` package is never dropped, and a project name
+that is also a standard-library module name is refused outright.
+
+Why: two projects in one process (a test run, a long-lived tool) can offer the same dotted name,
+and a config provider is imported with plain ``importlib`` and never registers anything here, so
+"under the current root" is the test, not "under some other root we know of". Why only when the
+root offers the name: a package the project does NOT provide (an installed hook package) is one
+module for every hook that names it, and is never unloaded or re-imported.
+
+A project package named like a standard-library module (``types/``, ``json/``, ``queue/``) is
+refused with an error naming it, before anything is imported, whether or not the standard-library
+module is already loaded: the import system would otherwise answer by load order.
+
+What it does NOT do, all as before:
+* A module cached from THIS root is kept: an edit made after the first import is not seen.
+* Returning to root A after root B loaded B's copy loads B's copy again.
+* Project B that has no such package at all is silently answered with project A's, because A's
+  module is still cached in ``sys.modules`` (it is served even after A's directory has left
+  ``sys.path``).
+* Project B that has the package only as a namespace layout (no ``__init__.py``) still gets A's
+  regular package, because a regular package later on ``sys.path`` beats a namespace portion.
+"""
+from __future__ import annotations
+
+import importlib
+import sys
+from pathlib import Path
+from typing import Any
+
+#: The package this module belongs to: running code the resolver must never unload, however a
+#: project shadows it.
+_RUNNING_PACKAGE = __name__.partition(".")[0]
+
+
+def _offered_at(root: Path, top: str) -> Path | None:
+    """Where the project provides the top-level name: its package directory, else its module
+    file, else ``None`` when it offers no such name."""
+    if (root / top).is_dir():
+        return root / top
+    if (root / f"{top}.py").is_file():
+        return root / f"{top}.py"
+    return None
+
+
+def _is_under(module: object, root: Path) -> bool:
+    """Whether the module was loaded from a file under *root*. A module with no file (a
+    namespace package, a built-in) is not."""
+    file = getattr(module, "__file__", None)
+    if file is None:
+        return False
+    return Path(file).resolve().is_relative_to(root)
+
+
+def import_project_symbol(module_name: str, symbol: str, root: Path) -> tuple[Any, str | None]:
+    """``(object, None)``, or ``(None, message)`` naming the module (and the symbol) and the real
+    cause: the message of whatever the import raised, which attribute is missing, or that the
+    project package or module shadows a standard-library module."""
+    resolved = root.resolve()
+    top = module_name.split(".")[0]
+    offered_at = _offered_at(resolved, top)
+    offered = offered_at is not None
+    if offered_at is not None and top in sys.stdlib_module_names:
+        kind = "package" if offered_at.is_dir() else "module"
+        return None, (
+            f"cannot import {module_name!r}: the project {kind} {top!r} ({offered_at}) shadows a "
+            f"standard-library module of the same name; rename it"
+        )
+    if str(resolved) not in sys.path:
+        sys.path.insert(0, str(resolved))
+    if offered and top != _RUNNING_PACKAGE:
+        for key in [k for k in sys.modules if k == top or k.startswith(top + ".")]:
+            if not _is_under(sys.modules[key], resolved):
+                del sys.modules[key]
+    try:
+        module = importlib.import_module(module_name)
+    except Exception as exc:  # ImportError and anything raised at import time
+        return None, f"cannot import {module_name!r}: {exc}"
+    obj = getattr(module, symbol, None)
+    if obj is None:
+        return None, f"{module_name!r} has no attribute {symbol!r}"
+    return obj, None
diff --git a/server/python/src/metaobjects/codegen/requirement_hooks.py b/server/python/src/metaobjects/codegen/requirement_hooks.py
new file mode 100644
index 000000000..b66d7c676
--- /dev/null
+++ b/server/python/src/metaobjects/codegen/requirement_hooks.py
@@ -0,0 +1,44 @@
+"""The renderer hook's types for the ``requirement-tests`` generator.
+
+They live in the PACKAGE, beside the identity function, and not in the generator module: an
+application that ejects the generator (``metaobjects eject requirement-tests``) copies that
+module whole, and a project renderer that imports :class:`RenderedTest` must be handed back to
+the owned copy as the SAME class, or the copy's ``isinstance`` check would refuse the renderer
+that works against the packaged generator (contract Table L: the hook types stay in the package).
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Callable
+
+from metaobjects.codegen.requirement_walk import RequirementTestIdentity
+
+
+@dataclass(frozen=True)
+class RequirementTestArgs:
+    """What a renderer is handed for one test: the identity plus the prose and the targets."""
+
+    identity: RequirementTestIdentity
+    statement: str
+    counterexample: str
+    #: ``(ref, "<type>.<subType>")`` for the targets this test stands for, ref as authored.
+    #: Under the ``concern`` grain: every resolved target of that concern, in authored order,
+    #: so one reference authored twice appears twice. Under the ``member`` grain: the one
+    #: target of the reference this test is for (a reference authored twice is one test and
+    #: keeps its first claim). A requirement that resolves nothing passes ``()``.
+    targets: tuple[tuple[str, str], ...]
+    disposition: str | None
+    tracked_by: tuple[str, ...]
+
+
+@dataclass(frozen=True)
+class RenderedTest:
+    """One rendered test: the import statements it needs and its source, no trailing blank lines."""
+
+    #: Complete import statements (``"import json"``), merged into the file's imports.
+    imports: tuple[str, ...]
+    source: str
+
+
+#: A renderer replaces the text of one test, or returns ``None`` to keep the default.
+RequirementTestRenderer = Callable[[RequirementTestArgs], "RenderedTest | None"]
diff --git a/server/python/src/metaobjects/codegen/requirement_walk.py b/server/python/src/metaobjects/codegen/requirement_walk.py
new file mode 100644
index 000000000..2055a61e3
--- /dev/null
+++ b/server/python/src/metaobjects/codegen/requirement_walk.py
@@ -0,0 +1,291 @@
+"""Walking ``requirement.*`` nodes: which tests a ledger yields and what each is called.
+
+Everything here is the part of the requirement-test generator that every language port copies
+and a shared corpus pins (``fixtures/requirement-test-identity-conformance/``): which tests a
+ledger yields, what each is called, whether it is skipped, and a fingerprint of the claim it
+tests. Mirrors the TS reference ``codegen-ts/src/requirement-walk.ts`` (contract Tables F and G).
+
+It lives beside the generator rather than in it because an application that owns its generator
+(``metaobjects eject requirement-tests``) still imports these from the package: an owned copy
+changes how a test is WRITTEN and keeps agreeing with every other tool about which tests exist.
+
+A filter is handed a :class:`RequirementView`, never the node: an application's filter is its own
+policy, and the node would bind adopter code to metamodel internals and export the ADR-0039
+own-versus-resolving accessor trap.
+"""
+from __future__ import annotations
+
+import hashlib
+import re
+from dataclasses import dataclass
+from typing import Callable
+
+from metaobjects.meta.core.requirement.meta_requirement import MetaRequirement
+from metaobjects.meta.core.requirement.requirement_constants import (
+    REQUIREMENT_ATTR_COUNTEREXAMPLE,
+    REQUIREMENT_ATTR_STATEMENT,
+    REQUIREMENT_LINK_FLOOR_LEVEL,
+    REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES,
+    REQUIREMENT_SUBTYPE_FUNCTIONAL,
+)
+from metaobjects.meta.core.requirement.resolve_claim import resolve_claim
+from metaobjects.meta.meta_data import MetaData
+from metaobjects.requirement_check import collect_addressed_requirements, effective_package
+from metaobjects.shared.separators import PACKAGE_SEP
+
+#: The unit of a requirement that resolves no target. Doubles as the catch-all renderer key.
+NO_CONCERN = "*"
+
+REQUIREMENT_TEST_GRAINS: tuple[str, ...] = ("concern", "member")
+
+DIGEST_VERSION = "requirement-digest/v1"
+
+
+@dataclass(frozen=True)
+class RequirementView:
+    """What a filter receives. Never the node."""
+
+    #: ``functional`` or ``architectural`` — the check-polarity axis.
+    sub_type: str
+    #: 1 solution, 2 segment, 3 service, 4 object, 5 member. ``None`` on an unlevelled
+    #: architectural requirement (the flat policy form): absent is not a number.
+    level: int | None
+    status: str | None
+    #: Dotted path from the root through nesting ancestors. No package.
+    path: str
+    #: The EFFECTIVE package (contract Table A).
+    package: str
+    #: The distinct ``<type>.<subType>`` of the references that RESOLVE, first-seen order.
+    implemented_by_types: tuple[str, ...]
+
+
+@dataclass(frozen=True)
+class ResolvedClaim:
+    #: The reference exactly as authored.
+    ref: str
+    node: MetaData
+    #: ``<type>.<subType>`` of the node it resolved to.
+    concern: str
+
+
+@dataclass(frozen=True)
+class WalkedRequirement:
+    node: MetaRequirement
+    view: RequirementView
+    targets: tuple[ResolvedClaim, ...]
+
+
+@dataclass(frozen=True)
+class RequirementTestIdentity:
+    """One generated test. The same record in every language port."""
+
+    #: The requirement's effective package.
+    package: str
+    #: The requirement's dotted path, without the package.
+    path: str
+    #: ``<type>.<subType>`` under the ``concern`` grain, the reference as authored under
+    #: ``member``, and ``*`` for a requirement that resolves no target.
+    unit: str
+    #: ``<qualified address> [<unit>]`` — unique per test.
+    id: str
+    #: An identifier-safe spelling of ``id``, for ports that bind a test to a function.
+    witness_key: str
+    status: str | None
+    #: ``None`` when the requirement claims the capability works right now; otherwise the
+    #: status (``planned`` or ``retired``).
+    skip: str | None
+    #: :func:`requirement_digest` of the requirement — the same for each of its tests.
+    digest: str
+
+
+RequirementFilter = Callable[[RequirementView], bool]
+
+
+def _concern_of(node: MetaData) -> str:
+    return f"{node.type}.{node.sub_type}"
+
+
+def walk_requirements(root: MetaData) -> list[WalkedRequirement]:
+    """Every ``requirement.*`` node, nested ones included, in declaration order.
+
+    An unresolvable ``@implementedBy`` reference is skipped rather than raised on: its
+    severity depends on ``@status`` and belongs to ``verify``, and codegen must not fail a
+    build over a diagnostic another command owns.
+    """
+    out: list[WalkedRequirement] = []
+    for item in collect_addressed_requirements(root):
+        req = item.node
+        # The referrer package a bare reference binds in (ADR-0042) is the effective package.
+        package = effective_package(req)
+        targets: list[ResolvedClaim] = []
+        for ref in req.implemented_by():
+            target = resolve_claim(root, ref, package)
+            if target is not None:
+                targets.append(ResolvedClaim(ref, target, _concern_of(target)))
+        concerns = tuple(dict.fromkeys(t.concern for t in targets))
+        out.append(
+            WalkedRequirement(
+                node=req,
+                view=RequirementView(
+                    sub_type=req.sub_type,
+                    level=req.level(),
+                    status=req.status(),
+                    path=item.path,
+                    package=package,
+                    implemented_by_types=concerns,
+                ),
+                targets=tuple(targets),
+            )
+        )
+    return out
+
+
+def assert_requirement_test_grain(grain: object) -> None:
+    """Refuse anything that is not a grain, rather than running some hybrid of the two.
+
+    Called wherever a grain enters: the identity function and the generator, built-in or
+    owned. A config file is not typechecked, so a typo arrives here as a plain string.
+    """
+    if grain not in REQUIREMENT_TEST_GRAINS:
+        expected = " or ".join(repr(g) for g in REQUIREMENT_TEST_GRAINS)
+        raise ValueError(f"unknown requirement-test grain {grain!r}: expected {expected}.")
+
+
+def default_requirement_test_filter(view: RequirementView) -> bool:
+    """RECOMMENDATION, not a rule: functional requirements at or below the link floor.
+
+    Architectural requirements are excluded because ``verify``'s universality check already
+    proves them structurally, so a test there is usually redundant. Usually, not never, which
+    is why this is overridable.
+    """
+    return (
+        view.sub_type == REQUIREMENT_SUBTYPE_FUNCTIONAL
+        and (view.level if view.level is not None else 0) >= REQUIREMENT_LINK_FLOOR_LEVEL
+    )
+
+
+def _digest_field(name: str, value: str) -> str:
+    # Length-prefixed in BYTES, so no value can be confused with the field that follows it.
+    return f"{name} {len(value.encode('utf-8'))}\n{value}\n"
+
+
+def requirement_digest(node: MetaRequirement) -> str:
+    """A fingerprint of the CLAIM: lowercase hex SHA-256 over the requirement's subtype,
+    level, status, statement, counterexample and ``@implementedBy`` list (``requirement-digest/v1``).
+
+    It answers "did the claim change", not "did the entry move": the name, package, title,
+    notes, disposition, tracking references and nested requirements are left out.
+    """
+
+    def prose(name: str) -> str:
+        # get_meta_attr RESOLVES (ADR-0039): the digest is over the effective claim.
+        value = node.get_meta_attr(name)
+        return re.sub(r"\r\n?", "\n", value) if isinstance(value, str) else ""
+
+    level = node.level()
+    refs = node.implemented_by()
+    text = (
+        f"{DIGEST_VERSION}\n"
+        + _digest_field("subType", node.sub_type)
+        + _digest_field("level", "" if level is None else str(level))
+        + _digest_field("status", node.status() or "")
+        + _digest_field("statement", prose(REQUIREMENT_ATTR_STATEMENT))
+        + _digest_field("counterexample", prose(REQUIREMENT_ATTR_COUNTEREXAMPLE))
+        + f"implementedBy {len(refs)}\n"
+        + "".join(_digest_field("ref", r) for r in refs)
+    )
+    return hashlib.sha256(text.encode("utf-8")).hexdigest()
+
+
+def mangle(value: str) -> str:
+    """Every maximal run of characters outside ``[A-Za-z0-9]`` becomes one ``_``."""
+    # ASCII [A-Za-z0-9] only. `\w` and `str.isalnum()` are both wrong: each keeps `_` and
+    # every Unicode letter, so `Orders__Recorded` and `Café` would keep their shape.
+    return re.sub(r"[^A-Za-z0-9]+", "_", value)
+
+
+def witness_key_of(qualified_address: str, unit: str) -> str:
+    """An identifier-safe key for one test: ``req_<address>``, then ``__<unit>`` unless the
+    requirement resolves no target. Mangling is lossy, which is what
+    :func:`witness_key_collisions` exists to report."""
+    base = f"req_{mangle(qualified_address)}"
+    return base if unit == NO_CONCERN else f"{base}__{mangle(unit)}"
+
+
+def requirement_test_units(
+    walked: WalkedRequirement, grain: str = "concern"
+) -> dict[str, list[ResolvedClaim]]:
+    """The requirement's targets grouped by fan-out unit under *grain*, first-seen order.
+
+    ``concern``: one entry per distinct ``<type>.<subType>``, NOT per target. ``member``: one
+    per distinct reference that resolves, as authored, holding its first claim, so the bare and qualified spellings of
+    one node are two units. In both grains a requirement resolving no target yields exactly
+    one entry, ``*``.
+    """
+    assert_requirement_test_grain(grain)
+    units: dict[str, list[ResolvedClaim]] = {}
+    for target in walked.targets:
+        if grain == "concern":
+            units.setdefault(target.concern, []).append(target)
+        elif target.ref not in units:
+            # A reference authored twice is one test, and its first claim is the one kept
+            # (the reference implementation does the same): the unit is the reference as
+            # written, so a second copy adds nothing a hook or a comment could use.
+            units[target.ref] = [target]
+    if not units:
+        units[NO_CONCERN] = []
+    return units
+
+
+def requirement_test_identity(walked: WalkedRequirement, unit: str) -> RequirementTestIdentity:
+    """The identity of the one test *unit* stands for (a key of :func:`requirement_test_units`)."""
+    view = walked.view
+    address = view.path if view.package == "" else f"{view.package}{PACKAGE_SEP}{view.path}"
+    # Derived from the loader's status list rather than naming the two skipped statuses: a
+    # status that does not claim the capability works right now is skipped by construction,
+    # so a status added later cannot be left failing by omission.
+    skips = view.status is not None and view.status not in REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES
+    return RequirementTestIdentity(
+        package=view.package,
+        path=view.path,
+        unit=unit,
+        id=f"{address} [{unit}]",
+        witness_key=witness_key_of(address, unit),
+        status=view.status,
+        skip=view.status if skips else None,
+        digest=requirement_digest(walked.node),
+    )
+
+
+def requirement_test_identities(
+    root: MetaData,
+    *,
+    grain: str = "concern",
+    filter: RequirementFilter | None = None,  # noqa: A002 — the seam's published name
+) -> list[RequirementTestIdentity]:
+    """Every test the generator would emit, sorted by ``id`` (code points, never a locale)."""
+    # Checked here as well as per requirement, so a bad grain is refused even over a ledger
+    # the filter empties: the answer must not depend on what the model holds.
+    assert_requirement_test_grain(grain)
+    include = filter if filter is not None else default_requirement_test_filter
+    out: list[RequirementTestIdentity] = []
+    for walked in walk_requirements(root):
+        if not include(walked.view):
+            continue
+        for unit in requirement_test_units(walked, grain):
+            out.append(requirement_test_identity(walked, unit))
+    return sorted(out, key=lambda t: t.id)
+
+
+def witness_key_collisions(tests: list[RequirementTestIdentity]) -> list[tuple[str, str]]:
+    """Pairs of ids that share a witness key, each pair and the list sorted."""
+    by_key: dict[str, list[str]] = {}
+    for t in tests:
+        by_key.setdefault(t.witness_key, []).append(t.id)
+    pairs: list[tuple[str, str]] = []
+    for ids in by_key.values():
+        ordered = sorted(ids)
+        for i, first in enumerate(ordered):
+            for second in ordered[i + 1 :]:
+                pairs.append((first, second))
+    return sorted(pairs)
diff --git a/server/python/src/metaobjects/config/dependencies.py b/server/python/src/metaobjects/config/dependencies.py
index a5687984e..132bf1985 100644
--- a/server/python/src/metaobjects/config/dependencies.py
+++ b/server/python/src/metaobjects/config/dependencies.py
@@ -658,7 +658,9 @@ def imported(self, fqn: str) -> bool:
         return package_of_resolution_key(fqn) in self.imported_packages
 
     def in_scope(self, fqn: str) -> bool:
-        """Output filter for codegen (`run_gen`'s `select`) and `verify --codegen`.
+        """Output filter for codegen (`run_gen`'s `select`) and `verify --codegen`, and the
+        requirement gate's coverable set (`scan_requirements`' `coverable`): an entity this
+        project imports is not its own to claim.
 
         `(not imported(fqn)) or explicitly_includes(scope_include, packageOf(fqn))`
         — UNLIKE TypeScript this does NOT also apply `matches_scope` to the
diff --git a/server/python/src/metaobjects/library/__init__.py b/server/python/src/metaobjects/library/__init__.py
index 8e3fc5d74..c93121f29 100644
--- a/server/python/src/metaobjects/library/__init__.py
+++ b/server/python/src/metaobjects/library/__init__.py
@@ -4,6 +4,6 @@
 ``extends: "metaobjects::ai::LlmCallBase"`` on their own entity.
 """
 
-from .library_sources import known_packages, library_sources
+from .library_sources import known_packages, library_packages, library_sources
 
-__all__ = ["known_packages", "library_sources"]
+__all__ = ["known_packages", "library_packages", "library_sources"]
diff --git a/server/python/src/metaobjects/library/library_sources.py b/server/python/src/metaobjects/library/library_sources.py
index 54be13dea..cb5af8577 100644
--- a/server/python/src/metaobjects/library/library_sources.py
+++ b/server/python/src/metaobjects/library/library_sources.py
@@ -46,6 +46,21 @@
 }
 
 
+def library_packages() -> frozenset[str]:
+    """The union of ``packages`` across every shipped library manifest — the metamodel
+    packages the libraries own (``metaobjects::iam``, ``metaobjects::ai``).
+
+    The provenance key for requirement-coverage activation (FR-043 §5.4): a requirement
+    whose effective package is in this set came from a shipped library, not from the
+    adopter. Read from the embedded manifests, never from a node's source id — an id
+    differs between a checkout (a path) and an installed wheel (``library:<ref>.yaml``).
+    Mirrors the TS ``libraryPackages``.
+    """
+    return frozenset(
+        pkg for manifest in LIBRARY_MANIFESTS.values() for pkg in manifest.get("packages", [])
+    )
+
+
 #: The prefix every library source id carries — the discriminator for "did a shipped
 #: library contribute this file", and the reason the id is stable rather than derived
 #: from a path (see :func:`library_file_id`).
diff --git a/server/python/src/metaobjects/loader/validation_passes.py b/server/python/src/metaobjects/loader/validation_passes.py
index 1aa8bac3c..00ed8d161 100644
--- a/server/python/src/metaobjects/loader/validation_passes.py
+++ b/server/python/src/metaobjects/loader/validation_passes.py
@@ -4195,9 +4195,10 @@ def _validate_index_lookup_fields(root: MetaData, errors: list[MetaError]) -> No
 #   2. `@supersededBy` is legal ONLY on `retired`. Resolution of the reference is
 #      `verify`'s job; the loader owns the shape.
 #
-# `requirement.*` gate logic otherwise lives only in the TS CLI, which is exactly
-# why THIS rule belongs in the loader: a Python estate would otherwise be free to
-# author the shape the rule exists to prevent.
+# The requirement gate runs in every port's `verify` since ADR-0057 (when this rule
+# was written it ran only in the TS CLI), yet the rule stays in the loader: a shape
+# the loader refuses is unreachable in every port and in every program that loads
+# the model, whether or not anyone runs `verify`.
 #
 # ADR-0039: attrs() is the RESOLVING accessor in Python (attr() is own-only), so a
 # requirement inheriting its status through `extends` is judged on its EFFECTIVE one.
diff --git a/server/python/src/metaobjects/meta/core/requirement/meta_requirement.py b/server/python/src/metaobjects/meta/core/requirement/meta_requirement.py
index bb646f1a9..f928114e1 100644
--- a/server/python/src/metaobjects/meta/core/requirement/meta_requirement.py
+++ b/server/python/src/metaobjects/meta/core/requirement/meta_requirement.py
@@ -13,9 +13,11 @@
     REQUIREMENT_ATTR_IMPLEMENTED_BY,
     REQUIREMENT_ATTR_LEVEL,
     REQUIREMENT_ATTR_STATUS,
+    REQUIREMENT_ATTR_SUPERSEDED_BY,
     REQUIREMENT_ATTR_TRACKED_BY,
     REQUIREMENT_LINK_FLOOR_LEVEL,
     REQUIREMENT_STATUS_PLANNED,
+    REQUIREMENT_STATUS_RETIRED,
     REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES,
     REQUIREMENT_STATUSES_WITH_OUTSTANDING_WORK,
     REQUIREMENT_SUBTYPE_ARCHITECTURAL,
@@ -67,6 +69,19 @@ def tracked_by(self) -> list[str]:
         v = self.get_meta_attr(REQUIREMENT_ATTR_TRACKED_BY)
         return [str(x) for x in v] if isinstance(v, list) else []
 
+    def superseded_by(self) -> str | None:
+        """ADR-0039: resolving. The requirement that REPLACED this one (FR-039).
+        Legal on ``retired`` only; ``verify`` resolves it against the ledger, so a
+        supersession chain stays walkable. ``None`` when absent or blank."""
+        v = self.get_meta_attr(REQUIREMENT_ATTR_SUPERSEDED_BY)
+        return v if isinstance(v, str) and v.strip() != "" else None
+
+    def is_retired(self) -> bool:
+        """Built, then deliberately removed. Carries no ``@implementedBy`` (the
+        loader refuses it), never counts toward object coverage, and is exempt from
+        the architectural universality check — a withdrawn policy governs nothing."""
+        return self.status() == REQUIREMENT_STATUS_RETIRED
+
     def is_planned(self) -> bool:
         """Intended but not built. Its nodes may legitimately not exist yet, and
         it must NOT count toward object coverage — planning a capability cannot
diff --git a/server/python/src/metaobjects/meta/core/requirement/resolve_claim.py b/server/python/src/metaobjects/meta/core/requirement/resolve_claim.py
new file mode 100644
index 000000000..73af4c002
--- /dev/null
+++ b/server/python/src/metaobjects/meta/core/requirement/resolve_claim.py
@@ -0,0 +1,93 @@
+"""resolve_claim — resolve an ``@implementedBy`` reference to the node it names.
+
+ONE resolver shared by the requirement gate (:mod:`metaobjects.requirement_check`) and
+the requirement-test generator, so the ADR-0042 package-local binding contract is not
+forked. Mirrors the TS reference ``metadata/src/core/requirement/resolve-claim.ts``
+(contract Table B).
+"""
+
+from __future__ import annotations
+
+from metaobjects.meta.meta_data import MetaData
+from metaobjects.naming_refs import resolve_object_ref
+from metaobjects.shared.base_types import TYPE_OBJECT, TYPE_REQUIREMENT
+from metaobjects.shared.separators import PACKAGE_SEP
+
+
+def split_member_ref(ref: str) -> tuple[str, list[str]]:
+    """Split a member reference into its owning object ref and the dotted member path.
+
+    ``::`` qualifies the ROOT-level node only, so the object ref ends at the FIRST
+    ``.`` after the last ``::``.
+    ``acme::sales::Order.total.display`` -> ``("acme::sales::Order", ["total", "display"])``.
+    """
+    pkg_end = ref.rfind(PACKAGE_SEP)
+    start = 0 if pkg_end == -1 else pkg_end + len(PACKAGE_SEP)
+    dot = ref.find(".", start)
+    if dot == -1:
+        return ref, []
+    return ref[:dot], ref[dot + 1 :].split(".")
+
+
+def resolve_claim_target(root: MetaData, owner: str, referrer_pkg: str) -> MetaData | None:
+    """Resolve the owner segment of an ``@implementedBy`` reference to the node it names.
+
+    OBJECTS FIRST, through the loader's own resolver, so package-local binding stays
+    the ADR-0042 contract and never a parallel name scan (#228).
+
+    Then ROOT-LEVEL NON-OBJECT nodes — ``template.prompt`` and its siblings today. A
+    declared prompt is a model node a capability can live in, so L4 means "a declared
+    top-level model node", not "an object". Requirements themselves are excluded:
+    hierarchy is nesting, and a requirement claiming a requirement would be a second,
+    contradictory parent mechanism.
+    """
+    node = resolve_object_ref(root, owner, referrer_pkg)
+    if node is not None:
+        return node
+
+    candidates = [c for c in root.children() if c.type != TYPE_OBJECT and c.type != TYPE_REQUIREMENT]
+
+    # A fully-qualified reference binds exactly, like every other FQN in the model.
+    if PACKAGE_SEP in owner:
+        return next((c for c in candidates if c.resolution_key() == owner), None)
+    # A bare reference prefers the referrer's own package, then a root-level node of that
+    # bare name. An ambiguous bare name binds NOTHING — the same fail-closed rule objects
+    # use, because silently picking one of two same-named nodes is how a claim ends up
+    # pointing at the wrong thing without anyone noticing.
+    if referrer_pkg:
+        local = [c for c in candidates if c.resolution_key() == f"{referrer_pkg}{PACKAGE_SEP}{owner}"]
+        if len(local) == 1:
+            return local[0]
+    # Root-level (unpackaged) only, matching resolve_object_ref's own bare fallback. A bare
+    # ref must not reach into an arbitrary package just because the name is unique there.
+    bare = [c for c in candidates if c.name == owner and c.resolution_key() == owner]
+    return bare[0] if len(bare) == 1 else None
+
+
+def resolve_member(obj: MetaData, path: list[str]) -> MetaData | None:
+    """Walk dotted member segments by CHILD NAME from an object node, to full depth.
+
+    Exported beside :func:`resolve_claim_target` because the gate's coverage pass needs the
+    OWNER node's ``resolution_key()`` while using member resolution only as a yes/no
+    validity test; composing them would key coverage on the member instead of the object.
+    """
+    cur: MetaData | None = obj
+    for seg in path:
+        if cur is None:
+            return None
+        cur = next((c for c in cur.children() if c.name == seg), None)
+    return cur
+
+
+def resolve_claim(root: MetaData, ref: str, referrer_pkg: str) -> MetaData | None:
+    """Resolve a full ``@implementedBy`` reference — owner segment plus any dotted member
+    segments — to the node it names, or ``None`` when it does not resolve.
+
+    Resolution walks to the FULL depth of the reference, so ``Council.slug.display``
+    yields the view node rather than stopping at the field.
+    """
+    segs = ref.split(".")
+    owner = resolve_claim_target(root, segs[0], referrer_pkg)
+    if owner is None or len(segs) == 1:
+        return owner
+    return resolve_member(owner, segs[1:])
diff --git a/server/python/src/metaobjects/requirement_check.py b/server/python/src/metaobjects/requirement_check.py
new file mode 100644
index 000000000..a228a9796
--- /dev/null
+++ b/server/python/src/metaobjects/requirement_check.py
@@ -0,0 +1,551 @@
+"""``metaobjects verify`` — the requirement (capability) gate.
+
+Requirements are METADATA: ``requirement.functional`` / ``requirement.architectural``
+are registered metamodel types, declared beside the entities they describe. So this
+module parses NOTHING. It reads ``requirement.*`` nodes off the already-loaded model and
+checks the things the loader cannot.
+
+Division of labour:
+
+* LOADER (unconditional) — the ``@status`` enum, required attrs, child rules.
+* VERIFY (conditional) — ``@implementedBy`` resolution, whose SEVERITY DEPENDS ON
+  ``@status``: a ``planned`` requirement names nodes that do not exist YET, so a loader
+  ``references`` descriptor (which always errors on an unresolved target) cannot hold it.
+
+Two kinds, opposite checks: ``functional`` WARNS when nothing implements it (and a named
+implementor that is gone is an error); ``architectural`` fails a live policy applied to
+nothing — claim-set arithmetic, deliberately not a predicate DSL.
+
+Mirrors the TS reference ``packages/cli/src/lib/requirement-check.ts`` — the codes, their
+conditions, their order and their message text. The shared corpus is
+``fixtures/requirement-check-conformance/``; ADR-0057.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Callable, cast
+
+from metaobjects.library import library_packages
+from metaobjects.meta.core.requirement.meta_requirement import MetaRequirement
+from metaobjects.meta.core.requirement.requirement_constants import (
+    REQUIREMENT_DISPOSITION_DEFERRED,
+    REQUIREMENT_LEVEL_MEMBER,
+    REQUIREMENT_LINK_FLOOR_LEVEL,
+    REQUIREMENT_MAX_LEVEL,
+    REQUIREMENT_MIN_LEVEL,
+    REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES,
+    REQUIREMENT_SUBTYPE_ARCHITECTURAL,
+)
+from metaobjects.meta.core.requirement.resolve_claim import (
+    resolve_claim_target,
+    resolve_member,
+    split_member_ref,
+)
+from metaobjects.meta.core.object.object_constants import OBJECT_SUBTYPE_ENTITY
+from metaobjects.meta.meta_data import MetaData
+from metaobjects.naming_refs import did_you_mean_hint
+from metaobjects.shared.base_types import TYPE_OBJECT, TYPE_REQUIREMENT
+from metaobjects.shared.separators import PACKAGE_SEP
+
+SEVERITY_ERROR = "error"
+SEVERITY_WARN = "warn"
+
+ERR_REQUIREMENT_LINK_ABOVE_FLOOR = "ERR_REQUIREMENT_LINK_ABOVE_FLOOR"
+ERR_REQUIREMENT_DANGLING_REF = "ERR_REQUIREMENT_DANGLING_REF"
+ERR_REQUIREMENT_BAD_LEVEL = "ERR_REQUIREMENT_BAD_LEVEL"
+ERR_REQUIREMENT_LEVEL_NESTING = "ERR_REQUIREMENT_LEVEL_NESTING"
+ERR_REQUIREMENT_L4_NOT_OBJECT = "ERR_REQUIREMENT_L4_NOT_OBJECT"
+ERR_REQUIREMENT_L5_NOT_MEMBER = "ERR_REQUIREMENT_L5_NOT_MEMBER"
+ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS = "ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS"
+WARN_REQUIREMENT_OBJECT_UNCLAIMED = "WARN_REQUIREMENT_OBJECT_UNCLAIMED"
+WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE = "WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE"
+WARN_REQUIREMENT_DEFERRED_UNTRACKED = "WARN_REQUIREMENT_DEFERRED_UNTRACKED"
+WARN_REQUIREMENT_NOTHING_IMPLEMENTS = "WARN_REQUIREMENT_NOTHING_IMPLEMENTS"
+
+#: Severity of the object-coverage gate. It stays ``"warn"``: on a real estate carrying a
+#: single requirement the gate reports every entity, so at ``"error"`` a project adopting
+#: requirements incrementally would fail its first ``verify`` after authoring one entry,
+#: which teaches people to delete the entry. Promotion is a one-line flip here.
+OBJECT_COVERAGE_SEVERITY = SEVERITY_WARN
+
+
+@dataclass(frozen=True)
+class Diagnostic:
+    severity: str  # "error" | "warn"
+    code: str
+    message: str
+    #: The subject's ADDRESS — the dotted child-name path. Two branches of a ledger may
+    #: reuse a NAME, so a bare name does not locate the node. ``None`` on a diagnostic
+    #: whose subject is not a requirement (object coverage names the entity instead).
+    path: str | None = None
+
+
+@dataclass(frozen=True)
+class AddressedRequirement:
+    """A requirement paired with its ADDRESS — the dotted child-name path from the root."""
+
+    node: MetaRequirement
+    path: str
+
+
+@dataclass
+class RequirementSummary:
+    """Counts behind the summary line ``verify`` prints on every run, clean or not."""
+
+    total: int
+    functional: int = 0
+    architectural: int = 0
+    by_status: dict[str, int] = field(default_factory=dict)
+    #: planned or partial with NO disposition recorded — the unreviewed gaps.
+    undecided: int = 0
+    #: deferred entries naming no ticket, so nobody will be reminded.
+    deferred_untracked: int = 0
+    #: ``None`` when coverage was not measured: a number here is a ratio the project is
+    #: held to; ``None`` is the honest reading of "this project authored no requirement
+    #: of its own, so it asked to be held to none".
+    entities_total: int | None = None
+    entities_claimed: int | None = None
+
+
+@dataclass(frozen=True)
+class RequirementScan:
+    """What one ``verify`` run computes once and both requirement passes read."""
+
+    addressed: list[AddressedRequirement]
+    claimed_objects: frozenset[str]
+    #: Whether object coverage applies at all on this run (FR-043 §5.4).
+    measure_coverage: bool
+    #: ADR-0057 — the strict switch: ``WARN_REQUIREMENT_NOTHING_IMPLEMENTS`` is reported
+    #: at severity ``error``. The code, path and message do not change.
+    require_implementers: bool
+    #: FR-023 — narrows which entities count; ``None`` means every non-abstract entity.
+    coverable: Callable[[str], bool] | None = None
+
+
+def effective_package(req: MetaRequirement) -> str:
+    """A requirement's effective package (contract Table A): the one it declares, else the
+    one the loader carried down from the nearest enclosing node that declares one, else its
+    file's default, else ``""``. Public because the requirement-test identity function must
+    use this ONE answer, not a second copy of it: it is also the referrer package every
+    ``@implementedBy`` reference binds in."""
+    return req.package or req.file_default_package or ""
+
+
+def collect_addressed_requirements(root: MetaData) -> list[AddressedRequirement]:
+    """Every ``requirement.*`` node in the tree, at any depth, each with its dotted path.
+
+    Hierarchy IS nesting, so this is a walk. Only a requirement contributes a path
+    segment; an intervening non-requirement node is traversed THROUGH. The traversal
+    descends through EVERY node, so a requirement somewhere the child rules did not
+    anticipate is still gated — the fail-closed direction for a gate.
+    """
+    out: list[AddressedRequirement] = []
+
+    def walk(n: MetaData, prefix: str) -> None:
+        for c in n.children():
+            is_req = c.type == TYPE_REQUIREMENT
+            path = (c.name if prefix == "" else f"{prefix}.{c.name}") if is_req else prefix
+            if is_req:
+                out.append(AddressedRequirement(cast(MetaRequirement, c), path))
+            walk(c, path)
+
+    walk(root, "")
+    return out
+
+
+def _resolve_requirement_ref(
+    addressed: list[AddressedRequirement], ref: str, referrer_pkg: str
+) -> MetaRequirement | None:
+    """Resolve a ``@supersededBy`` reference against the LEDGER, not the model: a
+    capability is replaced by another capability. Keyed by ``<package>::<path>`` and by the
+    bare path (first one wins, so a bare path ambiguous across packages still binds)."""
+    keyed: dict[str, MetaRequirement] = {}
+    for item in addressed:
+        pkg = effective_package(item.node)
+        if pkg != "":
+            keyed[f"{pkg}{PACKAGE_SEP}{item.path}"] = item.node
+        if item.path not in keyed:
+            keyed[item.path] = item.node
+    exact = keyed.get(ref)
+    if exact is not None:
+        return exact
+    if referrer_pkg != "":
+        return keyed.get(f"{referrer_pkg}{PACKAGE_SEP}{ref}")
+    return None
+
+
+def _missing_member_hint(obj: MetaData, path: list[str]) -> str:
+    """Names the FIRST segment of a non-empty, unresolvable ``path`` under ``obj``, and the
+    node it was looked for under."""
+    found = 0
+    while found < len(path) - 1 and resolve_member(obj, path[: found + 1]) is not None:
+        found += 1
+    parent = ".".join([obj.resolution_key(), *path[:found]])
+    return f" '{parent}' has no member '{path[found]}'."
+
+
+def _subtypes_of(root: MetaData, ancestor: MetaData) -> list[str]:
+    """Resolution keys of every root-level object whose ``extends`` chain reaches
+    ``ancestor``. Walks the RESOLVED super pointer, never the raw string."""
+    out: list[str] = []
+    for cand in root.children():
+        if cand.type != TYPE_OBJECT or cand is ancestor:
+            continue
+        seen: set[int] = set()
+        cur = cand.super_data
+        while cur is not None and id(cur) not in seen:
+            seen.add(id(cur))
+            if cur is ancestor:
+                out.append(cand.resolution_key())
+                break
+            cur = cur.super_data
+    return out
+
+
+def _subtree_claims_anything(req: MetaRequirement) -> bool:
+    """True when this requirement, or anything nested beneath it, names an implementing
+    node. Subtree-scoped deliberately: an L1 solution that delegates everything to its
+    children implements nothing directly, and flagging that would fire on every tree."""
+    if req.implemented_by():
+        return True
+    for child in req.children():
+        if child.type != TYPE_REQUIREMENT:
+            continue
+        if _subtree_claims_anything(cast(MetaRequirement, child)):
+            return True
+    return False
+
+
+def _project_authored_requirements(addressed: list[AddressedRequirement]) -> bool:
+    """Did the ADOPTER author any of these requirements? (FR-043 §5.4.)
+
+    Provenance is the library's declared PACKAGE, a manifest fact; a node's source id
+    differs between a checkout and an installed wheel. An adopter OVERLAYING a library
+    requirement stays in the library's package and is deliberately not authoring one."""
+    lib_pkgs = library_packages()
+    return any(effective_package(item.node) not in lib_pkgs for item in addressed)
+
+
+def _claimed_object_keys(root: MetaData, reqs: list[MetaRequirement]) -> frozenset[str]:
+    """Resolution keys of every object claimed by a requirement, shared by the gate and
+    the summary so the two cannot disagree."""
+    claimed: set[str] = set()
+    for req in reqs:
+        # A PLANNED requirement never contributes to coverage: otherwise the cheapest way
+        # to clear an unclaimed-entity warning would be to declare an intention.
+        if req.is_planned():
+            continue
+        referrer_pkg = effective_package(req)
+        for ref in req.implemented_by():
+            owner, path = split_member_ref(ref)
+            node = resolve_claim_target(root, owner, referrer_pkg)
+            if node is None:
+                continue
+            if path and resolve_member(node, path) is None:
+                continue
+            claimed.add(node.resolution_key())
+            # ARCHITECTURAL claims propagate DOWN the extends chain; functional ones do not.
+            if req.sub_type == REQUIREMENT_SUBTYPE_ARCHITECTURAL:
+                claimed.update(_subtypes_of(root, node))
+    return frozenset(claimed)
+
+
+def scan_requirements(
+    root: MetaData,
+    *,
+    coverable: Callable[[str], bool] | None = None,
+    measure_coverage: bool | None = None,
+    require_implementers: bool = False,
+) -> RequirementScan:
+    """Compute, once, what the gate and the summary both read.
+
+    ``measure_coverage`` forces coverage on or off instead of deriving it; the one caller
+    that legitimately knows better is a gate over a shipped library loaded standalone.
+    """
+    addressed = collect_addressed_requirements(root)
+    return RequirementScan(
+        addressed=addressed,
+        claimed_objects=_claimed_object_keys(root, [a.node for a in addressed]),
+        measure_coverage=(
+            measure_coverage if measure_coverage is not None else _project_authored_requirements(addressed)
+        ),
+        require_implementers=require_implementers,
+        coverable=coverable,
+    )
+
+
+def _coverable_entities(root: MetaData, coverable: Callable[[str], bool] | None) -> list[MetaData]:
+    """The entities object coverage measures — the same set for the gate and the summary.
+
+    An ABSTRACT entity is shape, not data, so it is exempt; ``object.value`` and
+    ``object.projection`` are exempt too. ``coverable`` (FR-023) is applied INSIDE this
+    function so every call site inherits it."""
+    return [
+        n
+        for n in root.children()
+        if n.type == TYPE_OBJECT
+        and n.sub_type == OBJECT_SUBTYPE_ENTITY
+        # ADR-0039 sanctioned own-only read: abstractness describes THIS declaration and is
+        # never inherited, so `is_abstract` is read as the node's own flag.
+        and not n.is_abstract
+        and (coverable is None or coverable(n.resolution_key()))
+    ]
+
+
+def check_requirements(root: MetaData, scan: RequirementScan | None = None) -> list[Diagnostic]:
+    """Check the requirement tree against the loaded model.
+
+    What a clean run proves: referential integrity — links sit at or below the link floor,
+    nesting agrees with levels, and references resolve. What it CANNOT prove: that a status
+    is *true*, or that a node actually implements the requirement claiming it.
+    """
+    scan = scan if scan is not None else scan_requirements(root)
+    out: list[Diagnostic] = []
+    if not scan.addressed:
+        return out  # opt-in by declaration — no requirements, nothing to say
+
+    for item in scan.addressed:
+        req, req_path = item.node, item.path
+        architectural = req.sub_type == REQUIREMENT_SUBTYPE_ARCHITECTURAL
+        level = req.level()
+        refs = req.implemented_by()
+
+        # -- the level rules. A functional requirement MUST be levelled; an architectural
+        # one MAY be, and levelling is the OPT-IN.
+        levelled = level is not None
+        if not architectural or levelled:
+            if level is None or level < REQUIREMENT_MIN_LEVEL or level > REQUIREMENT_MAX_LEVEL:
+                out.append(
+                    Diagnostic(
+                        SEVERITY_ERROR,
+                        ERR_REQUIREMENT_BAD_LEVEL,
+                        f"level must be an integer {REQUIREMENT_MIN_LEVEL}-{REQUIREMENT_MAX_LEVEL} "
+                        f"(got {'undefined' if level is None else level}). "
+                        "L1 solution, L2 segment (app/library), L3 service, L4 object, L5 member."
+                        + (
+                            " On an architectural requirement the level is optional — omit it for a flat policy."
+                            if architectural
+                            else ""
+                        ),
+                        req_path,
+                    )
+                )
+            # Nesting IS the hierarchy, so a child must sit strictly below its parent.
+            parent = req.parent
+            if parent is not None and parent.type == TYPE_REQUIREMENT:
+                pl = cast(MetaRequirement, parent).level()
+                if pl is not None and level is not None and level <= pl:
+                    out.append(
+                        Diagnostic(
+                            SEVERITY_ERROR,
+                            ERR_REQUIREMENT_LEVEL_NESTING,
+                            f'nested under "{parent.name}" (level {pl}) but declares level {level}. '
+                            "Nesting is the hierarchy — a child sits strictly below its parent.",
+                            req_path,
+                        )
+                    )
+
+        # -- the link boundary
+        if refs and not req.may_reference_model():
+            out.append(
+                Diagnostic(
+                    SEVERITY_ERROR,
+                    ERR_REQUIREMENT_LINK_ABOVE_FLOOR,
+                    f"'implementedBy' is legal at L{REQUIREMENT_LINK_FLOOR_LEVEL} (object) and "
+                    f"L{REQUIREMENT_MAX_LEVEL} (member) only. L1-L3 are organisational and never reference "
+                    f"the model — move the links to a nested L{REQUIREMENT_LINK_FLOOR_LEVEL} child.",
+                    req_path,
+                )
+            )
+            continue
+
+        for ref in refs:
+            owner, path = split_member_ref(ref)
+            referrer_pkg = effective_package(req)
+            node = resolve_claim_target(root, owner, referrer_pkg)
+            is_object_ref = not path
+
+            # GRAIN stays functional-only DELIBERATELY: on a levelled architectural
+            # requirement the upper tiers are a quality taxonomy, and a policy whose claim
+            # set legitimately mixes grains must not be forced to split by grain.
+            if not architectural and level == REQUIREMENT_LINK_FLOOR_LEVEL and not is_object_ref:
+                out.append(
+                    Diagnostic(
+                        SEVERITY_ERROR,
+                        ERR_REQUIREMENT_L4_NOT_OBJECT,
+                        f"L{REQUIREMENT_LINK_FLOOR_LEVEL} references an object; '{ref}' names a member. "
+                        f"Move it to a nested L{REQUIREMENT_LEVEL_MEMBER} child, or reference the object itself.",
+                        req_path,
+                    )
+                )
+                continue
+            if not architectural and level == REQUIREMENT_LEVEL_MEMBER and is_object_ref:
+                out.append(
+                    Diagnostic(
+                        SEVERITY_ERROR,
+                        ERR_REQUIREMENT_L5_NOT_MEMBER,
+                        f"L{REQUIREMENT_LEVEL_MEMBER} references a member (field, view or identity); "
+                        f"'{ref}' names an object. Move it to its L{REQUIREMENT_LINK_FLOOR_LEVEL} parent.",
+                        req_path,
+                    )
+                )
+                continue
+
+            resolved = node is not None and (is_object_ref or resolve_member(node, path) is not None)
+            if not resolved and req.requires_live_nodes():
+                # The did-you-mean hint answers an OBJECT that failed to resolve. When the
+                # object resolved and only the member is gone, name the member instead.
+                hint = did_you_mean_hint(root, owner) if node is None else _missing_member_hint(node, path)
+                out.append(
+                    Diagnostic(
+                        SEVERITY_ERROR,
+                        ERR_REQUIREMENT_DANGLING_REF,
+                        f"'{ref}' does not resolve in the loaded model (status '{req.status()}' — "
+                        "the model moved and the requirement is stale)." + hint,
+                        req_path,
+                    )
+                )
+
+        # -- @supersededBy resolution (FR-039): the target is a REQUIREMENT, resolved
+        # package-locally under ADR-0042 through the requirement's own effective package.
+        superseded = req.superseded_by()
+        if superseded is not None:
+            if _resolve_requirement_ref(scan.addressed, superseded, effective_package(req)) is None:
+                out.append(
+                    Diagnostic(
+                        SEVERITY_ERROR,
+                        ERR_REQUIREMENT_DANGLING_REF,
+                        f"@supersededBy '{superseded}' does not name a requirement in the loaded "
+                        "ledger. It must name the requirement that REPLACED this one — if nothing did, "
+                        "drop the attribute and let `notes` carry why the capability went.",
+                        req_path,
+                    )
+                )
+
+        # -- architectural universality, v1: claim-set arithmetic. Two structural
+        # exemptions: `planned` (supposed to be applied to nothing), and an
+        # ORGANISATIONAL node of a levelled tree (may_reference_model() is false there).
+        status = req.status()
+        live = status is not None and status in REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES
+        if architectural and live and not refs and req.may_reference_model():
+            out.append(
+                Diagnostic(
+                    SEVERITY_ERROR,
+                    ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS,
+                    f"architectural requirement is '{status}' but nothing implements it. "
+                    "Its check is universality — a claim set of zero means the policy is declared and unapplied.",
+                    req_path,
+                )
+            )
+
+        # -- disposition: the decision, not the state
+        disposition = req.disposition()
+        if disposition is not None and not req.has_outstanding_work():
+            out.append(
+                Diagnostic(
+                    SEVERITY_WARN,
+                    WARN_REQUIREMENT_DISPOSITION_NOT_APPLICABLE,
+                    f"carries @disposition '{disposition}' but its status is '{status}', which has no "
+                    "outstanding work to decide about. A disposition is meaningful on 'planned' and 'partial' only — "
+                    "on any other status the decision IS the status.",
+                    req_path,
+                )
+            )
+
+        # -- functional existence, SUBTREE-scoped. The strict switch (ADR-0057) raises the
+        # SEVERITY only; the code keeps its `WARN_` name because it identifies the finding.
+        if not architectural and live and not _subtree_claims_anything(req):
+            out.append(
+                Diagnostic(
+                    SEVERITY_ERROR if scan.require_implementers else SEVERITY_WARN,
+                    WARN_REQUIREMENT_NOTHING_IMPLEMENTS,
+                    f"is '{status}' but neither it nor anything nested under it names an "
+                    "implementing node. A functional requirement's check is existence — a subtree that claims "
+                    "nothing is a capability nobody built.",
+                    req_path,
+                )
+            )
+
+        if disposition == REQUIREMENT_DISPOSITION_DEFERRED and not req.tracked_by():
+            out.append(
+                Diagnostic(
+                    SEVERITY_WARN,
+                    WARN_REQUIREMENT_DEFERRED_UNTRACKED,
+                    "is deferred but names no @trackedBy issue. Deferring without a ticket is how a known gap "
+                    "becomes an unknown one — nothing will raise it again.",
+                    req_path,
+                )
+            )
+
+    # -- object coverage: adding an entity forces a requirement. Binary per entity, never a
+    # ratio. ENTITIES ONLY, OBJECT GRAIN ONLY, ADOPTER-AUTHORED ONLY (FR-043 §5.4).
+    if scan.measure_coverage:
+        for ent in _coverable_entities(root, scan.coverable):
+            key = ent.resolution_key()
+            if key not in scan.claimed_objects:
+                out.append(
+                    Diagnostic(
+                        OBJECT_COVERAGE_SEVERITY,
+                        WARN_REQUIREMENT_OBJECT_UNCLAIMED,
+                        f"no requirement claims '{key}'. Add it to an L{REQUIREMENT_LINK_FLOOR_LEVEL} "
+                        "requirement's 'implementedBy'.",
+                    )
+                )
+
+    return out
+
+
+def summarise_requirements(root: MetaData, scan: RequirementScan | None = None) -> RequirementSummary | None:
+    """Count what the ledger contains, for the line ``verify`` prints on EVERY run —
+    including a clean one, because silence cannot be told apart from "checked nothing".
+    ``None`` when the model declares no requirement."""
+    scan = scan if scan is not None else scan_requirements(root)
+    if not scan.addressed:
+        return None  # opt-in by declaration
+
+    summary = RequirementSummary(total=len(scan.addressed))
+
+    # `undecided` counts only the requirements a `@disposition` could actually SETTLE. A
+    # parent is `partial` because a descendant is, so a disposition on it would settle
+    # nothing. EVERY ancestor of a node with outstanding work is excluded, by path
+    # SEGMENT (`::` carries no dot, so a package-qualified root segment stays intact), and
+    # whether or not that descendant is itself disposed: once the only outstanding leaf has
+    # been ruled on, nothing beneath the parent is owed.
+    roll_up_ancestors: set[str] = set()
+    for item in scan.addressed:
+        if not item.node.has_outstanding_work():
+            continue
+        segments = item.path.split(".")
+        for i in range(1, len(segments)):
+            roll_up_ancestors.add(".".join(segments[:i]))
+
+    for item in scan.addressed:
+        req = item.node
+        if req.sub_type == REQUIREMENT_SUBTYPE_ARCHITECTURAL:
+            summary.architectural += 1
+        else:
+            summary.functional += 1
+
+        status = req.status()
+        # by_status is UNCHANGED by the roll-up rule: a parent is still genuinely `partial`.
+        if status is not None:
+            summary.by_status[status] = summary.by_status.get(status, 0) + 1
+
+        if req.has_outstanding_work() and req.disposition() is None and item.path not in roll_up_ancestors:
+            summary.undecided += 1
+        if req.disposition() == REQUIREMENT_DISPOSITION_DEFERRED and not req.tracked_by():
+            summary.deferred_untracked += 1
+
+    # Both sides of the ratio come from the SAME scan the gate read.
+    if scan.measure_coverage:
+        total = 0
+        claimed_count = 0
+        for ent in _coverable_entities(root, scan.coverable):
+            total += 1
+            if ent.resolution_key() in scan.claimed_objects:
+                claimed_count += 1
+        summary.entities_total = total
+        summary.entities_claimed = claimed_count
+
+    return summary
diff --git a/server/python/src/metaobjects/yaml_desugar.py b/server/python/src/metaobjects/yaml_desugar.py
index ceffeb033..dfb7ecc93 100644
--- a/server/python/src/metaobjects/yaml_desugar.py
+++ b/server/python/src/metaobjects/yaml_desugar.py
@@ -46,7 +46,7 @@
     ATTR_SUBTYPE_STRINGARRAY,
 )
 from .registry import AttrSchema, TypeRegistry
-from .shared.separators import ATTR_PREFIX, FUSED_KEY_SEP
+from .shared.separators import ATTR_PREFIX, FUSED_KEY_SEP, PACKAGE_SEP
 from .shared.structural import (
     KEY_ABSTRACT,
     KEY_CHILDREN,
diff --git a/server/python/tests/codegen/test_cli_registry.py b/server/python/tests/codegen/test_cli_registry.py
index 7d76d76c2..55377eb3a 100644
--- a/server/python/tests/codegen/test_cli_registry.py
+++ b/server/python/tests/codegen/test_cli_registry.py
@@ -39,8 +39,8 @@ def test_gen_list_prints_all_and_exits_zero(capsys, tmp_path: Path) -> None:
     # Every registered stable name appears in the listing.
     for name in GENERATOR_REGISTRY:
         assert name in out, f"--list omitted {name!r}"
-    # Exactly the 10 python-slice names are registered (ADR-0056 removed `payload`).
-    assert len(GENERATOR_REGISTRY) == 10
+    # Exactly the 11 python-slice names are registered (ADR-0056 removed `payload`).
+    assert len(GENERATOR_REGISTRY) == 11
     assert "payload" not in GENERATOR_REGISTRY
     # A template-tier generator says it needs the entity generator's models.
     assert "output-parser — " in out
diff --git a/server/python/tests/codegen/test_cli_verify_requirements.py b/server/python/tests/codegen/test_cli_verify_requirements.py
new file mode 100644
index 000000000..059183130
--- /dev/null
+++ b/server/python/tests/codegen/test_cli_verify_requirements.py
@@ -0,0 +1,477 @@
+"""``metaobjects verify`` — the requirement gate, end to end.
+
+It runs on EVERY ``verify`` (no subverb selects it), prints its summary and findings on
+stderr, and exits 1 on an error. The codes, paths and message text themselves are gated
+cross-port by ``tests/conformance/test_requirement_check_conformance.py``; these tests
+pin the wiring: what is printed, what reaches the exit code, and what must NOT change for
+a model that declares no ``requirement.*`` node.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import shutil
+import sys
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from metaobjects import cli
+from metaobjects.cli import main
+from tests.codegen.gen_suite import GEN_SUITE
+
+_PK = {"identity.primary": {"name": "pk", "@fields": ["id"]}}
+
+
+def _requirement(name: str, status: str, **attrs: Any) -> dict[str, Any]:
+    return {
+        "requirement.functional": {
+            "name": name,
+            "@level": 4,
+            "@status": status,
+            "@statement": f"{name} holds.",
+            "@counterexample": f"{name} does not hold.",
+            **{f"@{k}": v for k, v in attrs.items()},
+        }
+    }
+
+
+def _meta_dir(tmp_path: Path, requirements: list[dict[str, Any]]) -> str:
+    doc = {
+        "metadata.root": {
+            "package": "app",
+            "children": [
+                {"object.entity": {"name": "Order", "children": [{"field.long": {"name": "id"}}, _PK]}},
+                *requirements,
+            ],
+        }
+    }
+    d = tmp_path / "meta"
+    d.mkdir()
+    (d / "meta.app.json").write_text(json.dumps(doc))
+    return str(d)
+
+
+def _verify(tmp_path: Path, meta_dir: str, *extra: str) -> int:
+    out = tmp_path / "out"
+    assert main(["gen", "--generators", GEN_SUITE, meta_dir, "--out", str(out)]) == 0
+    return main(["verify", "--codegen", "--generators", GEN_SUITE, meta_dir, "--out", str(out), *extra])
+
+
+def test_a_model_with_no_requirements_prints_nothing_and_exits_as_before(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str], monkeypatch: pytest.MonkeyPatch
+) -> None:
+    meta_dir = _meta_dir(tmp_path, [])
+    capsys.readouterr()
+
+    # AFTER: the gate wired in.
+    after_code = _verify(tmp_path, meta_dir)
+    after = capsys.readouterr()
+
+    # BEFORE: the same run with the gate unplugged — what verify printed without it.
+    monkeypatch.setattr(cli, "_verify_requirements", lambda args, loaded=None: 0)
+    before_code = _verify(tmp_path, meta_dir)
+    before = capsys.readouterr()
+
+    assert (after_code, after.err, after.out) == (before_code, before.err, before.out)
+    assert after_code == 0
+    assert "requirements" not in after.err
+
+
+def test_a_dangling_live_reference_exits_1_and_prints_the_code_the_path_and_the_summary(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    meta_dir = _meta_dir(tmp_path, [_requirement("Recorded", "live", implementedBy=["Ordr"])])
+    capsys.readouterr()
+    assert _verify(tmp_path, meta_dir) == 1
+    err = capsys.readouterr().err
+    assert "metaobjects verify — requirements: 1 entries (1 functional, 0 architectural) — 1 live; " in err
+    assert "0/1 entities claimed, counted over 1 metadata file(s)." in err
+    assert "  ERR_REQUIREMENT_DANGLING_REF [Recorded]: 'Ordr' does not resolve in the loaded model" in err
+    assert "metaobjects verify — requirements: 1 error(s)." in err
+
+
+def test_warnings_alone_exit_0(tmp_path: Path, capsys: pytest.CaptureFixture[str]) -> None:
+    meta_dir = _meta_dir(tmp_path, [_requirement("Recorded", "live")])
+    capsys.readouterr()
+    assert _verify(tmp_path, meta_dir) == 0
+    err = capsys.readouterr().err
+    assert "  WARN_REQUIREMENT_NOTHING_IMPLEMENTS [Recorded]: is 'live' but neither it" in err
+    assert "  WARN_REQUIREMENT_OBJECT_UNCLAIMED: no requirement claims 'app::Order'." in err
+    assert "error(s)." not in err
+
+
+def test_require_implementers_flag_exits_1_on_a_nothing_implements_warning(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    meta_dir = _meta_dir(tmp_path, [_requirement("Recorded", "live")])
+    capsys.readouterr()
+    assert _verify(tmp_path, meta_dir, "--require-implementers") == 1
+    err = capsys.readouterr().err
+    assert "WARN_REQUIREMENT_NOTHING_IMPLEMENTS [Recorded]" in err
+    assert "metaobjects verify — requirements: 1 error(s)." in err
+
+
+def test_require_implementers_env_var_exits_1_on_a_nothing_implements_warning(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str], monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("META_REQUIRE_IMPLEMENTERS", "1")
+    meta_dir = _meta_dir(tmp_path, [_requirement("Recorded", "live")])
+    capsys.readouterr()
+    assert _verify(tmp_path, meta_dir) == 1
+    assert "metaobjects verify — requirements: 1 error(s)." in capsys.readouterr().err
+
+
+def test_the_gate_runs_with_templates_alone(tmp_path: Path, capsys: pytest.CaptureFixture[str]) -> None:
+    meta_dir = _meta_dir(tmp_path, [_requirement("Recorded", "live", implementedBy=["Ordr"])])
+    prompts = tmp_path / "prompts"
+    prompts.mkdir()
+    capsys.readouterr()
+    assert main(["verify", "--templates", "--prompts", str(prompts), meta_dir]) == 1
+    err = capsys.readouterr().err
+    assert "ERR_REQUIREMENT_DANGLING_REF [Recorded]" in err
+
+
+def test_a_metadata_load_failure_prints_no_requirement_line(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    meta_dir = tmp_path / "broken"
+    meta_dir.mkdir()
+    (meta_dir / "meta.app.json").write_text("{ not json")
+    prompts = tmp_path / "prompts"
+    prompts.mkdir()
+    capsys.readouterr()
+    code = main(["verify", "--templates", "--prompts", str(prompts), str(meta_dir)])
+    err = capsys.readouterr().err
+    assert code != 0
+    assert "requirements" not in err
+
+
+def test_a_failed_load_is_not_retried_by_the_gate(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str], monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """``None`` from the loader means "did not load"; the gate must not read it as "not supplied"."""
+    meta_dir = tmp_path / "broken"
+    meta_dir.mkdir()
+    (meta_dir / "meta.app.json").write_text("{ not json")
+    prompts = tmp_path / "prompts"
+    prompts.mkdir()
+    real = cli._load_verify_model
+    calls: list[int] = []
+
+    def counting(*args: Any) -> Any:
+        calls.append(1)
+        return real(*args)
+
+    monkeypatch.setattr(cli, "_load_verify_model", counting)
+    capsys.readouterr()
+    assert main(["verify", "--templates", "--prompts", str(prompts), str(meta_dir)]) != 0
+    assert len(calls) == 1
+
+
+def _raise_only_for_the_verify_model(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Make `_load_root` raise a bug-shaped error, but only for the verify model's own load, so
+    every earlier pass of the command runs normally and only the gate's input is affected."""
+    real = cli._load_root
+
+    def maybe_boom(*args: Any, **kwargs: Any) -> Any:
+        if sys._getframe(1).f_code.co_name == "_load_verify_model":
+            raise RuntimeError("loader bug")
+        return real(*args, **kwargs)
+
+    monkeypatch.setattr(cli, "_load_root", maybe_boom)
+
+
+def test_an_unexpected_load_exception_does_not_turn_the_gate_off_with_exit_0(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """A bug in the loader is not "no requirements declared": it must reach the caller, at the
+    helper and at the command."""
+    meta_dir = _meta_dir(tmp_path, [_requirement("Recorded", "live", implementedBy=["Ordr"])])
+    out = tmp_path / "out"
+    assert main(["gen", "--generators", GEN_SUITE, meta_dir, "--out", str(out)]) == 0
+    _raise_only_for_the_verify_model(monkeypatch)
+    with pytest.raises(RuntimeError, match="loader bug"):
+        cli._load_verify_model(argparse.Namespace(metadata_dir=meta_dir, provider=None))
+
+    capsys.readouterr()
+    with pytest.raises(RuntimeError, match="loader bug"):
+        main(["verify", "--codegen", "--generators", GEN_SUITE, meta_dir, "--out", str(out)])
+    # The gate did not report success on its behalf.
+    assert "requirements:" not in capsys.readouterr().err
+
+
+def test_the_load_errors_the_loader_raises_still_mean_nothing_to_read(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    meta_dir = _meta_dir(tmp_path, [])
+    for exc in (cli.ParseError("bad"), OSError("unreadable"), cli.ConfigError("bad config")):
+
+        def raising(*_a: Any, _exc: Exception = exc, **_k: Any) -> Any:
+            raise _exc
+
+        monkeypatch.setattr(cli, "_load_root", raising)
+        assert cli._load_verify_model(argparse.Namespace(metadata_dir=meta_dir, provider=None)) is None
+
+
+_ARTIFACT = (
+    Path(__file__).resolve().parents[4]
+    / "fixtures"
+    / "dependency-conformance"
+    / "artifacts"
+    / "acme-common-v1.json"
+)
+_LOCK_V1 = {
+    "schema_version": 1,
+    "dependencies": {
+        "acme-common": {
+            "version": "1.0.0",
+            "metamodelVersion": "1.0",
+            "resolvedFrom": {"path": "../acme-common/metaobjects"},
+            "artifact": "acme-common.metaobjects.json",
+            "integrity": "sha256-10fbf886e22faceca32c56e5e647c3ff1c82f503e638cba3bd3aa9390f7c409d",
+            "packages": ["acme::common"],
+            "nodes": ["acme::common::Address", "acme::common::Audited", "acme::common::Customer"],
+        }
+    },
+}
+
+
+def test_config_mode_counts_only_in_scope_entities_and_says_how_many_files_came_from_dependencies(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """The collection path: ``coverable=collection.in_scope``, the file count, the
+    ``, <n> from dependencies.`` suffix and the undecided-gap line."""
+    (tmp_path / "metaobjects").mkdir()
+    doc = {
+        "metadata.root": {
+            "package": "app",
+            "children": [
+                {"object.entity": {"name": "Order", "children": [{"field.long": {"name": "id"}}, _PK]}},
+                _requirement("Recorded", "partial"),
+            ],
+        }
+    }
+    (tmp_path / "metaobjects" / "meta.app.json").write_text(json.dumps(doc))
+    deps = tmp_path / ".metaobjects" / "deps" / "acme-common"
+    deps.mkdir(parents=True)
+    shutil.copyfile(_ARTIFACT, deps / "acme-common.metaobjects.json")
+    (tmp_path / ".metaobjects" / "config.json").write_text(
+        json.dumps(
+            {
+                "schema_version": 1,
+                "sources": [],
+                "dependencies": [{"name": "acme-common", "path": "../acme-common/metaobjects"}],
+            }
+        )
+    )
+    (tmp_path / ".metaobjects" / "deps.lock.json").write_text(json.dumps(_LOCK_V1))
+    cfg = tmp_path / "metaobjects.config.yaml"
+    cfg.write_text("metadata: metaobjects\ntargets:\n  main:\n    outDir: gen\n    generators: [names]\n")
+
+    assert main(["gen", "--generators", GEN_SUITE, "--config", str(cfg)]) == 0
+    capsys.readouterr()
+    code = main(["verify", "--codegen", "--generators", GEN_SUITE, "--config", str(cfg)])
+    err = capsys.readouterr().err
+
+    assert code == 0
+    # Order is the only entity in scope: the dependency's three are not the project's to claim.
+    assert (
+        "requirements: 1 entries (1 functional, 0 architectural) — 1 partial; "
+        "0/1 entities claimed, counted over 2 metadata file(s), 1 from dependencies." in err
+    )
+    assert "requirements: 1 recorded gap(s) with no @disposition." in err
+
+
+# ---------------------------------------------------------------------------
+# A model that does not LOAD is reported by the gate and fails `verify`. It is not "a model
+# with no requirement": on `verify <dir> --out <empty dir>` no other gate loads anything
+# (`--codegen` with nothing selected returns before the load), so the gate's own load is the
+# only one, and what it finds is the only report there will be.
+# ---------------------------------------------------------------------------
+
+_MODEL_YAML = """\
+metadata.root:
+  package: app
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.long: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+    - requirement.functional:
+        name: Recorded
+        level: 4
+        status: live
+        statement: An order is recorded.
+        counterexample: A placed order has no row.
+        implementedBy: [Ordr]
+"""
+
+_NO_GENERATORS_LINE = "verify --codegen: no generators selected and no generated output to check."
+
+
+def _yaml_dir(tmp_path: Path, text: str) -> str:
+    d = tmp_path / "meta"
+    d.mkdir()
+    (d / "meta.app.yaml").write_text(text)
+    return str(d)
+
+
+def _verify_with_nothing_selected(tmp_path: Path, meta_dir: str, *extra: str) -> int:
+    """``metaobjects verify <dir> --out <empty dir>``: bare, so `--codegen` by default, with no
+    `--generators`, which is the invocation where no other gate loads the model."""
+    out = tmp_path / "empty-out"
+    out.mkdir(exist_ok=True)
+    return main(["verify", meta_dir, "--out", str(out), *extra])
+
+
+def test_with_no_generators_selected_the_gate_is_still_reached(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """The control for the three below: same invocation, a model that loads."""
+    meta_dir = _yaml_dir(tmp_path, _MODEL_YAML)
+    capsys.readouterr()
+    assert _verify_with_nothing_selected(tmp_path, meta_dir) == 1
+    captured = capsys.readouterr()
+    assert "metaobjects verify — requirements: 1 entries (1 functional, 0 architectural) — 1 live; " in captured.err
+    assert "  ERR_REQUIREMENT_DANGLING_REF [Recorded]: 'Ordr' does not resolve" in captured.err
+    assert "metaobjects verify — requirements: 1 error(s)." in captured.err
+    assert _NO_GENERATORS_LINE in captured.out
+
+
+def test_a_status_the_loader_refuses_fails_verify_when_no_other_gate_loaded_the_model(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    meta_dir = _yaml_dir(tmp_path, _MODEL_YAML.replace("status: live", "status: bogus"))
+    capsys.readouterr()
+    code = _verify_with_nothing_selected(tmp_path, meta_dir)
+    err = capsys.readouterr().err
+    assert code != 0
+    assert "error: failed to load metadata:" in err
+    assert "bogus" in err  # the loader's own message, naming the refused value
+    assert "requirements:" not in err  # no summary for a model that did not load
+
+
+def test_a_yaml_syntax_error_fails_verify_when_no_other_gate_loaded_the_model(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    meta_dir = _yaml_dir(tmp_path, "metadata.root:\n  package: app\n  children: [ {\n")
+    capsys.readouterr()
+    code = _verify_with_nothing_selected(tmp_path, meta_dir)
+    err = capsys.readouterr().err
+    assert code != 0
+    assert "error: failed to load metadata:" in err
+    assert "ERR_MALFORMED_YAML" in err
+    assert "requirements:" not in err
+
+
+def test_a_mistyped_attribute_is_refused_by_the_gates_own_load_unless_lax(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str], monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The gate's load is strict, as every other gate of this command is: `implementdBy` is not
+    quietly read as "this requirement names no implementer"."""
+    # Once `--lax` loads it, the requirement names no implementer: a warning, unless the shell
+    # running the tests has the strict switch exported.
+    monkeypatch.delenv("META_REQUIRE_IMPLEMENTERS", raising=False)
+    meta_dir = _yaml_dir(tmp_path, _MODEL_YAML.replace("implementedBy: [Ordr]", "implementdBy: [Order]"))
+    capsys.readouterr()
+    code = _verify_with_nothing_selected(tmp_path, meta_dir)
+    err = capsys.readouterr().err
+    assert code != 0
+    assert "error: failed to load metadata:" in err
+    assert "ERR_UNKNOWN_ATTR" in err and "implementdBy" in err
+    assert "requirements:" not in err
+
+    # `--lax` is the documented way to load it anyway, and then the gate reads what loaded.
+    assert _verify_with_nothing_selected(tmp_path, meta_dir, "--lax") == 0
+    lax_err = capsys.readouterr().err
+    assert "failed to load metadata" not in lax_err
+    assert "metaobjects verify — requirements: 1 entries" in lax_err
+
+
+@pytest.mark.parametrize(
+    ("text", "names_the_cause"),
+    [
+        (_MODEL_YAML.replace("status: live", "status: bogus"), "'bogus'"),
+        # A YAML error's message spans several lines, each of which the other gate printed.
+        ("metadata.root:\n  package: app\n  children: [ {\n", "ERR_MALFORMED_YAML"),
+    ],
+    ids=["refused-value", "yaml-syntax-error"],
+)
+def test_a_load_error_another_gate_already_reported_is_not_printed_twice(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str], text: str, names_the_cause: str
+) -> None:
+    meta_dir = _yaml_dir(tmp_path, text)
+    prompts = tmp_path / "prompts"
+    prompts.mkdir()
+    out = tmp_path / "out"
+    out.mkdir()
+    for argv in (
+        ["verify", "--templates", "--prompts", str(prompts), meta_dir],
+        ["verify", "--codegen", "--generators", GEN_SUITE, meta_dir, "--out", str(out)],
+    ):
+        capsys.readouterr()
+        assert main(argv) != 0
+        err = capsys.readouterr().err
+        assert err.count("error: failed to load metadata:") == 1, argv
+        assert err.count(names_the_cause) == 1, argv
+
+
+def test_a_model_with_no_requirement_and_no_generators_selected_still_exits_0_and_says_nothing_new(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """The other side of the boundary: a model that LOADS and declares no requirement sees no
+    new line and no exit-code change, on the same invocation that reports an unloadable one."""
+    meta_dir = _meta_dir(tmp_path, [])
+    capsys.readouterr()
+    assert _verify_with_nothing_selected(tmp_path, meta_dir) == 0
+    captured = capsys.readouterr()
+    assert captured.out.startswith(_NO_GENERATORS_LINE) and captured.out.count("\n") == 1
+    # stderr holds the one line a bare `verify` has always printed, and nothing else.
+    (note,) = captured.err.splitlines()
+    assert note.startswith("metaobjects verify — running --codegen (default).")
+
+
+# ---------------------------------------------------------------------------
+# The printed summary sentence when coverage is not measured: a project whose only
+# requirements come from a library it opted into.
+# ---------------------------------------------------------------------------
+
+_LIBRARY_ONLY_CASE = (
+    Path(__file__).resolve().parents[4]
+    / "fixtures"
+    / "requirement-check-conformance"
+    / "coverage-library-only-not-measured"
+)
+
+
+def test_the_summary_line_of_a_library_only_project_says_coverage_is_not_measured(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """The corpus pins the counts of this case; this pins the sentence they are printed in."""
+    shutil.copytree(_LIBRARY_ONLY_CASE / "input", tmp_path / "metaobjects")
+    options = json.loads((_LIBRARY_ONLY_CASE / "options.json").read_text())
+    (tmp_path / ".metaobjects").mkdir()
+    (tmp_path / ".metaobjects" / "config.json").write_text(
+        json.dumps({"schema_version": 1, "sources": [], "libraries": options["libraries"]})
+    )
+    summary = json.loads((_LIBRARY_ONLY_CASE / "expected.json").read_text())["summary"]
+    assert "entitiesTotal" not in summary  # the case this test is about
+    statuses = ", ".join(
+        f"{summary['byStatus'][s]} {s}"
+        for s in ("planned", "live", "partial", "retired")
+        if summary["byStatus"].get(s)
+    )
+
+    capsys.readouterr()
+    assert _verify_with_nothing_selected(tmp_path, str(tmp_path / "metaobjects")) == 0
+    lines = capsys.readouterr().err.splitlines()
+    assert (
+        f"metaobjects verify — requirements: {summary['total']} entries "
+        f"({summary['functional']} functional, {summary['architectural']} architectural) — {statuses}; "
+        "coverage: not measured (no project-authored requirements)."
+    ) in lines
+    assert not any("entities claimed" in line for line in lines)
diff --git a/server/python/tests/codegen/test_eject.py b/server/python/tests/codegen/test_eject.py
index dbe953a74..c267dac3e 100644
--- a/server/python/tests/codegen/test_eject.py
+++ b/server/python/tests/codegen/test_eject.py
@@ -7,6 +7,7 @@
 from __future__ import annotations
 
 import importlib
+import sys
 from pathlib import Path
 
 import pytest
@@ -143,3 +144,115 @@ def test_bad_owned_token_is_a_clear_error(tmp_path: Path, monkeypatch, capsys, t
     monkeypatch.chdir(tmp_path)
     assert main(["gen"]) != 0
     assert token.split(":")[0] in capsys.readouterr().err
+
+
+WORKED_EXAMPLE = Path(__file__).parents[4] / "fixtures" / "requirement-test-identity-conformance" / "worked-example"
+_REQUIREMENT_BLOCK = (
+    "requirementTests:\n  witnessModule: app.witnesses\n  grain: member\n"
+    "  renderer: codegen.requirement_renderer:render\n  warnUncovered: false\n"
+)
+#: A project renderer. It imports the hook types from the PACKAGE, as every adopter's does, so
+#: the generator that receives its result may be the packaged one or an ejected copy of it.
+_RENDERER = (
+    "from metaobjects.codegen.requirement_hooks import RenderedTest\n\n\n"
+    "def render(args):\n"
+    "    if args.identity.skip is not None:\n"
+    "        return None\n"
+    "    return RenderedTest(\n"
+    "        imports=('import json',),\n"
+    "        source='def test_mine():\\n    json.dumps(1)\\n',\n"
+    "    )\n"
+)
+
+
+def _requirement_project(root: Path, generators: str) -> Path:
+    (root / "metaobjects").mkdir()
+    for doc in sorted((WORKED_EXAMPLE / "input").iterdir()):
+        (root / "metaobjects" / doc.name).write_text(doc.read_text(encoding="utf-8"), encoding="utf-8")
+    (root / "codegen").mkdir(exist_ok=True)
+    (root / "codegen" / "__init__.py").write_text("", encoding="utf-8")
+    (root / "codegen" / "requirement_renderer.py").write_text(_RENDERER, encoding="utf-8")
+    cfg = root / "metaobjects.config.yaml"
+    cfg.write_text(
+        f"{_REQUIREMENT_BLOCK}targets:\n  main:\n    outDir: gen\n    generators: [{generators}]\n",
+        encoding="utf-8",
+    )
+    return cfg
+
+
+def test_an_unchanged_ejected_requirement_tests_copy_generates_identical_output(
+    tmp_path: Path, monkeypatch
+) -> None:
+    packaged = tmp_path / "packaged"
+    packaged.mkdir()
+    _requirement_project(packaged, "requirement-tests")
+    monkeypatch.chdir(packaged)
+    assert main(["gen"]) == 0
+
+    owned = tmp_path / "owned"
+    owned.mkdir()
+    _requirement_project(owned, "codegen.generators.requirement_tests:requirement_tests_generator")
+    monkeypatch.chdir(owned)
+    assert main(["eject", "requirement-tests"]) == 0
+    assert (owned / "codegen" / "generators" / "requirement_tests.py").read_text(encoding="utf-8") == (
+        _packaged_source("requirement-tests")
+    )
+    assert main(["gen"]) == 0
+
+    a = {p.relative_to(packaged / "gen"): p.read_bytes() for p in (packaged / "gen").rglob("*.py")}
+    b = {p.relative_to(owned / "gen"): p.read_bytes() for p in (owned / "gen").rglob("*.py")}
+    assert a and a == b
+    # The NON-default block is what proves the owned copy still reads its options.
+    text = a[Path("requirements/test_acme_shop_requirements.py")].decode("utf-8")
+    assert '_WITNESS_MODULE = "app.witnesses"' in text
+    assert "def test_req_acme_shop_Orders_Recorded__Order():" not in text  # the renderer replaced it
+    assert "def test_mine():" in text and "import json" in text  # the project renderer ran
+    assert "def test_req_acme_shop_Orders_Refunded():" in text  # None kept the default (planned)
+    assert main(["verify", "--codegen"]) == 0
+
+
+def test_an_edited_ejected_requirement_tests_copy_drives_gen(tmp_path: Path, monkeypatch) -> None:
+    _requirement_project(tmp_path, "codegen.generators.requirement_tests:requirement_tests_generator")
+    monkeypatch.chdir(tmp_path)
+    assert main(["eject", "requirement-tests"]) == 0
+    copy = tmp_path / "codegen" / "generators" / "requirement_tests.py"
+    source = copy.read_text(encoding="utf-8")
+    assert source.count('"unimplemented requirement: "') == 1
+    copy.write_text(
+        source.replace('"unimplemented requirement: "', '"NOT YET WITNESSED: "'), encoding="utf-8"
+    )
+    assert main(["gen"]) == 0
+    text = (tmp_path / "gen" / "requirements" / "test_acme_shop_requirements.py").read_text(encoding="utf-8")
+    assert "NOT YET WITNESSED: " in text and "unimplemented requirement" not in text
+
+
+def test_an_owned_copy_is_imported_from_its_own_project_after_another_projects_config_provider_ran(
+    tmp_path: Path, monkeypatch
+) -> None:
+    """Project A's config provider is imported with the config directory on `sys.path` and no
+    help from the owned-generator resolver, so `codegen` is cached from A. Project B, in the
+    same process, must still generate from B's own ejected `entity`."""
+    # A fresh process would hold no `codegen` yet; config providers are imported with plain
+    # importlib, so earlier tests' copies would otherwise answer for project A.
+    for name in [k for k in sys.modules if k == "codegen" or k.startswith("codegen.")]:
+        monkeypatch.delitem(sys.modules, name)
+    a = tmp_path / "a"
+    a.mkdir()
+    cfg_a = _project(a, "names")
+    cfg_a.write_text(f"providers: ['codegen.providers:p']\n{cfg_a.read_text()}", encoding="utf-8")
+    (a / "codegen").mkdir()
+    (a / "codegen" / "__init__.py").write_text("")
+    (a / "codegen" / "providers.py").write_text(
+        "from metaobjects.provider import Provider\n\np = Provider('a-provider', ('metaobjects-core-types',))\n"
+    )
+    monkeypatch.chdir(a)
+    assert main(["gen"]) == 0
+
+    b = tmp_path / "b"
+    b.mkdir()
+    _project(b, "codegen.generators.entity:entity_model")
+    monkeypatch.chdir(b)
+    assert main(["eject", "entity"]) == 0
+    assert main(["gen"]) == 0
+    assert any((b / "gen").rglob("*.py"))
+    assert main(["verify", "--codegen"]) == 0
diff --git a/server/python/tests/codegen/test_project_config.py b/server/python/tests/codegen/test_project_config.py
index d695a2db9..b8b3fc544 100644
--- a/server/python/tests/codegen/test_project_config.py
+++ b/server/python/tests/codegen/test_project_config.py
@@ -9,10 +9,16 @@
 from metaobjects.codegen.project_config import (
     CONFIG_FILENAME,
     DEFAULT_METADATA_DIR,
+    DEFAULT_REQUIREMENT_WITNESS_MODULE,
+    DOTTED_MODULE_PATTERN,
+    MODULE_SYMBOL_PATTERN,
+    REQUIREMENT_TESTS_KEYS,
+    REQUIREMENT_TEST_GRAIN_VALUES,
     TARGET_KEYS,
     TOP_LEVEL_KEYS,
     ConfigError,
     ProjectConfig,
+    RequirementTestsConfig,
     TargetConfig,
     load_project_config,
 )
@@ -204,7 +210,101 @@ def test_schema_and_loader_accept_EXACTLY_the_same_keys(tmp_path: Path) -> None:
     assert set(schema["properties"]) == set(TOP_LEVEL_KEYS)
     target_props = schema["properties"]["targets"]["additionalProperties"]["properties"]
     assert set(target_props) == set(TARGET_KEYS)
+    # The `requirementTests` block is a third level with its own closed key set.
+    block = schema["properties"]["requirementTests"]
+    assert set(block["properties"]) == set(REQUIREMENT_TESTS_KEYS)
+    assert block["additionalProperties"] is False
+    assert block["properties"]["grain"]["enum"] == list(REQUIREMENT_TEST_GRAIN_VALUES)
     # Both levels must keep saying unknown keys are invalid — that claim is what the
     # loader now enforces.
     assert schema["additionalProperties"] is False
     assert schema["properties"]["targets"]["additionalProperties"]["additionalProperties"] is False
+
+
+_TARGETS = "targets:\n  m:\n    outDir: out\n"
+
+
+def test_requirement_tests_block_is_parsed_with_its_five_keys(tmp_path: Path) -> None:
+    p = _write(
+        tmp_path,
+        "requirementTests:\n"
+        "  witnessModule: app.witnesses\n"
+        "  grain: member\n"
+        "  renderer: codegen.requirement_renderer:render\n"
+        "  filter: codegen.requirement_filter:include\n"
+        "  warnUncovered: false\n" + _TARGETS,
+    )
+    assert load_project_config(p).requirement_tests == RequirementTestsConfig(
+        witness_module="app.witnesses",
+        grain="member",
+        renderer="codegen.requirement_renderer:render",
+        filter="codegen.requirement_filter:include",
+        warn_uncovered=False,
+    )
+
+
+def test_no_requirement_tests_block_means_no_options(tmp_path: Path) -> None:
+    assert load_project_config(_write(tmp_path, _TARGETS)).requirement_tests is None
+
+
+def test_an_empty_requirement_tests_block_means_the_defaults(tmp_path: Path) -> None:
+    p = _write(tmp_path, "requirementTests: {}\n" + _TARGETS)
+    assert load_project_config(p).requirement_tests == RequirementTestsConfig()
+
+
+@pytest.mark.parametrize(
+    ("block", "message"),
+    [
+        ("  witnessmodule: x\n", "witnessmodule"),
+        ("  grain: hybrid\n", "'grain' must be one of"),
+        ("  warnUncovered: \"no\"\n", "'warnUncovered' must be a boolean"),
+        ("  renderer: not_a_symbol\n", "'renderer' must be in 'module:symbol' form"),
+        ("  filter: a:b:c\n", "'filter' must be in 'module:symbol' form"),
+        ("  witnessModule: 3\n", "'witnessModule' must be a non-empty string"),
+        ('  witnessModule: "a b"\n', "'witnessModule' must be a dotted module name"),
+        ('  witnessModule: "x.1y"\n', "'witnessModule' must be a dotted module name"),
+        ('  witnessModule: "tests.w\\n"\n', "'witnessModule' must be a dotted module name"),
+        ('  renderer: "m:s\\n"\n', "'renderer' must be in 'module:symbol' form"),
+        ('  filter: "m :s"\n', "'filter' must be in 'module:symbol' form"),
+        ('  witnessModule: "x\\"; import os; \\""\n', "'witnessModule' must be a dotted module name"),
+    ],
+)
+def test_a_bad_requirement_tests_block_is_refused(tmp_path: Path, block: str, message: str) -> None:
+    p = _write(tmp_path, "requirementTests:\n" + block + _TARGETS)
+    with pytest.raises(ConfigError, match=message):
+        load_project_config(p)
+
+
+def test_the_schema_and_the_loader_agree_on_the_witness_module_pattern_and_default() -> None:
+    schema = json.loads(
+        (Path(__file__).parents[2] / "src" / "metaobjects" / "codegen" / "metaobjects-config.schema.json")
+        .read_text(encoding="utf-8")
+    )
+    witness = schema["properties"]["requirementTests"]["properties"]["witnessModule"]
+    assert witness["pattern"] == DOTTED_MODULE_PATTERN
+    assert witness["default"] == DEFAULT_REQUIREMENT_WITNESS_MODULE
+
+
+def test_the_schema_and_the_loader_agree_on_the_module_symbol_pattern() -> None:
+    schema = json.loads(
+        (Path(__file__).parents[2] / "src" / "metaobjects" / "codegen" / "metaobjects-config.schema.json")
+        .read_text(encoding="utf-8")
+    )
+    props = schema["properties"]["requirementTests"]["properties"]
+    assert props["renderer"]["pattern"] == props["filter"]["pattern"] == MODULE_SYMBOL_PATTERN
+
+
+def test_the_default_witness_module_is_spelled_once_and_every_consumer_agrees() -> None:
+    from metaobjects.codegen.generator_registry import RequirementTestsOptions
+    from metaobjects.codegen.generators.requirement_tests_generator import DEFAULT_WITNESS_MODULE
+
+    assert DEFAULT_REQUIREMENT_WITNESS_MODULE == "tests.requirement_witnesses"
+    assert RequirementTestsConfig().witness_module == DEFAULT_REQUIREMENT_WITNESS_MODULE
+    assert RequirementTestsOptions().witness_module == DEFAULT_REQUIREMENT_WITNESS_MODULE
+    assert DEFAULT_WITNESS_MODULE == DEFAULT_REQUIREMENT_WITNESS_MODULE
+
+
+def test_the_loaders_grain_values_are_the_walks_grains() -> None:
+    from metaobjects.codegen.requirement_walk import REQUIREMENT_TEST_GRAINS
+
+    assert tuple(REQUIREMENT_TEST_GRAIN_VALUES) == tuple(REQUIREMENT_TEST_GRAINS)
diff --git a/server/python/tests/codegen/test_project_import.py b/server/python/tests/codegen/test_project_import.py
new file mode 100644
index 000000000..2a9a33c1a
--- /dev/null
+++ b/server/python/tests/codegen/test_project_import.py
@@ -0,0 +1,300 @@
+"""``import_project_symbol`` — the one resolver for ``module:symbol`` a project owns.
+
+Used by ``eject.build_owned`` (an owned generator) and by the config hooks
+(``requirementTests.renderer`` / ``.filter``). Each test builds real project roots on disk, so
+what is asserted is which COPY of a module the resolver hands back when several projects (or an
+installed package) offer the same dotted name in one process.
+"""
+from __future__ import annotations
+
+import importlib
+import re
+import sys
+from pathlib import Path
+from typing import Iterator
+
+import pytest
+
+import metaobjects
+import metaobjects.codegen.requirement_walk  # noqa: F401 — loaded, so the tests can hold it
+from metaobjects.codegen.project_import import import_project_symbol
+
+
+_PROJECT_NAMES = ("codegen", "outer_pkg")
+
+
+def _is_project_name(name: str) -> bool:
+    return any(name == top or name.startswith(top + ".") for top in _PROJECT_NAMES)
+
+
+@pytest.fixture(autouse=True)
+def _restore_import_state() -> Iterator[None]:
+    """Each test starts as a fresh process would (no project package cached by an earlier test)
+    and leaves the import state it found."""
+    path = list(sys.path)
+    held = {k: v for k, v in sys.modules.items() if _is_project_name(k)}
+    before = set(sys.modules) - set(held)
+    for name in held:
+        del sys.modules[name]
+    try:
+        yield
+    finally:
+        sys.path[:] = path
+        for name in set(sys.modules) - before:
+            del sys.modules[name]
+        sys.modules.update(held)
+        importlib.invalidate_caches()
+
+
+def _project(root: Path, who: str, top: str = "codegen") -> Path:
+    """A project root holding ``<top>/generators/thing.py`` with ``WHO = <who>``."""
+    package = root / top / "generators"
+    package.mkdir(parents=True)
+    (root / top / "__init__.py").write_text("")
+    (package / "__init__.py").write_text("")
+    (package / "thing.py").write_text(f"WHO = {who!r}\n")
+    return root
+
+
+def _who(root: Path, top: str = "codegen") -> object:
+    obj, err = import_project_symbol(f"{top}.generators.thing", "WHO", root)
+    assert err is None, err
+    return obj
+
+
+def test_the_same_dotted_name_under_two_roots_resolves_in_the_root_asked_for(tmp_path: Path) -> None:  # (a)
+    a, b = _project(tmp_path / "a", "A"), _project(tmp_path / "b", "B")
+    assert _who(a) == "A"
+    assert _who(b) == "B"
+
+
+def test_a_module_another_route_cached_from_root_a_is_not_served_for_root_b(tmp_path: Path) -> None:  # (b)
+    """`_config_providers` puts a config dir on `sys.path` and imports with plain importlib,
+    never through this resolver; the next project must still get ITS copy."""
+    a, b = _project(tmp_path / "a", "A"), _project(tmp_path / "b", "B")
+    sys.path.insert(0, str(a))
+    assert importlib.import_module("codegen.generators.thing").WHO == "A"  # type: ignore[attr-defined]
+    assert _who(b) == "B"
+
+
+def test_a_top_level_name_already_imported_from_outside_any_project_is_replaced_by_the_projects(
+    tmp_path: Path,
+) -> None:  # (d), first half: what the old rule did for an owned generator
+    site = tmp_path / "site"
+    (site / "outer_pkg").mkdir(parents=True)
+    (site / "outer_pkg" / "__init__.py").write_text("WHO = 'outside'\n")
+    sys.path.insert(0, str(site))
+    assert importlib.import_module("outer_pkg").WHO == "outside"  # type: ignore[attr-defined]
+
+    project = tmp_path / "project"
+    (project / "outer_pkg").mkdir(parents=True)
+    (project / "outer_pkg" / "__init__.py").write_text("WHO = 'project'\n")
+    obj, err = import_project_symbol("outer_pkg", "WHO", project)
+    assert (obj, err) == ("project", None)
+
+
+def test_the_running_metaobjects_package_is_never_unloaded_even_when_a_project_shadows_it(
+    tmp_path: Path,
+) -> None:  # (d), second half
+    package = sys.modules["metaobjects"]
+    walk = sys.modules["metaobjects.codegen.requirement_walk"]
+    shadow = tmp_path / "project"
+    (shadow / "metaobjects").mkdir(parents=True)
+    (shadow / "metaobjects" / "__init__.py").write_text("WHO = 'shadow'\n")
+    obj, err = import_project_symbol(
+        "metaobjects.codegen.requirement_walk", "default_requirement_test_filter", shadow
+    )
+    assert err is None and callable(obj)
+    assert sys.modules["metaobjects"] is package and package is metaobjects
+    assert sys.modules["metaobjects.codegen.requirement_walk"] is walk
+
+
+def test_a_symbol_inside_the_running_package_resolves_from_a_project_with_no_such_directory(
+    tmp_path: Path,
+) -> None:
+    (tmp_path / "project").mkdir()
+    walk = sys.modules["metaobjects.codegen.requirement_walk"]
+    obj, err = import_project_symbol(
+        "metaobjects.codegen.requirement_walk", "default_requirement_test_filter", tmp_path / "project"
+    )
+    assert err is None and obj is walk.default_requirement_test_filter
+    assert sys.modules["metaobjects"] is metaobjects
+
+
+def test_a_standard_library_module_stays_loaded_when_a_project_package_shadows_its_name(tmp_path: Path) -> None:
+    stdlib_json = sys.modules["json"]
+    project = _shadowing_project(tmp_path / "project", "json")
+    obj, err = import_project_symbol("json", "dumps", project)
+    assert obj is None and err is not None and "shadows a standard-library module" in err
+    assert sys.modules["json"] is stdlib_json
+
+
+def test_root_a_again_after_its_file_changed_still_serves_the_cached_module(tmp_path: Path) -> None:  # (c)
+    """EXISTING behaviour, pinned and not endorsed: a module cached from the SAME root is not
+    reloaded, so an edit made after the first import is not seen in this process."""
+    a = _project(tmp_path / "a", "A1")
+    assert _who(a) == "A1"
+    (a / "codegen" / "generators" / "thing.py").write_text("WHO = 'A2'\n")
+    assert _who(a) == "A1"
+
+
+def test_a_missing_symbol_and_a_module_that_raises_name_the_module_and_the_real_cause(tmp_path: Path) -> None:
+    a = _project(tmp_path / "a", "A")
+    obj, err = import_project_symbol("codegen.generators.thing", "NOPE", a)
+    assert obj is None and err == "'codegen.generators.thing' has no attribute 'NOPE'"
+    (a / "codegen" / "generators" / "boom.py").write_text("raise RuntimeError('it blew up')\n")
+    obj, err = import_project_symbol("codegen.generators.boom", "x", a)
+    assert obj is None and err == "cannot import 'codegen.generators.boom': it blew up"
+
+
+def test_a_path_that_merely_starts_with_the_root_is_not_under_it(tmp_path: Path) -> None:
+    """`/tmp/x/a2` is not inside `/tmp/x/a`: a string-prefix test would keep A2's cached copy."""
+    a, a2 = _project(tmp_path / "a", "A"), _project(tmp_path / "a2", "A2")
+    assert _who(a2) == "A2"
+    assert _who(a) == "A"
+
+
+def test_the_sys_path_entry_is_the_resolved_root(tmp_path: Path) -> None:
+    a = _project(tmp_path / "a", "A")
+    _who(a)
+    _who(a)
+    assert sys.path.count(str(a.resolve())) == 1  # inserted once, resolved, never duplicated
+
+
+# ---------------------------------------------------------------------------
+# An installed package (outside every project) named by several hooks is ONE module.
+# ---------------------------------------------------------------------------
+
+
+def _outside_package(tmp_path: Path, name: str = "outside_hooks") -> Path:
+    site = tmp_path / "site"
+    (site / name).mkdir(parents=True)
+    (site / name / "__init__.py").write_text(
+        "RUNS = globals().get('RUNS', 0) + 1\n\ndef a():\n    return 'a'\n\ndef b():\n    return 'b'\n"
+    )
+    return site
+
+
+def test_two_symbols_of_the_same_outside_module_come_from_the_same_module_object(tmp_path: Path) -> None:
+    site = _outside_package(tmp_path)
+    sys.path.insert(0, str(site))
+    project = tmp_path / "project"
+    project.mkdir()
+    a, err_a = import_project_symbol("outside_hooks", "a", project)
+    b, err_b = import_project_symbol("outside_hooks", "b", project)
+    assert (err_a, err_b) == (None, None)
+    assert a.__module__ == b.__module__ == "outside_hooks"
+    assert sys.modules["outside_hooks"].a is a and sys.modules["outside_hooks"].b is b
+
+
+def test_a_module_imported_before_the_call_is_the_one_returned_when_the_project_does_not_offer_the_name(
+    tmp_path: Path,
+) -> None:
+    site = _outside_package(tmp_path)
+    sys.path.insert(0, str(site))
+    before = importlib.import_module("outside_hooks")
+    project = tmp_path / "project"
+    project.mkdir()
+    obj, err = import_project_symbol("outside_hooks", "a", project)
+    assert err is None and obj is before.a  # type: ignore[attr-defined]
+    assert sys.modules["outside_hooks"] is before
+
+
+# ---------------------------------------------------------------------------
+# A project package that shadows a standard-library module is refused, deterministically.
+# ---------------------------------------------------------------------------
+
+
+def _shadowing_project(root: Path, name: str) -> Path:
+    (root / name).mkdir(parents=True)
+    (root / name / "__init__.py").write_text("")
+    return root
+
+
+def _refusal(name: str, project: Path) -> str:
+    obj, err = import_project_symbol(f"{name}.generators.thing", "WHO", project)
+    assert obj is None and err is not None
+    return err
+
+
+@pytest.mark.parametrize("loaded", [True, False])
+def test_a_project_package_named_like_a_standard_library_module_is_refused_whether_or_not_it_is_loaded(
+    tmp_path: Path, loaded: bool
+) -> None:
+    if loaded:
+        name = "types"
+        assert name in sys.modules
+    else:
+        name = next(n for n in ("sched", "colorsys", "wave", "mailcap") if n not in sys.modules)
+        assert name not in sys.modules  # a stdlib name NOT yet imported in this process
+    project = _shadowing_project(tmp_path / "project", name)
+    err = _refusal(name, project)
+    assert f"the project package {name!r}" in err
+    assert "shadows a standard-library module" in err and "rename it" in err
+    assert err.startswith(f"cannot import '{name}.generators.thing': ")
+    # Refused before importing anything: no project module was imported, the stdlib one is untouched.
+    assert not any(k.startswith(f"{name}.generators") for k in sys.modules)
+
+
+def test_a_standard_library_named_module_file_is_refused_naming_the_file_that_exists(tmp_path: Path) -> None:
+    """`<root>/types.py`, a FILE: the message names that file, not a `<root>/types` that is not there."""
+    project = tmp_path / "project"
+    project.mkdir()
+    (project / "types.py").write_text("WHO = 'project'\n")
+    obj, err = import_project_symbol("types", "WHO", project)
+    assert obj is None and err is not None
+    assert "shadows a standard-library module" in err and "rename it" in err
+    assert f"({project.resolve() / 'types.py'})" in err
+    assert f"({project.resolve() / 'types'})" not in err
+
+
+def test_the_same_refusal_text_is_given_for_a_loaded_and_an_unloaded_standard_library_name(
+    tmp_path: Path,
+) -> None:
+    loaded = _refusal("types", _shadowing_project(tmp_path / "a", "types"))
+    unloaded_name = next(n for n in ("sched", "colorsys", "wave", "mailcap") if n not in sys.modules)
+    unloaded = _refusal(unloaded_name, _shadowing_project(tmp_path / "b", unloaded_name))
+    def shape(text: str, name: str) -> str:  # the project path in the message differs per project
+        return re.sub(r"\(.*?\)", "()", text).replace(name, "X")
+
+    assert shape(loaded, "types") == shape(unloaded, unloaded_name)
+
+
+def test_a_real_standard_library_symbol_with_no_such_directory_in_the_project_keeps_working(
+    tmp_path: Path,
+) -> None:
+    (tmp_path / "project").mkdir()
+    stdlib_json = sys.modules["json"]
+    obj, err = import_project_symbol("json", "dumps", tmp_path / "project")
+    assert err is None and obj is stdlib_json.dumps and sys.modules["json"] is stdlib_json
+
+
+# ---------------------------------------------------------------------------
+# Existing behaviour that this resolver does NOT change (see the module docstring).
+# ---------------------------------------------------------------------------
+
+
+def test_a_project_with_no_such_package_silently_gets_the_one_a_previous_project_left_cached(
+    tmp_path: Path,
+) -> None:
+    """EXISTING behaviour, pinned and not endorsed: project A's module stays cached in
+    `sys.modules`, so project B, which has no `codegen` at all, is answered with A's, even
+    once A's directory is off `sys.path`."""
+    a = _project(tmp_path / "a", "A")
+    (tmp_path / "b").mkdir()
+    assert _who(a) == "A"
+    sys.path.remove(str(a.resolve()))
+    assert _who(tmp_path / "b") == "A"
+
+
+def test_a_namespace_layout_in_the_project_loses_to_a_regular_package_earlier_loaded_from_sys_path(
+    tmp_path: Path,
+) -> None:
+    """EXISTING behaviour, pinned and not endorsed: B has `codegen/generators/thing.py` with no
+    `__init__.py` anywhere, but a regular package later on `sys.path` beats a namespace portion."""
+    a = _project(tmp_path / "a", "A")
+    b = tmp_path / "b"
+    (b / "codegen" / "generators").mkdir(parents=True)
+    (b / "codegen" / "generators" / "thing.py").write_text("WHO = 'B'\n")
+    assert _who(a) == "A"
+    assert _who(b) == "A"
diff --git a/server/python/tests/codegen/test_requirement_tests_generator.py b/server/python/tests/codegen/test_requirement_tests_generator.py
new file mode 100644
index 000000000..1541e83e8
--- /dev/null
+++ b/server/python/tests/codegen/test_requirement_tests_generator.py
@@ -0,0 +1,797 @@
+"""The ``requirement-tests`` generator: one machine-owned pytest file per metamodel package.
+
+The identity of each test (which tests exist, their keys, skip state and digests) is pinned by
+``tests/conformance/test_requirement_test_identity_conformance.py``; these tests pin what the
+generator WRITES: the reference file, its escaping, that the output runs, and the seams.
+"""
+from __future__ import annotations
+
+import ast
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from metaobjects import MetaDataLoader
+from metaobjects.codegen.config import GenConfig
+from metaobjects.codegen.generators.requirement_tests_generator import requirement_tests
+from metaobjects.codegen.requirement_hooks import RenderedTest, RequirementTestArgs
+from metaobjects.codegen.requirement_walk import requirement_test_identities
+from metaobjects.codegen.runner import run_gen
+from metaobjects.loader.sources import FileSource, InMemoryStringSource, MetaDataFormat
+
+CORPUS = Path(__file__).resolve().parents[4] / "fixtures" / "requirement-test-identity-conformance"
+
+#: The reference Python output for the worked example (contract Table H), byte for byte.
+WORKED_EXAMPLE = r'''# @generated by metaobjects (requirement-tests). DO NOT EDIT: this file is rewritten whole.
+# Witnesses are project-owned functions in the module named below.
+import importlib
+
+import pytest
+
+_WITNESS_MODULE = "tests.requirement_witnesses"
+
+
+def _witness(key):
+    try:
+        module = importlib.import_module(_WITNESS_MODULE)
+    except ModuleNotFoundError as exc:
+        missing = exc.name or ""
+        if _WITNESS_MODULE != missing and not _WITNESS_MODULE.startswith(missing + "."):
+            raise
+        return None
+    return getattr(module, key, None)
+
+
+def _run(key, test_id, counterexample):
+    witness = _witness(key)
+    if witness is None:
+        pytest.fail(
+            "unimplemented requirement: " + test_id + " - write " + _WITNESS_MODULE + "." + key
+            + "() so that it fails when: " + counterexample
+        )
+    witness()
+
+
+# acme::shop::Orders.Recorded [object.entity]
+# An order is recorded when it is placed.
+# Counterexample: A placed order has no row.
+# Status: live
+# Claims: Order  (object.entity)
+# Digest: 2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a
+def test_req_acme_shop_Orders_Recorded__object_entity():
+    _run(
+        "req_acme_shop_Orders_Recorded__object_entity",
+        "acme::shop::Orders.Recorded [object.entity]",
+        "A placed order has no row.",
+    )
+
+
+# acme::shop::Orders.Refunded [*]
+# A refund is recorded against its order.
+# Counterexample: A refund with no order.
+# Status: planned
+# Claims: (none)
+# Digest: 4ddcd781ccc2fe462bc316711d5cedb88b803af1727a0df19fe3a69487aa6f86
+@pytest.mark.skip(reason="planned - not built yet")
+def test_req_acme_shop_Orders_Refunded():
+    pass
+'''
+
+_ENTITY = """
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - identity.primary: { name: pk, fields: [id] }
+"""
+
+
+def _load_corpus_case(name: str) -> Any:
+    files = sorted((CORPUS / name / "input").iterdir(), key=lambda p: p.name)
+    result = MetaDataLoader(strict=True).load([FileSource(p) for p in files])
+    assert [str(e) for e in result.errors] == []
+    return result.root
+
+
+def _load_yaml(*documents: str) -> Any:
+    result = MetaDataLoader(strict=True).load(
+        [InMemoryStringSource(d, format=MetaDataFormat.YAML) for d in documents]
+    )
+    assert [str(e) for e in result.errors] == []
+    return result.root
+
+
+def _doc(requirements: str, package: str | None = "acme::shop") -> str:
+    head = f"metadata:\n  package: {package}\n  children:" if package else "metadata:\n  children:"
+    return head + _ENTITY + requirements
+
+
+def _requirement(name: str, status: str = "live", *, statement: str = "S holds.", counter: str = "S fails.",
+                 implemented_by: str = "[Order]", extra: str = "") -> str:
+    impl = "" if implemented_by == "" else f"        implementedBy: {implemented_by}\n"
+    return (
+        f"    - requirement.functional:\n"
+        f"        name: {name}\n"
+        f"        level: 4\n"
+        f"        status: {status}\n"
+        f"        statement: {statement}\n"
+        f"        counterexample: {counter}\n"
+        f"{impl}{extra}"
+    )
+
+
+def generate(root: Any, tmp_path: Path, **options: Any) -> tuple[dict[str, str], list[str]]:
+    """Run the generator through the real runner. Returns ({relative path: content}, warnings)."""
+    out = tmp_path / "gen"
+    result = run_gen(
+        GenConfig(out_dir=str(out)), root, generators=[requirement_tests(**options)]
+    )
+    files = {
+        str(Path(full).relative_to(out)): Path(full).read_text(encoding="utf-8")
+        for full, _status in result.files
+        if not full.endswith("__init__.py")
+    }
+    return files, result.warnings
+
+
+def test_the_worked_example_renders_the_reference_file(tmp_path: Path) -> None:
+    files, warnings = generate(_load_corpus_case("worked-example"), tmp_path)
+    assert list(files) == ["requirements/test_acme_shop_requirements.py"]
+    assert files["requirements/test_acme_shop_requirements.py"] == WORKED_EXAMPLE
+    assert warnings != [] and "matched no filter" in warnings[0]  # the L3 parent has no test
+
+
+def test_one_file_per_metamodel_package(tmp_path: Path) -> None:
+    root = _load_yaml(
+        _doc(_requirement("A"), "acme::one"),
+        _doc(_requirement("B"), "acme::two").replace("name: Order", "name: Order2"),
+    )
+    files, _ = generate(root, tmp_path)
+    assert sorted(files) == [
+        "requirements/test_acme_one_requirements.py",
+        "requirements/test_acme_two_requirements.py",
+    ]
+
+
+def test_an_unpackaged_ledger_writes_test_root_requirements(tmp_path: Path) -> None:
+    files, _ = generate(_load_corpus_case("unpackaged"), tmp_path)
+    assert list(files) == ["requirements/test_root_requirements.py"]
+
+
+def _imports(source: str) -> set[str]:
+    found: set[str] = set()
+    for node in ast.walk(ast.parse(source)):
+        if isinstance(node, ast.Import):
+            found.update(a.name for a in node.names)
+        elif isinstance(node, ast.ImportFrom):
+            found.add(node.module or "")
+    return found
+
+
+def test_the_output_imports_only_importlib_and_pytest(tmp_path: Path) -> None:
+    files, _ = generate(_load_corpus_case("concern-fanout"), tmp_path)
+    assert files
+    for source in files.values():
+        assert _imports(source) == {"importlib", "pytest"}
+
+
+def test_the_output_parses_under_the_python_3_9_grammar(tmp_path: Path) -> None:
+    for case in ("worked-example", "concern-fanout", "member-grain", "retired-skip", "filter-all"):
+        options = {"grain": "member"} if case == "member-grain" else {}
+        if case == "filter-all":
+            options = {"filter": lambda _view: True}
+        files, _ = generate(_load_corpus_case(case), tmp_path, **options)
+        for source in files.values():
+            ast.parse(source, feature_version=(3, 9))
+
+
+_AWKWARD = {
+    "quotes": 'the GM sees a player\'s "secret" notes',
+    "backslash": "a raw C:\\Users path and a trailing backslash\\",
+    "newline": "line one\nline two",
+    "triple": 'ends with """ and \'\'\' and */ and # and {x}',
+}
+
+
+@pytest.mark.parametrize("label", sorted(_AWKWARD))
+def test_prose_that_would_break_a_string_or_a_comment_still_parses_and_the_failure_message_carries_it(
+    tmp_path: Path, label: str
+) -> None:
+    prose = _AWKWARD[label]
+    block = "|\n          " + prose.replace("\n", "\n          ")
+    root = _load_yaml(
+        _doc(_requirement("Probe", statement=block, counter=block, implemented_by="[Order]"))
+    )
+    files, _ = generate(root, tmp_path)
+    source = files["requirements/test_acme_shop_requirements.py"]
+    tree = ast.parse(source, feature_version=(3, 9))
+    # The counterexample reaches the failure message as the third argument of _run, unaltered
+    # (a YAML block scalar keeps one trailing newline).
+    literals = [n.value for n in ast.walk(tree) if isinstance(n, ast.Constant) and isinstance(n.value, str)]
+    assert prose + "\n" in literals
+    # …and the statement sits in the comments, one marker per line, `*/` broken.
+    lines = source.splitlines()
+    for line in prose.split("\n"):
+        assert ("# " + line.replace("*/", "* /")).rstrip() in lines
+
+
+def _pytest(tmp_path: Path) -> str:
+    done = subprocess.run(
+        [sys.executable, "-m", "pytest", "-q", "-rA", "-p", "no:cacheprovider", "--no-header", "gen"],
+        cwd=tmp_path,
+        env={"PYTHONPATH": str(tmp_path), "PATH": "/usr/bin:/bin", "PYTHONDONTWRITEBYTECODE": "1"},
+        capture_output=True,
+        text=True,
+    )
+    return done.stdout + done.stderr
+
+
+def _four_outcomes_document() -> str:
+    return _doc(
+        _requirement("Passes")
+        + _requirement("Missing")
+        + _requirement("Asserts")
+        + _requirement("Later", "planned", implemented_by="")
+    )
+
+
+def _generated_project(tmp_path: Path, witness_module: str, witnesses: str | None) -> None:
+    """The REAL layout: `metaobjects gen` writes `gen/`, `gen/__init__.py` and
+    `gen/requirements/__init__.py` beside the test file, and the tests run from there."""
+    config = _project(
+        tmp_path,
+        f"requirementTests:\n  witnessModule: {witness_module}\n  warnUncovered: false\n",
+        _four_outcomes_document(),
+    )
+    assert main(["gen", "--config", str(config)]) == 0
+    assert (tmp_path / "gen" / "__init__.py").is_file()
+    assert (tmp_path / "gen" / "requirements" / "__init__.py").is_file()
+    if witnesses is not None:
+        (tmp_path / "req_witnesses.py").write_text(witnesses, encoding="utf-8")
+
+
+def test_the_generated_tests_run_one_passes_one_has_no_witness_one_asserts_one_is_skipped(
+    tmp_path: Path,
+) -> None:
+    _generated_project(
+        tmp_path,
+        "req_witnesses",
+        "def req_acme_shop_Passes__object_entity():\n    return None\n\n\n"
+        "def req_acme_shop_Asserts__object_entity():\n    assert 1 == 2, 'the witness itself says no'\n",
+    )
+    out = _pytest(tmp_path)
+    assert "PASSED gen/requirements/test_acme_shop_requirements.py::test_req_acme_shop_Passes__object_entity" in out
+    # -rA names a skip by file and line, not by test: the reason is what identifies it.
+    assert "SKIPPED [1] gen/requirements/test_acme_shop_requirements.py:" in out
+    assert "planned - not built yet" in out
+    assert "FAILED gen/requirements/test_acme_shop_requirements.py::test_req_acme_shop_Missing__object_entity" in out
+    assert (
+        "unimplemented requirement: acme::shop::Missing [object.entity] - write req_witnesses."
+        "req_acme_shop_Missing__object_entity() so that it fails when: S fails."
+    ) in out
+    assert "FAILED gen/requirements/test_acme_shop_requirements.py::test_req_acme_shop_Asserts__object_entity" in out
+    assert "the witness itself says no" in out
+    assert "2 failed, 1 passed, 1 skipped" in out
+
+
+def test_a_missing_witness_module_is_no_witness_not_an_import_error(tmp_path: Path) -> None:
+    _generated_project(tmp_path, "no_such_pkg.requirement_witnesses", None)
+    out = _pytest(tmp_path)
+    assert out.count("unimplemented requirement:") >= 3
+    assert "ModuleNotFoundError" not in out
+
+
+def test_a_broken_witness_module_raises_its_own_error(tmp_path: Path) -> None:
+    _generated_project(tmp_path, "req_witnesses", "import does_not_exist\n")
+    out = _pytest(tmp_path)
+    assert "ModuleNotFoundError: No module named 'does_not_exist'" in out
+    assert "unimplemented requirement" not in out
+
+
+def test_a_witness_key_collision_refuses_generation_naming_both_ids(tmp_path: Path) -> None:
+    with pytest.raises(ValueError) as exc:
+        generate(_load_corpus_case("witness-key-collision"), tmp_path)
+    # The message every port outside TypeScript gives: the code, both ids, and the key they share.
+    assert str(exc.value) == (
+        "ERR_REQUIREMENT_WITNESS_KEY_COLLISION: two requirement tests map to one witness key, so one "
+        "witness could not serve both. Rename one so the names differ in more than punctuation:\n"
+        "  'acme::shop::Orders.Recorded [object.entity]' and 'acme::shop::Orders_Recorded [object.entity]' "
+        "(witness key req_acme_shop_Orders_Recorded__object_entity)"
+    )
+
+
+def test_grain_member_emits_one_test_per_reference(tmp_path: Path) -> None:
+    files, _ = generate(_load_corpus_case("member-grain"), tmp_path, grain="member")
+    source = next(iter(files.values()))
+    expected = requirement_test_identities(_load_corpus_case("member-grain"), grain="member")
+    assert len(expected) > len(requirement_test_identities(_load_corpus_case("member-grain")))
+    for identity in expected:
+        assert f"def test_{identity.witness_key}():" in source
+
+
+def test_an_unknown_grain_is_refused_with_a_clear_error_by_the_generator(tmp_path: Path) -> None:
+    with pytest.raises(ValueError, match="unknown requirement-test grain 'hybrid': expected 'concern' or 'member'"):
+        requirement_tests(grain="hybrid")
+
+
+@pytest.mark.parametrize("module", ['x"; import os; "', "tests.w\n", "a b", ""])
+def test_a_malformed_witness_module_is_refused(module: str) -> None:
+    with pytest.raises(ValueError, match="not a dotted module name"):
+        requirement_tests(witness_module=module)
+
+
+def test_a_renderer_hook_replaces_one_test_and_receives_the_digest(tmp_path: Path) -> None:
+    seen: list[RequirementTestArgs] = []
+
+    def renderer(args: RequirementTestArgs) -> RenderedTest | None:
+        seen.append(args)
+        if args.identity.path != "Orders.Recorded":
+            return None
+        return RenderedTest(imports=(), source=f"def test_custom():\n    assert {args.identity.digest!r}\n")
+
+    files, _ = generate(_load_corpus_case("worked-example"), tmp_path, renderer=renderer)
+    source = files["requirements/test_acme_shop_requirements.py"]
+    assert "def test_custom():" in source and "def test_req_acme_shop_Orders_Recorded__object_entity" not in source
+    assert "def test_req_acme_shop_Orders_Refunded():" in source  # the hook returned None: default kept
+    recorded = next(a for a in seen if a.identity.path == "Orders.Recorded")
+    assert recorded.identity.digest == "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a"
+    assert recorded.statement == "An order is recorded when it is placed."
+    assert recorded.counterexample == "A placed order has no row."
+    assert recorded.targets == (("Order", "object.entity"),)
+    assert (recorded.disposition, recorded.tracked_by) == (None, ())
+
+
+def test_a_hook_returning_none_keeps_the_default(tmp_path: Path) -> None:
+    files, _ = generate(_load_corpus_case("worked-example"), tmp_path, renderer=lambda _a: None)
+    assert files["requirements/test_acme_shop_requirements.py"] == WORKED_EXAMPLE
+
+
+def test_the_hooks_imports_are_merged_deduplicated_and_sorted(tmp_path: Path) -> None:
+    def renderer(args: RequirementTestArgs) -> RenderedTest:
+        imports = ("import json", "import importlib", "import abc") if args.identity.skip is None else ("import abc",)
+        return RenderedTest(imports=imports, source=f"def test_{args.identity.witness_key}():\n    pass\n")
+
+    files, _ = generate(_load_corpus_case("worked-example"), tmp_path, renderer=renderer)
+    source = files["requirements/test_acme_shop_requirements.py"]
+    assert "import importlib\n\nimport pytest\n\nimport abc\nimport json\n\n_WITNESS_MODULE" in source
+    assert source.count("import abc") == 1 and source.count("import importlib") == 1
+    ast.parse(source, feature_version=(3, 9))
+
+
+def test_a_model_with_no_requirement_emits_nothing_and_warns_nothing(tmp_path: Path) -> None:
+    root = _load_yaml("metadata:\n  package: acme::shop\n  children:" + _ENTITY)
+    files, warnings = generate(root, tmp_path)
+    assert (files, warnings) == ({}, [])
+
+
+def test_requirements_the_filter_excludes_produce_one_capped_warning(tmp_path: Path) -> None:
+    reqs = "".join(
+        f"    - requirement.functional:\n        name: R{i}\n        level: 3\n        status: live\n"
+        f"        statement: s\n        counterexample: c\n"
+        for i in range(7)
+    )
+    _, warnings = generate(_load_yaml(_doc(reqs)), tmp_path)
+    assert len(warnings) == 1
+    assert warnings[0] == (
+        "[requirement-tests] 7 requirement(s) matched no filter and get no test. If that is deliberate, "
+        "set warnUncovered: false to silence this. Uncovered: R0, R1, R2, R3, R4, and 2 more."
+    )
+
+
+def test_the_uncovered_warning_without_overflow_lists_paths_and_no_more_clause(tmp_path: Path) -> None:
+    reqs = "".join(
+        f"    - requirement.functional:\n        name: R{i}\n        level: 3\n        status: live\n"
+        f"        statement: s\n        counterexample: c\n"
+        for i in range(2)
+    )
+    _, warnings = generate(_load_yaml(_doc(reqs)), tmp_path)
+    assert warnings == [
+        "[requirement-tests] 2 requirement(s) matched no filter and get no test. If that is deliberate, "
+        "set warnUncovered: false to silence this. Uncovered: R0, R1."
+    ]
+
+
+def test_warn_uncovered_false_silences_the_warning(tmp_path: Path) -> None:
+    _, warnings = generate(_load_corpus_case("worked-example"), tmp_path, warn_uncovered=False)
+    assert warnings == []
+
+
+def test_a_filter_keeps_an_l3_requirement_the_default_drops_and_it_renders_with_unit_star(tmp_path: Path) -> None:
+    root = _load_corpus_case("worked-example")
+    assert all(i.path != "Orders" for i in requirement_test_identities(root))
+    files, _ = generate(root, tmp_path, filter=lambda view: view.level == 3)
+    source = files["requirements/test_acme_shop_requirements.py"]
+    assert "# acme::shop::Orders [*]" in source
+    assert "def test_req_acme_shop_Orders():" in source
+    assert "Recorded" not in source
+
+
+def test_a_generator_built_with_a_filter_is_not_taken_for_an_entity_matcher() -> None:
+    # The runner reads a `filter` attribute on a generator as the ENTITY matcher.
+    assert not hasattr(requirement_tests(filter=lambda _v: True), "filter")
+
+
+# ---------------------------------------------------------------------------
+# Config mode: the `requirementTests` block reaches the generator through `gen`.
+# ---------------------------------------------------------------------------
+
+from metaobjects.cli import main  # noqa: E402 — grouped with the CLI-driven tests below
+
+
+def _project(tmp_path: Path, block: str, *documents: str) -> Path:
+    (tmp_path / "metaobjects").mkdir()
+    for i, doc in enumerate(documents):
+        (tmp_path / "metaobjects" / f"meta.{i}.yaml").write_text(doc, encoding="utf-8")
+    config = tmp_path / "metaobjects.config.yaml"
+    config.write_text(
+        f"{block}targets:\n  main:\n    outDir: gen\n    generators: [requirement-tests]\n",
+        encoding="utf-8",
+    )
+    return config
+
+
+def _worked_example_document() -> str:
+    return next(iter((CORPUS / "worked-example" / "input").iterdir())).read_text(encoding="utf-8")
+
+
+def test_requirement_tests_filter_in_the_config_is_imported_as_module_symbol_and_applied(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    config = _project(
+        tmp_path,
+        "requirementTests:\n  filter: codegen.requirement_filter:include\n  warnUncovered: false\n",
+        _worked_example_document(),
+    )
+    (tmp_path / "codegen").mkdir()
+    (tmp_path / "codegen" / "__init__.py").write_text("")
+    (tmp_path / "codegen" / "requirement_filter.py").write_text(
+        "def include(view):\n    return view.level == 3\n", encoding="utf-8"
+    )
+    monkeypatch.chdir(tmp_path)
+    assert main(["gen", "--config", str(config)]) == 0
+    source = (tmp_path / "gen" / "requirements" / "test_acme_shop_requirements.py").read_text(encoding="utf-8")
+    assert "def test_req_acme_shop_Orders():" in source
+    assert "Recorded" not in source
+
+
+def test_requirement_tests_renderer_and_witness_module_in_the_config_are_applied(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    config = _project(
+        tmp_path,
+        "requirementTests:\n  witnessModule: app.witnesses\n  grain: member\n"
+        "  renderer: codegen.requirement_renderer:render\n  warnUncovered: false\n",
+        _worked_example_document(),
+    )
+    (tmp_path / "codegen").mkdir()
+    (tmp_path / "codegen" / "__init__.py").write_text("")
+    (tmp_path / "codegen" / "requirement_renderer.py").write_text(
+        "from metaobjects.codegen.requirement_hooks import RenderedTest\n\n\n"
+        "def render(args):\n"
+        "    if args.identity.unit != 'Order':\n        return None\n"
+        "    return RenderedTest(imports=('import json',), source='def test_mine():\\n    json.dumps(1)\\n')\n",
+        encoding="utf-8",
+    )
+    monkeypatch.chdir(tmp_path)
+    assert main(["gen", "--config", str(config)]) == 0
+    source = (tmp_path / "gen" / "requirements" / "test_acme_shop_requirements.py").read_text(encoding="utf-8")
+    assert '_WITNESS_MODULE = "app.witnesses"' in source
+    assert "def test_mine():" in source and "import json" in source
+
+
+def test_a_renderer_that_cannot_be_imported_fails_gen_naming_the_key(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    config = _project(
+        tmp_path,
+        "requirementTests:\n  renderer: nowhere.module:render\n",
+        _worked_example_document(),
+    )
+    monkeypatch.chdir(tmp_path)
+    assert main(["gen", "--config", str(config)]) == 1
+    err = capsys.readouterr().err
+    assert "requirementTests.renderer" in err and "nowhere.module" in err
+    assert not (tmp_path / "gen").exists()
+
+
+def _two_package_documents(second_has_requirement: bool) -> tuple[str, str]:
+    first = _doc(_requirement("Kept"), "acme::one")
+    second = _doc(
+        _requirement("Gone", implemented_by="[Order2]") if second_has_requirement else "", "acme::two"
+    ).replace(
+        "name: Order", "name: Order2"
+    )
+    return first, second
+
+
+def test_stale_file_gen_leaves_the_file_of_a_package_that_lost_its_requirements_and_verify_codegen_names_it_extra(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """The port's existing behaviour for ANY generator: `gen` never deletes a file it no longer
+    emits, and `verify --codegen` reports it as `extra:` (stale) when the manifest records that
+    this tool wrote it. Nothing about the requirement tests is special-cased."""
+    config = _project(tmp_path, "requirementTests:\n  warnUncovered: false\n", *_two_package_documents(True))
+    monkeypatch.chdir(tmp_path)
+    assert main(["gen", "--config", str(config)]) == 0
+    stale = tmp_path / "gen" / "requirements" / "test_acme_two_requirements.py"
+    assert stale.exists()
+    before = stale.read_text(encoding="utf-8")
+    assert "Gone" in before
+    assert main(["verify", "--codegen", "--config", str(config)]) == 0
+
+    first, second = _two_package_documents(False)
+    (tmp_path / "metaobjects" / "meta.0.yaml").write_text(first, encoding="utf-8")
+    (tmp_path / "metaobjects" / "meta.1.yaml").write_text(second, encoding="utf-8")
+    capsys.readouterr()
+    assert main(["gen", "--config", str(config)]) == 0
+    assert stale.read_text(encoding="utf-8") == before, "gen does not remove a file it no longer emits"
+
+    assert main(["verify", "--codegen", "--config", str(config)]) == 1
+    assert "  extra:   requirements/test_acme_two_requirements.py" in capsys.readouterr().err
+
+
+def test_tests_are_emitted_sorted_by_id_whatever_order_the_model_declares_them_in(tmp_path: Path) -> None:
+    root = _load_yaml(
+        _doc(_requirement("Zebra") + _requirement("Mango") + _requirement("Apple"))
+    )
+    files, _ = generate(root, tmp_path)
+    source = files["requirements/test_acme_shop_requirements.py"]
+    order = [line[len("def test_"):-3] for line in source.splitlines() if line.startswith("def test_")]
+    assert order == [
+        "req_acme_shop_Apple__object_entity",
+        "req_acme_shop_Mango__object_entity",
+        "req_acme_shop_Zebra__object_entity",
+    ]
+
+
+@pytest.mark.parametrize("separator", ["\\r\\n", "\\r"])
+def test_a_carriage_return_in_a_counterexample_is_escaped_the_file_parses_and_the_message_carries_it(
+    tmp_path: Path, separator: str
+) -> None:
+    # A double-quoted YAML scalar, so the carriage return is a real character in the value.
+    counter = f'"first{separator}second"'
+    root = _load_yaml(_doc(_requirement("Probe", counter=counter)))
+    files, _ = generate(root, tmp_path, witness_module="req_witnesses")
+    source = files["requirements/test_acme_shop_requirements.py"]
+    assert "\r" not in source  # a raw carriage return would end the line inside the literal
+    tree = ast.parse(source, feature_version=(3, 9))
+    expected = "first" + separator.encode().decode("unicode_escape") + "second"
+    literals = [n.value for n in ast.walk(tree) if isinstance(n, ast.Constant)]
+    assert expected in literals  # the literal holds the exact characters, escaped in the file
+    out = _run_files(tmp_path, files)
+    assert "unimplemented requirement:" in out and "so that it fails when: first" in out
+
+
+def test_the_file_names_the_witness_module_before_any_test(tmp_path: Path) -> None:
+    files, _ = generate(_load_corpus_case("worked-example"), tmp_path, witness_module="app.witnesses")
+    source = files["requirements/test_acme_shop_requirements.py"]
+    assert source.index('_WITNESS_MODULE = "app.witnesses"') < source.index("def test_")
+    assert "Witnesses are project-owned functions in the module named below." in source.splitlines()[1]
+
+
+def _run_files(tmp_path: Path, files: dict[str, str]) -> str:
+    """Run already-generated files, laid out as `gen` lays them out (with the package markers)."""
+    for rel, content in {
+        "__init__.py": "",
+        "requirements/__init__.py": "",
+        **files,
+    }.items():
+        target = tmp_path / "gen" / rel
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(content, encoding="utf-8")
+    return _pytest(tmp_path)
+
+
+def _filter_project(tmp_path: Path, module_body: str, symbol: str = "include") -> Path:
+    config = _project(
+        tmp_path,
+        f"requirementTests:\n  filter: codegen.requirement_filter:{symbol}\n",
+        _worked_example_document(),
+    )
+    (tmp_path / "codegen").mkdir()
+    (tmp_path / "codegen" / "__init__.py").write_text("")
+    (tmp_path / "codegen" / "requirement_filter.py").write_text(module_body, encoding="utf-8")
+    return config
+
+
+def test_a_filter_module_that_raises_on_import_names_module_symbol_and_the_real_cause(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    config = _filter_project(tmp_path, "raise RuntimeError('the filter module blew up')\n")
+    monkeypatch.chdir(tmp_path)
+    assert main(["gen", "--config", str(config)]) == 1
+    err = capsys.readouterr().err
+    assert "requirementTests.filter" in err
+    assert "codegen.requirement_filter:include" in err
+    assert "the filter module blew up" in err
+    assert "not found" not in err
+
+
+def test_a_filter_symbol_that_is_missing_names_module_and_symbol(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    config = _filter_project(tmp_path, "def other(view):\n    return True\n")
+    monkeypatch.chdir(tmp_path)
+    assert main(["gen", "--config", str(config)]) == 1
+    err = capsys.readouterr().err
+    assert "'codegen.requirement_filter' has no attribute 'include'" in err
+
+
+def test_a_filter_naming_a_symbol_inside_the_running_package_does_not_unload_it(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Resolving a config symbol drops a stale module cached from ANOTHER PROJECT; it must never
+    unload an installed package (here `metaobjects` itself) the run is using."""
+    import sys
+
+    config = _project(
+        tmp_path,
+        "requirementTests:\n"
+        "  filter: metaobjects.codegen.requirement_walk:default_requirement_test_filter\n"
+        "  warnUncovered: false\n",
+        _worked_example_document(),
+    )
+    monkeypatch.chdir(tmp_path)
+    package = sys.modules["metaobjects"]
+    walk = sys.modules["metaobjects.codegen.requirement_walk"]
+    assert main(["gen", "--config", str(config)]) == 0
+    assert sys.modules["metaobjects"] is package
+    assert sys.modules["metaobjects.codegen.requirement_walk"] is walk
+    assert (tmp_path / "gen" / "requirements" / "test_acme_shop_requirements.py").is_file()
+
+
+def test_member_grain_keeps_the_first_of_a_reference_authored_twice(tmp_path: Path) -> None:
+    root = _load_corpus_case("member-grain-duplicate-ref")
+    seen: list[RequirementTestArgs] = []
+
+    def renderer(args: RequirementTestArgs) -> None:
+        seen.append(args)
+
+    files, _ = generate(root, tmp_path, grain="member", renderer=renderer)
+    source = next(iter(files.values()))
+    assert seen
+    for args in seen:
+        refs = [ref for ref, _concern in args.targets]
+        assert len(refs) == len(set(refs)), refs  # one claim per distinct reference
+    claims = [line for line in source.splitlines() if line.startswith("# Claims:")]
+    assert claims and all(line.count("  (object.entity)") == 1 for line in claims), claims
+
+
+# ---------------------------------------------------------------------------
+# A renderer that returns the wrong thing is a clean error naming it.
+# ---------------------------------------------------------------------------
+
+
+def _wrong_renderer(_args: RequirementTestArgs) -> str:
+    return "def test_x(): pass"
+
+
+def _wrong_source_renderer(_args: RequirementTestArgs) -> RenderedTest:
+    return RenderedTest(imports=(), source=b"def test_x(): pass")  # type: ignore[arg-type]
+
+
+@pytest.mark.parametrize(
+    ("renderer", "returned"),
+    [(_wrong_renderer, "str"), (_wrong_source_renderer, "a RenderedTest whose source is bytes")],
+)
+def test_a_renderer_returning_the_wrong_type_is_a_clean_error_naming_it(
+    tmp_path: Path, renderer: Any, returned: str
+) -> None:
+    with pytest.raises(ValueError) as exc:
+        generate(_load_corpus_case("worked-example"), tmp_path, renderer=renderer)
+    message = str(exc.value)
+    assert renderer.__qualname__ in message and renderer.__module__ in message
+    assert f"returned {returned} for 'acme::shop::Orders.Recorded [object.entity]'" in message
+    assert "expected a RenderedTest" in message
+
+
+def test_a_renderer_returning_the_wrong_type_fails_gen_without_a_traceback(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    config = _project(
+        tmp_path,
+        "requirementTests:\n  renderer: codegen.requirement_renderer:render\n  warnUncovered: false\n",
+        _worked_example_document(),
+    )
+    (tmp_path / "codegen").mkdir()
+    (tmp_path / "codegen" / "__init__.py").write_text("")
+    (tmp_path / "codegen" / "requirement_renderer.py").write_text(
+        "def render(args):\n    return 'not a RenderedTest'\n", encoding="utf-8"
+    )
+    monkeypatch.chdir(tmp_path)
+    assert main(["gen", "--config", str(config)]) == 1
+    err = capsys.readouterr().err
+    assert "codegen.requirement_renderer.render" in err and "returned str" in err
+
+
+# ---------------------------------------------------------------------------
+# Output text the other tests only parse.
+# ---------------------------------------------------------------------------
+
+
+def test_a_retired_requirement_is_skipped_with_the_retired_reason(tmp_path: Path) -> None:
+    files, _ = generate(_load_corpus_case("retired-skip"), tmp_path)
+    source = next(iter(files.values()))
+    assert (
+        '@pytest.mark.skip(reason="retired - the capability was deliberately removed; '
+        'assert it stays removed")'
+    ) in source
+    assert "# Status: retired" in source
+
+
+def test_a_missing_status_is_written_as_none_in_the_comment() -> None:
+    from metaobjects.codegen.generators.requirement_tests_generator import render_requirement_test
+    from metaobjects.codegen.requirement_walk import RequirementTestIdentity
+
+    identity = RequirementTestIdentity(
+        package="", path="P", unit="*", id="P [*]", witness_key="req_P",
+        status=None, skip=None, digest="0" * 64,
+    )
+    rendered = render_requirement_test(
+        RequirementTestArgs(identity, "s", "c", (), None, ())
+    )
+    assert "# Status: (none)\n" in rendered.source and "# Claims: (none)\n" in rendered.source
+
+
+def test_the_hook_receives_the_disposition_and_the_tracking_references(tmp_path: Path) -> None:
+    extra = "        disposition: deferred\n        trackedBy: [TRK-1, TRK-2]\n"
+    root = _load_yaml(_doc(_requirement("Gap", "partial", extra=extra)))
+    seen: list[RequirementTestArgs] = []
+
+    def renderer(args: RequirementTestArgs) -> None:
+        seen.append(args)
+
+    generate(root, tmp_path, renderer=renderer)
+    (args,) = seen
+    assert (args.disposition, args.tracked_by) == ("deferred", ("TRK-1", "TRK-2"))
+
+
+def test_a_nul_in_the_statement_is_written_visibly_in_the_comment_and_the_file_still_parses(
+    tmp_path: Path,
+) -> None:
+    root = _load_yaml(_doc(_requirement("Probe", statement='"before\\0after\\x07bell\\ttab"')))
+    files, _ = generate(root, tmp_path)
+    source = files["requirements/test_acme_shop_requirements.py"]
+    ast.parse(source, feature_version=(3, 9))
+    compile(source, "generated", "exec")  # the interpreter itself refuses a NUL in source
+    assert "# before\\x00after\\x07bell\ttab" in source.splitlines()
+    assert "\x00" not in source
+
+
+def test_a_package_outside_the_project_that_supplies_a_provider_a_renderer_and_a_filter_is_imported_once(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    import sys
+
+    runs = tmp_path / "runs.txt"
+    site = tmp_path / "site"
+    (site / "outside_hooks").mkdir(parents=True)
+    (site / "outside_hooks" / "__init__.py").write_text(
+        f"open({str(runs)!r}, 'a').write('x')\n"
+        "from metaobjects.provider import Provider\n"
+        "from metaobjects.codegen.requirement_hooks import RenderedTest\n"
+        "p = Provider('outside', ('metaobjects-core-types',))\n"
+        "def render(args):\n    return None\n"
+        "def include(view):\n    return view.level == 4\n",
+        encoding="utf-8",
+    )
+    monkeypatch.syspath_prepend(str(site))
+    assert "outside_hooks" not in sys.modules
+    project = tmp_path / "project"  # the package lives in tmp_path/site: OUTSIDE this root
+    project.mkdir()
+    config = _project(
+        project,
+        "providers: ['outside_hooks:p']\n"
+        "requirementTests:\n  renderer: outside_hooks:render\n  filter: outside_hooks:include\n"
+        "  warnUncovered: false\n",
+        _worked_example_document(),
+    )
+    monkeypatch.chdir(project)
+    try:
+        assert main(["gen", "--config", str(config)]) == 0
+        assert runs.read_text() == "x", "the outside package's __init__ must run exactly once in one gen"
+    finally:
+        sys.modules.pop("outside_hooks", None)
diff --git a/server/python/tests/conformance/test_requirement_check_conformance.py b/server/python/tests/conformance/test_requirement_check_conformance.py
new file mode 100644
index 000000000..c9c6b8933
--- /dev/null
+++ b/server/python/tests/conformance/test_requirement_check_conformance.py
@@ -0,0 +1,132 @@
+"""Cross-port requirement-check conformance corpus — fixtures/requirement-check-conformance/.
+
+See that directory's README.md for the fixture format. Every case is LOADED strict
+first, so "this model loads today" is proven by the fixture, and only then checked.
+Mirrors the TS reference (requirement-check-conformance.test.ts); a mismatch here is
+a bug in THIS port's gate, never in the fixture, and a committed ``expected.json`` is
+never edited to make this port pass.
+"""
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from metaobjects import MetaDataLoader
+from metaobjects.requirement_check import (
+    RequirementSummary,
+    check_requirements,
+    scan_requirements,
+    summarise_requirements,
+)
+
+
+def _corpus_root() -> Path:
+    here = Path(__file__).resolve()
+    for parent in [here, *here.parents]:
+        candidate = parent / "fixtures" / "requirement-check-conformance"
+        if candidate.is_dir():
+            return candidate
+    raise RuntimeError("could not locate fixtures/requirement-check-conformance from " + str(here))
+
+
+CORPUS = _corpus_root()
+FIXTURES = sorted(p.name for p in CORPUS.iterdir() if p.is_dir())
+
+#: The whole of ``options.json``. A key outside this list, or a value of the wrong
+#: type, is refused rather than ignored: a misspelt ``requireImplementers``, or one
+#: written as the string "true", would otherwise run the case without the strict
+#: switch and pin the wrong severity.
+OPTION_KEYS = {"libraries", "requireImplementers"}
+
+#: A case whose ``input/`` must be, file for file and byte for byte, another case's.
+SAME_INPUT_AS = {"require-implementers": "nothing-implements-subtree"}
+
+
+def _read_options(case_dir: Path) -> dict[str, Any]:
+    file = case_dir / "options.json"
+    if not file.exists():
+        return {}
+    options: dict[str, Any] = json.loads(file.read_text(encoding="utf-8"))
+    unknown = sorted(set(options) - OPTION_KEYS)
+    if unknown:
+        raise AssertionError(f"{file}: unknown option(s) {', '.join(unknown)}")
+    libraries = options.get("libraries")
+    if libraries is not None and not (
+        isinstance(libraries, list) and all(isinstance(x, str) for x in libraries)
+    ):
+        raise AssertionError(f"{file}: 'libraries' must be an array of strings")
+    require = options.get("requireImplementers")
+    if require is not None and not isinstance(require, bool):
+        raise AssertionError(f"{file}: 'requireImplementers' must be a boolean")
+    return options
+
+
+def _summary_dict(summary: RequirementSummary | None) -> dict[str, Any] | None:
+    """The corpus's JSON shape. ``entities*`` are absent unless coverage was measured."""
+    if summary is None:
+        return None
+    out: dict[str, Any] = {
+        "total": summary.total,
+        "functional": summary.functional,
+        "architectural": summary.architectural,
+        "byStatus": dict(summary.by_status),
+        "undecided": summary.undecided,
+        "deferredUntracked": summary.deferred_untracked,
+    }
+    if summary.entities_total is not None:
+        out["entitiesClaimed"] = summary.entities_claimed
+        out["entitiesTotal"] = summary.entities_total
+    return out
+
+
+def _input_files(name: str) -> dict[str, str]:
+    directory = CORPUS / name / "input"
+    return {p.name: p.read_text(encoding="utf-8") for p in sorted(directory.iterdir())}
+
+
+def _documented_cases() -> list[str]:
+    readme = (CORPUS / "README.md").read_text(encoding="utf-8")
+    section = next((s for s in re.split(r"^## ", readme, flags=re.M) if s.startswith("Cases\n")), None)
+    assert section is not None, "README.md has no '## Cases' section"
+    return re.findall(r"^\| `([^`]+)` \|", section, flags=re.M)
+
+
+def test_found_fixtures() -> None:
+    assert FIXTURES, "fixtures/requirement-check-conformance/ discovered no fixture directories"
+
+
+def test_every_case_on_disk_is_documented_in_the_readme_and_nothing_else_is() -> None:
+    assert sorted(_documented_cases()) == FIXTURES
+
+
+@pytest.mark.parametrize("name", FIXTURES)
+def test_fixture(name: str) -> None:
+    case_dir = CORPUS / name
+    expected = json.loads((case_dir / "expected.json").read_text(encoding="utf-8"))
+    options = _read_options(case_dir)
+
+    twin = SAME_INPUT_AS.get(name)
+    if twin is not None:
+        assert _input_files(name) == _input_files(twin)
+
+    result = MetaDataLoader.from_directory(
+        str(case_dir / "input"), strict=True, libraries=options.get("libraries")
+    )
+    assert [str(e) for e in result.errors] == []
+
+    # No scope predicate and no forced coverage answer: both are the port's defaults.
+    scan = scan_requirements(result.root, require_implementers=options.get("requireImplementers", False))
+
+    actual = sorted(
+        (d.severity, d.code, d.path or "", d.message) for d in check_requirements(result.root, scan)
+    )
+    wanted = sorted(
+        (d["severity"], d["code"], d.get("path", ""), d["message"]) for d in expected["diagnostics"]
+    )
+    assert actual == wanted
+
+    assert _summary_dict(summarise_requirements(result.root, scan)) == expected["summary"]
diff --git a/server/python/tests/conformance/test_requirement_test_identity_conformance.py b/server/python/tests/conformance/test_requirement_test_identity_conformance.py
new file mode 100644
index 000000000..772e32777
--- /dev/null
+++ b/server/python/tests/conformance/test_requirement_test_identity_conformance.py
@@ -0,0 +1,172 @@
+"""Cross-port requirement-test identity corpus — fixtures/requirement-test-identity-conformance/.
+
+Every port generates one test per requirement, in its own language and framework, and the
+generated files are free to differ. What may not differ is which tests a ledger yields, what
+each is called, whether it is skipped, the digest of the claim it tests, and what a project's
+filter is shown. This runner holds the Python port to the corpus; TypeScript is the reference
+(``requirement-test-identity-conformance.test.ts``), and a committed ``expected.json`` is never
+edited to make this port pass.
+
+Every case is LOADED strict first, in file-name order, so "this model loads today" is proven by
+the fixture rather than asserted in prose.
+"""
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+from typing import Any, Callable
+
+import pytest
+
+from metaobjects import MetaDataLoader
+from metaobjects.codegen.requirement_walk import (
+    RequirementTestIdentity,
+    RequirementView,
+    requirement_test_identities,
+    witness_key_collisions,
+    witness_key_of,
+)
+
+
+def _corpus_root() -> Path:
+    here = Path(__file__).resolve()
+    for parent in [here, *here.parents]:
+        candidate = parent / "fixtures" / "requirement-test-identity-conformance"
+        if candidate.is_dir():
+            return candidate
+    raise RuntimeError("could not locate fixtures/requirement-test-identity-conformance from " + str(here))
+
+
+CORPUS = _corpus_root()
+FIXTURES = sorted(p.name for p in CORPUS.iterdir() if p.is_dir())
+
+#: The whole of ``options.json``. A key outside this list is refused rather than ignored: a
+#: misspelt ``filter`` would otherwise run the case under the default filter and pin the wrong
+#: set of tests in every port.
+OPTION_KEYS = {"grain", "filter"}
+
+Predicate = Callable[[RequirementView], bool]
+
+#: The corpus's closed list of filters: exactly eight rows, in the README's order. A case NAMES
+#: one and every port's runner holds this table in its own language.
+FILTERS: dict[str, Predicate] = {
+    "all": lambda r: True,
+    "architectural": lambda r: r.sub_type == "architectural",
+    "live": lambda r: r.status == "live",
+    "level-5": lambda r: r.level == 5,
+    "unlevelled": lambda r: r.level is None,
+    "package-acme-shop": lambda r: r.package == "acme::shop",
+    "path-under-Shop": lambda r: r.path == "Shop" or r.path.startswith("Shop."),
+    "claims-entity": lambda r: "object.entity" in r.implemented_by_types,
+}
+
+
+def _read_options(case_dir: Path) -> dict[str, Any]:
+    file = case_dir / "options.json"
+    if not file.exists():
+        return {}
+    options: dict[str, Any] = json.loads(file.read_text(encoding="utf-8"))
+    unknown = sorted(set(options) - OPTION_KEYS)
+    if unknown:
+        raise AssertionError(f"{file}: unknown option(s) {', '.join(unknown)}")
+    return options
+
+
+def _filter_named(name: str) -> Predicate:
+    try:
+        return FILTERS[name]
+    except KeyError:
+        raise AssertionError(f"unknown filter '{name}'. The corpus names: {', '.join(FILTERS)}") from None
+
+
+def _record(t: RequirementTestIdentity) -> dict[str, Any]:
+    """The corpus's JSON shape: ``witnessKey``, not ``witness_key``."""
+    return {
+        "package": t.package,
+        "path": t.path,
+        "unit": t.unit,
+        "id": t.id,
+        "witnessKey": t.witness_key,
+        "status": t.status,
+        "skip": t.skip,
+        "digest": t.digest,
+    }
+
+
+def _by_id(records: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    return sorted(records, key=lambda r: r["id"])
+
+
+def _sorted_pairs(pairs: list[Any]) -> list[list[str]]:
+    return sorted(sorted(p) for p in pairs)
+
+
+def _documented_cases() -> list[str]:
+    readme = (CORPUS / "README.md").read_text(encoding="utf-8")
+    section = next((s for s in re.split(r"^## ", readme, flags=re.M) if s.startswith("Cases\n")), None)
+    assert section is not None, "README.md has no '## Cases' section"
+    return re.findall(r"^\| `([^`]+)` \|", section, flags=re.M)
+
+
+def load_case(name: str):
+    """Load ``input/`` of one case strict, in file-name order, asserting zero load errors."""
+    from metaobjects.loader.sources import FileSource
+
+    files = sorted((CORPUS / name / "input").iterdir(), key=lambda p: p.name)
+    result = MetaDataLoader(strict=True).load([FileSource(p) for p in files])
+    assert [str(e) for e in result.errors] == []
+    return result.root
+
+
+def test_found_fixtures() -> None:
+    assert FIXTURES, "fixtures/requirement-test-identity-conformance/ discovered no fixture directories"
+
+
+def test_every_case_on_disk_is_documented_in_the_readme_and_nothing_else_is() -> None:
+    assert sorted(_documented_cases()) == FIXTURES
+
+
+def test_the_filter_table_has_exactly_the_eight_named_rows() -> None:
+    readme = (CORPUS / "README.md").read_text(encoding="utf-8")
+    section = readme.split("### The named filters", 1)[1].split("- `level` is **absent**", 1)[0]
+    rows = [name for name in re.findall(r"^\| `([^`]+)` \|", section, flags=re.M) if name != "filter"]
+    assert sorted(rows) == sorted(FILTERS)
+    assert len(FILTERS) == 8
+
+
+@pytest.mark.parametrize("name", FIXTURES)
+def test_fixture(name: str) -> None:
+    case_dir = CORPUS / name
+    expected = json.loads((case_dir / "expected.json").read_text(encoding="utf-8"))
+    options = _read_options(case_dir)
+    root = load_case(name)
+
+    # Each option is passed only when the case sets it, so a case without one runs the
+    # port's own default, which is itself part of what the corpus pins.
+    kwargs: dict[str, Any] = {}
+    if "grain" in options:
+        kwargs["grain"] = options["grain"]
+    if "filter" in options:
+        kwargs["filter"] = _filter_named(options["filter"])
+    tests = requirement_test_identities(root, **kwargs)
+
+    assert _by_id([_record(t) for t in tests]) == _by_id(expected["tests"])
+    assert _sorted_pairs(witness_key_collisions(tests)) == _sorted_pairs(expected["collisions"])
+
+
+def test_the_witness_key_class_is_ascii_letters_and_digits_only() -> None:
+    # Pinned here and not by the corpus: no input declares a non-ASCII name, because the
+    # loaders are not known to agree on one. `str.isalnum()` and `\w` both keep the accent.
+    assert witness_key_of("acme::shop::Café.Réglé", "*") == "req_acme_shop_Caf_R_gl_"
+    # An underscore is outside the class, so a doubled one collapses.
+    assert witness_key_of("Orders__Recorded", "*") == "req_Orders_Recorded"
+    assert witness_key_of("acme::shop::Orders.Recorded", "object.entity") == (
+        "req_acme_shop_Orders_Recorded__object_entity"
+    )
+
+
+def test_an_unknown_grain_is_refused_by_the_identity_function_even_over_an_empty_ledger() -> None:
+    root = load_case("default-filter")
+    with pytest.raises(ValueError, match="unknown requirement-test grain 'hybrid'"):
+        requirement_test_identities(root, grain="hybrid", filter=lambda _view: False)
diff --git a/server/python/tests/loader/test_library_packages.py b/server/python/tests/loader/test_library_packages.py
new file mode 100644
index 000000000..966ef7769
--- /dev/null
+++ b/server/python/tests/loader/test_library_packages.py
@@ -0,0 +1,24 @@
+"""``library_packages()`` — the package set that decides whether a requirement came from a
+shipped library (and so whether object coverage is measured at all).
+
+It is read from the manifests embedded in the wheel. This test holds it to the manifests the
+repository ships, so a library added under ``library/`` without re-embedding, or a package
+added to one manifest, cannot leave the two disagreeing.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from metaobjects.library import library_packages
+
+_LIBRARY_DIR = Path(__file__).resolve().parents[4] / "library"
+
+
+def test_library_packages_is_exactly_the_packages_of_the_shipped_manifests() -> None:
+    manifests = sorted(_LIBRARY_DIR.glob("*/library.json"))
+    assert manifests, f"no library manifest under {_LIBRARY_DIR}"
+    expected = {pkg for manifest in manifests for pkg in json.loads(manifest.read_text())["packages"]}
+    assert expected  # a manifest that declares no package would make this test vacuous
+    assert library_packages() == expected
diff --git a/server/python/tests/unit/test_resolve_claim.py b/server/python/tests/unit/test_resolve_claim.py
new file mode 100644
index 000000000..15ae7c816
--- /dev/null
+++ b/server/python/tests/unit/test_resolve_claim.py
@@ -0,0 +1,47 @@
+"""``resolve_claim`` — an ``@implementedBy`` reference resolved to the node it names.
+
+The corpora pin the gate's verdicts; this pins the resolver's own contract for a reference
+that goes THREE segments deep (``Owner.member.child``), which every other resolution in the
+suite reaches only through the gate's yes/no.
+"""
+
+from __future__ import annotations
+
+from metaobjects import MetaDataLoader
+from metaobjects.loader.meta_data_loader import MetaDataFormat
+from metaobjects.meta.core.requirement.resolve_claim import resolve_claim
+
+_DOC = """
+metadata:
+  package: acme::shop
+  children:
+    - object.entity:
+        name: Order
+        children:
+          - field.uuid: { name: id }
+          - field.currency:
+              name: total
+              currency: USD
+              children:
+                - view.currency: { name: display, locale: en-US }
+          - identity.primary: { name: pk, fields: [id] }
+"""
+
+
+def _root():
+    result = MetaDataLoader.from_string(_DOC, format=MetaDataFormat.YAML, strict=True)
+    assert [str(e) for e in result.errors] == []
+    return result.root
+
+
+def test_a_three_segment_member_reference_resolves_to_the_innermost_node() -> None:
+    node = resolve_claim(_root(), "Order.total.display", "acme::shop")
+    assert node is not None
+    assert (node.type, node.sub_type, node.name) == ("view", "currency", "display")
+
+
+def test_a_three_segment_member_reference_does_not_resolve_when_a_segment_is_missing() -> None:
+    root = _root()
+    assert resolve_claim(root, "Order.total.nothing", "acme::shop") is None
+    assert resolve_claim(root, "Order.nothing.display", "acme::shop") is None
+    assert resolve_claim(root, "Missing.total.display", "acme::shop") is None
diff --git a/server/python/tests/unit/test_yaml_desugar.py b/server/python/tests/unit/test_yaml_desugar.py
index fa235c1dc..c3ba50a35 100644
--- a/server/python/tests/unit/test_yaml_desugar.py
+++ b/server/python/tests/unit/test_yaml_desugar.py
@@ -6,6 +6,9 @@
 """
 from __future__ import annotations
 
+from pathlib import Path
+
+from metaobjects import MetaDataLoader
 from metaobjects.core_types import core_providers
 from metaobjects.errors import ErrorCode
 from metaobjects.provider import compose_registry
@@ -305,3 +308,26 @@ def test_top_level_multi_key_collects_error() -> None:
     result = desugar({"a": 1, "b": 2}, _registry())
     assert len(result.errors) == 1
     assert "exactly one type key" in result.errors[0].message
+
+
+# ---------------------------------------------------------------------------
+# FR-032 - a node's own `package` under a packaged root
+# ---------------------------------------------------------------------------
+
+
+def test_node_level_package_under_a_packaged_root_loads_strict(tmp_path: Path) -> None:
+    """An absolute `package` is taken literally and a leading `::` is relative to the
+    parent's. Both used to raise NameError (PACKAGE_SEP was never imported here)."""
+    (tmp_path / "meta.acme.yaml").write_text(
+        "metadata:\n"
+        "  package: acme\n"
+        "  children:\n"
+        "    - object.entity: { name: Plain }\n"
+        "    - object.entity: { name: Absolute, package: other::shop }\n"
+        "    - object.entity: { name: Relative, package: '::billing' }\n",
+        encoding="utf-8",
+    )
+    result = MetaDataLoader.from_directory(str(tmp_path), strict=True)
+    assert [str(e) for e in result.errors] == []
+    keys = sorted(c.resolution_key() for c in result.root.children())
+    assert keys == ["acme::Plain", "acme::billing::Relative", "other::shop::Absolute"]
diff --git a/server/typescript/packages/cli/src/commands/verify.ts b/server/typescript/packages/cli/src/commands/verify.ts
index 92404b10f..9002b9f4e 100644
--- a/server/typescript/packages/cli/src/commands/verify.ts
+++ b/server/typescript/packages/cli/src/commands/verify.ts
@@ -684,7 +684,14 @@ export async function verifyCommand(
     // ONE scan for all three passes. The gate and the summary each used to walk the
     // model AND resolve every @implementedBy claim for themselves — the resolution
     // being the expensive half — and the lint added a third walk on top.
-    const scan = scanRequirements(root, { coverable: collection.inScope });
+    // The strict switch (ADR-0057) is decided here, once, and travels on the scan: the
+    // flag or META_REQUIRE_IMPLEMENTERS=1 — a flag-or-variable pair, as
+    // --no-requirement-lint has below, so a CI job can turn it on without editing a
+    // command line it shares with local runs.
+    const scan = scanRequirements(root, {
+      coverable: collection.inScope,
+      requireImplementers: flags.requireImplementers || process.env.META_REQUIRE_IMPLEMENTERS === "1",
+    });
     const diags = [...checkRequirements(root, scan)];
 
     // Printed on EVERY run, clean or not — a gate that says nothing when it
diff --git a/server/typescript/packages/cli/src/index.ts b/server/typescript/packages/cli/src/index.ts
index 9cf7ef350..519ed3c27 100644
--- a/server/typescript/packages/cli/src/index.ts
+++ b/server/typescript/packages/cli/src/index.ts
@@ -141,6 +141,11 @@ VERIFY FLAGS (ADR-0021 D2 — explicit subverbs; combine any; exit 1 on ANY drif
   --no-antipatterns     Suppress the advisory "you hand-rolled what MetaObjects can
                         model" pass (aggregate/currency/enum hints; warnings only)
   --no-requirement-lint Suppress the advisory requirement AUTHORING lint (not the gate)
+  --require-implementers
+                        Fail (exit 1) when a live functional requirement has nothing
+                        implementing it. That finding is a warning without this flag;
+                        with it, the same WARN_REQUIREMENT_NOTHING_IMPLEMENTS code is
+                        reported as an error. Also: META_REQUIRE_IMPLEMENTERS=1.
   --no-overlay-lint     Suppress the advisory overlay-redeclaration AUTHORING lint
                         (never a gate — this lint can't fail the build)
   --no-name-lint        Suppress the advisory node-name AUTHORING lint (whitespace
@@ -341,6 +346,11 @@ FLAGS:
                         migrating a model onto a registered provider.
   --no-antipatterns     Suppress the advisory "hand-rolled what MetaObjects can model" pass
   --no-requirement-lint Suppress the advisory requirement AUTHORING lint (not the gate)
+  --require-implementers
+                        Fail (exit 1) when a live functional requirement has nothing
+                        implementing it. That finding is a warning without this flag;
+                        with it, the same WARN_REQUIREMENT_NOTHING_IMPLEMENTS code is
+                        reported as an error. Also: META_REQUIRE_IMPLEMENTERS=1.
   --no-overlay-lint     Suppress the advisory overlay-redeclaration AUTHORING lint —
                         never a gate; this lint can't fail the build
   --no-name-lint        Suppress the advisory node-name AUTHORING lint (whitespace in
@@ -373,6 +383,9 @@ lint in its own section: names that are not addressable, prose slots holding one
 sentence twice, content written where no surface reads it. Warnings only — it can
 never fail the build. Opt out with --no-requirement-lint or META_NO_REQUIREMENT_LINT=1.
 The requirements GATE itself (dangling refs, link floor, levels) always runs.
+One of its findings is a warning you can raise: a live functional requirement that
+nothing implements fails the build under --require-implementers or
+META_REQUIRE_IMPLEMENTERS=1. The diagnostic keeps its code; only its severity moves.
 
 verify also prints an ADVISORY overlay authoring lint, in its own section: a
 top-level declaration redeclared in two or more files where more than one
diff --git a/server/typescript/packages/cli/src/lib/args.ts b/server/typescript/packages/cli/src/lib/args.ts
index b0815b662..54cb051b7 100644
--- a/server/typescript/packages/cli/src/lib/args.ts
+++ b/server/typescript/packages/cli/src/lib/args.ts
@@ -381,6 +381,21 @@ export interface VerifyFlags {
    * the half that CAN fail a build switched on. Same shape as --no-antipatterns.
    */
   noRequirementLint: boolean;
+  /**
+   * The requirement gate's strict switch (ADR-0057): report a live functional
+   * requirement that nothing implements (`WARN_REQUIREMENT_NOTHING_IMPLEMENTS`) at
+   * severity `error`, so it fails the build. The code is unchanged and no other
+   * diagnostic moves. Off by default because a ledger authored ahead of its links is
+   * the normal incremental state.
+   *
+   * Named for what it requires, not `--strict`: `--lax` below is a different axis
+   * (ADR-0023 attribute strictness), and a `--strict` beside it would read as that
+   * flag's opposite rather than as a requirement-gate setting — the same reason
+   * `--replay-snapshot` above is a subverb and not a `--strict` modifier. It is not
+   * an explicit subverb either: the requirement gate runs on every `verify`, so this
+   * flag modifies a gate that is already selected.
+   */
+  requireImplementers: boolean;
   /**
    * Suppress the advisory overlay AUTHORING lint (FR-023 §11.1 item 4) — the
    * finding that an unflagged cross-file redeclaration works today only
@@ -452,6 +467,7 @@ export const VERIFY_OPTIONS = {
   "replay-snapshot": { type: "boolean", default: false },
   "no-antipatterns": { type: "boolean", default: false },
   "no-requirement-lint": { type: "boolean", default: false },
+  "require-implementers": { type: "boolean", default: false },
   "no-overlay-lint": { type: "boolean", default: false },
   "no-name-lint": { type: "boolean", default: false },
   "no-deprecation-lint": { type: "boolean", default: false },
@@ -539,6 +555,7 @@ export function parseVerifyArgs(argv: string[]): VerifyFlags {
     anyExplicit,
     noAntipatterns: !!values["no-antipatterns"],
     noRequirementLint: !!values["no-requirement-lint"],
+    requireImplementers: !!values["require-implementers"],
     noOverlayLint: !!values["no-overlay-lint"],
     noNameLint: !!values["no-name-lint"],
     noDeprecationLint: !!values["no-deprecation-lint"],
diff --git a/server/typescript/packages/cli/src/lib/requirement-check.ts b/server/typescript/packages/cli/src/lib/requirement-check.ts
index 35018ab13..dfe86abf3 100644
--- a/server/typescript/packages/cli/src/lib/requirement-check.ts
+++ b/server/typescript/packages/cli/src/lib/requirement-check.ts
@@ -279,6 +279,11 @@ export interface RequirementScan {
    *  printed a ratio the gate had not enforced would be a measurement nobody could
    *  reconcile with the diagnostics beneath it. */
   readonly measureCoverage: boolean;
+  /** ADR-0057 — the strict switch. When true, the functional EXISTENCE finding
+   *  (`WARN_REQUIREMENT_NOTHING_IMPLEMENTS`) is reported at severity `error`; the code,
+   *  path and message do not change, and no other diagnostic is touched. Carried on
+   *  the scan, like `measureCoverage`, so a caller decides it once per run. */
+  readonly requireImplementers: boolean;
 }
 
 /**
@@ -321,6 +326,8 @@ export function scanRequirements(
      *  by its own ledger" is exactly what is being asserted — so the derivation would
      *  switch the check off precisely where it is the point. */
     measureCoverage?: boolean;
+    /** Raise WARN_REQUIREMENT_NOTHING_IMPLEMENTS to severity "error". Default false. */
+    requireImplementers?: boolean;
   },
 ): RequirementScan {
   const addressed = collectAddressedRequirements(root);
@@ -328,6 +335,7 @@ export function scanRequirements(
     addressed,
     claimedObjects: claimedObjectKeys(root, addressed.map((r) => r.node)),
     measureCoverage: opts?.measureCoverage ?? projectAuthoredRequirements(addressed),
+    requireImplementers: opts?.requireImplementers ?? false,
     // `exactOptionalPropertyTypes` — an omitted key, never an explicit `undefined`.
     ...(opts?.coverable !== undefined ? { coverable: opts.coverable } : {}),
   };
@@ -593,9 +601,15 @@ export function checkRequirements(root: MetaData, scan: RequirementScan = scanRe
     // tree. So the question is not "does this node claim anything" but "does
     // anything in this subtree claim anything". A live L1 whose entire subtree
     // is empty is a capability declared and built by nobody.
+    //
+    // The strict switch (ADR-0057, `meta verify --require-implementers`) raises the
+    // SEVERITY for a project whose ledger has caught up with its links. The code
+    // keeps its `WARN_` name on purpose: it identifies the finding, and one finding
+    // under two codes would split every suppression and corpus case that keys on it.
     if (!architectural && live && !subtreeClaimsAnything(req)) {
       out.push({
-        severity: "warn", code: WARN_REQUIREMENT_NOTHING_IMPLEMENTS, path: reqPath,
+        severity: scan.requireImplementers ? "error" : "warn",
+        code: WARN_REQUIREMENT_NOTHING_IMPLEMENTS, path: reqPath,
         message: `is '${String(status)}' but neither it nor anything nested under it names an ` +
           `implementing node. A functional requirement's check is existence — a subtree that claims ` +
           `nothing is a capability nobody built.`,
diff --git a/server/typescript/packages/cli/test/__snapshots__/cli.test.ts.snap b/server/typescript/packages/cli/test/__snapshots__/cli.test.ts.snap
index 9b18bde00..8e96556ff 100644
--- a/server/typescript/packages/cli/test/__snapshots__/cli.test.ts.snap
+++ b/server/typescript/packages/cli/test/__snapshots__/cli.test.ts.snap
@@ -121,6 +121,11 @@ VERIFY FLAGS (ADR-0021 D2 — explicit subverbs; combine any; exit 1 on ANY drif
   --no-antipatterns     Suppress the advisory "you hand-rolled what MetaObjects can
                         model" pass (aggregate/currency/enum hints; warnings only)
   --no-requirement-lint Suppress the advisory requirement AUTHORING lint (not the gate)
+  --require-implementers
+                        Fail (exit 1) when a live functional requirement has nothing
+                        implementing it. That finding is a warning without this flag;
+                        with it, the same WARN_REQUIREMENT_NOTHING_IMPLEMENTS code is
+                        reported as an error. Also: META_REQUIRE_IMPLEMENTERS=1.
   --no-overlay-lint     Suppress the advisory overlay-redeclaration AUTHORING lint
                         (never a gate — this lint can't fail the build)
   --no-name-lint        Suppress the advisory node-name AUTHORING lint (whitespace
diff --git a/server/typescript/packages/cli/test/eject-multi.test.ts b/server/typescript/packages/cli/test/eject-multi.test.ts
index e64690529..deae7a513 100644
--- a/server/typescript/packages/cli/test/eject-multi.test.ts
+++ b/server/typescript/packages/cli/test/eject-multi.test.ts
@@ -91,6 +91,29 @@ describe("meta eject takes many names", () => {
     }
   });
 
+  test("requirement-tests ejects — it ships a reference template", async () => {
+    // It used to answer `package-only`: the registry listed it and no template existed.
+    const dir = tmp();
+    try {
+      expect(await ejectCommand(["requirement-tests"], dir, "json")).toBe(0);
+      expect(erred.join("\n")).not.toContain("package-only");
+      const copy = join(dir, "codegen/generators/requirement-tests.ts");
+      expect(existsSync(copy)).toBe(true);
+      // One eject hands over the generator AND the default stub renderer.
+      const source = readFileSync(copy, "utf8");
+      expect(source).toContain("export function requirementTests(");
+      expect(source).toContain("export function renderRequirementTest(");
+      const [row] = payload().ejected;
+      expect(row?.status).toBe("created");
+      expect(row?.wire.entry).toBe("requirementTests()");
+      expect(row?.wire.import).toBe(
+        'import { requirementTests } from "./codegen/generators/requirement-tests.js";',
+      );
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   test("a repeated name is a usage error, not a silent second write", async () => {
     const dir = tmp();
     try {
diff --git a/server/typescript/packages/cli/test/requirement-check-conformance.test.ts b/server/typescript/packages/cli/test/requirement-check-conformance.test.ts
new file mode 100644
index 000000000..d8997bff1
--- /dev/null
+++ b/server/typescript/packages/cli/test/requirement-check-conformance.test.ts
@@ -0,0 +1,127 @@
+// Cross-port requirement-check conformance corpus — fixtures/requirement-check-conformance/.
+//
+// The requirement gate is core (`meta verify` is a drift gate), and ADR-0057 puts it in
+// every port. This corpus is what holds the other four to this one: the same inputs, the
+// same diagnostics down to the message text, the same summary counts.
+//
+// Every case is LOADED strict first, so "this model loads today" is proven by the fixture
+// rather than asserted in prose, and only then checked. `expected.json` is written from
+// this implementation by `scripts/write-requirement-corpus-expected.ts` and reviewed by
+// hand; this runner is what stops it drifting afterwards.
+import { describe, test, expect } from "bun:test";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { MetaDataLoader } from "@metaobjectsdev/metadata";
+import {
+  checkRequirements,
+  scanRequirements,
+  summariseRequirements,
+  type RequirementSummary,
+} from "../src/lib/requirement-check.js";
+
+const CORPUS_DIR = join(import.meta.dir, "../../../../../fixtures/requirement-check-conformance");
+
+/** `path` is absent on a diagnostic whose subject is not a requirement (object coverage). */
+interface Finding { severity: string; code: string; path?: string; message: string }
+interface Expected { diagnostics: Finding[]; summary: RequirementSummary | null }
+
+/** The whole of `options.json`. A key outside this list, or a value of the wrong type, is
+ *  refused rather than ignored: a misspelt `requireImplementers`, or one written as the
+ *  string "true", would otherwise run the case without the strict switch and pin the
+ *  wrong severity in every port. */
+const OPTION_KEYS = ["libraries", "requireImplementers"] as const;
+interface Options { libraries?: string[]; requireImplementers?: boolean }
+
+/** A case whose `input/` must be, file for file and byte for byte, another case's. The
+ *  pair differs in `options.json` only, so the two expectations isolate what the option
+ *  does; an input edited on one side would quietly end that. */
+const SAME_INPUT_AS: Readonly<Record<string, string>> = {
+  "require-implementers": "nothing-implements-subtree",
+};
+
+type Row = readonly [severity: string, code: string, path: string, message: string];
+
+const row = (d: Finding): Row => [d.severity, d.code, d.path ?? "", d.message];
+const order = (a: Row, b: Row): number => {
+  for (let i = 0; i < a.length; i++) {
+    if (a[i]! < b[i]!) return -1;
+    if (a[i]! > b[i]!) return 1;
+  }
+  return 0;
+};
+/** The comparison the corpus README names: a sorted multiset of (severity, code, path, message). */
+const multiset = (ds: readonly Finding[]): Row[] => ds.map(row).sort(order);
+
+function readOptions(caseDir: string): Options {
+  const file = join(caseDir, "options.json");
+  if (!existsSync(file)) return {};
+  const options = JSON.parse(readFileSync(file, "utf8")) as Record<string, unknown>;
+  const unknown = Object.keys(options).filter((k) => !(OPTION_KEYS as readonly string[]).includes(k));
+  if (unknown.length > 0) throw new Error(`${file}: unknown option(s) ${unknown.join(", ")}`);
+
+  const { libraries, requireImplementers } = options;
+  if (libraries !== undefined
+      && !(Array.isArray(libraries) && libraries.every((l): l is string => typeof l === "string"))) {
+    throw new Error(`${file}: 'libraries' must be an array of strings`);
+  }
+  if (requireImplementers !== undefined && typeof requireImplementers !== "boolean") {
+    throw new Error(`${file}: 'requireImplementers' must be a boolean`);
+  }
+  return {
+    ...(libraries === undefined ? {} : { libraries }),
+    ...(requireImplementers === undefined ? {} : { requireImplementers }),
+  };
+}
+
+/** Every file under a case's `input/`, by name, with its content. */
+function inputFiles(name: string): Record<string, string> {
+  const dir = join(CORPUS_DIR, name, "input");
+  return Object.fromEntries(readdirSync(dir).sort().map((f) => [f, readFileSync(join(dir, f), "utf8")]));
+}
+
+/** The case names the README's "Cases" table documents, in table order. */
+function documentedCases(): string[] {
+  const readme = readFileSync(join(CORPUS_DIR, "README.md"), "utf8");
+  const section = readme.split(/^## /m).find((s) => s.startsWith("Cases\n"));
+  if (section === undefined) throw new Error("README.md has no '## Cases' section");
+  return [...section.matchAll(/^\| `([^`]+)` \|/gm)].map((m) => m[1]!);
+}
+
+const cases = readdirSync(CORPUS_DIR).filter((n) => statSync(join(CORPUS_DIR, n)).isDirectory()).sort();
+
+describe("requirement-check conformance corpus", () => {
+  test("every case on disk is documented in the README, and nothing else is", () => {
+    expect(cases.length).toBeGreaterThan(0);
+    expect(documentedCases().sort()).toEqual(cases);
+  });
+
+  for (const name of cases) {
+    test(name, async () => {
+      const caseDir = join(CORPUS_DIR, name);
+      const expectedFile = join(caseDir, "expected.json");
+      if (!existsSync(expectedFile)) {
+        throw new Error(
+          `${name}: no expected.json. Write it with ` +
+            `'bun scripts/write-requirement-corpus-expected.ts check', then review it by hand.`,
+        );
+      }
+      const expected = JSON.parse(readFileSync(expectedFile, "utf8")) as Expected;
+      const options = readOptions(caseDir);
+
+      const twin = SAME_INPUT_AS[name];
+      if (twin !== undefined) expect(inputFiles(name)).toEqual(inputFiles(twin));
+
+      const result = await MetaDataLoader.fromDirectory(join(caseDir, "input"), {
+        strict: true,
+        ...(options.libraries === undefined ? {} : { libraries: options.libraries }),
+      });
+      expect(result.errors.map(String)).toEqual([]);
+
+      const scan = scanRequirements(result.root, {
+        requireImplementers: options.requireImplementers ?? false,
+      });
+      expect(multiset(checkRequirements(result.root, scan))).toEqual(multiset(expected.diagnostics));
+      expect(summariseRequirements(result.root, scan) ?? null).toStrictEqual(expected.summary);
+    });
+  }
+});
diff --git a/server/typescript/packages/cli/test/unit/args-verify.test.ts b/server/typescript/packages/cli/test/unit/args-verify.test.ts
index 38d850fa5..300528fce 100644
--- a/server/typescript/packages/cli/test/unit/args-verify.test.ts
+++ b/server/typescript/packages/cli/test/unit/args-verify.test.ts
@@ -6,7 +6,7 @@ describe("parseVerifyArgs", () => {
   test("defaults: prompts/db/dialect undefined, allow empty, skipSchema false, no explicit subverb", () => {
     expect(parseVerifyArgs([])).toEqual({
       prompts: undefined, db: undefined, dialect: undefined, allow: [], skipSchema: false,
-      templates: false, codegen: false, forbidHandEdits: false, docs: false, deps: false, anyExplicit: false, noAntipatterns: false, noRequirementLint: false, noOverlayLint: false, noNameLint: false, noDeprecationLint: false, noFieldLint: false, lax: false,
+      templates: false, codegen: false, forbidHandEdits: false, docs: false, deps: false, anyExplicit: false, noAntipatterns: false, noRequirementLint: false, requireImplementers: false, noOverlayLint: false, noNameLint: false, noDeprecationLint: false, noFieldLint: false, lax: false,
       replay: false, replaySnapshot: false,
       d1: undefined, remote: false, limit: DEFAULT_ADVISORY_LIMIT,
     });
@@ -14,7 +14,7 @@ describe("parseVerifyArgs", () => {
   test("--prompts <dir> is captured", () => {
     expect(parseVerifyArgs(["--prompts", "templates"])).toEqual({
       prompts: "templates", db: undefined, dialect: undefined, allow: [], skipSchema: false,
-      templates: false, codegen: false, forbidHandEdits: false, docs: false, deps: false, anyExplicit: false, noAntipatterns: false, noRequirementLint: false, noOverlayLint: false, noNameLint: false, noDeprecationLint: false, noFieldLint: false, lax: false,
+      templates: false, codegen: false, forbidHandEdits: false, docs: false, deps: false, anyExplicit: false, noAntipatterns: false, noRequirementLint: false, requireImplementers: false, noOverlayLint: false, noNameLint: false, noDeprecationLint: false, noFieldLint: false, lax: false,
       replay: false, replaySnapshot: false,
       d1: undefined, remote: false, limit: DEFAULT_ADVISORY_LIMIT,
     });
@@ -22,7 +22,7 @@ describe("parseVerifyArgs", () => {
   test("--db / --dialect / --skip-schema are captured", () => {
     expect(parseVerifyArgs(["--db", "file:x.db", "--dialect", "sqlite", "--skip-schema"])).toEqual({
       prompts: undefined, db: "file:x.db", dialect: "sqlite", allow: [], skipSchema: true,
-      templates: false, codegen: false, forbidHandEdits: false, docs: false, deps: false, anyExplicit: true, noAntipatterns: false, noRequirementLint: false, noOverlayLint: false, noNameLint: false, noDeprecationLint: false, noFieldLint: false, lax: false,
+      templates: false, codegen: false, forbidHandEdits: false, docs: false, deps: false, anyExplicit: true, noAntipatterns: false, noRequirementLint: false, requireImplementers: false, noOverlayLint: false, noNameLint: false, noDeprecationLint: false, noFieldLint: false, lax: false,
       replay: false, replaySnapshot: false,
       d1: undefined, remote: false, limit: DEFAULT_ADVISORY_LIMIT,
     });
@@ -32,7 +32,7 @@ describe("parseVerifyArgs", () => {
   test("--dialect d1 --d1 <binding> --remote are captured; --dialect d1 alone is an explicit subverb", () => {
     expect(parseVerifyArgs(["--dialect", "d1", "--d1", "DB", "--remote"])).toEqual({
       prompts: undefined, db: undefined, dialect: "d1", allow: [], skipSchema: false,
-      templates: false, codegen: false, forbidHandEdits: false, docs: false, deps: false, anyExplicit: true, noAntipatterns: false, noRequirementLint: false, noOverlayLint: false, noNameLint: false, noDeprecationLint: false, noFieldLint: false, lax: false,
+      templates: false, codegen: false, forbidHandEdits: false, docs: false, deps: false, anyExplicit: true, noAntipatterns: false, noRequirementLint: false, requireImplementers: false, noOverlayLint: false, noNameLint: false, noDeprecationLint: false, noFieldLint: false, lax: false,
       replay: false, replaySnapshot: false,
       d1: "DB", remote: true, limit: DEFAULT_ADVISORY_LIMIT,
     });
@@ -61,7 +61,7 @@ describe("parseVerifyArgs", () => {
     expect(parseVerifyArgs(["--allow", "drop-column,drop-table"])).toEqual({
       prompts: undefined, db: undefined, dialect: undefined,
       allow: ["drop-column", "drop-table"], skipSchema: false,
-      templates: false, codegen: false, forbidHandEdits: false, docs: false, deps: false, anyExplicit: false, noAntipatterns: false, noRequirementLint: false, noOverlayLint: false, noNameLint: false, noDeprecationLint: false, noFieldLint: false, lax: false,
+      templates: false, codegen: false, forbidHandEdits: false, docs: false, deps: false, anyExplicit: false, noAntipatterns: false, noRequirementLint: false, requireImplementers: false, noOverlayLint: false, noNameLint: false, noDeprecationLint: false, noFieldLint: false, lax: false,
       replay: false, replaySnapshot: false,
       d1: undefined, remote: false, limit: DEFAULT_ADVISORY_LIMIT,
     });
@@ -134,6 +134,13 @@ describe("parseVerifyArgs", () => {
     // is the whole reason the two print as separate sections.
     expect(parseVerifyArgs(["--no-requirement-lint"]).anyExplicit).toBe(false);
   });
+  test("--require-implementers parses to requireImplementers: true, and defaults false", () => {
+    expect(parseVerifyArgs([]).requireImplementers).toBe(false);
+    expect(parseVerifyArgs(["--require-implementers"]).requireImplementers).toBe(true);
+    // A modifier on the requirement gate, which runs on every verify — not a subverb,
+    // so it must not switch the bare-verify template default off.
+    expect(parseVerifyArgs(["--require-implementers"]).anyExplicit).toBe(false);
+  });
   test("--forbid-hand-edits rides on --codegen, and is refused without it", () => {
     expect(parseVerifyArgs(["--codegen"]).forbidHandEdits).toBe(false);
     expect(parseVerifyArgs(["--codegen", "--forbid-hand-edits"]).forbidHandEdits).toBe(true);
diff --git a/server/typescript/packages/cli/test/unit/requirement-check.test.ts b/server/typescript/packages/cli/test/unit/requirement-check.test.ts
index 65ec67db5..ab2ad96f4 100644
--- a/server/typescript/packages/cli/test/unit/requirement-check.test.ts
+++ b/server/typescript/packages/cli/test/unit/requirement-check.test.ts
@@ -23,6 +23,7 @@ import {
 } from "@metaobjectsdev/metadata";
 import {
   checkRequirements,
+  scanRequirements,
   summariseRequirements,
   collectRequirements,
   splitMemberRef,
@@ -36,6 +37,8 @@ import {
   ERR_REQUIREMENT_L5_NOT_MEMBER,
   ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS,
   WARN_REQUIREMENT_OBJECT_UNCLAIMED,
+  WARN_REQUIREMENT_NOTHING_IMPLEMENTS,
+  WARN_REQUIREMENT_DEFERRED_UNTRACKED,
   type Diagnostic,
 } from "../../src/lib/requirement-check.js";
 
@@ -134,7 +137,13 @@ interface Loaded { diags: Diagnostic[]; }
 /** Load a model + requirement declarations and run the check. Returns the loader
  *  error instead when the load itself is rejected — several tests assert that the
  *  LOADER, not this CLI, is what refuses bad input. */
-async function run(capsYaml: string, extraModel = ""): Promise<Loaded & { loadError?: string }> {
+async function run(
+  capsYaml: string,
+  extraModel = "",
+  /** Options for the scan the check reads. Omitted, the check builds its own default
+   *  scan — the path every test that does not care about an option goes through. */
+  scanOpts?: Parameters<typeof scanRequirements>[1],
+): Promise<Loaded & { loadError?: string }> {
   const dir = mkdtempSync(join(tmpdir(), "req-check-"));
   try {
     mkdirSync(join(dir, "metaobjects"));
@@ -147,7 +156,11 @@ async function run(capsYaml: string, extraModel = ""): Promise<Loaded & { loadEr
     } catch (err) {
       return { diags: [], loadError: (err as Error).message };
     }
-    return { diags: checkRequirements(root) };
+    return {
+      diags: scanOpts === undefined
+        ? checkRequirements(root)
+        : checkRequirements(root, scanRequirements(root, scanOpts)),
+    };
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }
@@ -698,6 +711,86 @@ describe("requirement.* — planned, disposition and tracking", () => {
     expect(r.diags.map((d) => d.code)).not.toContain("WARN_REQUIREMENT_NOTHING_IMPLEMENTS");
   });
 
+  // -- the strict switch (ADR-0057) -------------------------------------------
+  // `meta verify --require-implementers` reaches the check as this one scan option.
+  // It RAISES the existence warning; it does not rename it. A second `ERR_` code for
+  // the same finding would make every tool that keys on the code — a suppression, a
+  // dashboard, the cross-port corpus — treat one condition as two.
+  test("requireImplementers raises nothing-implements to an error and keeps the code", async () => {
+    const model = caps(COVER + `
+          - requirement.functional:
+              name: BuiltByNobody
+              level: 4
+              status: live
+              statement: "Customers can export their order history"
+              counterexample: "A customer who asks for their data and cannot be given it"
+`);
+    const byDefault = await run(model, OTHER);
+    expect(byDefault.loadError).toBeUndefined();
+    // Exactly one diagnostic: COVER claims every entity, so nothing else is in play.
+    expect(byDefault.diags).toHaveLength(1);
+    const warned = byDefault.diags[0]!;
+    expect(warned.severity).toBe("warn");
+    expect(warned.code).toBe(WARN_REQUIREMENT_NOTHING_IMPLEMENTS);
+    expect(warned.path).toBe("Solution.OrderService.BuiltByNobody");
+
+    const strict = await run(model, OTHER, { requireImplementers: true });
+    // Same code, same path, same message — the severity is the only thing that moved.
+    expect(strict.diags).toEqual([{ ...warned, severity: "error" }]);
+
+    // An explicit `false` is the default, not a third state.
+    expect((await run(model, OTHER, { requireImplementers: false })).diags).toEqual(byDefault.diags);
+  });
+
+  test("requireImplementers changes no other diagnostic", async () => {
+    // One of each neighbour the switch must leave alone: a gate ERROR (dangling ref),
+    // a different gate WARNING (deferred, untracked) and the coverage warning (neither
+    // entity is claimed by a reference that resolves) — beside one nothing-implements.
+    const model = caps(`
+          - requirement.functional:
+              name: OrderRecording
+              level: 4
+              status: live
+              statement: "Orders are recorded"
+              counterexample: "An order placed and never stored"
+              implementedBy: ["acme::shop::Ordr"]
+          - requirement.functional:
+              name: BuiltByNobody
+              level: 4
+              status: live
+              statement: "Customers can export their order history"
+              counterexample: "A customer who asks for their data and cannot be given it"
+          - requirement.functional:
+              name: Refunds
+              level: 4
+              status: planned
+              disposition: deferred
+              statement: "A refund is recorded against its order"
+              counterexample: "A refund with no order behind it"
+`);
+    const byDefault = await run(model);
+    const strict = await run(model, "", { requireImplementers: true });
+    expect(byDefault.loadError).toBeUndefined();
+
+    // The fixture really does hold the neighbours, at the severities they ship with —
+    // otherwise "nothing else changed" below would be true of an empty list.
+    const severityOf = (d: Diagnostic[], code: string): string[] =>
+      d.filter((x) => x.code === code).map((x) => x.severity);
+    expect(severityOf(byDefault.diags, ERR_REQUIREMENT_DANGLING_REF)).toEqual(["error"]);
+    expect(severityOf(byDefault.diags, WARN_REQUIREMENT_DEFERRED_UNTRACKED)).toEqual(["warn"]);
+    expect(severityOf(byDefault.diags, WARN_REQUIREMENT_OBJECT_UNCLAIMED))
+      .toEqual([OBJECT_COVERAGE_SEVERITY, OBJECT_COVERAGE_SEVERITY]);
+    expect(severityOf(byDefault.diags, WARN_REQUIREMENT_NOTHING_IMPLEMENTS)).toEqual(["warn"]);
+
+    // The switch reached its own row...
+    expect(severityOf(strict.diags, WARN_REQUIREMENT_NOTHING_IMPLEMENTS)).toEqual(["error"]);
+    // ...and nothing else: same diagnostics, same order, once that one row is set back.
+    const lowered = strict.diags.map((d) =>
+      d.code === WARN_REQUIREMENT_NOTHING_IMPLEMENTS ? { ...d, severity: "warn" as const } : d,
+    );
+    expect(lowered).toEqual(byDefault.diags);
+  });
+
   test("an ARCHITECTURAL claim on an abstract base covers everything extending it", async () => {
     // The documented BaseEntity pattern was previously WORSE than not using it:
     // claiming the base covered none of its subtypes, and the abstract was itself
diff --git a/server/typescript/packages/cli/test/verify-requirements-e2e.test.ts b/server/typescript/packages/cli/test/verify-requirements-e2e.test.ts
index 5ab5e8e1f..e8e1cd443 100644
--- a/server/typescript/packages/cli/test/verify-requirements-e2e.test.ts
+++ b/server/typescript/packages/cli/test/verify-requirements-e2e.test.ts
@@ -10,7 +10,7 @@
 // Each case drives the real command dispatcher, so a regression in the wiring —
 // requirements silently unhooked from the exit-code max, say — fails here.
 
-import { test, expect, describe, spyOn } from "bun:test";
+import { test, expect, describe, spyOn, beforeEach, afterEach } from "bun:test";
 import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -33,6 +33,14 @@ async function captureWarn(fn: () => Promise<unknown>): Promise<string[]> {
   return seen;
 }
 
+/** Collects `log.error` lines emitted while `fn` runs. */
+async function captureError(fn: () => Promise<unknown>): Promise<string[]> {
+  const seen: string[] = [];
+  const spy = spyOn(log, "error").mockImplementation((m: string) => { seen.push(m); });
+  try { await fn(); } finally { spy.mockRestore(); }
+  return seen;
+}
+
 // verify lazily imports its (heavy) command module on first dispatch; a cold runner
 // can exceed bun's default 5s. Generous timeout, still fails loudly on a real hang.
 const TIMEOUT_MS = 30_000;
@@ -85,6 +93,19 @@ const L4 = {
 };
 
 describe("meta verify — requirements exit-code contract", () => {
+  // The strict switch is also an environment variable, and these tests assert the DEFAULT
+  // severity. Whatever the shell that runs them has exported must not decide the outcome:
+  // each test starts with the variable unset, and the shell's value is put back after.
+  let ambientRequireImplementers: string | undefined;
+  beforeEach(() => {
+    ambientRequireImplementers = process.env.META_REQUIRE_IMPLEMENTERS;
+    delete process.env.META_REQUIRE_IMPLEMENTERS;
+  });
+  afterEach(() => {
+    if (ambientRequireImplementers === undefined) delete process.env.META_REQUIRE_IMPLEMENTERS;
+    else process.env.META_REQUIRE_IMPLEMENTERS = ambientRequireImplementers;
+  });
+
   test("a clean requirement tree exits 0", async () => {
     const dir = project(req({ ...L4, "@implementedBy": ["Order"] }));
     expect(await run(["verify", "--cwd", dir])).toBe(0);
@@ -268,6 +289,89 @@ describe("meta verify — requirements exit-code contract", () => {
     }
   }, TIMEOUT_MS);
 
+  // -- the strict switch (ADR-0057) -------------------------------------------
+  // The unit tests prove the scan option raises the severity. These prove the flag
+  // and the environment variable each REACH that option, and that the raised
+  // diagnostic reaches the exit code. `Order` is claimed by a second requirement so
+  // the existence warning is the only finding: an unclaimed-entity warning beside it
+  // would leave it unclear which of the two the switch had acted on.
+  const NOTHING_IMPLEMENTS_ONLY = JSON.stringify({
+    "metadata.root": {
+      package: "acme::shop",
+      children: [
+        { "requirement.functional": { ...L4, "@implementedBy": ["Order"] } },
+        {
+          "requirement.functional": {
+            name: "orderExport",
+            "@level": 4,
+            "@status": "live",
+            "@statement": "A customer can export their order history.",
+            "@counterexample": "A customer asks for their orders and gets nothing.",
+          },
+        },
+      ],
+    },
+  });
+  const NOTHING_IMPLEMENTS_LINE = "WARN_REQUIREMENT_NOTHING_IMPLEMENTS [orderExport]";
+
+  test("a live requirement nothing implements WARNS and exits 0 by default", async () => {
+    const dir = project(NOTHING_IMPLEMENTS_ONLY);
+    let warns: string[] = [];
+    const errors = await captureError(async () => {
+      warns = await captureWarn(async () => {
+        expect(await run(["verify", "--cwd", dir])).toBe(0);
+      });
+    });
+    expect(warns.some((w) => w.includes(NOTHING_IMPLEMENTS_LINE))).toBe(true);
+    // The ONLY finding — which is what makes the two tests below about this warning.
+    expect(warns.filter((w) => w.includes("_REQUIREMENT_"))).toHaveLength(1);
+    expect(errors.filter((e) => e.includes("_REQUIREMENT_"))).toEqual([]);
+  }, TIMEOUT_MS);
+
+  test("--require-implementers turns that same run into exit 1, under the same code", async () => {
+    const dir = project(NOTHING_IMPLEMENTS_ONLY);
+    let warns: string[] = [];
+    const errors = await captureError(async () => {
+      warns = await captureWarn(async () => {
+        expect(await run(["verify", "--cwd", dir, "--require-implementers"])).toBe(1);
+      });
+    });
+    // Printed as an ERROR now, and no longer among the warnings — one finding, moved.
+    expect(errors.some((e) => e.includes(NOTHING_IMPLEMENTS_LINE))).toBe(true);
+    expect(warns.some((w) => w.includes(NOTHING_IMPLEMENTS_LINE))).toBe(false);
+  }, TIMEOUT_MS);
+
+  test("META_REQUIRE_IMPLEMENTERS=1 does the same without the flag", async () => {
+    const dir = project(NOTHING_IMPLEMENTS_ONLY);
+    process.env.META_REQUIRE_IMPLEMENTERS = "1";
+    try {
+      const errors = await captureError(async () => {
+        expect(await run(["verify", "--cwd", dir])).toBe(1);
+      });
+      expect(errors.some((e) => e.includes(NOTHING_IMPLEMENTS_LINE))).toBe(true);
+    } finally {
+      delete process.env.META_REQUIRE_IMPLEMENTERS;
+    }
+  }, TIMEOUT_MS);
+
+  test("--require-implementers is not warnings-as-errors: other warnings still exit 0", async () => {
+    // A planned, deferred, untracked requirement: it is not live, so the existence
+    // check does not apply, and a planned claim never counts toward coverage. That
+    // leaves two OTHER warnings (deferred-untracked, and `Order` unclaimed) and the
+    // switch must raise neither.
+    const dir = project(req({ ...L4, "@status": "planned", "@disposition": "deferred" }));
+    const warns = await captureWarn(async () => {
+      expect(await run(["verify", "--cwd", dir, "--require-implementers"])).toBe(0);
+    });
+    expect(warns.some((w) => w.includes("WARN_REQUIREMENT_DEFERRED_UNTRACKED"))).toBe(true);
+    expect(warns.some((w) => w.includes("WARN_REQUIREMENT_OBJECT_UNCLAIMED"))).toBe(true);
+  }, TIMEOUT_MS);
+
+  test("--require-implementers changes nothing for a model with no requirements", async () => {
+    const dir = project();
+    expect(await run(["verify", "--cwd", dir, "--require-implementers"])).toBe(0);
+  }, TIMEOUT_MS);
+
   test("a project with no requirements is never linted", async () => {
     const dir = project();
     const warns = await captureWarn(async () => {
diff --git a/server/typescript/packages/codegen-ts/src/generator-registry.ts b/server/typescript/packages/codegen-ts/src/generator-registry.ts
index 8ab2a7ede..4a43ef827 100644
--- a/server/typescript/packages/codegen-ts/src/generator-registry.ts
+++ b/server/typescript/packages/codegen-ts/src/generator-registry.ts
@@ -400,7 +400,7 @@ export const generatorRegistry: Record<string, GeneratorRegistryEntry> = {
     description: "Per-requirement test stub, one per requirement.functional claim in the ledger.",
     tier: "native",
     factory: () => requirementTests(),
-    options: "filter?, target?",
+    options: "filter?, grain?, target?",
     ejectable: ejectable("requirement-tests"),
   },
   "shared-model": {
diff --git a/server/typescript/packages/codegen-ts/src/generators/requirement-tests.ts b/server/typescript/packages/codegen-ts/src/generators/requirement-tests.ts
index f1af28030..63e0ba132 100644
--- a/server/typescript/packages/codegen-ts/src/generators/requirement-tests.ts
+++ b/server/typescript/packages/codegen-ts/src/generators/requirement-tests.ts
@@ -16,16 +16,18 @@
 // package.
 
 import {
-  REQUIREMENT_SUBTYPE_FUNCTIONAL,
-  REQUIREMENT_LINK_FLOOR_LEVEL,
   REQUIREMENT_ATTR_STATEMENT,
   REQUIREMENT_ATTR_COUNTEREXAMPLE,
 } from "@metaobjectsdev/metadata";
 import type { Generator, EmittedFile, GenContext } from "../generator.js";
 import {
   walkRequirements,
-  groupByConcern,
+  assertRequirementTestGrain,
+  defaultRequirementTestFilter,
+  requirementTestUnits,
+  requirementTestIdentity,
   NO_CONCERN,
+  type RequirementTestGrain,
   type RequirementView,
 } from "../requirement-walk.js";
 import {
@@ -40,11 +42,20 @@ export interface RequirementTestsOpts {
   name?: string;
   /** WHICH requirements get stubs. This is the app's policy declaration. */
   filter?: (r: RequirementView) => boolean;
-  /** Renderer per concern key: exact `type.subType`, `type.*`, or `*`. */
+  /**
+   * What one stub stands for. `"concern"` (the default): one per distinct
+   * `type.subType` a requirement claims. `"member"`: one per distinct `@implementedBy`
+   * reference that resolves, for an application that wants a test per claimed node.
+   */
+  grain?: RequirementTestGrain;
+  /** Renderer per concern key: exact `type.subType`, `type.*`, or `*`. In both grains
+   *  the key is what the stub's target RESOLVES to, never the reference text. */
   renderers?: Record<string, RequirementTestRenderer>;
   /** Full control over renderer selection — beats `renderers` when it returns one. */
   resolveRenderer?: (concern: string) => RequirementTestRenderer | undefined;
-  /** Where each stub lands. */
+  /** Where each stub lands. The second argument is the stub's fan-out key: the
+   *  concern, or under `grain: "member"` the reference exactly as authored — which
+   *  may hold `::`, so mangle it before it reaches a filename. */
   path?: (view: RequirementView, concern: string) => string;
   /** Named output target (registry key). */
   target?: string;
@@ -83,22 +94,23 @@ const MAX_NAMED_UNCOVERED = 5;
  *  default policy claims. Kept beside it so the pair cannot drift. */
 const DEFAULT_STUB_DIR = "requirements/";
 
-/**
- * RECOMMENDATION, not a rule: functional requirements at or below the link floor.
- *
- * Architectural requirements are excluded by default because `verify`'s
- * universality check already proves them structurally, so a test there is usually
- * redundant — usually, not never, which is exactly why this is overridable.
- */
-const defaultFilter = (r: RequirementView): boolean =>
-  r.subType === REQUIREMENT_SUBTYPE_FUNCTIONAL &&
-  (r.level ?? 0) >= REQUIREMENT_LINK_FLOOR_LEVEL;
-
 const defaultPath = (view: RequirementView, concern: string): string =>
   concern === NO_CONCERN
     ? `${DEFAULT_STUB_DIR}${view.path}.test.ts`
     : `${DEFAULT_STUB_DIR}${view.path}.${concern}.test.ts`;
 
+/**
+ * The default path under `grain: "member"`, where the fan-out key is a reference.
+ *
+ * The reference is MANGLED into the last segment — every run of characters outside
+ * `[A-Za-z0-9]` becomes one `_` — because a reference may be package-qualified and
+ * `::` is not a legal filename on every platform this output is checked out on. The
+ * concern grain keeps its unmangled segment: those paths are already in adopters'
+ * repositories with hand-written bodies in them.
+ */
+const defaultMemberPath = (view: RequirementView, ref: string): string =>
+  defaultPath(view, ref === NO_CONCERN ? ref : ref.replace(/[^A-Za-z0-9]+/g, "_"));
+
 /** Exact concern → `type.*` → `*` → the built-in renderer. */
 function pickRenderer(
   concern: string,
@@ -117,8 +129,12 @@ function attrString(node: { attr: (n: string) => unknown }, name: string): strin
 }
 
 export function requirementTests(opts: RequirementTestsOpts = {}): Generator {
-  const filter = opts.filter ?? defaultFilter;
-  const toPath = opts.path ?? defaultPath;
+  const filter = opts.filter ?? defaultRequirementTestFilter;
+  const grain = opts.grain ?? "concern";
+  // Refused here, when the generator is built, rather than on the first requirement:
+  // an unknown grain is a mistake in the config whatever the model holds.
+  assertRequirementTestGrain(grain);
+  const toPath = opts.path ?? (grain === "member" ? defaultMemberPath : defaultPath);
   // A custom `path` with no custom `owns` leaves the default namespace pointing
   // somewhere the generator no longer writes, so reconciliation matches nothing.
   // That degrades safely — it can only ever delete less — but silently, and a
@@ -144,19 +160,31 @@ export function requirementTests(opts: RequirementTestsOpts = {}): Generator {
           uncovered.push(walked.view.path);
           continue;
         }
-        for (const [concern, targets] of groupByConcern(walked)) {
+        for (const [unit, targets] of requirementTestUnits(walked, grain)) {
+          const identity = requirementTestIdentity(walked, unit);
           const args: RequirementTestArgs = {
             view: walked.view,
-            concern,
+            concern: unit,
             targets,
             statement: attrString(walked.node, REQUIREMENT_ATTR_STATEMENT),
             counterexample: attrString(walked.node, REQUIREMENT_ATTR_COUNTEREXAMPLE),
             disposition: walked.node.disposition(),
             trackedBy: walked.node.trackedBy(),
+            package: identity.package,
+            unit,
+            id: identity.id,
+            witnessKey: identity.witnessKey,
+            skip: identity.skip,
+            digest: identity.digest,
           };
+          // The renderer is chosen by what the stub's target IS, in both grains. Under
+          // the concern grain that is the unit itself; under the member grain the unit
+          // is a reference, and keying on it would match no `type.subType` entry and
+          // silently retire every renderer the application registered.
+          const rendererKey = targets[0]?.concern ?? NO_CONCERN;
           files.push({
-            path: toPath(walked.view, concern),
-            content: pickRenderer(concern, opts)(args),
+            path: toPath(walked.view, unit),
+            content: pickRenderer(rendererKey, opts)(args),
           });
         }
       }
diff --git a/server/typescript/packages/codegen-ts/src/index.ts b/server/typescript/packages/codegen-ts/src/index.ts
index 0e6686b79..92edc1ea4 100644
--- a/server/typescript/packages/codegen-ts/src/index.ts
+++ b/server/typescript/packages/codegen-ts/src/index.ts
@@ -355,11 +355,24 @@ export {
   groupByConcern,
   concernOf,
   NO_CONCERN,
+  // The test identity, the digest and the grain: what every language port's
+  // requirement-test generator agrees on, and what an owned (ejected) generator
+  // keeps importing from here.
+  defaultRequirementTestFilter,
+  assertRequirementTestGrain,
+  requirementDigest,
+  witnessKeyOf,
+  requirementTestUnits,
+  requirementTestIdentity,
+  requirementTestIdentities,
+  witnessKeyCollisions,
 } from "./requirement-walk.js";
 export type {
   RequirementView,
   ResolvedClaim,
   WalkedRequirement,
+  RequirementTestGrain,
+  RequirementTestIdentity,
 } from "./requirement-walk.js";
 export { renderRequirementTest } from "./templates/requirement-test.js";
 export type { RequirementTestArgs } from "./templates/requirement-test.js";
diff --git a/server/typescript/packages/codegen-ts/src/reference-templates.ts b/server/typescript/packages/codegen-ts/src/reference-templates.ts
index 44951e817..112ab3ee5 100644
--- a/server/typescript/packages/codegen-ts/src/reference-templates.ts
+++ b/server/typescript/packages/codegen-ts/src/reference-templates.ts
@@ -18,6 +18,10 @@ export const REFERENCE_GENERATOR_NAMES = [
   // The prompt tier (ADR-0034 Amendment 3): each is a thin generator over a public
   // `render*` composer, so an adopter owns WHICH prompts get a module and where it lands.
   "prompt-render", "output-parser", "extractor", "output-prompt", "render-helper",
+  // The requirement-test stubs: ONE file holding the generator and the default stub
+  // renderer, because an eject copies one file and the stub text is what an application
+  // is most likely to change.
+  "requirement-tests",
 ] as const;
 export type ReferenceGeneratorName = (typeof REFERENCE_GENERATOR_NAMES)[number];
 
diff --git a/server/typescript/packages/codegen-ts/src/reference/requirement-tests.ts b/server/typescript/packages/codegen-ts/src/reference/requirement-tests.ts
new file mode 100644
index 000000000..b4cd3ef21
--- /dev/null
+++ b/server/typescript/packages/codegen-ts/src/reference/requirement-tests.ts
@@ -0,0 +1,363 @@
+// REFERENCE TEMPLATE — copy this into your repo (e.g. codegen/generators/requirement-tests.ts) and own it.
+// Then import it LOCALLY in metaobjects.config.ts:
+//   import { requirementTests } from "./codegen/generators/requirement-tests.js";
+//
+// RUNTIME: this file executes under whatever runs `meta gen`, and the published CLI's
+// shebang is `#!/usr/bin/env node` — so it runs under NODE even in a Bun project. Do not
+// reach for `Bun.*` globals here; they are undefined and take the whole run down with
+// `Bun is not defined`. Use `node:` builtins instead.
+// targets:       bun:test. Each emitted stub imports `test` and `expect` from "bun:test"
+//                and nothing from MetaObjects. For vitest, jest or node:test, change the
+//                import line and the failing call in `renderRequirementTest` below.
+// use-when:      the model declares `requirement.*` nodes and you want one test stub per
+//                requirement the model claims. A live or partial requirement gets a stub
+//                that FAILS until someone writes its assertion; a planned or retired one
+//                gets a skipped stub.
+// emits:         <target>/requirements/<path>.<concern>.test.ts for each requirement the
+//                filter keeps, one per distinct `type.subType` it claims, and
+//                <target>/requirements/<path>.test.ts when it claims nothing. Under
+//                `grain: "member"` there is one stub per claimed reference instead.
+// customize:     the stub text (`renderRequirementTest`, below, is the default renderer),
+//                which requirements get a stub (`filter`), one stub per concern or one per
+//                reference (`grain`), and where stubs land (`path`, together with `owns`).
+//                What stays in the package is the walk, the grouping into tests, each
+//                test's identity and the digest of a claim. Every language port agrees on
+//                those, so replace them only if you mean to stop agreeing.
+// composes-with: nothing. It reads the requirement ledger, not another generator's output.
+//
+// THE DIVISION OF LABOUR: the package owns the MECHANISM; this file is the POLICY, and it
+// is yours. Which requirements get tests, at which levels, in what style, or none at all,
+// is the application's decision. The filter IS the policy declaration, which is why there
+// is no opt-out vocabulary: a requirement no generator matches expects no stub.
+//
+// Everything below imports ONLY from `@metaobjectsdev/codegen-ts` (the stable engine) and
+// `@metaobjectsdev/metadata` (the named constants of the requirement vocabulary).
+
+import {
+  GENERATED_HEADER,
+  NO_CONCERN,
+  assertRequirementTestGrain,
+  defaultRequirementTestFilter,
+  requirementTestIdentity,
+  requirementTestUnits,
+  walkRequirements,
+  type EmittedFile,
+  type GenContext,
+  type Generator,
+  type RequirementTestArgs,
+  type RequirementTestGrain,
+  type RequirementTestRenderer,
+  type RequirementView,
+  type ResolvedClaim,
+} from "@metaobjectsdev/codegen-ts";
+import {
+  REQUIREMENT_ATTR_COUNTEREXAMPLE,
+  REQUIREMENT_ATTR_STATEMENT,
+  REQUIREMENT_STATUSES,
+  REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES,
+  REQUIREMENT_STATUS_RETIRED,
+} from "@metaobjectsdev/metadata";
+
+// ---------------------------------------------------------------------------
+// The default stub renderer.
+//
+// The package supplies DATA (statement, counterexample, status, claimed references, the
+// test's identity and digest); a renderer supplies SYNTAX. This is the one you get when
+// you register no renderer of your own, and the part of this file most worth editing.
+//
+// The load-bearing rule: an empty generated stub must NOT pass. A `live` entry claims the
+// capability works, so an empty green test asserts the opposite of the claim.
+// ---------------------------------------------------------------------------
+
+/**
+ * Statuses whose stub is SKIPPED rather than failing.
+ *
+ * The rule is "does this entry claim the capability works right now?" — only `live` and
+ * `partial` do. A stub for anything else is skipped: a red build for something nobody
+ * intends to build is noise an application silences wholesale, taking the live stubs
+ * with it. Derived from the loader's status list, not restated from it, so a status
+ * added later is skipped by construction instead of being left failing.
+ */
+const SKIPPED_STATUSES: ReadonlySet<string> = new Set(
+  REQUIREMENT_STATUSES.filter((s) => !REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES.includes(s)),
+);
+
+/**
+ * Escape an author-supplied value for a double-quoted TS string literal.
+ *
+ * Unescaped, a quote closes the literal and a newline breaks it, and the stub no longer
+ * parses. Applied to EVERY value that reaches a literal, not only the two that are
+ * obviously prose: the requirement path and the concern land in the same literals.
+ */
+function forStringLiteral(s: string): string {
+  return s
+    .replace(/\\/g, "\\\\")
+    .replace(/"/g, '\\"')
+    .replace(/\r?\n/g, "\\n")
+    .replace(/\r/g, "\\r");
+}
+
+/**
+ * Make an author-supplied value safe inside a JSDoc block, preserving what was written.
+ *
+ * A comment terminator would close the block early and spill the rest into code, so it
+ * is split by a space (never deleted, and never by an invisible character); a newline
+ * gets its own continuation marker. Every interpolated value goes through this,
+ * `@trackedBy` included: it is free-form by design.
+ */
+function forDocComment(s: string): string {
+  return s.replace(/\*\//g, "* /").replace(/\r?\n/g, "\n * ");
+}
+
+function claimLines(targets: readonly ResolvedClaim[]): string {
+  if (targets.length === 0) {
+    return " *   (none — this requirement names no model nodes)";
+  }
+  return targets
+    .map((t) => ` *   - ${forDocComment(t.ref)}  (${forDocComment(t.concern)})`)
+    .join("\n");
+}
+
+function gapLine(a: RequirementTestArgs): string {
+  const tracked = a.trackedBy ?? [];
+  if (a.disposition === undefined && tracked.length === 0) return "";
+  const decided = forDocComment(a.disposition ?? "undecided");
+  const refs = tracked.length > 0 ? ` — ${tracked.map(forDocComment).join(", ")}` : "";
+  return `\n *\n * Known gap: ${decided}${refs}`;
+}
+
+export function renderRequirementTest(a: RequirementTestArgs): string {
+  // Decided from the requirement's STATUS. The identity fields on `a` (`skip`, `id`,
+  // `digest`, …) are there for a renderer of your own; this one reads none of them.
+  const skipped = a.view.status !== undefined && SKIPPED_STATUSES.has(a.view.status);
+  const runner = skipped ? "test.skip" : "test";
+  // The test NAME is the link between the ledger entry and the assertion, and it is a
+  // string literal: an unescaped quote in either value closes it.
+  const testName = `${forStringLiteral(a.view.path)} [${forStringLiteral(a.concern)}]`;
+
+  // A live or partial stub asserts FAILURE until someone writes the real assertion over
+  // it, and names the requirement in the message, so a red run says which claim is
+  // unproven. The two skipped statuses mean OPPOSITE things and must not share a body:
+  // `planned` is intended and not built yet; `retired` was built and deliberately
+  // removed, and telling its reader to write the assertion "when this becomes live"
+  // would instruct them to revive it.
+  let body: string[];
+  if (!skipped) {
+    body = [
+      "  expect.unreachable(",
+      `    "unimplemented requirement stub: ${testName} — " +`,
+      `    "replace this with an assertion that fails when: ${forStringLiteral(a.counterexample)}",`,
+      "  );",
+    ];
+  } else if (a.view.status === REQUIREMENT_STATUS_RETIRED) {
+    body = [
+      "  // Retired: this capability was deliberately removed and must not be rebuilt.",
+      "  // If you assert anything here, assert that it STAYS removed.",
+    ];
+  } else {
+    body = ["  // Intended, not built. Write the assertion when this becomes live."];
+  }
+
+  // The header states the CONDITION on the survival promise, not just the promise: a
+  // hand-written body is merged where this machine holds the file's snapshot, and the
+  // file is refused (never overwritten) where it does not.
+  const lines = [
+    `// ${GENERATED_HEADER}.`,
+    "// The test IDENTITY is generated from the requirement; the BODY below is yours.",
+    "// Do not rename the test — the name is the link.",
+    "// Your body is never overwritten: MERGED where .metaobjects/.gen-state/ holds this",
+    "// file's snapshot body, REFUSED (run exits 1, body kept) where it does not. Those",
+    "// bodies are gitignored, so a fresh clone or CI is always the second case — see",
+    "// docs/features/own-your-codegen.md for the recovery.",
+    'import { test, expect } from "bun:test";',
+    "",
+    "/**",
+    ` * ${forDocComment(a.statement)}`,
+    " *",
+    ` * Counterexample: ${forDocComment(a.counterexample)}${gapLine(a)}`,
+    " *",
+    " * Claims:",
+    claimLines(a.targets),
+    " */",
+    `${runner}("${testName}", () => {`,
+    ...body,
+    "});",
+  ];
+  return `${lines.join("\n")}\n`;
+}
+
+// ---------------------------------------------------------------------------
+// The generator.
+// ---------------------------------------------------------------------------
+
+export interface RequirementTestsOpts {
+  /** Generator name — surfaces in diagnostics and drift logs. */
+  name?: string;
+  /** WHICH requirements get stubs. This is the app's policy declaration. */
+  filter?: (r: RequirementView) => boolean;
+  /**
+   * What one stub stands for. `"concern"` (the default): one per distinct
+   * `type.subType` a requirement claims. `"member"`: one per distinct `@implementedBy`
+   * reference that resolves, for an application that wants a test per claimed node.
+   */
+  grain?: RequirementTestGrain;
+  /** Renderer per concern key: exact `type.subType`, `type.*`, or `*`. In both grains
+   *  the key is what the stub's target RESOLVES to, never the reference text. */
+  renderers?: Record<string, RequirementTestRenderer>;
+  /** Full control over renderer selection — beats `renderers` when it returns one. */
+  resolveRenderer?: (concern: string) => RequirementTestRenderer | undefined;
+  /** Where each stub lands. The second argument is the stub's fan-out key: the
+   *  concern, or under `grain: "member"` the reference exactly as authored — which
+   *  may hold `::`, so mangle it before it reaches a filename. */
+  path?: (view: RequirementView, concern: string) => string;
+  /** Named output target (registry key). */
+  target?: string;
+  /** Name requirements no filter covered. Default true; never fails the build. */
+  warnUncovered?: boolean;
+  /**
+   * Which emitted paths this generator is the sole producer of, so the runner may
+   * remove a stub whose requirement was deleted. Given a path relative to this
+   * generator's output directory, `/`-separated.
+   *
+   * Defaults to the directory `defaultPath` writes into. Supply this whenever you
+   * supply `path`: the two describe the same namespace from opposite directions and
+   * only you can keep them in agreement.
+   */
+  owns?: (relPathInTarget: string) => boolean;
+  /** Delete a hand-edited orphan rather than refusing it. Default false. */
+  forceOrphanDelete?: boolean;
+  /** Turn orphan reconciliation off entirely. Default true — a stub whose requirement
+   *  is gone is drift, and leaving it is how a deleted claim keeps a green test. */
+  reconcileOrphans?: boolean;
+}
+
+/** How many uncovered requirements to name before "…and N more". */
+const MAX_NAMED_UNCOVERED = 5;
+
+/** The directory `defaultPath` writes into — and therefore the namespace the default
+ *  policy claims. Kept beside it so the pair cannot drift. */
+const DEFAULT_STUB_DIR = "requirements/";
+
+const defaultPath = (view: RequirementView, concern: string): string =>
+  concern === NO_CONCERN
+    ? `${DEFAULT_STUB_DIR}${view.path}.test.ts`
+    : `${DEFAULT_STUB_DIR}${view.path}.${concern}.test.ts`;
+
+/**
+ * The default path under `grain: "member"`, where the fan-out key is a reference.
+ *
+ * The reference is MANGLED into the last segment — every run of characters outside
+ * `[A-Za-z0-9]` becomes one `_` — because a reference may be package-qualified and
+ * `::` is not a legal filename on every platform this output is checked out on.
+ */
+const defaultMemberPath = (view: RequirementView, ref: string): string =>
+  defaultPath(view, ref === NO_CONCERN ? ref : ref.replace(/[^A-Za-z0-9]+/g, "_"));
+
+/** Exact concern → `type.*` → `*` → the default renderer above. */
+function pickRenderer(concern: string, opts: RequirementTestsOpts): RequirementTestRenderer {
+  const viaFn = opts.resolveRenderer?.(concern);
+  if (viaFn !== undefined) return viaFn;
+  const map = opts.renderers ?? {};
+  const typeOnly = `${concern.split(".")[0] ?? ""}.*`;
+  return map[concern] ?? map[typeOnly] ?? map[NO_CONCERN] ?? renderRequirementTest;
+}
+
+// `attr()` RESOLVES in TypeScript, so a requirement that inherits its statement through
+// `extends` renders what it effectively says.
+function attrString(node: { attr: (n: string) => unknown }, name: string): string {
+  const v = node.attr(name);
+  return typeof v === "string" ? v : "";
+}
+
+export function requirementTests(opts: RequirementTestsOpts = {}): Generator {
+  const filter = opts.filter ?? defaultRequirementTestFilter;
+  const grain = opts.grain ?? "concern";
+  // Refused here, when the generator is built, rather than on the first requirement:
+  // an unknown grain is a mistake in the config whatever the model holds.
+  assertRequirementTestGrain(grain);
+  const toPath = opts.path ?? (grain === "member" ? defaultMemberPath : defaultPath);
+  // A custom `path` with no custom `owns` leaves the default namespace pointing
+  // somewhere the generator no longer writes, so reconciliation matches nothing. That
+  // degrades safely — it can only ever delete less — but silently, hence the warning.
+  const namespaceUnknown = opts.path !== undefined && opts.owns === undefined;
+
+  const generator: Generator = {
+    name: opts.name ?? "requirement-tests",
+    generate: (ctx: GenContext): EmittedFile[] => {
+      const files: EmittedFile[] = [];
+      const uncovered: string[] = [];
+
+      if (namespaceUnknown && opts.reconcileOrphans !== false) {
+        ctx.warn(
+          "a custom 'path' was supplied without a matching 'owns', so a stub left " +
+            "behind by a deleted requirement will NOT be cleaned up. Supply 'owns' " +
+            "to describe where 'path' writes, or set reconcileOrphans: false.",
+        );
+      }
+
+      for (const walked of walkRequirements(ctx.loadedRoot)) {
+        if (!filter(walked.view)) {
+          uncovered.push(walked.view.path);
+          continue;
+        }
+        for (const [unit, targets] of requirementTestUnits(walked, grain)) {
+          const identity = requirementTestIdentity(walked, unit);
+          const args: RequirementTestArgs = {
+            view: walked.view,
+            concern: unit,
+            targets,
+            statement: attrString(walked.node, REQUIREMENT_ATTR_STATEMENT),
+            counterexample: attrString(walked.node, REQUIREMENT_ATTR_COUNTEREXAMPLE),
+            disposition: walked.node.disposition(),
+            trackedBy: walked.node.trackedBy(),
+            package: identity.package,
+            unit,
+            id: identity.id,
+            witnessKey: identity.witnessKey,
+            skip: identity.skip,
+            digest: identity.digest,
+          };
+          // The renderer is chosen by what the stub's target IS, in both grains. Under
+          // the member grain the unit is a reference, and keying on it would match no
+          // `type.subType` entry and silently retire every renderer you registered.
+          const rendererKey = targets[0]?.concern ?? NO_CONCERN;
+          files.push({
+            path: toPath(walked.view, unit),
+            content: pickRenderer(rendererKey, opts)(args),
+          });
+        }
+      }
+
+      // Policy living only in config means an uncovered requirement is indistinguishable
+      // from a deliberate exclusion. One warning, never failing, and CAPPED: the default
+      // filter excludes every architectural node and every L1-L3 functional one, so an
+      // uncapped list buries the one actionable sentence under a wall of dotted paths.
+      if ((opts.warnUncovered ?? true) && uncovered.length > 0) {
+        const shown = uncovered.slice(0, MAX_NAMED_UNCOVERED).join(", ");
+        const more =
+          uncovered.length > MAX_NAMED_UNCOVERED
+            ? `, and ${uncovered.length - MAX_NAMED_UNCOVERED} more`
+            : "";
+        ctx.warn(
+          `${uncovered.length} requirement(s) matched no filter and get no stub. If that is deliberate, set warnUncovered: false to silence this. Uncovered: ${shown}${more}.`,
+        );
+      }
+
+      return files;
+    },
+  };
+
+  if (opts.target !== undefined) generator.target = opts.target;
+  if (opts.reconcileOrphans !== false) {
+    generator.orphanPolicy = {
+      // With a custom `path` and no `owns`, claim NOTHING rather than guess: the default
+      // namespace would be a claim over a directory this generator does not write to,
+      // and a wrong claim deletes another generator's files.
+      owns:
+        opts.owns ??
+        (namespaceUnknown ? () => false : (relPath) => relPath.startsWith(DEFAULT_STUB_DIR)),
+      ...(opts.forceOrphanDelete === true && { force: true }),
+    };
+  }
+  return generator;
+}
diff --git a/server/typescript/packages/codegen-ts/src/requirement-walk.ts b/server/typescript/packages/codegen-ts/src/requirement-walk.ts
index 9da1e1471..85252d274 100644
--- a/server/typescript/packages/codegen-ts/src/requirement-walk.ts
+++ b/server/typescript/packages/codegen-ts/src/requirement-walk.ts
@@ -12,7 +12,17 @@
 // metamodel internals and export the ADR-0039 own-vs-resolving accessor trap. The
 // projection is additive — it can grow, but it never hands out the node.
 
-import { TYPE_REQUIREMENT, resolveClaim } from "@metaobjectsdev/metadata";
+import { createHash } from "node:crypto";
+import {
+  PACKAGE_SEPARATOR,
+  TYPE_REQUIREMENT,
+  REQUIREMENT_SUBTYPE_FUNCTIONAL,
+  REQUIREMENT_LINK_FLOOR_LEVEL,
+  REQUIREMENT_ATTR_STATEMENT,
+  REQUIREMENT_ATTR_COUNTEREXAMPLE,
+  REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES,
+  resolveClaim,
+} from "@metaobjectsdev/metadata";
 import type { MetaData, MetaRequirement } from "@metaobjectsdev/metadata";
 
 /** The shape an app's `filter` receives. Never the node itself. */
@@ -25,6 +35,8 @@ export interface RequirementView {
   readonly status: string | undefined;
   /** Dotted path from the root through nesting ancestors — hierarchy is nesting. */
   readonly path: string;
+  /** The EFFECTIVE package: the node's own, else its file's default, else "". */
+  readonly package: string;
   /** DISTINCT `type.subType` concerns among the resolved targets. */
   readonly implementedByTypes: readonly string[];
 }
@@ -88,6 +100,7 @@ export function walkRequirements(root: MetaData): WalkedRequirement[] {
         level: req.level(),
         status: req.status(),
         path,
+        package: referrerPkg,
         implementedByTypes: [...new Set(targets.map((t) => t.concern))],
       },
       targets,
@@ -122,3 +135,223 @@ export function groupByConcern(w: WalkedRequirement): Map<string, ResolvedClaim[
   if (groups.size === 0) groups.set(NO_CONCERN, []);
   return groups;
 }
+
+// ---------------------------------------------------------------------------
+// Test identity, digest and grain.
+//
+// Everything below is the part of the generator that every language port copies
+// and a shared corpus pins: which tests a ledger yields, what each is called, and
+// a fingerprint of the claim it tests. It lives here, beside the walk, rather than
+// in the generator, because an application that owns its generator (`meta eject
+// requirement-tests`) still imports these from the package: an owned copy changes
+// how a test is WRITTEN, and keeps agreeing with every other tool about which
+// tests exist.
+// ---------------------------------------------------------------------------
+
+const REQUIREMENT_TEST_GRAINS = ["concern", "member"] as const;
+
+/**
+ * The fan-out unit: what one generated test stands for.
+ *
+ * - `concern` (default): one test per distinct `<type>.<subType>` a requirement claims.
+ * - `member`: one test per distinct `@implementedBy` reference that resolves.
+ */
+export type RequirementTestGrain = (typeof REQUIREMENT_TEST_GRAINS)[number];
+
+/**
+ * Refuse anything that is not a grain.
+ *
+ * The type alone does not hold: `metaobjects.config.ts` is loaded without a typecheck,
+ * so a typo arrives here as a plain string. Letting it through picks a grain by
+ * accident — and not even one grain, since each place that branches on it would fall
+ * to its own default. Called wherever a grain enters: the identity functions below and
+ * the generator, built-in or owned.
+ */
+export function assertRequirementTestGrain(grain: unknown): asserts grain is RequirementTestGrain {
+  if (!(REQUIREMENT_TEST_GRAINS as readonly unknown[]).includes(grain)) {
+    throw new Error(
+      `unknown requirement-test grain ${JSON.stringify(grain)}: expected ` +
+        `${REQUIREMENT_TEST_GRAINS.map((g) => JSON.stringify(g)).join(" or ")}.`,
+    );
+  }
+}
+
+/** One generated test. The same record in every language port. */
+export interface RequirementTestIdentity {
+  /** The requirement's effective package. */
+  readonly package: string;
+  /** The requirement's dotted path, without the package. */
+  readonly path: string;
+  /** `<type>.<subType>` under the `concern` grain, the reference exactly as authored
+   *  under `member`, and `*` for a requirement that resolves no target. */
+  readonly unit: string;
+  /** `<qualified address> [<unit>]` — unique per test. */
+  readonly id: string;
+  /** An identifier-safe spelling of `id`, for ports that bind a test to a function. */
+  readonly witnessKey: string;
+  readonly status: string | undefined;
+  /** Why the test is skipped, or null when the requirement claims the capability
+   *  works right now. */
+  readonly skip: "planned" | "retired" | null;
+  /** `requirementDigest` of the requirement — the same for each of its tests. */
+  readonly digest: string;
+}
+
+/**
+ * RECOMMENDATION, not a rule: functional requirements at or below the link floor.
+ *
+ * Architectural requirements are excluded by default because `verify`'s
+ * universality check already proves them structurally, so a test there is usually
+ * redundant — usually, not never, which is exactly why this is overridable.
+ */
+export function defaultRequirementTestFilter(r: RequirementView): boolean {
+  return (
+    r.subType === REQUIREMENT_SUBTYPE_FUNCTIONAL &&
+    (r.level ?? 0) >= REQUIREMENT_LINK_FLOOR_LEVEL
+  );
+}
+
+const DIGEST_VERSION = "requirement-digest/v1";
+
+/** `<name> <byte length>\n<value>\n` — length-prefixed, so no value can be confused
+ *  with the field that follows it, whatever it contains. */
+function digestField(name: string, value: string): string {
+  return `${name} ${Buffer.byteLength(value, "utf8")}\n${value}\n`;
+}
+
+/**
+ * A fingerprint of the CLAIM: lowercase hex SHA-256 over the requirement's subtype,
+ * level, status, statement, counterexample and `@implementedBy` list.
+ *
+ * It answers "did the claim change", not "did the entry move": the name, the package,
+ * the title, the notes, the disposition, the tracking references and nested
+ * requirements are all left out, so renaming or annotating an entry does not disturb
+ * a test written against it, and rewording what it asserts does.
+ */
+export function requirementDigest(node: MetaRequirement): string {
+  // attr() RESOLVES in TypeScript (ADR-0039): the digest is over the effective claim.
+  const prose = (name: string): string => {
+    const v = node.attr(name);
+    return typeof v === "string" ? v.replace(/\r\n?/g, "\n") : "";
+  };
+  const level = node.level();
+  const refs = node.implementedBy();
+  const text =
+    `${DIGEST_VERSION}\n` +
+    digestField("subType", node.subType) +
+    digestField("level", level === undefined ? "" : String(level)) +
+    digestField("status", node.status() ?? "") +
+    digestField("statement", prose(REQUIREMENT_ATTR_STATEMENT)) +
+    digestField("counterexample", prose(REQUIREMENT_ATTR_COUNTEREXAMPLE)) +
+    `implementedBy ${refs.length}\n` +
+    refs.map((r) => digestField("ref", r)).join("");
+  return createHash("sha256").update(text, "utf8").digest("hex");
+}
+
+/** Every maximal run of characters outside `[A-Za-z0-9]` becomes one `_`. */
+const mangle = (s: string): string => s.replace(/[^A-Za-z0-9]+/g, "_");
+
+/**
+ * An identifier-safe key for one test: `req_<address>`, then `__<unit>` unless the
+ * requirement resolves no target.
+ *
+ * Mangling is lossy — `Orders.Recorded` and `Orders_Recorded` give one key — which is
+ * what `witnessKeyCollisions` exists to report.
+ */
+export function witnessKeyOf(qualifiedAddress: string, unit: string): string {
+  const base = `req_${mangle(qualifiedAddress)}`;
+  return unit === NO_CONCERN ? base : `${base}__${mangle(unit)}`;
+}
+
+/**
+ * A requirement's targets, grouped by fan-out unit under the given grain — one entry
+ * per test, in first-seen order.
+ *
+ * Under `member` a reference authored twice is one test, and the bare and qualified
+ * spellings of one node are two: the unit is the reference as written, not what it
+ * resolves to. In both grains a requirement resolving NO targets still yields
+ * exactly one entry, keyed `NO_CONCERN` (see `groupByConcern`).
+ */
+export function requirementTestUnits(
+  w: WalkedRequirement,
+  grain: RequirementTestGrain = "concern",
+): Map<string, ResolvedClaim[]> {
+  assertRequirementTestGrain(grain);
+  if (grain === "concern") return groupByConcern(w);
+  const units = new Map<string, ResolvedClaim[]>();
+  for (const t of w.targets) {
+    if (!units.has(t.ref)) units.set(t.ref, [t]);
+  }
+  if (units.size === 0) units.set(NO_CONCERN, []);
+  return units;
+}
+
+/** The identity of the one test `unit` stands for (a key of `requirementTestUnits`). */
+export function requirementTestIdentity(
+  w: WalkedRequirement,
+  unit: string,
+): RequirementTestIdentity {
+  const { path, status } = w.view;
+  const pkg = w.view.package;
+  const address = pkg === "" ? path : `${pkg}${PACKAGE_SEPARATOR}${path}`;
+  // Derived from the loader's status list rather than naming the two skipped statuses:
+  // a status that does not claim the capability works right now is skipped by
+  // construction, so a status added later cannot be left failing by omission.
+  const skips =
+    status !== undefined &&
+    !(REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES as readonly string[]).includes(status);
+  return {
+    package: pkg,
+    path,
+    unit,
+    id: `${address} [${unit}]`,
+    witnessKey: witnessKeyOf(address, unit),
+    status,
+    skip: skips ? (status as "planned" | "retired") : null,
+    digest: requirementDigest(w.node),
+  };
+}
+
+// Code units, never localeCompare: a collation differs between machines and between
+// language ports, and these orders are pinned by a corpus all five ports run.
+const compareCodeUnits = (a: string, b: string): number => (a < b ? -1 : a > b ? 1 : 0);
+
+/** Every test the generator would emit, sorted by id. */
+export function requirementTestIdentities(
+  root: MetaData,
+  opts: { grain?: RequirementTestGrain; filter?: (r: RequirementView) => boolean } = {},
+): RequirementTestIdentity[] {
+  const filter = opts.filter ?? defaultRequirementTestFilter;
+  // Checked here as well as per requirement, so a bad grain is refused even over a
+  // ledger the filter empties — the answer must not depend on what the model holds.
+  const grain = opts.grain ?? "concern";
+  assertRequirementTestGrain(grain);
+  const out: RequirementTestIdentity[] = [];
+  for (const walked of walkRequirements(root)) {
+    if (!filter(walked.view)) continue;
+    for (const unit of requirementTestUnits(walked, grain).keys()) {
+      out.push(requirementTestIdentity(walked, unit));
+    }
+  }
+  return out.sort((a, b) => compareCodeUnits(a.id, b.id));
+}
+
+/** Pairs of ids that share a witnessKey, each pair and the list sorted. */
+export function witnessKeyCollisions(
+  tests: readonly RequirementTestIdentity[],
+): [string, string][] {
+  const byKey = new Map<string, string[]>();
+  for (const t of tests) {
+    const ids = byKey.get(t.witnessKey);
+    if (ids === undefined) byKey.set(t.witnessKey, [t.id]);
+    else ids.push(t.id);
+  }
+  const pairs: [string, string][] = [];
+  for (const ids of byKey.values()) {
+    const sorted = [...ids].sort(compareCodeUnits);
+    for (const [i, first] of sorted.entries()) {
+      for (const second of sorted.slice(i + 1)) pairs.push([first, second]);
+    }
+  }
+  return pairs.sort((a, b) => compareCodeUnits(a[0], b[0]) || compareCodeUnits(a[1], b[1]));
+}
diff --git a/server/typescript/packages/codegen-ts/src/templates/requirement-test.ts b/server/typescript/packages/codegen-ts/src/templates/requirement-test.ts
index 96da1f4c3..dd55d76c2 100644
--- a/server/typescript/packages/codegen-ts/src/templates/requirement-test.ts
+++ b/server/typescript/packages/codegen-ts/src/templates/requirement-test.ts
@@ -20,12 +20,27 @@ import type { RequirementView, ResolvedClaim } from "../requirement-walk.js";
 
 export interface RequirementTestArgs {
   readonly view: RequirementView;
+  /** The fan-out key this stub stands for: `<type>.<subType>` under the default grain,
+   *  the reference as authored under `grain: "member"`, `*` when the requirement
+   *  resolves no target. Always equal to `unit`, which is the name the other language
+   *  ports use for it. */
   readonly concern: string;
   readonly statement: string;
   readonly counterexample: string;
+  /** The claims this stub covers. Each carries its own `concern`, which stays the
+   *  target's `<type>.<subType>` in both grains. */
   readonly targets: readonly ResolvedClaim[];
   readonly disposition?: string | undefined;
   readonly trackedBy?: readonly string[] | undefined;
+  // The test's identity record (`RequirementTestIdentity`) — the same six values in
+  // every language port. They are DATA for an application's renderer: the default
+  // renderer below reads none of them, so its output does not move when they do.
+  readonly package: string;
+  readonly unit: string;
+  readonly id: string;
+  readonly witnessKey: string;
+  readonly skip: "planned" | "retired" | null;
+  readonly digest: string;
 }
 
 /**
diff --git a/server/typescript/packages/codegen-ts/test/ownership-seam.test.ts b/server/typescript/packages/codegen-ts/test/ownership-seam.test.ts
index d615954df..f77563e31 100644
--- a/server/typescript/packages/codegen-ts/test/ownership-seam.test.ts
+++ b/server/typescript/packages/codegen-ts/test/ownership-seam.test.ts
@@ -146,12 +146,19 @@ describe("the requirementTests() stub header states the CONDITION on survival",
       level: 4,
       status: "live",
       path: "links.slugField",
+      package: "acme::probe",
       implementedByTypes: [],
     },
     concern: "object.entity",
     statement: "A council has a human-readable slug.",
     counterexample: "a council with no slug",
     targets: [],
+    package: "acme::probe",
+    unit: "object.entity",
+    id: "acme::probe::links.slugField [object.entity]",
+    witnessKey: "req_acme_probe_links_slugField__object_entity",
+    skip: null,
+    digest: "0".repeat(64),
   };
 
   test("it names the machine-local half, and no longer promises survival flat", () => {
diff --git a/server/typescript/packages/codegen-ts/test/reference-byte-identical.test.ts b/server/typescript/packages/codegen-ts/test/reference-byte-identical.test.ts
index 9941d5f7a..94c394c68 100644
--- a/server/typescript/packages/codegen-ts/test/reference-byte-identical.test.ts
+++ b/server/typescript/packages/codegen-ts/test/reference-byte-identical.test.ts
@@ -29,7 +29,14 @@ import { outputParser as refOutputParser } from "../src/reference/output-parser.
 import { extractor as refExtractor } from "../src/reference/extractor.js";
 import { outputPrompt as refOutputPrompt } from "../src/reference/output-prompt.js";
 import { renderHelper as refRenderHelper } from "../src/reference/render-helper.js";
-import { MetaDataLoader } from "@metaobjectsdev/metadata";
+import { requirementTests as builtinRequirementTests } from "../src/generators/requirement-tests.js";
+import {
+  requirementTests as refRequirementTests,
+  renderRequirementTest as refRenderRequirementTest,
+} from "../src/reference/requirement-tests.js";
+import { renderRequirementTest as builtinRenderRequirementTest } from "../src/templates/requirement-test.js";
+import type { RequirementTestArgs, RequirementTestsOpts } from "../src/index.js";
+import { MetaDataLoader, InMemoryStringSource } from "@metaobjectsdev/metadata";
 import { FileSource } from "@metaobjectsdev/metadata/core";
 
 const FIXTURE_DIR = resolve(import.meta.dir, "fixtures");
@@ -114,6 +121,7 @@ const PAIRS: Record<ReferenceGeneratorName, { builtin: () => Generator; ref: ()
   extractor: { builtin: builtinExtractor, ref: refExtractor },
   "output-prompt": { builtin: builtinOutputPrompt, ref: refOutputPrompt },
   "render-helper": { builtin: builtinRenderHelper, ref: refRenderHelper },
+  "requirement-tests": { builtin: builtinRequirementTests, ref: refRequirementTests },
 };
 
 // The prompt tier emits nothing for the entity-shaped fixtures above — none declares a
@@ -297,3 +305,364 @@ describe("ADR-0034 — the prompt-tier reference templates over corpora that dec
     });
   }
 });
+
+// The requirement-test reference is the one template that carries a RENDERER as well as a
+// generator: an eject copies one file, and the stub text is what an application is most
+// likely to change, so both live in it. That makes the copy larger than its siblings —
+// every status branch, both escaping paths, the gap line, the uncovered warning — and no
+// fixture above declares a requirement, so each of those would be compared over two empty
+// sets. This ledger reaches every one of them.
+const REQUIREMENT_LEDGER = {
+  "metadata.root": {
+    package: "acme::shop",
+    children: [
+      {
+        "object.entity": {
+          name: "Order",
+          children: [
+            { "field.long": { name: "id" } },
+            { "field.string": { name: "note" } },
+            { "field.string": { name: "memo" } },
+            { "source.rdb": { "@table": "orders" } },
+            { "identity.primary": { name: "pk", "@fields": ["id"] } },
+          ],
+        },
+      },
+      {
+        "requirement.functional": {
+          name: "Orders",
+          "@level": 3,
+          "@status": "live",
+          "@statement": "Orders are taken.",
+          "@counterexample": "an order nobody can place",
+          children: [
+            {
+              // L4, live, claiming the entity twice over — bare and package-qualified.
+              "requirement.functional": {
+                name: "Recorded",
+                "@level": 4,
+                "@status": "live",
+                "@statement": "An order is recorded when it is placed.",
+                "@counterexample": "A placed order has no row.",
+                "@implementedBy": ["Order", "acme::shop::Order"],
+                children: [
+                  {
+                    // L5, partial with a tracked gap, two members of ONE concern, and
+                    // prose that must be escaped in a string literal and in a comment.
+                    "requirement.functional": {
+                      name: "Annotated",
+                      "@level": 5,
+                      "@status": "partial",
+                      "@disposition": "deferred",
+                      "@trackedBy": ["#12", "a */ tracker"],
+                      "@statement": "The note is kept \"verbatim\" */ as typed.\nOn every order.",
+                      "@counterexample": "a note with a \\ dropped\r\nor a \"tidied\" one",
+                      "@implementedBy": ["Order.note", "Order.memo"],
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              // Planned: skipped, and naming a node that does not exist yet.
+              "requirement.functional": {
+                name: "Refunded",
+                "@level": 4,
+                "@status": "planned",
+                "@statement": "A refund is recorded against its order.",
+                "@counterexample": "A refund with no order.",
+                "@implementedBy": ["Refund"],
+              },
+            },
+            {
+              // Retired: skipped, with its own body.
+              "requirement.functional": {
+                name: "Faxed",
+                "@level": 4,
+                "@status": "retired",
+                "@statement": "An order can be faxed in.",
+                "@counterexample": "a fax line that answers",
+              },
+            },
+            {
+              // Live with no targets at all.
+              "requirement.functional": {
+                name: "Acknowledged",
+                "@level": 4,
+                "@status": "live",
+                "@statement": "An order is acknowledged.",
+                "@counterexample": "a silent checkout",
+              },
+            },
+            {
+              // A gap somebody is tracking and nobody has ruled on: `@trackedBy` with no
+              // `@disposition`, which the stub records as "undecided".
+              "requirement.functional": {
+                name: "Chased",
+                "@level": 4,
+                "@status": "partial",
+                "@trackedBy": ["#77"],
+                "@statement": "An unpaid order is chased.",
+                "@counterexample": "an unpaid order nobody hears about",
+              },
+            },
+          ],
+        },
+      },
+      {
+        "requirement.architectural": {
+          name: "Audited",
+          "@status": "live",
+          "@statement": "Every entity is audited.",
+          "@counterexample": "an entity with no audit trail",
+          "@implementedBy": ["Order"],
+        },
+      },
+    ],
+  },
+};
+
+describe("ADR-0034 — the requirement-tests reference over a ledger that declares requirements", () => {
+  // Where a run moves the stubs to, and the namespace that goes with it.
+  const specPath: NonNullable<RequirementTestsOpts["path"]> = (view, key) =>
+    `specs/${view.path}__${key.replace(/[^A-Za-z0-9]+/g, "_")}.spec.ts`;
+  const ownsSpecs = (relPath: string): boolean => relPath.startsWith("specs/");
+
+  // `warns` names a sentence the run MUST produce. The warnings are compared between the
+  // two generators either way; this is what stops that comparison passing over two
+  // empty lists when the branch under test was never reached.
+  const RUNS: ReadonlyArray<{ label: string; opts: RequirementTestsOpts; files: number; warns?: string }> = [
+    // Recorded, Annotated, Refunded, Faxed, Acknowledged, Chased — one concern each.
+    { label: "the defaults", opts: {}, files: 6, warns: "2 requirement(s) matched no filter" },
+    // Every requirement (the L3 parent and the architectural policy included), one stub
+    // per reference: Orders 1, Recorded 2, Annotated 2, Refunded 1, Faxed 1,
+    // Acknowledged 1, Chased 1, Audited 1.
+    { label: 'grain: "member" under a filter that keeps everything', opts: { grain: "member", filter: () => true }, files: 10 },
+    // A filter that drops requirements while the warning is on, in the default grain.
+    { label: "a filter by package and status", opts: { filter: (r) => r.package === "acme::shop" && r.status !== "retired" }, files: 7, warns: "Uncovered: Orders.Faxed." },
+    { label: "the uncovered warning switched off", opts: { warnUncovered: false }, files: 6 },
+    // Seven of the eight requirements uncovered: five are named and the rest counted.
+    { label: "more uncovered requirements than the warning names", opts: { filter: (r) => r.path === "Orders.Recorded" }, files: 1, warns: ", and 2 more." },
+    // A custom `path` with no `owns`: the stubs move and the generator says it can no
+    // longer clean up after a deleted requirement.
+    { label: "a custom path without owns", opts: { path: specPath }, files: 6, warns: "a custom 'path' was supplied without a matching 'owns'" },
+    { label: "a custom path with its owns, under member grain", opts: { path: specPath, owns: ownsSpecs, grain: "member", forceOrphanDelete: true }, files: 8, warns: "2 requirement(s) matched no filter" },
+    { label: "a custom path with orphan reconciliation off", opts: { path: specPath, reconcileOrphans: false, warnUncovered: false }, files: 6 },
+  ];
+
+  for (const run of RUNS) {
+    test(run.label, async () => {
+      const loaded = await new MetaDataLoader().load([
+        new InMemoryStringSource(JSON.stringify(REQUIREMENT_LEDGER)),
+      ]);
+      expect(loaded.errors).toEqual([]);
+
+      const emit = async (generator: Generator) => {
+        const dir = mkdtempSync(join(tmpdir(), "codegen-req-"));
+        try {
+          const result = await runGen({
+            config: defineConfig({ outDir: join(dir, "out"), extStyle: "none", dbImport: "~/server/db", dialect: "sqlite", generators: [generator] }),
+            metadata: loaded.root,
+            projectRoot: dir,
+          });
+          const files: Record<string, string> = {};
+          for (const f of readdirSync(join(dir, "out"), { recursive: true, withFileTypes: true })) {
+            if (!f.isFile()) continue;
+            const abs = join(f.parentPath, f.name);
+            files[abs.slice(join(dir, "out").length + 1)] = readFileSync(abs, "utf-8");
+          }
+          return { files, warnings: result.warnings };
+        } finally {
+          rmSync(dir, { recursive: true, force: true });
+        }
+      };
+
+      const a = await emit(builtinRequirementTests(run.opts));
+      const b = await emit(refRequirementTests(run.opts));
+      const aKeys = Object.keys(a.files).sort();
+      // A gate over an empty emit passes trivially.
+      expect(aKeys.length).toBe(run.files);
+      expect(Object.keys(b.files).sort()).toEqual(aKeys);
+      for (const k of aKeys) expect(`${k}:\n${b.files[k]}`).toBe(`${k}:\n${a.files[k]}`);
+      // The warning text is duplicated in the copy too, so it is compared too.
+      expect(b.warnings).toEqual(a.warnings);
+      if (run.warns === undefined) expect(a.warnings).toEqual([]);
+      else expect(a.warnings.join("\n")).toContain(run.warns);
+    });
+  }
+
+  test("the ledger reaches the undecided gap line", async () => {
+    // Vacuity guard for the one stub branch only this requirement takes.
+    const loaded = await new MetaDataLoader().load([
+      new InMemoryStringSource(JSON.stringify(REQUIREMENT_LEDGER)),
+    ]);
+    const ctx = { loadedRoot: loaded.root, warn: () => {} } as unknown as Parameters<Generator["generate"]>[0];
+    const files = await refRequirementTests().generate(ctx);
+    const chased = files.find((f) => f.path === "requirements/Orders.Chased.test.ts");
+    expect(chased?.content).toContain(" * Known gap: undecided — #77");
+  });
+});
+
+// Everything above compares what a generator WRITES. A generator is also an object the
+// runner reads: its name, its target, and above all its orphan policy, which decides
+// which previously-generated files the runner may DELETE. A copy whose `owns` claimed
+// more than the built-in's would remove another generator's output, and no emitted
+// file would show it.
+describe("ADR-0034 — the requirement-tests reference is the same GENERATOR, not just the same output", () => {
+  const specPath: NonNullable<RequirementTestsOpts["path"]> = (view, key) => `specs/${view.path}.${key}.spec.ts`;
+  const SAMPLE_PATHS = [
+    "requirements/Orders.Recorded.object.entity.test.ts",
+    "requirements/deep/nested.test.ts",
+    "requirements",
+    "requirementsElsewhere/a.test.ts",
+    "specs/Orders.Recorded.object.entity.spec.ts",
+    "Order.ts",
+    "",
+  ];
+
+  const shape = (g: Generator) => ({
+    name: g.name,
+    target: g.target,
+    reconciles: g.orphanPolicy !== undefined,
+    force: g.orphanPolicy?.force,
+    owns: g.orphanPolicy === undefined ? null : SAMPLE_PATHS.filter((p) => g.orphanPolicy?.owns(p)),
+  });
+
+  // `expected` is the built-in's shape written out, so the comparison below cannot
+  // pass by both sides being wrong together (or both claiming nothing at all).
+  const CASES: ReadonlyArray<{ label: string; opts: RequirementTestsOpts; expected: ReturnType<typeof shape> }> = [
+    {
+      label: "the defaults own the default stub directory, and nothing beside it",
+      opts: {},
+      expected: {
+        name: "requirement-tests",
+        target: undefined,
+        reconciles: true,
+        force: undefined,
+        owns: ["requirements/Orders.Recorded.object.entity.test.ts", "requirements/deep/nested.test.ts"],
+      },
+    },
+    {
+      label: "member grain owns the same directory",
+      opts: { grain: "member" },
+      expected: {
+        name: "requirement-tests",
+        target: undefined,
+        reconciles: true,
+        force: undefined,
+        owns: ["requirements/Orders.Recorded.object.entity.test.ts", "requirements/deep/nested.test.ts"],
+      },
+    },
+    {
+      label: "the name and the target are the application's",
+      opts: { name: "req-api", target: "api-tests" },
+      expected: {
+        name: "req-api",
+        target: "api-tests",
+        reconciles: true,
+        force: undefined,
+        owns: ["requirements/Orders.Recorded.object.entity.test.ts", "requirements/deep/nested.test.ts"],
+      },
+    },
+    {
+      label: "a custom path without owns claims NOTHING",
+      opts: { path: specPath },
+      expected: { name: "requirement-tests", target: undefined, reconciles: true, force: undefined, owns: [] },
+    },
+    {
+      label: "a custom path with owns claims exactly what owns says",
+      opts: { path: specPath, owns: (p) => p.startsWith("specs/") },
+      expected: {
+        name: "requirement-tests",
+        target: undefined,
+        reconciles: true,
+        force: undefined,
+        owns: ["specs/Orders.Recorded.object.entity.spec.ts"],
+      },
+    },
+    {
+      label: "forceOrphanDelete sets force",
+      opts: { forceOrphanDelete: true },
+      expected: {
+        name: "requirement-tests",
+        target: undefined,
+        reconciles: true,
+        force: true,
+        owns: ["requirements/Orders.Recorded.object.entity.test.ts", "requirements/deep/nested.test.ts"],
+      },
+    },
+    {
+      label: "reconcileOrphans: false declares no policy at all",
+      opts: { reconcileOrphans: false, forceOrphanDelete: true },
+      expected: { name: "requirement-tests", target: undefined, reconciles: false, force: undefined, owns: null },
+    },
+  ];
+
+  for (const c of CASES) {
+    test(c.label, () => {
+      const builtin = shape(builtinRequirementTests(c.opts));
+      expect(builtin).toEqual(c.expected);
+      expect(shape(refRequirementTests(c.opts))).toEqual(builtin);
+    });
+  }
+
+  test("an unknown grain is refused by both, in the same words", () => {
+    const typo = { grain: "members" } as unknown as RequirementTestsOpts;
+    const refusal = (make: () => Generator): string => {
+      try {
+        make();
+      } catch (err) {
+        return err instanceof Error ? err.message : String(err);
+      }
+      return "(did not throw)";
+    };
+    const builtin = refusal(() => builtinRequirementTests(typo));
+    expect(builtin).toBe('unknown requirement-test grain "members": expected "concern" or "member".');
+    expect(refusal(() => refRequirementTests(typo))).toBe(builtin);
+  });
+});
+
+// The renderer is exported from the copy too, and an application may call it with
+// arguments it built itself. Rendering through a generator only ever supplies arguments
+// that agree with each other, so the two renderers are also compared directly — over
+// every status, with the identity's `skip` field set to agree with it and to contradict
+// it. The default renderer reads the STATUS; a copy that read `skip` instead passed
+// every generator run above and diverged here.
+describe("ADR-0034 — the requirement-tests reference renders hand-built arguments identically", () => {
+  const STATUSES = ["live", "partial", "planned", "retired", undefined] as const;
+  const SKIPS = [null, "planned", "retired"] as const;
+  const EXTRAS: ReadonlyArray<Partial<RequirementTestArgs>> = [
+    {},
+    { disposition: "accepted" },
+    { trackedBy: ["#1", "a */ b"] },
+    {
+      disposition: "deferred",
+      trackedBy: ["#2"],
+      targets: [{ ref: "Order.note", concern: "field.string", node: {} as never }],
+    },
+  ];
+
+  for (const status of STATUSES) {
+    for (const skip of SKIPS) {
+      test(`status ${status ?? "(absent)"}, skip ${skip ?? "null"}`, () => {
+        for (const extra of EXTRAS) {
+          const args: RequirementTestArgs = {
+            view: { subType: "functional", level: 4, status, path: 'Orders."Quoted"', package: "acme::shop", implementedByTypes: [] },
+            concern: "object.entity",
+            statement: "A statement */ with a break.\nAnd a second line.",
+            counterexample: 'a "quoted" \\ counterexample\r\nover two lines',
+            targets: [],
+            package: "acme::shop",
+            unit: "object.entity",
+            id: 'acme::shop::Orders."Quoted" [object.entity]',
+            witnessKey: "req_acme_shop_Orders_Quoted__object_entity",
+            skip,
+            digest: "0".repeat(64),
+            ...extra,
+          };
+          expect(refRenderRequirementTest(args)).toBe(builtinRenderRequirementTest(args));
+        }
+      });
+    }
+  }
+});
diff --git a/server/typescript/packages/codegen-ts/test/reference-templates.test.ts b/server/typescript/packages/codegen-ts/test/reference-templates.test.ts
index 65a5d15e9..8cd954149 100644
--- a/server/typescript/packages/codegen-ts/test/reference-templates.test.ts
+++ b/server/typescript/packages/codegen-ts/test/reference-templates.test.ts
@@ -15,6 +15,7 @@ describe("reference-templates reader", () => {
     expect([...REFERENCE_GENERATOR_NAMES]).toEqual([
       "entity", "queries", "routes", "routes-hono", "barrel", "names",
       "prompt-render", "output-parser", "extractor", "output-prompt", "render-helper",
+      "requirement-tests",
     ]);
   });
 
diff --git a/server/typescript/packages/codegen-ts/test/requirement-stub-executes.test.ts b/server/typescript/packages/codegen-ts/test/requirement-stub-executes.test.ts
index 715095f50..574b85f57 100644
--- a/server/typescript/packages/codegen-ts/test/requirement-stub-executes.test.ts
+++ b/server/typescript/packages/codegen-ts/test/requirement-stub-executes.test.ts
@@ -19,12 +19,19 @@ function args(status: string): RequirementTestArgs {
       level: 4,
       status,
       path: "req.probe",
+      package: "acme::probe",
       implementedByTypes: [],
     },
     concern: "object.entity",
     statement: "A council has a human-readable slug.",
     counterexample: "a council with no slug",
     targets: [],
+    package: "acme::probe",
+    unit: "object.entity",
+    id: "acme::probe::req.probe [object.entity]",
+    witnessKey: "req_acme_probe_req_probe__object_entity",
+    skip: null,
+    digest: "0".repeat(64),
   };
 }
 
diff --git a/server/typescript/packages/codegen-ts/test/requirement-test-escaping.test.ts b/server/typescript/packages/codegen-ts/test/requirement-test-escaping.test.ts
index 4342134fa..3ddeee42d 100644
--- a/server/typescript/packages/codegen-ts/test/requirement-test-escaping.test.ts
+++ b/server/typescript/packages/codegen-ts/test/requirement-test-escaping.test.ts
@@ -25,9 +25,20 @@ const view = {
   level: 4,
   status: "live",
   path: "req.probe",
+  package: "acme::probe",
   implementedByTypes: [],
 } as const;
 
+// The test identity every renderer is handed. The default renderer reads none of it.
+const identity = {
+  package: "acme::probe",
+  unit: "object.entity",
+  id: "acme::probe::req.probe [object.entity]",
+  witnessKey: "req_acme_probe_req_probe__object_entity",
+  skip: null,
+  digest: "0".repeat(64),
+} as const;
+
 function render(statement: string, counterexample: string): string {
   return renderRequirementTest({
     view: { ...view },
@@ -35,6 +46,7 @@ function render(statement: string, counterexample: string): string {
     statement,
     counterexample,
     targets: [],
+    ...identity,
   });
 }
 
@@ -107,6 +119,7 @@ describe("every author-supplied field is escaped, not just the two obvious ones"
       statement: "Notes are private.",
       counterexample: "the GM sees a player's notes",
       targets: [],
+      ...identity,
       ...extra,
     });
   }
@@ -186,6 +199,7 @@ describe("a retired requirement does not redden the suite forever", () => {
         statement: "s",
         counterexample: "v",
         targets: [],
+        ...identity,
       });
       expect(src).toContain("test.skip");
       expect(src).not.toContain("expect.unreachable");
@@ -200,6 +214,7 @@ describe("a retired requirement does not redden the suite forever", () => {
         statement: "s",
         counterexample: "v",
         targets: [],
+        ...identity,
       });
       expect(src).toContain("expect.unreachable");
       expect(src).not.toContain("test.skip");
diff --git a/server/typescript/packages/codegen-ts/test/requirement-test-identity-conformance.test.ts b/server/typescript/packages/codegen-ts/test/requirement-test-identity-conformance.test.ts
new file mode 100644
index 000000000..38689cba3
--- /dev/null
+++ b/server/typescript/packages/codegen-ts/test/requirement-test-identity-conformance.test.ts
@@ -0,0 +1,143 @@
+// Cross-port requirement-test identity corpus — fixtures/requirement-test-identity-conformance/.
+//
+// Every port generates a test per requirement, each in its own language and test
+// framework, and the generated FILES are free to differ. What may not differ is which
+// tests a ledger yields, what each is called, whether it is skipped, the fingerprint of
+// the claim it tests, and what a project's filter is shown. This corpus pins those, and
+// this runner holds the TypeScript reference to it.
+//
+// Every case is LOADED strict first, so "this model loads today" is proven by the fixture
+// rather than asserted in prose. `expected.json` is written from this implementation by
+// `scripts/write-requirement-corpus-expected.ts identity` and reviewed by hand; this
+// runner is what stops it drifting afterwards.
+import { describe, test, expect } from "bun:test";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import {
+  MetaDataLoader,
+  OBJECT_SUBTYPE_ENTITY,
+  REQUIREMENT_LEVEL_MEMBER,
+  REQUIREMENT_STATUS_LIVE,
+  REQUIREMENT_SUBTYPE_ARCHITECTURAL,
+  TYPE_OBJECT,
+} from "@metaobjectsdev/metadata";
+// The package's PUBLIC exports, not the module they are defined in: the filter seam under
+// test is the one an application reaches.
+import { requirementTestIdentities, witnessKeyCollisions } from "../src/index.js";
+import type {
+  RequirementTestGrain,
+  RequirementTestIdentity,
+  RequirementView,
+} from "../src/index.js";
+
+const CORPUS_DIR = join(
+  import.meta.dir,
+  "../../../../../fixtures/requirement-test-identity-conformance",
+);
+
+interface Expected {
+  tests: RequirementTestIdentity[];
+  collisions: [string, string][];
+}
+
+/** The whole of `options.json`. A key outside this list is refused rather than ignored: a
+ *  misspelt `filter` would otherwise run the case under the default filter and pin the
+ *  wrong set of tests in every port. */
+const OPTION_KEYS = ["grain", "filter"] as const;
+interface Options { grain?: RequirementTestGrain; filter?: string }
+
+type Predicate = (r: RequirementView) => boolean;
+
+/**
+ * The corpus's closed list of filters. A predicate cannot be written in a file five
+ * languages read, so a case NAMES one and every port's runner holds this table in its own
+ * language, handing the predicate to its public filter seam. Between them the eight rows
+ * read every field of the requirement view, and `unlevelled` reads a field that is not
+ * there.
+ *
+ * A Map, not an object literal: looking `constructor` up in a literal finds
+ * `Object.prototype`'s, so a misnamed filter would be run as a predicate that keeps
+ * everything instead of being refused.
+ */
+const FILTERS: ReadonlyMap<string, Predicate> = new Map<string, Predicate>([
+  ["all", () => true],
+  ["architectural", (r) => r.subType === REQUIREMENT_SUBTYPE_ARCHITECTURAL],
+  ["live", (r) => r.status === REQUIREMENT_STATUS_LIVE],
+  ["level-5", (r) => r.level === REQUIREMENT_LEVEL_MEMBER],
+  ["unlevelled", (r) => r.level === undefined],
+  ["package-acme-shop", (r) => r.package === "acme::shop"],
+  ["path-under-Shop", (r) => r.path === "Shop" || r.path.startsWith("Shop.")],
+  ["claims-entity", (r) => r.implementedByTypes.includes(`${TYPE_OBJECT}.${OBJECT_SUBTYPE_ENTITY}`)],
+]);
+
+function readOptions(caseDir: string): Options {
+  const file = join(caseDir, "options.json");
+  if (!existsSync(file)) return {};
+  const options = JSON.parse(readFileSync(file, "utf8")) as Record<string, unknown>;
+  const unknown = Object.keys(options).filter((k) => !(OPTION_KEYS as readonly string[]).includes(k));
+  if (unknown.length > 0) throw new Error(`${file}: unknown option(s) ${unknown.join(", ")}`);
+  return options as Options;
+}
+
+function filterNamed(name: string): Predicate {
+  const filter = FILTERS.get(name);
+  if (filter === undefined) {
+    throw new Error(`unknown filter '${name}'. The corpus names: ${[...FILTERS.keys()].join(", ")}`);
+  }
+  return filter;
+}
+
+// Code units, as the reference orders ids: a locale collation differs between machines.
+const codeUnits = (a: string, b: string): number => (a < b ? -1 : a > b ? 1 : 0);
+/** The comparison the corpus README names: both sides sorted by `id`. */
+const byId = (tests: readonly RequirementTestIdentity[]): RequirementTestIdentity[] =>
+  [...tests].sort((a, b) => codeUnits(a.id, b.id));
+/** …and each collision pair sorted, then the list. */
+const sortedPairs = (pairs: readonly (readonly [string, string])[]): string[][] =>
+  pairs
+    .map((pair) => [...pair].sort(codeUnits))
+    .sort((a, b) => codeUnits(a[0]!, b[0]!) || codeUnits(a[1]!, b[1]!));
+
+/** The case names the README's "Cases" table documents, in table order. */
+function documentedCases(): string[] {
+  const readme = readFileSync(join(CORPUS_DIR, "README.md"), "utf8");
+  const section = readme.split(/^## /m).find((s) => s.startsWith("Cases\n"));
+  if (section === undefined) throw new Error("README.md has no '## Cases' section");
+  return [...section.matchAll(/^\| `([^`]+)` \|/gm)].map((m) => m[1]!);
+}
+
+const cases = readdirSync(CORPUS_DIR).filter((n) => statSync(join(CORPUS_DIR, n)).isDirectory()).sort();
+
+describe("requirement-test identity conformance corpus", () => {
+  test("every case on disk is documented in the README, and nothing else is", () => {
+    expect(cases.length).toBeGreaterThan(0);
+    expect(documentedCases().sort()).toEqual(cases);
+  });
+
+  for (const name of cases) {
+    test(name, async () => {
+      const caseDir = join(CORPUS_DIR, name);
+      const expectedFile = join(caseDir, "expected.json");
+      if (!existsSync(expectedFile)) {
+        throw new Error(
+          `${name}: no expected.json. Write it with ` +
+            `'bun scripts/write-requirement-corpus-expected.ts identity', then review it by hand.`,
+        );
+      }
+      const expected = JSON.parse(readFileSync(expectedFile, "utf8")) as Expected;
+      const options = readOptions(caseDir);
+
+      const result = await MetaDataLoader.fromDirectory(join(caseDir, "input"), { strict: true });
+      expect(result.errors.map(String)).toEqual([]);
+
+      // Each option is passed only when the case sets it, so a case without one runs
+      // the port's own default — which is itself part of what the corpus pins.
+      const tests = requirementTestIdentities(result.root, {
+        ...(options.grain === undefined ? {} : { grain: options.grain }),
+        ...(options.filter === undefined ? {} : { filter: filterNamed(options.filter) }),
+      });
+      expect(byId(tests)).toStrictEqual(byId(expected.tests));
+      expect(sortedPairs(witnessKeyCollisions(tests))).toStrictEqual(sortedPairs(expected.collisions));
+    });
+  }
+});
diff --git a/server/typescript/packages/codegen-ts/test/requirement-test-render.test.ts b/server/typescript/packages/codegen-ts/test/requirement-test-render.test.ts
index 3ed5e1c15..10ffc9b27 100644
--- a/server/typescript/packages/codegen-ts/test/requirement-test-render.test.ts
+++ b/server/typescript/packages/codegen-ts/test/requirement-test-render.test.ts
@@ -14,12 +14,19 @@ const base: RequirementTestArgs = {
     level: 4,
     status: "live",
     path: "links.slugField",
+    package: "acme::probe",
     implementedByTypes: [],
   },
   concern: "object.entity",
   statement: "A council has a human-readable slug.",
   counterexample: "a council with no slug",
   targets: [],
+  package: "acme::probe",
+  unit: "object.entity",
+  id: "acme::probe::links.slugField [object.entity]",
+  witnessKey: "req_acme_probe_links_slugField__object_entity",
+  skip: null,
+  digest: "0".repeat(64),
 };
 
 describe("renderRequirementTest", () => {
@@ -103,3 +110,51 @@ describe("renderRequirementTest", () => {
     expect(src).toContain("object.entity");
   });
 });
+
+describe("renderRequirementTest — the default stub keeps its bytes", () => {
+  // The whole stub, pinned. An application's hand-written test bodies live in these
+  // files and are merged against them, so a changed byte in the default output is a
+  // three-way merge on every stub an adopter has already filled in.
+  const EXPECTED =
+    `// @generated by @metaobjectsdev/codegen-ts.\n` +
+    `// The test IDENTITY is generated from the requirement; the BODY below is yours.\n` +
+    `// Do not rename the test — the name is the link.\n` +
+    `// Your body is never overwritten: MERGED where .metaobjects/.gen-state/ holds this\n` +
+    `// file's snapshot body, REFUSED (run exits 1, body kept) where it does not. Those\n` +
+    `// bodies are gitignored, so a fresh clone or CI is always the second case — see\n` +
+    `// docs/features/own-your-codegen.md for the recovery.\n` +
+    `import { test, expect } from "bun:test";\n` +
+    `\n` +
+    `/**\n` +
+    ` * A council has a human-readable slug.\n` +
+    ` *\n` +
+    ` * Counterexample: a council with no slug\n` +
+    ` *\n` +
+    ` * Claims:\n` +
+    ` *   (none — this requirement names no model nodes)\n` +
+    ` */\n` +
+    `test("links.slugField [object.entity]", () => {\n` +
+    `  expect.unreachable(\n` +
+    `    "unimplemented requirement stub: links.slugField [object.entity] — " +\n` +
+    `    "replace this with an assertion that fails when: a council with no slug",\n` +
+    `  );\n` +
+    `});\n`;
+
+  test("the default output is byte-identical with the new args present", () => {
+    expect(renderRequirementTest(base)).toBe(EXPECTED);
+    // …and the identity fields are DATA for an application's renderer, not input to
+    // this one: whatever they hold, the default stub does not move.
+    expect(
+      renderRequirementTest({
+        ...base,
+        view: { ...base.view, package: "other::pkg" },
+        package: "other::pkg",
+        unit: "Other.member",
+        id: "other::pkg::Somewhere.Else [Other.member]",
+        witnessKey: "req_other_pkg_Somewhere_Else__Other_member",
+        skip: "planned",
+        digest: "f".repeat(64),
+      }),
+    ).toBe(EXPECTED);
+  });
+});
diff --git a/server/typescript/packages/codegen-ts/test/requirement-tests-generator.test.ts b/server/typescript/packages/codegen-ts/test/requirement-tests-generator.test.ts
index d550d0dde..78b595c47 100644
--- a/server/typescript/packages/codegen-ts/test/requirement-tests-generator.test.ts
+++ b/server/typescript/packages/codegen-ts/test/requirement-tests-generator.test.ts
@@ -9,6 +9,7 @@ import { MetaDataLoader, InMemoryStringSource } from "@metaobjectsdev/metadata";
 import { requirementTests } from "../src/generators/requirement-tests.js";
 import type { RequirementTestsOpts } from "../src/generators/requirement-tests.js";
 import type { EmittedFile, GenContext } from "../src/generator.js";
+import type { RequirementTestArgs } from "../src/templates/requirement-test.js";
 
 const MODEL = {
   "metadata.root": {
@@ -162,3 +163,92 @@ describe("requirementTests — uncovered warning", () => {
     expect(seen).toEqual([]);
   });
 });
+
+describe("requirementTests — grain", () => {
+  test('grain: "member" emits one file per reference', async () => {
+    const files = await emit({ grain: "member" });
+    // The last segment is the MANGLED reference, so a qualified reference can never
+    // put "::" (or a path separator) into a filename.
+    expect(files.map((f) => f.path).sort()).toEqual([
+      "requirements/links.slugField.Council.test.ts",
+      "requirements/links.slugField.Council_slug.test.ts",
+      "requirements/links.slugField.Council_slug_display.test.ts",
+    ]);
+  });
+
+  test("under member grain each stub is named for, and lists, its one reference", async () => {
+    const files = await emit({ grain: "member" });
+    const slug = files.find((f) => f.path.endsWith(".Council_slug.test.ts"))?.content ?? "";
+    expect(slug).toContain('test("links.slugField [Council.slug]"');
+    expect(slug).toContain(" *   - Council.slug  (field.string)");
+    expect(slug).not.toContain("Council.slug.display");
+  });
+
+  test("a type-keyed renderer still applies under member grain", async () => {
+    // The renderer map is keyed by what the reference RESOLVES to, in both grains —
+    // otherwise switching grain would silently retire every renderer an app registered.
+    const files = await emit({ grain: "member", renderers: { "field.*": () => "FIELD" } });
+    expect(files.filter((f) => f.content === "FIELD").map((f) => f.path)).toEqual([
+      "requirements/links.slugField.Council_slug.test.ts",
+    ]);
+  });
+
+  test("the renderer receives the test identity, digest and witnessKey", async () => {
+    const seen: RequirementTestArgs[] = [];
+    const capture = (a: RequirementTestArgs): string => {
+      seen.push(a);
+      return "";
+    };
+    await emit({ grain: "member", renderers: { "*": capture } });
+    const slug = seen.find((a) => a.unit === "Council.slug");
+    expect(slug?.package).toBe("acme::probe");
+    expect(slug?.id).toBe("acme::probe::links.slugField [Council.slug]");
+    expect(slug?.witnessKey).toBe("req_acme_probe_links_slugField__Council_slug");
+    expect(slug?.skip).toBeNull();
+    expect(slug?.digest).toMatch(/^[0-9a-f]{64}$/);
+    // One claim, so one digest: every test of a requirement carries the same one.
+    expect(new Set(seen.map((a) => a.digest)).size).toBe(1);
+  });
+
+  test("the default grain hands the renderer the same record, keyed by concern", async () => {
+    const seen: RequirementTestArgs[] = [];
+    await emit({
+      renderers: { "*": (a) => (seen.push(a), "") },
+    });
+    expect(seen.map((a) => [a.unit, a.concern, a.id, a.witnessKey])).toEqual([
+      [
+        "object.entity",
+        "object.entity",
+        "acme::probe::links.slugField [object.entity]",
+        "req_acme_probe_links_slugField__object_entity",
+      ],
+      [
+        "field.string",
+        "field.string",
+        "acme::probe::links.slugField [field.string]",
+        "req_acme_probe_links_slugField__field_string",
+      ],
+      [
+        "view.text",
+        "view.text",
+        "acme::probe::links.slugField [view.text]",
+        "req_acme_probe_links_slugField__view_text",
+      ],
+    ]);
+  });
+});
+
+describe("requirementTests — an unknown grain", () => {
+  test("is refused when the generator is built, before anything is generated", () => {
+    // `metaobjects.config.ts` is loaded without a typecheck. A typo used to take the
+    // member grouping and the concern paths at once.
+    const typo = { grain: "members" } as unknown as RequirementTestsOpts;
+    expect(() => requirementTests(typo)).toThrow(
+      'unknown requirement-test grain "members": expected "concern" or "member".',
+    );
+  });
+
+  test("an absent grain is the default, not an error", async () => {
+    expect((await emit({})).length).toBe(3);
+  });
+});
diff --git a/server/typescript/packages/codegen-ts/test/requirement-walk.test.ts b/server/typescript/packages/codegen-ts/test/requirement-walk.test.ts
index f99ec70ec..341100d6b 100644
--- a/server/typescript/packages/codegen-ts/test/requirement-walk.test.ts
+++ b/server/typescript/packages/codegen-ts/test/requirement-walk.test.ts
@@ -5,13 +5,19 @@
 
 import { describe, test, expect } from "bun:test";
 import { MetaDataLoader, InMemoryStringSource } from "@metaobjectsdev/metadata";
-import type { MetaData } from "@metaobjectsdev/metadata";
+import type { MetaData, MetaRequirement } from "@metaobjectsdev/metadata";
 import {
   walkRequirements,
   concernOf,
   groupByConcern,
   NO_CONCERN,
+  requirementDigest,
+  witnessKeyOf,
+  requirementTestUnits,
+  requirementTestIdentities,
+  witnessKeyCollisions,
 } from "../src/requirement-walk.js";
+import type { RequirementTestGrain } from "../src/requirement-walk.js";
 
 // The claimed nodes deliberately span THREE distinct types. A model whose targets
 // are all one type cannot tell the per-type fan-out rule from the per-node rule
@@ -158,3 +164,383 @@ describe("groupByConcern — the fan-out unit", () => {
     expect(groups.get("field.string")?.length).toBe(2);
   });
 });
+
+// ---------------------------------------------------------------------------
+// Test identity, digest and grain — the records the other four ports copy.
+// ---------------------------------------------------------------------------
+
+const ORDER = {
+  "object.entity": {
+    name: "Order",
+    children: [
+      { "field.long": { name: "id" } },
+      { "field.currency": { name: "total" } },
+      { "source.rdb": { "@table": "orders" } },
+      { "identity.primary": { name: "pk", "@fields": ["id"] } },
+    ],
+  },
+};
+
+type Json = Record<string, unknown>;
+
+const functional = (name: string, attrs: Json, children: Json[] = []): Json => ({
+  "requirement.functional": {
+    name,
+    "@statement": "s",
+    "@counterexample": "c",
+    ...attrs,
+    ...(children.length > 0 ? { children } : {}),
+  },
+});
+
+/** The worked example of the plan's contract tables, exactly. */
+const RECORDED = functional("Recorded", {
+  "@level": 4,
+  "@status": "live",
+  "@statement": "An order is recorded when it is placed.",
+  "@counterexample": "A placed order has no row.",
+  "@implementedBy": ["Order"],
+});
+const REFUNDED = functional("Refunded", {
+  "@level": 4,
+  "@status": "planned",
+  "@statement": "A refund is recorded against its order.",
+  "@counterexample": "A refund with no order.",
+});
+const RECORDED_DIGEST = "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a";
+const REFUNDED_DIGEST = "4ddcd781ccc2fe462bc316711d5cedb88b803af1727a0df19fe3a69487aa6f86";
+
+const shop = (...requirements: Json[]): Json => ({
+  "metadata.root": { package: "acme::shop", children: [ORDER, ...requirements] },
+});
+
+const WORKED_EXAMPLE = shop(
+  functional("Orders", { "@level": 3, "@status": "live" }, [RECORDED, REFUNDED]),
+);
+
+async function loadDocs(...docs: Json[]): Promise<MetaData> {
+  const r = await new MetaDataLoader().load(
+    docs.map((d) => new InMemoryStringSource(JSON.stringify(d))),
+  );
+  if (r.errors.length > 0) {
+    throw new Error(`Loader errors:\n${r.errors.map((e) => e.message).join("\n")}`);
+  }
+  return r.root;
+}
+
+async function requirementAt(doc: Json, path: string): Promise<MetaRequirement> {
+  const found = walkRequirements(await loadDocs(doc)).find((w) => w.view.path === path);
+  if (found === undefined) throw new Error(`no requirement at ${path}`);
+  return found.node;
+}
+
+describe("requirementDigest — did the claim change", () => {
+  test("the digest of the worked example is pinned", async () => {
+    // functional, level 4, live, one ref "Order" — Table G
+    const recorded = await requirementAt(WORKED_EXAMPLE, "Orders.Recorded");
+    expect(requirementDigest(recorded)).toBe(
+      "2714aa3925a47959aa5e48ae39d80ed203fd4e2caa046a90aab9e04691d9881a",
+    );
+  });
+
+  test("a requirement with no links hashes an empty reference list", async () => {
+    const refunded = await requirementAt(WORKED_EXAMPLE, "Orders.Refunded");
+    expect(requirementDigest(refunded)).toBe(REFUNDED_DIGEST);
+  });
+
+  test("the digest ignores title, notes, disposition and trackedBy", async () => {
+    const plain = functional("Gap", { "@level": 4, "@status": "partial" });
+    const annotated = functional("Gap", {
+      "@level": 4,
+      "@status": "partial",
+      "@title": "A title",
+      "@notes": "Some notes.",
+      "@disposition": "deferred",
+      "@trackedBy": ["#42"],
+    });
+    const reworded = functional("Gap", {
+      "@level": 4,
+      "@status": "partial",
+      "@statement": "a different claim",
+    });
+    const base = requirementDigest(await requirementAt(shop(plain), "Gap"));
+    expect(requirementDigest(await requirementAt(shop(annotated), "Gap"))).toBe(base);
+    // …and the comparison is not vacuous: a changed claim does move it.
+    expect(requirementDigest(await requirementAt(shop(reworded), "Gap"))).not.toBe(base);
+  });
+
+  test("lengths in the digest are UTF-8 BYTE lengths, not character counts", async () => {
+    // Every other digest in this file hashes ASCII, where the two agree. Here the
+    // statement is 36 characters and 44 bytes, the counterexample 23 and 26.
+    //
+    // The expected value was computed without this code, in a shell:
+    //   printf 'requirement-digest/v1\nsubType 10\nfunctional\nlevel 1\n4\nstatus 4\nlive\n
+    //           statement 44\n<statement>\ncounterexample 26\n<counterexample>\n
+    //           implementedBy 1\nref 5\nOrder\n' | sha256sum
+    // with 44 and 26 taken from `printf %s "<value>" | wc -c`. The same recipe over the
+    // worked example's text reproduces its pinned digest.
+    const accented = functional("Exact", {
+      "@level": 4,
+      "@status": "live",
+      "@statement": "Le total est exact — à l’euro près ✓",
+      "@counterexample": "Un total arrondi à 10 €",
+      "@implementedBy": ["Order"],
+    });
+    expect(requirementDigest(await requirementAt(shop(accented), "Exact"))).toBe(
+      "ba64ffbaad8827f7c4692b49c083bfc8edc754d65690280f20f2257f3377a813",
+    );
+  });
+
+  test("the digest normalises CRLF", async () => {
+    const withBreak = (br: string): Json =>
+      functional("Gap", {
+        "@level": 4,
+        "@status": "live",
+        "@statement": `first${br}second`,
+        "@counterexample": `one${br}two`,
+      });
+    const lf = requirementDigest(await requirementAt(shop(withBreak("\n")), "Gap"));
+    expect(requirementDigest(await requirementAt(shop(withBreak("\r\n")), "Gap"))).toBe(lf);
+    expect(requirementDigest(await requirementAt(shop(withBreak("\r")), "Gap"))).toBe(lf);
+  });
+});
+
+describe("witnessKeyOf", () => {
+  test("witness keys follow Table F", () => {
+    expect(witnessKeyOf("acme::shop::Orders.Recorded", "object.entity"))
+      .toBe("req_acme_shop_Orders_Recorded__object_entity");
+    expect(witnessKeyOf("acme::shop::Orders.Recorded", "Order.total"))
+      .toBe("req_acme_shop_Orders_Recorded__Order_total");
+    expect(witnessKeyOf("acme::shop::Orders.Recorded", "*"))
+      .toBe("req_acme_shop_Orders_Recorded");
+  });
+
+  test("a letter outside ASCII is replaced, not kept", () => {
+    // The kept class is ASCII [A-Za-z0-9] and nothing else. A language's own notion of
+    // a letter (`\w`, isalnum, isLetterOrDigit) keeps "é" and gives a different key in
+    // each port. Every port carries this test with this value; the shared corpus cannot,
+    // because the loaders are not known to agree on a name outside ASCII.
+    //
+    // "é" is written as the one code point U+00E9, so the result does not depend on how
+    // this file was normalised. Run by run:
+    //   acme  "::"->_  shop  "::"->_  Caf  "é."->_  R  "é"->_  gl  "é"->_
+    // "é." is ONE run, so one underscore, and the final "é" leaves a trailing one. The
+    // unit is "*", so there is no unit suffix.
+    expect(witnessKeyOf("acme::shop::Café.Réglé", "*")).toBe("req_acme_shop_Caf_R_gl_");
+  });
+});
+
+describe("the requirement view's package", () => {
+  test("the view carries the effective package", async () => {
+    // One requirement takes the file's default package, one declares its own.
+    const root = await loadDocs(
+      shop(
+        functional("Local", { "@level": 4, "@status": "live" }),
+        {
+          "requirement.functional": {
+            name: "Elsewhere",
+            package: "acme::billing",
+            "@level": 4,
+            "@status": "live",
+            "@statement": "s",
+            "@counterexample": "c",
+          },
+        },
+      ),
+    );
+    const packages = Object.fromEntries(
+      walkRequirements(root).map((w) => [w.view.path, w.view.package]),
+    );
+    expect(packages).toEqual({ Local: "acme::shop", Elsewhere: "acme::billing" });
+  });
+
+  test("an unpackaged requirement has the empty package and a bare address", async () => {
+    const root = await loadDocs({
+      "metadata.root": {
+        children: [functional("Bare", { "@level": 4, "@status": "live" })],
+      },
+    });
+    expect(walkRequirements(root)[0]?.view.package).toBe("");
+    const [only] = requirementTestIdentities(root);
+    expect(only?.id).toBe("Bare [*]");
+    expect(only?.witnessKey).toBe("req_Bare");
+  });
+});
+
+describe("requirementTestIdentities — one record per generated test", () => {
+  test("the worked example yields the records of Table F", async () => {
+    expect(requirementTestIdentities(await loadDocs(WORKED_EXAMPLE))).toEqual([
+      {
+        package: "acme::shop",
+        path: "Orders.Recorded",
+        unit: "object.entity",
+        id: "acme::shop::Orders.Recorded [object.entity]",
+        witnessKey: "req_acme_shop_Orders_Recorded__object_entity",
+        status: "live",
+        skip: null,
+        digest: RECORDED_DIGEST,
+      },
+      {
+        package: "acme::shop",
+        path: "Orders.Refunded",
+        unit: "*",
+        id: "acme::shop::Orders.Refunded [*]",
+        witnessKey: "req_acme_shop_Orders_Refunded",
+        status: "planned",
+        skip: "planned",
+        digest: REFUNDED_DIGEST,
+      },
+    ]);
+  });
+
+  // "Missing" does not resolve; "Order" is repeated; the qualified spelling names the
+  // same entity as the bare one and is still a different reference AS AUTHORED.
+  const MEMBERS = shop(
+    functional("Recorded", {
+      "@level": 4,
+      "@status": "live",
+      "@implementedBy": ["Order", "acme::shop::Order", "Order", "Missing", "Order.total"],
+    }),
+  );
+
+  test("member grain yields one identity per distinct resolving reference", async () => {
+    const tests = requirementTestIdentities(await loadDocs(MEMBERS), { grain: "member" });
+    // Sorted by id, and in code units "." sorts before "]".
+    expect(tests.map((t) => t.unit)).toEqual(["Order.total", "Order", "acme::shop::Order"]);
+    expect(tests.map((t) => t.witnessKey)).toEqual([
+      "req_acme_shop_Recorded__Order_total",
+      "req_acme_shop_Recorded__Order",
+      "req_acme_shop_Recorded__acme_shop_Order",
+    ]);
+    // The default grain fans the same requirement out by concern instead.
+    expect(requirementTestIdentities(await loadDocs(MEMBERS)).map((t) => t.unit)).toEqual([
+      "field.currency",
+      "object.entity",
+    ]);
+  });
+
+  test("a requirement with no resolved target yields unit *", async () => {
+    // Nothing declared, and a planned requirement naming only nodes that do not exist.
+    const root = await loadDocs(
+      shop(
+        functional("Unlinked", { "@level": 4, "@status": "live" }),
+        functional("Ahead", { "@level": 4, "@status": "planned", "@implementedBy": ["NotYet"] }),
+      ),
+    );
+    for (const grain of ["concern", "member"] as const) {
+      expect(requirementTestIdentities(root, { grain }).map((t) => t.id)).toEqual([
+        "acme::shop::Ahead [*]",
+        "acme::shop::Unlinked [*]",
+      ]);
+    }
+  });
+
+  test("skip is derived from the status lists", async () => {
+    const root = await loadDocs(
+      shop(
+        functional("A", { "@level": 4, "@status": "planned" }),
+        functional("B", { "@level": 4, "@status": "live" }),
+        functional("C", { "@level": 4, "@status": "partial" }),
+        functional("D", { "@level": 4, "@status": "retired" }),
+      ),
+    );
+    expect(requirementTestIdentities(root).map((t) => [t.path, t.status, t.skip])).toEqual([
+      ["A", "planned", "planned"],
+      ["B", "live", null],
+      ["C", "partial", null],
+      ["D", "retired", "retired"],
+    ]);
+  });
+
+  test("identities come back sorted by id", async () => {
+    // Declared out of order, and mixed-case on purpose: a code-unit comparison puts
+    // every capital before every lower-case letter, where a locale collation would
+    // interleave them — and a collation differs between machines and between ports.
+    const root = await loadDocs(
+      shop(
+        functional("beta", { "@level": 4, "@status": "live" }),
+        functional("Zeta", { "@level": 4, "@status": "live" }),
+        functional("alpha", { "@level": 4, "@status": "live" }),
+        functional("Beta", { "@level": 4, "@status": "live" }),
+      ),
+    );
+    expect(requirementTestIdentities(root).map((t) => t.path)).toEqual([
+      "Beta",
+      "Zeta",
+      "alpha",
+      "beta",
+    ]);
+  });
+
+  test("a filter replaces the default and its view carries the effective package", async () => {
+    const root = await loadDocs(
+      shop(functional("Orders", { "@level": 3, "@status": "live" }, [RECORDED])),
+      {
+        "metadata.root": {
+          package: "acme::billing",
+          children: [functional("Invoiced", { "@level": 4, "@status": "live" })],
+        },
+      },
+    );
+    const tests = requirementTestIdentities(root, {
+      filter: (r) => r.package === "acme::shop",
+    });
+    // The L3 parent is IN — the default would have dropped it, so the predicate
+    // replaced the default rather than narrowing it — and the other package is out.
+    expect(tests.map((t) => t.id)).toEqual([
+      "acme::shop::Orders [*]",
+      "acme::shop::Orders.Recorded [object.entity]",
+    ]);
+  });
+});
+
+describe("an unknown grain is refused", () => {
+  // A config file is loaded without a typecheck, so a typo reaches this code as a
+  // plain string. Falling through to either grain would generate SOMETHING and say
+  // nothing; half of each (one grain's grouping, the other's paths) is worse.
+  const typo = "members" as unknown as RequirementTestGrain;
+  const refusal = 'unknown requirement-test grain "members": expected "concern" or "member".';
+
+  test("by requirementTestIdentities, even when the ledger is empty", async () => {
+    const empty = await loadDocs(shop());
+    expect(walkRequirements(empty)).toEqual([]);
+    expect(() => requirementTestIdentities(empty, { grain: typo })).toThrow(refusal);
+    const root = await loadDocs(WORKED_EXAMPLE);
+    expect(() => requirementTestIdentities(root, { grain: typo })).toThrow(refusal);
+  });
+
+  test("by requirementTestUnits", async () => {
+    const [first] = walkRequirements(await loadDocs(WORKED_EXAMPLE));
+    expect(() => requirementTestUnits(first!, typo)).toThrow(refusal);
+  });
+
+  test("and a value of the wrong type is named as it was given", async () => {
+    const root = await loadDocs(WORKED_EXAMPLE);
+    expect(() =>
+      requirementTestIdentities(root, { grain: 5 as unknown as RequirementTestGrain }),
+    ).toThrow('unknown requirement-test grain 5: expected "concern" or "member".');
+  });
+});
+
+describe("witnessKeyCollisions", () => {
+  test("two addresses that mangle alike are reported as a collision", async () => {
+    const root = await loadDocs(
+      shop(
+        functional("Orders_Recorded", { "@level": 4, "@status": "live", "@implementedBy": ["Order"] }),
+        functional("Orders", { "@level": 3, "@status": "live" }, [RECORDED]),
+      ),
+    );
+    const tests = requirementTestIdentities(root);
+    expect(witnessKeyCollisions(tests)).toEqual([
+      [
+        "acme::shop::Orders.Recorded [object.entity]",
+        "acme::shop::Orders_Recorded [object.entity]",
+      ],
+    ]);
+  });
+
+  test("distinct keys report nothing", async () => {
+    const tests = requirementTestIdentities(await loadDocs(WORKED_EXAMPLE));
+    expect(witnessKeyCollisions(tests)).toEqual([]);
+  });
+});
diff --git a/server/typescript/packages/metadata/src/loader/validation-passes.ts b/server/typescript/packages/metadata/src/loader/validation-passes.ts
index 40b92c71b..fa5fbf04d 100644
--- a/server/typescript/packages/metadata/src/loader/validation-passes.ts
+++ b/server/typescript/packages/metadata/src/loader/validation-passes.ts
@@ -2706,9 +2706,10 @@ function checkProjectionFilterRefs(
 //      Resolution of the reference itself is `verify`'s job (it owns every other
 //      @implementedBy-style resolution) — the loader owns the shape.
 //
-// Runs in every port. `requirement.*` gate logic otherwise lives only in the TS
-// CLI, which is exactly why THIS rule belongs in the loader: a Java or Python
-// estate would otherwise be free to author the shape the rule exists to prevent.
+// Runs in every port. The requirement gate runs in every port's `verify` since
+// ADR-0057 (when this rule was written it ran only in the TS CLI), yet the rule
+// stays in the loader: a shape the loader refuses is unreachable in every port
+// and in every program that loads the model, whether or not anyone runs `verify`.
 //
 // ADR-0039: children()/attr() throughout — never own* — so a requirement that
 // inherits its status through `extends` is judged on its EFFECTIVE status.
diff --git a/spec/capability-ledger.md b/spec/capability-ledger.md
index 9e2f0a512..e2a60e4ca 100644
--- a/spec/capability-ledger.md
+++ b/spec/capability-ledger.md
@@ -233,9 +233,11 @@ supersession chain stays walkable.
 ### `implementedBy` resolution, severity conditional on status
 
 References resolve against the loaded model through the loader's own resolver, so the
-package-local contract (ADR-0042) applies uniformly. A ledger entry has no package of its
-own, so a **bare** name binds only a root-level object: fail-closed, and a bare name that
-exists in two packages resolves to nothing rather than to a coin flip.
+package-local contract (ADR-0042) applies uniformly. A **bare** name binds in the ledger
+entry's own package first (the package the loader resolved for it: its own, or its file's),
+then to an unpackaged root-level node of that name. It never reaches into another package:
+fail-closed, and a bare name that exists in two other packages resolves to nothing rather
+than to a coin flip.
 
 | status | dangling reference |
 |---|---|
@@ -354,13 +356,20 @@ result is evidence that structured links buy no retrieval value over prose. It s
 about which node carries the link, because direction was never a variable in any round. The
 direction decision is the owner's, on the asymmetry above.
 
-### The verify gate is TypeScript-only, on purpose
+### The verify gate runs in every port
 
-All five ports **load and validate** requirements. Only the TS CLI ships the `meta verify`
-gate, on the D1 / leading-wildcard precedent for single-port tooling: `verify --db` and
-schema migration are already TS-owned (ADR-0015), so the gate lives where the rest of the
-drift checking lives. A JVM or Python project declaring requirements gets the loader's
-guarantees today and would need `meta verify` from the Node CLI for the conditional layer.
+All five ports **load and validate** requirements, and every port's `verify` runs the same
+gate over them: `meta verify`, `metaobjects verify`, `mvn metaobjects:verify` (Java and
+Kotlin) and `dotnet meta verify`. One corpus, `fixtures/requirement-check-conformance/`,
+holds each port's codes, severities, paths, message text and summary counts to the
+TypeScript reference.
+
+This section used to say the gate was TypeScript-only on purpose, on the ADR-0015 precedent
+for single-port tooling.
+[ADR-0057](decisions/ADR-0057-requirement-checks-and-tests-in-every-port.md) reversed that
+and records why the precedent did not carry over: a requirement test is code in the
+project's own language, and generating one needs the gate's walk and claim resolver anyway.
+What stays TypeScript-only is the authoring lint, which never fails a build.
 
 ## What a green check does not prove
 
diff --git a/spec/decisions/ADR-0034-codegen-scaffold-and-own.md b/spec/decisions/ADR-0034-codegen-scaffold-and-own.md
index a20193823..2e187e5df 100644
--- a/spec/decisions/ADR-0034-codegen-scaffold-and-own.md
+++ b/spec/decisions/ADR-0034-codegen-scaffold-and-own.md
@@ -259,13 +259,15 @@ three UI templates, and every capability-tier generator was package-only. Two th
   C# and Python ports already ejected their equivalents. What an adopter owns is the thin
   generator — which templates get a module, and where it lands; the module body comes from a
   public `render*` composer, and the render and extract ENGINES it calls stay core.
-- **What is still package-only says so.** `callable`, `trace-helper`, `requirement-tests`,
+- **What is still package-only says so.** `callable`, `trace-helper`,
   the `template` primitive, the docs tier (`docs`, `api-docs`, `mermaid-er`) and
   `shared-model` ship no TypeScript reference template. `meta gen --list` marks each
   `package-only`, its JSON row carries `source.kind: "package-only"`, and `meta eject` names
   such an entry as package-only rather than as an unknown name. They remain helpers in the
   sense of this amendment — what they write is not a guarantee — but "copy it and own it" is
-  not available for them until a reference template ships.
+  not available for them until a reference template ships. (2026-10-05: `requirement-tests`
+  was on this list and has left it. It now ships a reference template holding the generator
+  and its default stub renderer in one file, so `meta eject requirement-tests` copies both.)
 
 The "condition this depends on" paragraph above is also out of date: every port now has an
 eject command (`docs/features/own-your-codegen.md`, "Per port").
diff --git a/spec/decisions/ADR-0057-requirement-checks-and-tests-in-every-port.md b/spec/decisions/ADR-0057-requirement-checks-and-tests-in-every-port.md
new file mode 100644
index 000000000..90411c8d3
--- /dev/null
+++ b/spec/decisions/ADR-0057-requirement-checks-and-tests-in-every-port.md
@@ -0,0 +1,207 @@
+# ADR-0057: Requirement checks and requirement tests run in every port
+
+## Status
+
+**Accepted** (2026-10-05). Reverses the "Checks — TypeScript only, by decision" boundary stated
+in `docs/CONFORMANCE.md` ("Split coverage"), a decision that never had an ADR of its own.
+Registers no vocabulary: `metamodelVersion` stays `1.1` and
+`fixtures/registry-conformance/expected-registry.json` is untouched.
+[ADR-0015](ADR-0015-single-shared-migrate-engine.md) is unchanged.
+
+Contract tables, per-port work and the corpus case lists:
+[`docs/superpowers/plans/2026-10-05-requirements-slice-1-checks-and-test-generators.md`](../../docs/superpowers/plans/2026-10-05-requirements-slice-1-checks-and-test-generators.md).
+
+## Context
+
+A requirement (`requirement.functional`, `requirement.architectural`) is metadata, and all five
+ports load and validate it. Two things were built on top of that vocabulary, and both shipped in
+TypeScript only:
+
+- **The requirement gate.** `meta verify` checks that every claim resolves, that links sit at or
+  below the link floor, that nesting agrees with levels, that a live policy is applied to
+  something, and it reports the ledger on every run.
+- **The test scaffold.** `requirementTests()` emits one test stub per claim, which the project
+  fills in by hand and the three-way merge preserves.
+
+The split was a decision, recorded as one in two places: `docs/CONFORMANCE.md`, "Split
+coverage", quoted below, and `spec/capability-ledger.md`, in a section titled "The verify gate
+is TypeScript-only, on purpose" (`docs/features/requirements.md` and the pillar summaries stated
+the split without the reasoning):
+
+> *Checks — TypeScript only, by decision.* The `meta verify` diagnostics over requirements ship
+> in the TypeScript CLI; the other ports load and validate and stop there. Same call as ADR-0015:
+> one implementation of a build-time gate rather than five, where the gate is not a per-port
+> runtime concern.
+
+The reasoning was the one ADR-0015 applied to schema migrations. The gate reads canonical
+metadata, which is identical in every port, and prints diagnostics. A function with identical
+input and identical output wants one implementation, not five kept in agreement by a test suite.
+
+That reasoning does not carry over, for three reasons.
+
+1. **A requirement test is code in the project's own language.** ADR-0015 holds because a
+   migration's output is SQL, the same artifact whichever port the application is written in. A
+   test is not: a pytest project needs a pytest file, a JUnit project a JUnit class, an xUnit
+   project an xUnit class. One implementation of the scaffold serves one port by construction.
+2. **The scaffold needs the gate's machinery anyway.** Generating a test from a requirement
+   takes the same walk, the same address and the same claim resolver the gate uses. A port that
+   scaffolds tests therefore already holds everything the gate is built from, and a port that
+   generated tests from claims its own `verify` never checked would be scaffolding from a ledger
+   it had not validated.
+3. **Each port already runs a `verify` in the project's own build**, and already runs a shared
+   check there: the field authoring lint, held across the ports by
+   `fixtures/field-lint-conformance/`. The cost the original decision avoided, five
+   implementations drifting, has a remedy this repository already uses.
+
+## Decision
+
+The owner has ruled that **every language runs the requirement checks and scaffolds tests from
+requirements.** The clauses below are that ruling and the rulings that follow from it. None of
+them is open.
+
+### The gate
+
+1. **Every port's `verify` runs the requirement gate**, on every run and with no subverb:
+   `meta verify` (TypeScript), `metaobjects verify` (Python), `mvn metaobjects:verify` (Java and
+   Kotlin, which share the Maven goal) and `dotnet meta verify` (C#). The gate is implemented
+   per port, in the port's core library.
+2. **The gate is held to the TypeScript reference by a shared corpus**,
+   `fixtures/requirement-check-conformance/`. Its expectations are produced from the TypeScript
+   implementation and committed. A port that disagrees with a committed expectation is wrong
+   unless the reference is shown to be wrong first.
+3. **Diagnostic message text is pinned by that corpus**, with the code, the severity, the path
+   and the summary counts. The field-lint corpus already works this way.
+4. **The strict switch keeps the code and raises the severity.** A live functional requirement
+   that nothing implements is `WARN_REQUIREMENT_NOTHING_IMPLEMENTS` at severity `warn`. Under
+   `--require-implementers` (or `META_REQUIRE_IMPLEMENTERS=1`;
+   `-Dmeta.verify.requireImplementers=true` on the Maven goal) the same code is reported at
+   severity `error`. There is no new `ERR_` code.
+   The flag is not called `--strict`, because `verify` already has `--lax` on a different axis
+   (ADR-0023 attribute strictness) and a `--strict` beside it would read as that flag's opposite.
+5. **A model with no `requirement.*` node sees no change in any port**: no line printed, no
+   exit-code change, no file generated.
+
+### The generator
+
+6. **Every port ships a `requirement-tests` generator**: the existing TypeScript one, pytest for
+   Python, JUnit Jupiter for Java and for Kotlin, xUnit for C#. It is implemented per port.
+7. **The generator is held by a second shared corpus**,
+   `fixtures/requirement-test-identity-conformance/`. It pins the *identity* of every generated
+   test (its package, path, unit, id, witness key, status, skip state and digest), which is the
+   same in five ports. It does not pin emitted bytes, which are each port's own language.
+8. **Generated Java and Kotlin tests are JUnit Jupiter only.** A JUnit 4 project uses the
+   renderer hook or ejects the generator.
+9. **The digest covers six things**: subtype, level, status, statement, counterexample and the
+   `implementedBy` list. It does not cover the title, description, notes, disposition,
+   `trackedBy`, `supersededBy`, the name, the package or nested requirements. It answers "did the
+   claim change", not "did the entry move". It is written into the generated file, which is what
+   turns `verify --codegen` red when a claim changes.
+10. **The filter that selects which requirements get a test is uniform.** Every port offers the
+    same two options: a predicate over one shared *requirement view* (subtype, level, status,
+    path, effective package and the distinct concerns of the resolved targets), and a switch for
+    the warning that names what the filter excluded. With no predicate, the default is
+    functional requirements at level 4 and 5.
+11. **Generated tests import nothing from MetaObjects.** Python output imports `importlib` and
+    `pytest`; JVM output imports JUnit; C# output imports xUnit.
+
+### The witness model
+
+12. **Outside TypeScript the generated test file is fully machine-owned** and rewritten whole on
+    every run. No three-way merge is ported. Project code lives in a *witness*: a function the
+    project owns, which the generated test calls. A requirement that is live or partial and has
+    no witness is a failing test that names the function to write.
+13. **A JVM or .NET generated test finds its witness through a generated interface**, with one
+    member per test that is not skipped and a failing default for each. The project names one
+    class that implements it. There is no run-time lookup by name (ADR-0001). A requirement that
+    becomes live adds a failing default, which is a red test and not a compile break. A
+    requirement that is retired or deleted removes its member. Whether a witness left behind
+    then stops compiling depends on the language: always in Kotlin, where `override` is
+    mandatory; in Java only when the witness method carries `@Override`; in C# only when the
+    witness implements the member explicitly. A witness written in the other form goes stale
+    silently, and each generated header names the form that does not.
+14. **A Python generated test looks its witness up by name** in a configured module. Python has
+    no static binding to offer, and this is test code, so it is the one by-name lookup in the
+    design.
+15. **TypeScript keeps its own model**: hand-filled stubs, preserved by the three-way merge. The
+    witness model is not offered there.
+16. **The Python interpreter floor is documented, not lowered.** The tool needs Python 3.11 or
+    later to run. The tests it generates parse under the 3.9 grammar and need only pytest, so a
+    project on an older interpreter runs the tool with a different one.
+
+### What is a contract and what is a recommendation
+
+17. **The generator, its renderer and the witness model are a recommended approach, not a
+    contract.** The generator is a reference helper (ADR-0034 Amendment 3). It is ejectable in
+    every port through that port's existing eject mechanism (`meta eject`, `metaobjects eject`,
+    `mvn metaobjects:eject`, `dotnet meta eject`), and an application may change or replace its
+    copy freely.
+18. **The checks in `verify` stay stock.** They are not ejectable in any port, because they are
+    the shared contract.
+19. **`verify` still never reads test results.** The generator emits the tests, the codegen
+    drift gate proves the set matches the ledger, an unfilled live test fails, and the project's
+    own test run supplies "passing".
+
+## Consequences
+
+- **A change to a gate code, a message, the test identity or the digest is now a five-port
+  change with a corpus edit.** Rewording one diagnostic touches five implementations and the
+  committed expectations. That cost is the price of clause 3 and is accepted.
+- **The analogy with ADR-0015 no longer applies to requirements.** ADR-0015 itself is
+  unchanged: schema migrations stay owned by the TypeScript toolchain, for the reason that ADR
+  gives.
+- **The seven authoring-lint advisories stay TypeScript-only in this slice**, by the owner's
+  ruling. They never fail a build. Porting them is a follow-up slice. Until then the split is
+  narrower, not gone: the gate is in every port, its advisory lint is in one.
+- **A project that declares requirements on a non-TypeScript port will see diagnostics it did
+  not see before, and its `verify` may now fail.** That is the purpose of the change, and the
+  `CHANGELOG.md` entry for the release says so.
+- **JVM and .NET projects pay one setup cost.** The generated test module does not compile
+  until the project creates its witness class.
+- **A passing generated test proves that the witness ran**, not that the witness tests the
+  claim. The boundary `docs/features/requirements.md` draws under "What a green run does not
+  prove" still holds.
+- **TypeScript and the other four ports differ in how a project supplies its test body.**
+  TypeScript's emitted bytes do not change; its test names do not carry the package, and the
+  other ports' identities do.
+
+## Realization status
+
+Realized by the change this ADR was accepted with. All five ports run the gate in their
+`verify` and ship a `requirement-tests` generator, ejectable through each port's own mechanism.
+Both corpora are asserted by every port; Kotlin has no CLI of its own and takes the gate and the
+identity function from Java, with its emitted names asserted by its own generator test.
+`docs/CONFORMANCE.md`, `docs/features/requirements.md`, `spec/capability-ledger.md` and the
+pillar summaries were corrected in the same change and no longer state the TypeScript-only
+split.
+
+Two things remain TypeScript-only: the seven authoring-lint advisories (Consequences), and the
+structured `--format` payload of `verify`.
+
+## Alternatives considered
+
+- **Keep the checks TypeScript-only and have other ports run the Node CLI for them.** Rejected:
+  the scaffold cannot be single-port (Context, reason 1), and once a port has the scaffold's walk
+  and resolver the gate is a thin layer over them.
+- **A new `ERR_REQUIREMENT_NOTHING_IMPLEMENTS` code for the strict switch.** Rejected: one
+  finding under two codes splits every suppression, report and corpus case keyed on the code.
+  Object coverage already works the other way, with one code and a named severity constant.
+- **A run-time lookup by name for JVM and .NET witnesses, as Python does.** Rejected: it is
+  runtime reflection (ADR-0001), and a witness for a deleted requirement would go on existing
+  unnoticed. The interface makes that a compile error in Kotlin always, in Java when the
+  witness method carries `@Override`, and in C# when the witness implements the member
+  explicitly (clause 13).
+- **Port the three-way merge to four more languages.** Rejected: none of those ports has one,
+  and the witness model keeps hand-written code out of the generated file altogether.
+- **Emit JUnit 4 as well as Jupiter.** Rejected: the renderer hook and eject already cover a
+  JUnit 4 project, and a second stock output is a second thing to test and document in two ports.
+- **A digest over every attribute.** Rejected: an edit to a title, a note or a disposition would
+  turn every generated file stale without the claim having changed.
+- **Pin codes in the corpus and leave message text to each port.** Rejected: the message is what
+  an adopter reads, and unpinned prose is where the ports would drift first.
+- **Lower the Python floor to 3.9.** Rejected: the generated output already runs there, and the
+  tool can be run with a different interpreter than the project's own.
+- **Per-port filter options**, with the predicate offered in TypeScript and Python only.
+  Rejected by the owner: the filter is uniform.
+- **Make the generator's output a cross-port contract.** Rejected: it writes code into the
+  adopter's repository, which makes it a helper the adopter owns. The identities are pinned so
+  the ports agree on *what* is tested; how the test is written is the application's to change.
diff --git a/spec/decisions/README.md b/spec/decisions/README.md
index e7d1c17f0..44006d3ab 100644
--- a/spec/decisions/README.md
+++ b/spec/decisions/README.md
@@ -53,6 +53,7 @@ Write one when a decision is **cross-cutting** (affects more than one language p
 - [ADR-0054 — A `<type>.base` subtype is a registry anchor, not an authorable node](ADR-0054-base-subtypes-are-not-authorable.md) — *Accepted*
 - [ADR-0055 — Overlay application is a deferred pass — plain declarations first, then overlays, each in source order](ADR-0055-deferred-overlay-application.md) — *Accepted*
 - [ADR-0056 — A value object's type is generated once — the template tier references it](ADR-0056-value-object-types-are-generated-once.md) — *Accepted* (supersedes the payload-tier half of ADR-0044)
+- [ADR-0057 — Requirement checks and requirement tests run in every port](ADR-0057-requirement-checks-and-tests-in-every-port.md) — *Accepted* (reverses the "Checks — TypeScript only" split recorded in `docs/CONFORMANCE.md`)
 
 > **Index gap — ADR-0031 through ADR-0051 are on disk but not listed above.** The index stopped
 > being maintained after ADR-0030; the files are authoritative, this list is not. Read