fix(cli): verify --templates drift-checks template.output bodies cross-port (#193)

Java (TemplateVerify) and C# (VerifyCommand) skipped template.output body drift
entirely — they did a payload-ref-resolution-only check then continue'd, so a
mustache {{field}} that drifted from its @payloadRef passed `verify` and only
failed later at gen time (ERR_VAR_NOT_ON_PAYLOAD); @kind=email outputs were never
checked at all. Both ports now resolve every renderable body ref and run the
render Verify engine per ref, mirroring the gen-time render-helper and the TS
reference (4c90504): document output -> @textRef; email output -> @subjectRef +
@htmlBodyRef + optional @textBodyRef; prompt -> @textRef (with required slots/tags,
which stay prompt-only).

C# also switches the loop's attr reads from OwnAttr to resolving Attr (ADR-0039:
template attrs may be inherited via extends).

Python was already correct (its _verify_templates iterates all four text-ref
attrs) — added @kind=email clean/drift regression tests to lock the parity
(document output was already covered).

Per-port CLI tests added (email clean/drift + document body drift). The one C#
test asserting "output passes without a template file on disk" encoded the pre-fix
bug (a document @textRef is now walked, so its body must resolve) — corrected to
write a clean body and renamed.

Verified: Java TemplateVerifyTest 8/8 + MetaDataVerifyTemplatesModeTest 7/7;
C# Cli.Tests 45/45; Python test_cli_verify_subverbs 12/12.

Refs #193.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XeGSV3StPCcJGZNNJ4ZfAb

Author: dmealing

server/csharp/MetaObjects.Cli.Tests/VerifyCommandTests.cs

@@ -41,6 +41,15 @@ private void WriteTemplate(string body)
         File.WriteAllText(Path.Combine(dir, "main.mustache"), body);
     }
 
+    // Write a template body at an arbitrary 2-layer ref (group/source) → <ref>.mustache.
+    private void WriteAt(string reference, string body)
+    {
+        var full = Path.Combine(TplDir,
+            reference.Replace('/', Path.DirectorySeparatorChar) + ".mustache");
+        Directory.CreateDirectory(Path.GetDirectoryName(full)!);
+        File.WriteAllText(full, body);
+    }
+
     [Fact]
     public void Clean_template_passes()
     {
@@ -98,11 +107,10 @@ public void Prompt_findings_are_tagged_with_prompt_kind()
     // -------------------- template.output (FR6, ADR-0010) --------------------
 
     [Fact]
-    public void Output_with_resolved_payload_ref_passes_without_a_template_file()
+    public void Output_document_body_passes_when_clean()
     {
-        // template.output's parser is schema-derived from the payload VO; it does
-        // not require a @textRef-resolved template body. A clean payload-VO should
-        // pass even when no template file is on disk.
+        // A document template.output's @textRef body is drift-checked (parity with
+        // prompt, #193): a clean body referencing only payload fields passes.
         const string outputModel = """
         { "metadata.root": { "package": "acme::ai", "children": [
           { "object.value": { "name": "NpcResponsePayload", "children": [
@@ -114,11 +122,66 @@ public void Output_with_resolved_payload_ref_passes_without_a_template_file()
         ]}}
         """;
         File.WriteAllText(Path.Combine(MetaDir, "meta.ai.json"), outputModel);
+        WriteAt("npc/output", "{{name}} is {{age}}");
         var o = VerifyCommand.Run(MetaDir, TplDir);
         Assert.True(o.Ok, string.Join("; ",
             o.LoadErrors.Concat(o.UnresolvedText).Concat(o.Errors.Select(e => $"{e.Kind}/{e.Code}({e.Path})"))));
     }
 
+    // ---------- #193: template.output bodies are drift-checked (parity with prompt) ----------
+
+    private const string EmailModel = """
+    { "metadata.root": { "package": "acme::ai", "children": [
+      { "object.value": { "name": "P", "children": [ { "field.string": { "name": "name" } } ] } },
+      { "template.output": { "name": "Welcome", "@kind": "email",
+        "@payloadRef": "P", "@subjectRef": "e/subj", "@htmlBodyRef": "e/html" } }
+    ]}}
+    """;
+
+    [Fact]
+    public void Output_email_clean_passes()
+    {
+        File.WriteAllText(Path.Combine(MetaDir, "meta.ai.json"), EmailModel);
+        WriteAt("e/subj", "Hello {{name}}");
+        WriteAt("e/html", "<p>Hi {{name}}</p>");
+        var o = VerifyCommand.Run(MetaDir, TplDir);
+        Assert.True(o.Ok, string.Join("; ",
+            o.LoadErrors.Concat(o.UnresolvedText).Concat(o.Errors.Select(e => $"{e.Kind}/{e.Code}({e.Path})"))));
+    }
+
+    [Fact]
+    public void Output_email_body_drift_is_caught()
+    {
+        File.WriteAllText(Path.Combine(MetaDir, "meta.ai.json"), EmailModel);
+        WriteAt("e/subj", "Hello {{name}}");
+        WriteAt("e/html", "<p>Hi {{nope}}</p>"); // {{nope}} is not on payload P
+        var o = VerifyCommand.Run(MetaDir, TplDir);
+        Assert.False(o.Ok);
+        Assert.Contains(o.Errors, d =>
+            d.Kind == VerifyCommand.KIND_OUTPUT &&
+            d.Code == Render.Verify.ERR_VAR_NOT_ON_PAYLOAD &&
+            d.Path == "nope");
+    }
+
+    [Fact]
+    public void Output_document_body_drift_is_caught()
+    {
+        const string docModel = """
+        { "metadata.root": { "package": "acme::ai", "children": [
+          { "object.value": { "name": "P", "children": [ { "field.string": { "name": "name" } } ] } },
+          { "template.output": { "name": "Doc", "@format": "json", "@payloadRef": "P", "@textRef": "t/main" } }
+        ]}}
+        """;
+        File.WriteAllText(Path.Combine(MetaDir, "meta.ai.json"), docModel);
+        WriteTemplate("spec for {{nope}}"); // {{nope}} is not on payload P → document-body drift
+        var o = VerifyCommand.Run(MetaDir, TplDir);
+        Assert.False(o.Ok);
+        Assert.Contains(o.Errors, d =>
+            d.Kind == VerifyCommand.KIND_OUTPUT &&
+            d.Code == Render.Verify.ERR_VAR_NOT_ON_PAYLOAD &&
+            d.Path == "nope");
+    }
+
     [Fact]
     public void Output_with_unresolved_payload_ref_is_flagged_as_output_drift()
     {

server/csharp/MetaObjects.Cli/VerifyCommand.cs

@@ -2,14 +2,15 @@
 // extended to template.output by FR6, ADR-0010).
 //
 // Loads metadata from a directory; for each template node derives the
-// @payloadRef view-object's field tree and dispatches on subtype:
+// @payloadRef view-object's field tree, resolves every renderable body ref via a
+// filesystem provider, and runs the engine's Verify on each (template variable ↔
+// payload field drift, unresolved partials, and — prompts only — missing output
+// tags). The body refs are subtype-/kind-aware, mirroring the gen-time
+// render-helper so verify and gen agree (#193):
 //
-//   template.prompt — resolves @textRef via a filesystem provider and runs the
-//                     engine's Verify (template variable ↔ payload field drift,
-//                     unresolved partials, missing output tags).
-//   template.output — payload-VO resolution check only (the generator derives
-//                     the parser schema from the same VO, so any field-tree
-//                     drift surfaces here as well as at gen time).
+//   template.prompt                    — @textRef (WITH @requiredSlots/@requiredTags).
+//   template.output document (default) — @textRef.
+//   template.output @kind=email        — @subjectRef + @htmlBodyRef + optional @textBodyRef.
 //
 // Runs at the last fixed point before serve, never on the request path.
 
@@ -244,6 +245,12 @@ private static Codegen.CodegenDrift.Result RunCodegenDrift(Options opts)
         _ => [],
     };
 
+    /// <summary>Append a non-blank string attr value to a ref list.</summary>
+    private static void AddIfPresent(List<string> refs, object? attr)
+    {
+        if (attr is string s && s.Length > 0) refs.Add(s);
+    }
+
     public static Outcome Run(string metadataDir, string templatesRoot, bool strict = true)
     {
         var load = MetaDataLoader.FromDirectory(metadataDir, strict: strict);
@@ -256,11 +263,13 @@ public static Outcome Run(string metadataDir, string templatesRoot, bool strict
 
         foreach (var tmpl in load.Root.OwnChildren().Where(c => c.Type == TYPE_TEMPLATE))
         {
-            // Missing @payloadRef is already a load error (template schema requires it).
-            if (tmpl.OwnAttr(TEMPLATE_ATTR_PAYLOAD_REF) is not string payloadRef)
+            // ADR-0039: @payloadRef may be inherited via an abstract template (templates
+            // CAN extend) → resolving Attr, not OwnAttr. Missing is a load error already.
+            if (tmpl.Attr(TEMPLATE_ATTR_PAYLOAD_REF) is not string payloadRef)
                 continue;
 
-            var kind = tmpl.SubType == TEMPLATE_SUBTYPE_OUTPUT ? KIND_OUTPUT : KIND_PROMPT;
+            var isOutput = tmpl.SubType == TEMPLATE_SUBTYPE_OUTPUT;
+            var kind = isOutput ? KIND_OUTPUT : KIND_PROMPT;
 
             // Both subtypes: @payloadRef must resolve to a loaded object.value (=>
             // non-empty derived field tree). Catches a renamed VO before codegen.
@@ -271,40 +280,62 @@ public static Outcome Run(string metadataDir, string templatesRoot, bool strict
                 continue;
             }
 
-            if (tmpl.SubType == TEMPLATE_SUBTYPE_OUTPUT)
+            // Collect every renderable body ref, mirroring the gen-time render-helper
+            // gate so verify and gen agree (#193):
+            //   template.prompt                    → @textRef (WITH required slots/tags).
+            //   template.output document (default) → @textRef.
+            //   template.output @kind=email        → @subjectRef + @htmlBodyRef + optional @textBodyRef.
+            var refs = new List<string>();
+            IReadOnlyList<string> requiredSlots = [];
+            IReadOnlyList<string> requiredTags = [];
+            if (isOutput)
             {
-                // Output's parser schema is derived from the same VO that drives prompt
-                // rendering — payload-VO resolution above covers FR6's drift contract.
-                // No @textRef walk: output templates may not carry one (the parser is
-                // schema-driven), and the generator surfaces gen-time issues directly.
-                continue;
+                var outKind = ((tmpl.Attr(TEMPLATE_ATTR_KIND) as string) ?? TEMPLATE_KIND_DEFAULT).ToLowerInvariant();
+                if (outKind == TEMPLATE_KIND_EMAIL)
+                {
+                    AddIfPresent(refs, tmpl.Attr(TEMPLATE_ATTR_SUBJECT_REF));
+                    AddIfPresent(refs, tmpl.Attr(TEMPLATE_ATTR_HTML_BODY_REF));
+                    AddIfPresent(refs, tmpl.Attr(TEMPLATE_ATTR_TEXT_BODY_REF));
+                }
+                else
+                {
+                    AddIfPresent(refs, tmpl.Attr(TEMPLATE_ATTR_TEXT_REF));
+                }
             }
-
-            // template.prompt branch — existing Mustache + tag/slot checks.
-            if (tmpl.OwnAttr(TEMPLATE_ATTR_TEXT_REF) is not string textRef)
-                continue;
-
-            var text = provider.Resolve(textRef);
-            if (text is null)
+            else
             {
-                unresolved.Add($"template \"{tmpl.Name}\": @textRef \"{textRef}\" did not resolve under {templatesRoot}");
-                continue;
+                AddIfPresent(refs, tmpl.Attr(TEMPLATE_ATTR_TEXT_REF));
+                // Slot/tag requirements are a template.prompt concept; the email/document
+                // gate does NOT apply them per part (they would false-flag a slot as
+                // unused in each part). So only the prompt path carries them.
+                requiredSlots = AsStringList(tmpl.Attr(TEMPLATE_ATTR_REQUIRED_SLOTS));
+                requiredTags = AsStringList(tmpl.Attr(TEMPLATE_ATTR_REQUIRED_TAGS));
             }
 
-            var requiredSlots = AsStringList(tmpl.OwnAttr(TEMPLATE_ATTR_REQUIRED_SLOTS));
-            var requiredTags = AsStringList(tmpl.OwnAttr(TEMPLATE_ATTR_REQUIRED_TAGS));
+            // No renderable body ref present — a loader-schema concern, not verify's
+            // (a well-formed output always carries one; document→@textRef, email→subject+html).
+            if (refs.Count == 0) continue;
 
             var verifyOptions = new VerifyOptions
             {
                 Provider = provider,
                 RequiredSlots = requiredSlots,
                 RequiredTags = requiredTags,
             };
-            foreach (var e in Verify.Check(text, fields, verifyOptions))
+            foreach (var reference in refs)
             {
-                var drift = new Drift(tmpl.Name, kind, e.Code, e.Path);
-                if (e.Code == Verify.ERR_REQUIRED_SLOT_UNUSED) warnings.Add(drift);
-                else errors.Add(drift);
+                var text = provider.Resolve(reference);
+                if (text is null)
+                {
+                    unresolved.Add($"template \"{tmpl.Name}\": ref \"{reference}\" did not resolve under {templatesRoot}");
+                    continue;
+                }
+                foreach (var e in Verify.Check(text, fields, verifyOptions))
+                {
+                    var drift = new Drift(tmpl.Name, kind, e.Code, e.Path);
+                    if (e.Code == Verify.ERR_REQUIRED_SLOT_UNUSED) warnings.Add(drift);
+                    else errors.Add(drift);
+                }
             }
         }
 

server/java/codegen-base/src/main/java/com/metaobjects/generator/verify/TemplateVerify.java

@@ -31,14 +31,16 @@
  *   <li>derives the {@code @payloadRef} value-object's {@link PayloadField} field
  *       tree (the SAME walk {@code SpringRenderHelperGenerator} uses — object-ref
  *       fields recurse, cycle-guarded — so the build-time gate and this check agree),</li>
- *   <li>for {@code template.output}: a payload-resolution-only check (the parser
- *       schema is derived from the same VO; field-tree drift surfaces here AND at
- *       gen time),</li>
- *   <li>for {@code template.prompt}: resolves {@code @textRef} through a
- *       {@link FilesystemProvider} rooted at the on-disk template dir and runs the
- *       render {@link Verify} engine — reporting {@code {{field}}}↔payload drift,
- *       unresolved partials, and missing required output tags. {@code @requiredSlots}
- *       that are never referenced are warnings (not failures).</li>
+ *   <li>resolves every renderable body ref through a {@link FilesystemProvider}
+ *       rooted at the on-disk template dir and runs the render {@link Verify} engine
+ *       against each — reporting {@code {{field}}}↔payload drift, unresolved partials,
+ *       and (prompts only) missing required output tags. The body refs are
+ *       subtype-/kind-aware, mirroring the gen-time render-helper (#193):
+ *       {@code template.prompt} → {@code @textRef} (with {@code @requiredSlots}/
+ *       {@code @requiredTags}); {@code template.output} document → {@code @textRef};
+ *       {@code template.output @kind=email} → {@code @subjectRef} + {@code @htmlBodyRef}
+ *       + optional {@code @textBodyRef}. {@code @requiredSlots} never referenced are
+ *       warnings (not failures).</li>
  * </ol>
  *
  * <p><b>Reuse, not reimplementation</b>: the actual drift logic is the render
@@ -114,33 +116,52 @@ public static Outcome run(MetaDataLoader loader, Path templateRoot) {
                 continue;
             }
 
+            // Collect every renderable body ref for this template, mirroring the
+            // gen-time render-helper drift gate so `verify` and `gen` agree (#193):
+            //   template.prompt                    → @textRef (WITH required slots/tags).
+            //   template.output document (default) → @textRef.
+            //   template.output @kind=email        → @subjectRef + @htmlBodyRef + optional @textBodyRef.
+            List<String> refs = new ArrayList<>();
+            List<String> requiredSlots = null;
+            List<String> requiredTags = null;
             if (isOutput) {
-                // Output's parser schema is derived from the same VO that drives prompt
-                // rendering — payload-VO resolution above covers the drift contract.
-                // No @textRef walk: output templates may not carry one (the parser is
-                // schema-driven), and the generator surfaces gen-time issues directly.
-                continue;
-            }
-
-            // template.prompt branch — Mustache + tag/slot checks via the render engine.
-            String textRef = tmpl.getTextRef();
-            if (textRef == null || textRef.isEmpty()) continue;
-
-            String text = provider.resolve(textRef);
-            if (text == null) {
-                unresolved.add("template \"" + tmpl.getName() + "\": @textRef \"" + textRef
-                        + "\" did not resolve under " + templateRoot);
-                continue;
+                String outKind = attrString(tmpl, TemplateConstants.ATTR_KIND);
+                outKind = (outKind == null ? TemplateConstants.KIND_DEFAULT : outKind)
+                        .toLowerCase(java.util.Locale.ROOT);
+                if (TemplateConstants.KIND_EMAIL.equals(outKind)) {
+                    addIfPresent(refs, attrString(tmpl, TemplateConstants.ATTR_SUBJECT_REF));
+                    addIfPresent(refs, attrString(tmpl, TemplateConstants.ATTR_HTML_BODY_REF));
+                    addIfPresent(refs, attrString(tmpl, TemplateConstants.ATTR_TEXT_BODY_REF));
+                } else {
+                    addIfPresent(refs, tmpl.getTextRef());
+                }
+            } else {
+                addIfPresent(refs, tmpl.getTextRef());
+                // Slot/tag requirements are a template.prompt concept; the email/document
+                // gate does NOT apply them per part (they would false-flag a slot as
+                // unused in each part). So only the prompt path carries them.
+                requiredSlots = tmpl instanceof PromptTemplate p ? p.getRequiredSlots() : null;
+                requiredTags = tmpl.getRequiredTags();
             }
 
-            List<String> requiredSlots = tmpl instanceof PromptTemplate p ? p.getRequiredSlots() : null;
-            List<String> requiredTags = tmpl.getRequiredTags();
+            // No renderable body ref present — a loader-schema concern, not verify's
+            // (a well-formed output always carries one; document→@textRef, email→subject+html).
+            if (refs.isEmpty()) continue;
 
             VerifyOptions opts = new VerifyOptions(provider, requiredSlots, requiredTags);
-            for (VerifyError e : Verify.check(text, fields, opts)) {
-                Drift drift = new Drift(tmpl.getName(), kind, e.code(), e.path());
-                if (Verify.ERR_REQUIRED_SLOT_UNUSED.equals(e.code())) warnings.add(drift);
-                else errors.add(drift);
+            for (String ref : refs) {
+                // Render-engine drift check: mustache variables ↔ payload field names.
+                String text = provider.resolve(ref);
+                if (text == null) {
+                    unresolved.add("template \"" + tmpl.getName() + "\": ref \"" + ref
+                            + "\" did not resolve under " + templateRoot);
+                    continue;
+                }
+                for (VerifyError e : Verify.check(text, fields, opts)) {
+                    Drift drift = new Drift(tmpl.getName(), kind, e.code(), e.path());
+                    if (Verify.ERR_REQUIRED_SLOT_UNUSED.equals(e.code())) warnings.add(drift);
+                    else errors.add(drift);
+                }
             }
         }
 
@@ -202,6 +223,20 @@ private static MetaObject resolveNestedObjectRef(MetaDataLoader loader, ObjectFi
         return null;
     }
 
+    /**
+     * Resolving read of a string attr (ADR-0039: template attrs may be inherited via
+     * {@code extends} — templates CAN extend). Returns null when absent or blank.
+     */
+    private static String attrString(com.metaobjects.MetaData md, String name) {
+        // Raw resolving read (blank-guarding lives in addIfPresent, matching the C# port).
+        return md.hasMetaAttr(name) ? md.getMetaAttr(name).getValueAsString() : null;
+    }
+
+    /** Append a non-blank ref to the list. */
+    private static void addIfPresent(List<String> refs, String ref) {
+        if (ref != null && !ref.isEmpty()) refs.add(ref);
+    }
+
     /** Resolve {@code @payloadRef} to its {@code object.value} target (rejects entities). */
     private static MetaObject resolveValueObject(MetaDataLoader loader, String ref) {
         for (MetaObject obj : loader.getMetaObjects()) {