Moltaro 0.0.18-beta

Release date: 2026-08-13

This release adds governed Manual Order, deterministic fuzzy duplicate detection, conditional mutation effects, safer long-running file and function operations, and more useful date and action-input defaults across Moltaro’s runtime, administration, and developer surfaces.

Highlights

• Record types can opt into one durable Manual Order shared by Flat and Parent Tree View tables, with accessible pointer, keyboard, and mobile move flows, authorization-aware validation, realtime refresh, and semantic audit history.
• Duplicate-detection profiles can combine exact guards with bounded, Unicode-aware fuzzy String/Text matching and review durable full-scan pairs without automatically merging or deleting records.
• Mutation effects can use an optional typed ApplyWhen condition, allowing declarative value-copy rules to run only for the intended create/update state.
• Function operations now preserve retry policy per job, fence every execution attempt, reconcile Job/Run state safely after failures, and let administrators stop an entire retry chain from the operations UI.
• Managed-file uploads can resume an expired physical attempt under the same logical idempotency key, and trusted packages can atomically reassign an available attachment without copying its body.
• Empty Date inputs can open at today, a fixed year, or a relative year without setting a value; create forms also preview CurrentDate defaults in the workspace time zone until the user changes or clears them.

Detailed changes

Record ordering and runtime tables

• Owners and administrators can enable Manual Order for an ordinary data Entity Definition and optionally make it the default sort. Existing records receive one canonical order only when the capability is activated.
• Flat lists move records before or after another record. Parent Tree View also supports sibling placement, reparenting as the last child, and root/sibling start or end placement. Parent and position changes commit atomically.
• Move controls remain available only for an active, unfiltered, ascending Manual Order projection and an actor who may update the row. Access, hierarchy, Reference Eligibility, business invariants, mutation effects, and package concurrency rules are rechecked by the server before commit.
• Realtime refresh preserves valid selection, expansion, focus, scroll, and query state across Data Explorer, picker/Lookup, Details, Drawer, and related table hosts. Audit Trail records one semantic move without exposing internal rank values.
• Entity Definition YAML version 6 and the Package SDK can declare Manual Order and typed table/tree selectors. Protected rank storage and direct move services remain platform-owned and are not exported to clients or packages.
• New reference columns on Table surfaces now start with a server-approved renderer, stale overrides are sanitized, and the selected renderer survives save, reload, and API read-back.

Duplicate detection

• Exact-normalized rules remain supported. A fuzzy rule can add exact guard fields and one or more String/Text comparisons with bounded edit distance, minimum length, weight, diacritic handling, and ordered or order-independent tokens.
• Fuzzy results are deterministic pairs rather than transitive clusters. The review UI reports safe distance, threshold, similarity, weight, and effective score evidence without returning raw or normalized matching values.
• Details checks cover the complete actor-visible scope within a bounded interactive budget. Table previews stay intentionally partial; users can enqueue a durable full scan and later recover its queued, running, completed, failed, or cancelled state.
• Execution, comparison, memory, result-count, and value-length budgets fail closed without publishing partial or privacy-sensitive results. Saved results are invalidated when access, matching configuration, entity definition, or a candidate record changes.
• Matching profiles, including fuzzy field settings, round-trip through Entity Definition YAML. Existing exact profiles remain exact and are not silently converted.

Declarative logic and action inputs

• Mutation effects accept an optional ApplyWhen Boolean expression over supported scalar fields, operation mode, and one direct Reference hop. The condition is compiled and evaluated consistently for form preview and final save before the effect source is resolved.
• Conditions participate in dependency and cycle validation, use actor-shaped reference reads, and fail the complete preview/save when persisted metadata is invalid. Hidden or inaccessible referenced state cannot leak through patches, labels, warnings, or fallback selection.
• C# Actions can declare visible Boolean and Select defaults through the Package SDK. Defaults are versioned schema metadata and are submitted even when the user does not touch the control; absent fields still remain distinct from an explicit null.
• Action-input discovery now rejects ambiguous, renamed, ignored, or non-bindable configured properties and sanitizes deserialization failures. Sensitive inputs cannot declare defaults.

Function, board, and file operations

• Every queued function job snapshots its retry limit and delay. Attempt-scoped leases, run correlation, heartbeats, terminal evidence, cancellation, and recovery prevent a stale worker or ambiguous database acknowledgement from replaying potentially committed business effects.
• A job reaches Completed only after a matching terminal successful or skipped run is durable. Ambiguous or incomplete evidence fails closed, while recovery can reconcile a confirmed outcome without executing business logic again.
• Administrators can use Stop retries for a whole active retry chain. Disabling or deleting a schedule prevents new occurrences but no longer silently cancels a job that was already created.
• Board activation and active-configuration changes now use governance barriers coordinated with Entity mutations. Large active boards validate governing invariants in bounded batches and roll back activation on the first failure.
• Trusted package code can reassign one available attachment between supported owners with a stable operation id and optimistic row version. The descriptor, provider object, bytes, checksum, and upload attribution remain unchanged; authorization, active uploads, holds, field bindings, invariants, and target filename conflicts are enforced before commit.
• A logical managed-file upload can create exactly one successor physical session after expiry when the caller repeats the same stream operation with unchanged identity, metadata, idempotency key, and requested reference. Abort and rejection remain terminal, while an already published result replays without uploading again.

Forms and dates

• Form Date fields can configure the initial empty-calendar anchor as the workspace’s current year, a fixed year, or a relative year. This presentation setting does not fill the field, dirty the form, or bypass date constraints.
• CurrentDate defaults appear as editable workspace-local previews in root and child create forms. The server still owns the default until the user changes or clears it, and an open create surface refreshes at workspace midnight.

Database and upgrade impact

The Workspace schema changes add configuration and operational state for Manual Order, fuzzy matching, conditional effects, function-attempt consistency, retry-chain control, attachment reassignment, durable upload attempts, and Date calendar anchors. Portal has no schema change. The upgrade performs no bulk rewrite of customer records or file bodies: existing matching profiles remain exact, legacy jobs and upload sessions are adopted lazily, and Manual Order assigns record positions only if an owner or administrator later activates it.

Deployctl takes a database recovery point and managed object-storage backup for each Managed App before applying the Workspace upgrade. Expect ordinary sequential full-replacement downtime for each app; Portal, documentation, StorageSigner, and the Runtime VM agent are published as part of the same release workflow.

Rollback must be coordinated from the complete pre-release recovery points. After the durable-upload capability is installed, a runtime that does not understand it is refused rather than allowed to write an unsafe older shape. Do not manually remove schema history or downgrade only application containers; restore the matching Workspace database, managed object storage, runtime, and configuration together.

Deployment and operator actions

• Publish 0.0.18-beta with the production ReplaceRuntime workflow for all three Managed Apps. Do not prepare or apply a delta update package.
• Publish Portal, StorageSigner, regenerated public documentation, the base runtime package, and Runtime VM agent 0.1.40, then replace each Managed App sequentially using its generated recovery points.
• Avoid Board activation/deactivation, active Board configuration changes, Manual Order activation/removal, and package/configuration cutovers while an app’s API and Worker are being replaced. Resume those operations only after both services report the new runtime and their health checks pass.
• This delivery advances the trusted package gateway contract to 10 and the Net Operation Project gateway contract to 7. The full Workspace upgrade rebuilds and activates Net Operation Projects with the target toolchain. Re-apply any customer .NET package built against the new SDK and rebuild/activate Workspace UI projects through their normal workflows; older trusted-code artifacts are rejected instead of executed.
• No new environment variable, credential, storage bucket, signer policy, public DNS record, Portal setting, or Runtime VM agent configuration is required.
• After every replacement, verify Workspace migration/model parity, package and project build state, API/WebApp/Worker/RabbitMQ health, exact runtime version, queue consistency, managed-file access, and absence of unsupported-contract, migration, authorization, or repeated-restart errors.

Compatibility and breaking changes

Runtime HTTP and Configuration APIs are additive for existing clients, and existing exact matching profiles, Entity Definition YAML versions 1 through 5, stored business records, attachments, and action submissions remain readable. Older YAML cannot author or clear Manual Order, and older clients do not expose the new fuzzy, conditional-effect, date-anchor, or retry-control settings.

The trusted .NET gateway contract bump is intentionally fail-closed and is the release’s required compatibility action: rebuild/re-apply customer packages and rebuild Workspace UI projects against the delivered SDK/toolchain. Package definitions whose configured action-input properties are renamed, ignored, ambiguous, or not publicly bindable are now rejected during discovery and must be corrected before re-apply. No Runtime VM agent protocol change is included; agent version remains 0.1.40.