Moltaro 0.0.48-beta

Release date: 2026-09-08

Open and download saved files directly from a record’s embedded tables, retain SVG documents as download-only files, and administer Task Queue metadata through the application, .NET automation and installation packages.

Highlights

• File cells in embedded record tables now offer the same saved-file actions as individual File fields, using the parent record’s current access checks.
• Accepted SVG documents retain their original name and bytes without enabling browser preview or Markdown inline images.
• Task administrators can create, inspect, edit and manage the lifecycle of queue configurations, with separate read and management permissions.

Detailed changes

Files in record tables

Card layouts pass the parent record identity through embedded table cells to the existing Preview and Download actions. A child row is not treated as a separate owning record. Restricted or deleted values, and values without saved record context, do not expose these actions. An access-denied record download does not retry through the general file catalogue.

Download-only SVG documents

Ordinary file verification can accept SVG as binary download content after the existing size, checksum and configured malware-scanning checks. Download uses the inspected application/octet-stream type and attachment disposition; the original declared MIME remains metadata, not permission to render inline. PNG, JPEG, WebP and PDF retain their signature and MIME-matching rules.

SVG remains untrusted. The bounded signature probe is not a sanitizer and does not establish the absence of scripts, event handlers or other active content. There is no built-in SVG preview or Markdown inline rendering. Downloading a document does not certify that opening it in another application is safe.

Task Queue administration

The Task Queue configuration catalogue provides a searchable list, preview drawer, details and audit history. Queues have a stable, case-insensitive unique key, display name, optional description and explicit lifecycle state. Creation starts inactive; the key cannot be edited afterward. Deletion requires an inactive queue. Changes use row-version checks and idempotent operation identities.

The Tasks module distinguishes queue configuration read and management rights. Existing Tasks administrator and queue-management roles receive both rights through normal module reconciliation; the viewer role receives read access. Operational Task roles do not acquire configuration rights implicitly.

The Tasks menu setup can add the Queue catalogue while preserving existing menu placement, names and role restrictions. Existing navigation is not silently rewritten during upgrade. The .NET Tasks API exposes equivalent queue query and command operations. Installation packages can export and install queue metadata; matching existing configurations are unchanged and conflicting configurations are rejected rather than overwritten.

This is queue configuration, not task dispatch: worker membership, routing, distribution limits and workload execution are not introduced by this release.

Database and upgrade impact

This release adds storage for Task Queue configuration. Existing business records, file bodies, Task Definitions and historical operation receipts are not rewritten. The portal database has no new migration. Managed Apps receive a full runtime replacement, with a short interruption per application; storage locations and application placement remain unchanged.

Preserve the pre-upgrade database recovery points and previous runtime. Reverting the queue schema removes queue configurations created after upgrade; a binary rollback alone is not a data-recovery procedure. Coordinate compatible workspace project versions and verified database recovery before any rollback. Accepted SVG remains download-only for existing consumers; retrying an earlier rejected upload requires a normal upload attempt, not a database edit.

Deployment and operator actions

• Use two-phase Deployctl ReplaceRuntime for all three Managed Apps. Do not use Portal-only publication or a prepared delta update for this release.
• Keep the confirmed active workspace C# revision and custom UI artifact fixed during prepare and promote. Compatibility Check and the normal replacement rebuild target that exact source; no new project draft belongs in that window.
• Keep OMS synchronization schedules disabled during bounded acceptance. This release does not start bulk synchronization or repair the import backlog.
• Verify one accepted SVG through the actual authorized storage GET: original bytes/SHA, binary Content-Type and attachment Content-Disposition. Headers on the preceding JSON authorization response are not storage-response evidence.
• Verify table-file actions on desktop and at 375 px, including the actual preview drawer, download and denied access. SVG must not load a browser preview.
• Verify queue metadata read/navigation and the applied schema without enabling Tasks or changing customer menus or permission assignments solely for a smoke. Administrators wanting a Queue menu entry use the normal Tasks menu setup.
• No new storage account, credentials or agent protocol is required. Runtime VM agent 0.1.45 and file verification policy version 1 remain declared.

Compatibility and breaking changes

The Tasks module contract advances to 1.7.0 with additive queue configuration and automation contracts. Code that uses the new queue API requires this runtime. Existing file upload, catalogue and attachment APIs are unchanged; no SDK bypass flag or legacy-uninspected admission path is added. Ordinary file and record authorization remain authoritative. No new breaking HTTP contract is introduced.