fix(csharp): serialize a TPH collection by each row's runtime type

GET /<base> returns List<Base>, and System.Text.Json serializes a collection by
its DECLARED element type — so a discriminated-union list answered 200 with rows
quietly missing half their columns. Nothing errored.

A single-object read was unaffected, because ASP.NET falls back to the runtime
type when it differs from the declared one. That asymmetry is why this survived:
GET /parties/{id} showed a Broker's bondNumber while GET /parties did not, so
every by-id assertion passed and the shape looked right wherever anyone looked
at one row.

The base class now carries a [JsonDerivedType(typeof(<Sub>))] per concrete
subtype — declarative, so it also covers a base-typed collection nested inside
another response, which fixing only the list handler would not. No type
discriminator is configured, so NO $type key is emitted: the model already
carries @Discriminator as an ordinary property, and a second C#-only key would
be an addition to a cross-port wire contract. Deserializing into the base is not
something the generated routes do — an abstract base has no create/update
handler, and each subtype's handler deserializes that subtype directly.

Non-TPH entities are byte-identical; the committed integration fixture moves by
exactly the three attribute lines on Auth.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015NrWUxA6euwvnFcwKxcK6A

Author: dmealing

CHANGELOG.md

@@ -181,6 +181,17 @@ edit (two registered `description` strings) and was ruled a hold, as 1.0.4's was
   projection with no `@filterable` field gets an empty allowlist, exactly as an entity does,
   and the api-docs builder now documents the projection's Filter symbol.
 
+- **C#: a TPH base-path collection dropped every subtype field.** `GET /<base>` returns
+  `List<Base>`, and System.Text.Json serializes a collection by its DECLARED element type —
+  so a discriminated-union list answered 200 with rows quietly missing half their columns,
+  with nothing to error on. A single-object read was unaffected, because ASP.NET falls back
+  to the runtime type when it differs from the declared one, which is exactly why this
+  survived: `GET /parties/{id}` looked right while `GET /parties` did not. The base class now
+  carries a `[JsonDerivedType(typeof(<Sub>))]` per concrete subtype. **No `$type` key is
+  added** — the model already carries `@discriminator`, emitted as an ordinary property, and a
+  second C#-only key would be an addition to a cross-port wire contract. Non-TPH entities are
+  byte-identical.
+
 - **C#: a constraint violation answered 500 instead of 409.** A generated CRUD route had no
   try/catch around `SaveChangesAsync`, so a client-supplied foreign key naming no row, or a
   value duplicating a unique one, reached ASP.NET's default handler and came back as a bare

server/csharp/MetaObjects.Codegen.Tests/TphCodegenTests.cs

@@ -110,6 +110,53 @@ public void Entity_base_carries_table_and_discriminator_property()
         Assert.DoesNotContain("Quantity", auth);
     }
 
+    [Fact]
+    public void Entity_base_declares_its_subtypes_for_polymorphic_serialization()
+    {
+        // A LIST route returns List<Auth> whose elements are really subtypes.
+        // System.Text.Json serializes a collection by its DECLARED element type, so
+        // without this the subtype's own columns are silently dropped from every
+        // collection response — while a single-object read still shows them, because
+        // ASP.NET falls back to the runtime type when it differs from the declared one.
+        // A base-path list answering 200 with rows that quietly lack half their fields
+        // is the worst shape this can take: nothing errors.
+        //
+        // No type discriminator is configured: the model already HAS one
+        // (@discriminator), it is emitted as a normal property, and a second `$type`
+        // key would be a C#-only addition to a cross-port wire contract.
+        var auth = FileContent(new EntityGenerator().Generate(Ctx(Load())), "Auth.g.cs");
+
+        Assert.Contains("[System.Text.Json.Serialization.JsonDerivedType(typeof(BridgeAuth))]", auth);
+        Assert.Contains("[System.Text.Json.Serialization.JsonDerivedType(typeof(CopayAuth))]", auth);
+        Assert.Contains("[System.Text.Json.Serialization.JsonDerivedType(typeof(PriorAuthAuth))]", auth);
+        Assert.DoesNotContain("typeDiscriminator", auth);
+    }
+
+    [Fact]
+    public void A_non_tph_entity_declares_no_derived_types()
+    {
+        // The attribute is TPH-only: putting it on every entity would turn an ordinary
+        // class into a polymorphic root and change how it serializes.
+        const string flat = """
+        { "metadata.root": { "package": "acme", "children": [
+          { "object.entity": { "name": "Author", "children": [
+            { "source.rdb":       { "@table": "authors" } },
+            { "field.long":       { "name": "id" } },
+            { "identity.primary": { "@fields": "id" } }
+          ]}}
+        ]}}
+        """;
+        var r = new MetaDataLoader().Load([new InMemoryStringSource(flat, id: "flat.json")]);
+        Assert.Empty(r.Errors);
+        var ctx = new GenContext
+        {
+            Entities = r.Root.Objects(), Root = r.Root,
+            Config = new GenConfig { OutDir = "/tmp", Namespace = "Acme.Generated" },
+        };
+        Assert.DoesNotContain("JsonDerivedType",
+            FileContent(new EntityGenerator().Generate(ctx), "Author.g.cs"));
+    }
+
     [Fact]
     public void Entity_subtypes_extend_base_with_only_own_fields_and_no_table()
     {

server/csharp/MetaObjects.Codegen/Generators/EntityGenerator.cs

@@ -370,6 +370,27 @@ protected virtual void EmitClassHeader(
         if (!isProjection)
             sb.AppendLine($"[Table({CSharpNaming.NameRef(entity, ctx.Config.ColumnNamingStrategy, ctx.Config.IncludeNames, CSharpNaming.Table(entity))}"
                 + $"{CSharpNaming.TableSchemaArg(entity, ctx.Config.ColumnNamingStrategy, ctx.Config.IncludeNames)})]");
+        // FR-017 TPH — declare the concrete subtypes so System.Text.Json serializes each row
+        // by its RUNTIME type.
+        //
+        // A collection result is serialized by its DECLARED element type, so a base-path list
+        // returning List<Base> wrote only the base's properties and silently dropped every
+        // subtype column — a 200 whose rows are missing half their fields, with nothing to
+        // error on. (A single-object read was unaffected: ASP.NET falls back to the runtime
+        // type when it differs from the declared one, which is exactly why this survived —
+        // GET /parties/{id} looked right while GET /parties did not.)
+        //
+        // No type discriminator is configured, so NO `$type` key is emitted: the model
+        // already carries a discriminator (@discriminator) which is emitted as an ordinary
+        // property, and a second, C#-only key would be an addition to a cross-port wire
+        // contract. Deserialization into the BASE is not something the generated routes do —
+        // an abstract base has no create/update handler, and each subtype's handler
+        // deserializes that subtype directly.
+        if (TphPlanBuilder.For(entity, ctx.Root) is { } tphPlan)
+            foreach (var sub in tphPlan.Subtypes)
+                sb.AppendLine(
+                    $"[System.Text.Json.Serialization.JsonDerivedType(typeof({CSharpNaming.Pascal(sub.Entity.Name)}))]");
+
         // The `public [abstract] class <Name>[ : Base]` declaration line itself is routed
         // through the single overridable seam shared by all four emitted class kinds, so an
         // adopter's `partial`/marker-interface override applies uniformly. The EF mapping

server/csharp/MetaObjects.IntegrationTests/Generated/Auth.g.cs

@@ -9,6 +9,9 @@
 namespace MetaObjects.IntegrationTests.Generated;
 
 [Table(AuthNames.SourcePrimaryTable)]
+[System.Text.Json.Serialization.JsonDerivedType(typeof(BridgeAuth))]
+[System.Text.Json.Serialization.JsonDerivedType(typeof(CopayAuth))]
+[System.Text.Json.Serialization.JsonDerivedType(typeof(PriorAuthAuth))]
 public abstract class Auth
 {
     public enum AuthType { Bridge, Copay, PriorAuth }