Moltaro 0.0.14-beta

Release date: 2026-08-10

This release makes declarative Entity mutations deterministic across preview, save, reload, Package SDK writes, and concurrent authorization changes; enables trusted scheduled attachment imports; fixes generated workspace File and Markdown contracts; and localizes grid-selection accessibility in every supported language.

Highlights

• Declarative mutation effects now keep durable per-field ownership, evaluate ordered fallback sources consistently, and preserve the same result after a record is saved and reloaded.
• Reference values produced by defaults, calculations, and mutation effects arrive with actor-shaped display data, so forms apply IDs, labels, origins, and dependent clearing atomically without flashing raw identifiers or making one display lookup per generated value.
• Scheduled Package SDK attachment imports use durable, host-established trusted-system provenance. Worker verification rechecks the same Entity or Board policy without requiring a synthetic workspace user.
• Generated Workspace Contracts keep field-name ownership within the correct root or child-row CLR type, and generated Markdown saves write the visible text projection through the mapped EF property instead of a physical column name.
• Select-all and row-selection controls in shared grids expose localized, privacy-safe accessible names and state announcements in English, Ukrainian, German, Polish, and Spanish.

Detailed changes

Deterministic Entity mutations and Reference forms

• SetIfEmpty effects that target the same field are reevaluated as one ordered candidate chain. The first readable, non-empty source wins; empty or unavailable candidates cannot erase an earlier valid value. Overwrite keeps its independent trigger and global sort position, with effect ID as a stable tie-breaker.
• Effect-owned target field IDs are persisted on each Entity primary row. A later API save can therefore recalculate or clear only values still owned by effects, while a caller-provided or direct Package SDK value remains authoritative.
• Missing, archived, and unreadable referenced records share one outward non-resolved result. Mutation patches do not reveal which state occurred and do not leak hidden target values.
• Form evaluation returns canonical Reference IDs plus bounded display and projected behavior values in ReferencePatchValues. LoadingFieldKeys preserves authoritative server precedence while all direct drivers remain bound; breaking an intermediate driver still clears downstream values.
• Create flows distinguish editable caller-owned values from values owned by defaults, calculations, or mutation effects. Non-editable generated values may participate in eligibility; client attempts to supply those fields still fail validation.
• Entity writes, mutation-effect ownership, audit, outbox work, and pre-save-hook database work now share one transaction or savepoint boundary. Principal mutations serialize through the same workspace access-state lock and commit their cache-version change atomically, closing the post-commit stale-authorization window.
• Direct MoltaroDbContext.SaveChanges[Async] updates release stored effect ownership only for fields actually modified by package code. Direct-db saves deliberately do not execute dynamic mutation effects; application/API saves remain the authoritative mutation-effect path.

Scheduled attachments and file attribution

• Runtime-hosted scheduled attachment transfers persist HasTrustedSystemActorProvenance independently from actor and source-user strings. The reserved automation actor string alone grants no authority.
• Worker verification and publication reconstruct the runtime-owned trusted scope and repeat upload policy and Business Invariant checks before a file becomes available.
• BoardItem transfers use the existing Boards attachment placement and policy provider. Source creator metadata remains attribution only and must resolve to a real workspace user when supplied.
• File descriptor and reference modification/deletion attribution may now store the reserved system actor without requiring a corresponding auth.User row. Interactive user attribution remains unchanged.

Generated workspace and Package SDK contracts

• Workspace Contract generator 6.2.0 assigns CLR property names within each generated type. The root entity and separate child table row types may use the same field key without forcing unrelated property renames.
• Root EntityConfiguration<TEntity> metadata contains only primary-table fields and uses strongly typed property expressions. A generator/property mismatch now fails Diagnostics, Check, and Build instead of reaching the first runtime save.
• Markdown presentation processing now distinguishes the EF shadow-property name from its mapped PostgreSQL column. Generated package and Net Operation Project contexts update <Property>_$MarkdownVisibleText correctly and keep source plus projection in one save transaction.
• A generated-workspace File load scenario and focused contract tests cover repeated field keys, large generated schemas, File ownership, Markdown projection writes, and direct-db save semantics.

Grid accessibility and localization

• Shared selectable grids localize select-all, deselect-all, per-row selection, disabled-selection, and checked/unchecked/mixed announcements in all five supported locales.
• Row checkbox names use only server-shaped DisplayName or Number; arbitrary field values are never used because field access may hide them.
• Changing locale recreates AG Grid and reapplies controlled selection and grid settings so the accessibility tree cannot retain text from the previous language.
• Missing required selection translations fail closed to the translation key and emit a development diagnostic rather than silently exposing an English library fallback.

Security Statements readiness work

• Sprint 0 gained typed assignment, policy-revision, DSL profile, relational traversal, portability, deletion, concurrency, rollback, and acceptance evidence plus a focused PostgreSQL proof runtime.
• These commits validate and document a future destructive security cutover. They do not activate the planned Security Statements runtime or change the currently supported authorization model in this release; the latest review keeps Sprint 1 at No-Go until its remaining gates are closed.

Database and upgrade impact

Each Managed App Workspace database changes during its replacement window to record trusted-system upload provenance and mutation-effect field ownership. Existing uploads remain untrusted, and existing Entity rows begin with no owned fields; ownership is populated only by later authoritative saves. There is no PortalDb or bulk data rewrite. An incompatible pre-existing Entity field fails deployment closed. After the new attribution or ownership state is used, rollback requires the exact pre-release database backup with the previous runtime; an older runtime must not use the advanced schema.

Deployment and operator actions

• Publish 0.0.14-beta as a full Managed App runtime replacement. Do not create or apply a Managed App update package.
• Deploy Portal and regenerated public documentation from the same clean source revision, then replace API, WebApp, Worker, package runtime, and workspace schema for east sos 1, OMS, and Questionnaire.
• Verify the EF migration and the mutation-ownership column reconciliation in all three workspace databases before declaring each application ready.
• Rebuild existing Net Operation Projects against Workspace Contract generator 6.2.0 through the normal runtime artifact reconciliation path.
• Preserve existing managed S3 bindings, signer capabilities, secrets, runtime resource policy, and automatic backup schedule. This release adds no host configuration key and does not reintroduce ClamAV.
• Create the normal pre-release PortalDb recovery point. Do not delete Managed App backups, prior runtime artifacts, Docker tags, or recovery points automatically; report them for explicit manual dependency review.

Compatibility and breaking changes

• The workspace schema is forward-only for this replacement. Restoring the old runtime without its exact old database backup is unsupported after the new migration or ownership-column reconciliation is used.
• Form evaluation adds Reference display/hydration metadata without removing existing patch fields. Clients that ignore unknown response members remain compatible; generated clients should be refreshed to consume the new metadata and avoid per-reference display lookups.
• Package SDK direct-db writes now explicitly release declarative mutation-effect ownership for modified fields and do not execute configured effects. Package integrations that depended on undocumented direct execution must route that save through the application/API pipeline.
• Generated Workspace Contract output changes to generator 6.2.0; stored user source remains compatible, but generated artifacts must be rebuilt.
• Grid locale changes recreate the grid instance while restoring controlled state. Consumers of the shared grid require the five complete translation sets; there is no English fallback for missing accessibility strings.
• No supported Runtime API route, Portal API route, or Package SDK type was removed. The planned Security Statements cutover is not part of this release.
• The release-gate audit fixture now creates real Available file references when exercising File-field diffs. This keeps the test aligned with the existing pre-commit content-availability invariant without weakening that production validation.