fix(codegen): generated partial PATCH no longer clobbers omitted columns (C#, Kotlin)

The only generated update handler is a partial PATCH (both PATCH and PUT map to it),
but two ports overwrote every column a PATCH OMITTED — silent data loss on every
partial update, in shipped generated code:

  - C#  — the handler bound the body into a full `<Entity> input`; a field absent from
          the JSON deserialized to its CLR default (0 / null / false / DateTime.MinValue),
          and `CurrentValues.SetValues(input)` then wrote those defaults over the live
          row. `PATCH {"status":"ACTIVE"}` on a wide entity destroyed every other column.
  - Kotlin (base controller) — `it[field] = dto.field` for EVERY field, so an omitted
          optional field's null was written over the stored value.

TS (Zod `InsertSchema.partial()`), Java and Python (present-field merges in the
generated repositories / doubles) were already correct — so this is two ports, not one.
Each broken port already had the CORRECT logic in its own TPH branch (C#'s per-subtype
JSON-body enumeration; Kotlin's `if (dto.f != null)` guard); the base handlers just
didn't use it.

Fix:
  - C# base + TPH handlers deserialize each PRESENT property from the raw JSON body
    (skipping the PK, and — for the base — null values), using the app's CONFIGURED
    JsonSerializerOptions. The last point matters: a field.timestamp binds to
    DateTimeOffset via a custom converter registered on ConfigureHttpJsonOptions, and
    the first cut used default options, which can't read the wire format and 500'd (the
    TPH handler had the identical latent bug — also fixed).
  - Kotlin base controller null-guards OPTIONAL fields only. Required props are non-null
    (Jackson 400s a body missing them before the handler runs), so they stay
    unconditional — guarding them would be an always-true warning and break -Werror.

Contract: an omitted field always survives, in every port. Whether an EXPLICIT null
clears a nullable column (the absent-vs-null tristate) is deferred to FR-035.

Gate — the forcing function no existing scenario could provide: every prior update
scenario sent every non-PK column, so there was never an omitted field to clobber.
`fixtures/api-contract-conformance/scenarios/update-partial-omitted-field-survives.yaml`
PATCHes one field, OMITS the optional `bio`, and asserts (via the response AND a fresh
GET) that `bio` keeps its seed value. It runs on all five ports, both lanes (reference +
generated). Verified to FAIL on the pre-fix Kotlin generator with exactly
"expected row.bio=First computer programmer, got null" — and ONLY that scenario — then
pass after. All five ports: C# 22/22 (both lanes), Kotlin 22/22, Java 22/22, Python
44, TS both lanes.

Goldens updated (verified correct, not blind-regenerated): the C# routes unit test
pinned the old `(long id, Subscriber input, ...)` signature; the Kotlin snapshot changed
exactly one line (`it[label] = dto.label` → null-guarded, `label` being optional).

Design context for the broader work (typed patch surface, Kotlin repository generator,
optimistic concurrency) in docs/superpowers/specs/2026-07-13-generated-mutation-surface-design.md.
Its @rowVersion / ADR-0043 proposal is NOT adopted here: @autoset:onUpdate already models
"stamps on every write" and OMDB already derives its optimistic-lock column from it, so a
new attribute would violate ADR-0023 (can't-invent-what's-derivable) — a decision left to
the owner. Corrects GitHub #198; #197's premise was already refuted on that issue.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hd5NWZ1rKau63vJzrBSpLb

Author: dmealing

docs/superpowers/specs/2026-07-13-generated-mutation-surface-design.md

@@ -0,0 +1,47 @@
+name: update-partial-omitted-field-survives
+description: >
+  A partial PATCH must not clobber a field it OMITS. This sends only `name` (plus
+  the required `createdAt`, so DTO-binding ports don't 400 on a missing required
+  field) and OMITS the optional `bio`, then asserts — via the PATCH response AND a
+  fresh GET — that `bio` still holds its seed value.
+
+  This is the forcing function for a data-corruption bug that shipped in generated
+  code and no existing scenario could see: the only other update scenario
+  (update-patch-and-put) sends every non-PK column, so there was never an omitted
+  field to clobber. Two ports overwrote omitted columns with type defaults on every
+  partial update:
+    - C#  — the handler bound the body into a full entity (absent fields → CLR
+            defaults 0/null/false/MinValue) and CurrentValues.SetValues wrote them all.
+    - Kotlin (base controller) — `it[field] = dto.field` for EVERY field, so an
+            omitted optional field's null was written over the stored value.
+  TS (Zod .partial()), Java and Python (present-field merges) were already correct.
+
+  Contract asserted here: an omitted field survives, in every port. (Whether an
+  EXPLICIT null clears a column — the absent-vs-null tristate — is deferred to FR-035;
+  this scenario deliberately does not exercise it.)
+
+requests:
+  - id: r1
+    method: PATCH
+    path: /api/authors/1
+    body:
+      name: "Ada (name patched, bio omitted)"
+      createdAt: "2026-01-01T10:00:00"
+    expect:
+      status: 200
+      body:
+        row:
+          id: 1
+          name: "Ada (name patched, bio omitted)"
+          bio: "First computer programmer"      # omitted from the PATCH → must be untouched
+  # Re-read from the DB, not just the mutation's echo, to prove it PERSISTED.
+  - id: r2
+    method: GET
+    path: /api/authors/1
+    expect:
+      status: 200
+      body:
+        row:
+          id: 1
+          name: "Ada (name patched, bio omitted)"
+          bio: "First computer programmer"

fixtures/api-contract-conformance/scenarios/update-partial-omitted-field-survives.yaml

@@ -104,8 +104,11 @@ public void Routes_generator_emits_crud_endpoints()
         Assert.Contains("app.MapGet(prefix + \"/subscribers/{id}\", async (long id, AppDbContext db) =>", src);
         Assert.Contains("db.Subscribers.FindAsync(id)", src);
         Assert.Contains("app.MapPost(prefix + \"/subscribers\", async (Subscriber input, AppDbContext db) =>", src);
-        // PATCH + PUT share the same update handler (matches TS reference).
-        Assert.Contains("async System.Threading.Tasks.Task<IResult> UpdateSubscriber(long id, Subscriber input, AppDbContext db)", src);
+        // PATCH + PUT share the same update handler (matches TS reference). It takes the raw
+        // HttpContext (not a bound DTO) and PARTIAL-merges only the properties present in the
+        // JSON body — a bound DTO would fill omitted fields with CLR defaults and clobber them.
+        Assert.Contains("async System.Threading.Tasks.Task<IResult> UpdateSubscriber(long id, HttpContext http, AppDbContext db)", src);
+        Assert.Contains("foreach (var prop in body.RootElement.EnumerateObject())", src);
         Assert.Contains("app.MapPatch(prefix + \"/subscribers/{id}\", UpdateSubscriber);", src);
         Assert.Contains("app.MapPut(prefix + \"/subscribers/{id}\", UpdateSubscriber);", src);
         Assert.Contains("app.MapDelete(prefix + \"/subscribers/{id}\", async (long id, AppDbContext db) =>", src);

server/csharp/MetaObjects.Codegen.Tests/EntityGeneratorTests.cs

@@ -181,19 +181,45 @@ protected virtual EmittedFile GenerateStandardRoutes(MetaObject entity, GenConte
             sb.AppendLine("            return Results.Created(prefix + \"/" + route + "\", input);");
             sb.AppendLine("        });");
 
-            // PATCH + PUT share the same handler — TS reference exposes both verbs,
-            // and both return the updated row (HTTP 200), matching the cross-port
-            // api-contract. The route id is authoritative for the key: stamp it onto
-            // the bound input BEFORE SetValues so EF sees the primary key unchanged
-            // (a default/zero key on the input would otherwise trip "the property is
-            // part of a key and so cannot be modified").
+            // PATCH + PUT share the same handler — TS reference exposes both verbs, and both
+            // return the updated row (HTTP 200), matching the cross-port api-contract.
+            //
+            // A PARTIAL merge of the JSON body, NOT a full-row overwrite. The previous
+            // implementation bound the body into a `cls input` and called
+            // `CurrentValues.SetValues(input)` — but a field ABSENT from a PATCH body
+            // deserializes to its CLR default (0 / null / false / DateTime.MinValue), and
+            // SetValues then wrote those defaults over the live row. A `PATCH {"name":"x"}`
+            // on a wide entity silently DESTROYED every other column. So enumerate the JSON
+            // that was actually sent and set only those properties — the same present-field
+            // merge the TPH per-subtype handler already uses. The PK stays route-authoritative.
+            //
+            // Null-valued properties are skipped (write present-NON-null only), matching the
+            // Kotlin controller and the Java repository merge, so the five ports agree on the
+            // "omitted field survives" contract. Distinguishing an explicit `null` (clear the
+            // column) from an omitted field is the deferred tristate (FR-035).
             sb.AppendLine();
-            sb.AppendLine("        async System.Threading.Tasks.Task<IResult> Update" + cls + "(" + pkType + " id, " + cls + " input, AppDbContext db)");
+            sb.AppendLine("        async System.Threading.Tasks.Task<IResult> Update" + cls + "(" + pkType + " id, HttpContext http, AppDbContext db)");
             sb.AppendLine("        {");
             sb.AppendLine("            var existing = await db." + dbSet + ".FindAsync(id);");
             sb.AppendLine("            if (existing is null) return Results.NotFound(new { error = \"not_found\" });");
-            sb.AppendLine("            input." + pkProp + " = id;");
-            sb.AppendLine("            db.Entry(existing).CurrentValues.SetValues(input);");
+            sb.AppendLine("            using var body = await System.Text.Json.JsonDocument.ParseAsync(http.Request.Body);");
+            sb.AppendLine("            // Deserialize each value with the app's CONFIGURED JSON options, not defaults —");
+            sb.AppendLine("            // a field.timestamp binds to DateTimeOffset via a custom converter registered on");
+            sb.AppendLine("            // ConfigureHttpJsonOptions, and default options cannot read the wire format, throwing 500.");
+            sb.AppendLine("            var jsonOpts = ((Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Http.Json.JsonOptions>)");
+            sb.AppendLine("                http.RequestServices.GetService(typeof(Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Http.Json.JsonOptions>))!)");
+            sb.AppendLine("                .Value.SerializerOptions;");
+            sb.AppendLine("            var entry = db.Entry(existing);");
+            sb.AppendLine("            foreach (var prop in body.RootElement.EnumerateObject())");
+            sb.AppendLine("            {");
+            sb.AppendLine("                var target = entry.Metadata.FindProperty(prop.Name)");
+            sb.AppendLine("                    ?? entry.Metadata.GetProperties().FirstOrDefault(p => string.Equals(p.Name, prop.Name, System.StringComparison.OrdinalIgnoreCase));");
+            sb.AppendLine("                if (target is null) continue;");
+            sb.AppendLine("                if (target.IsPrimaryKey()) continue;                        // PK is route-authoritative");
+            sb.AppendLine("                if (prop.Value.ValueKind == System.Text.Json.JsonValueKind.Null) continue; // present-non-null (see note)");
+            sb.AppendLine("                var clr = System.Nullable.GetUnderlyingType(target.ClrType) ?? target.ClrType;");
+            sb.AppendLine("                entry.CurrentValues[target] = System.Text.Json.JsonSerializer.Deserialize(prop.Value.GetRawText(), clr, jsonOpts);");
+            sb.AppendLine("            }");
             sb.AppendLine("            await db.SaveChangesAsync();");
             sb.AppendLine("            return Results.Ok(existing);");
             sb.AppendLine("        }");
@@ -444,6 +470,11 @@ private static void AppendTphSubtypeRoutes(
         sb.AppendLine($"            var existing = await db.{dbSet}.OfType<{subCls}>().FirstOrDefaultAsync(x => x.{pkProp} == id);");
         sb.AppendLine("            if (existing is null) return Results.NotFound(new { error = \"not_found\" });");
         sb.AppendLine("            var body = await System.Text.Json.JsonDocument.ParseAsync(http.Request.Body);");
+        sb.AppendLine("            // Configured JSON options (not defaults) so a custom converter — e.g. the");
+        sb.AppendLine("            // field.timestamp DateTimeOffset converter — is honored; defaults throw 500 on it.");
+        sb.AppendLine("            var jsonOpts = ((Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Http.Json.JsonOptions>)");
+        sb.AppendLine("                http.RequestServices.GetService(typeof(Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Http.Json.JsonOptions>))!)");
+        sb.AppendLine("                .Value.SerializerOptions;");
         sb.AppendLine("            var entry = db.Entry(existing);");
         sb.AppendLine("            foreach (var prop in body.RootElement.EnumerateObject())");
         sb.AppendLine("            {");
@@ -455,7 +486,7 @@ private static void AppendTphSubtypeRoutes(
         sb.AppendLine("                var clr = System.Nullable.GetUnderlyingType(target.ClrType) ?? target.ClrType;");
         sb.AppendLine("                object? value = prop.Value.ValueKind == System.Text.Json.JsonValueKind.Null");
         sb.AppendLine("                    ? null");
-        sb.AppendLine("                    : System.Text.Json.JsonSerializer.Deserialize(prop.Value.GetRawText(), clr);");
+        sb.AppendLine("                    : System.Text.Json.JsonSerializer.Deserialize(prop.Value.GetRawText(), clr, jsonOpts);");
         sb.AppendLine("                entry.CurrentValues[target] = value;");
         sb.AppendLine("            }");
         sb.AppendLine("            await db.SaveChangesAsync();");

server/csharp/MetaObjects.Codegen/Generators/RoutesGenerator.cs

@@ -359,7 +359,18 @@ open class KotlinSpringControllerGenerator : MultiFileDirectGeneratorBase<MetaOb
             for (field in entity.metaFields) {
                 if (field is ObjectField || field is MapField) continue
                 if (field.name == pkFieldName) continue
-                append("            it[${field.name}] = dto.${field.name}\n")
+                // Partial merge: an OPTIONAL field omitted from a PATCH must not clobber the
+                // stored value. Optional DTO props are nullable + default to null, so absent
+                // reads as null here — null-guard them (the same merge the TPH per-subtype
+                // handler uses). Required props are non-null (Jackson rejects a body missing
+                // them with a 400 before this runs), so they are always present → written
+                // unconditionally. Guarding a non-null prop would be an always-true warning
+                // and break -Werror consumers. (Explicit-null-clears is the deferred tristate.)
+                if (KotlinGenUtil.isRequiredField(field)) {
+                    append("            it[${field.name}] = dto.${field.name}\n")
+                } else {
+                    append("            if (dto.${field.name} != null) it[${field.name}] = dto.${field.name}\n")
+                }
             }
             append("        }\n")
             append("        if (updated == 0) ResponseEntity.status(HttpStatus.NOT_FOUND).body(mapOf(\"error\" to \"not_found\") as Any)\n")

server/java/codegen-kotlin/src/main/kotlin/com/metaobjects/generator/kotlin/KotlinSpringControllerGenerator.kt

@@ -282,7 +282,7 @@ class AuthLineController {
     @RequestMapping(value = ["/{id}"], method = [RequestMethod.PATCH, RequestMethod.PUT])
     fun update(@PathVariable id: Long, @Valid @RequestBody dto: AuthLine): ResponseEntity<Any> = transaction {
         val updated = AuthLineTable.update({ AuthLineTable.id eq id }) {
-            it[label] = dto.label
+            if (dto.label != null) it[label] = dto.label
         }
         if (updated == 0) ResponseEntity.status(HttpStatus.NOT_FOUND).body(mapOf("error" to "not_found") as Any)
         else {