Moltaro 0.0.73-beta

Release date: 2026-10-04

Teams can discuss and assign queued work with clearer results, organize navigation in translated submenus, and open a table row’s related business record directly. Record screens are more compact, merge history records reference transfers, and integrations can confirm an uncertain save without sending it again. Existing installations require a staged expression-language upgrade and rebuilt extensions.

Highlights

• Use Task comments, files and assignment notifications in Work Inbox, with access checked against the Task and its configured content destinations.
• Request new work or distribute queued tasks through dialogs that retain the result, applying worker capacity, task availability and configured schedules.
• Build translated navigation submenus and choose a table’s primary record for Preview and Open Details.
• Read denser record drawers, details pages and Kanban cards; optionally place Card labels beside values and hide empty read-only fields.
• Author rules with shared expression help and nested related-record conditions, including ANY and ALL where collection predicates are supported.
• Check whether an Entity mutation committed, recover an uncertain lifecycle action after reload, and use composite saves with a default limit of 100 steps.

Detailed changes

Task collaboration and assignment

Direct and Queue Tasks support independently configured comment and file channels. A channel can read Task content and supported Entity or Board context content, choose one owner for new content, and publish it to additional configured destinations. Sending or publishing requires current rights at every destination; Task access alone does not grant access to the related record. Mentions and file downloads retain current access checks. Unavailable sources can be shown without exposing their identity.

Assignment notifications reach the assigned user’s Work Inbox from Task creation, responsible/executor assignment or replacement, and queue acquisition. The Inbox supports unread state, read/archive actions and opening currently accessible work. An old notification does not preserve access after permissions change.

Give me work attempts one new assignment for the requesting worker, even when that worker already has assigned work. A full capacity limit or no eligible task produces an explanation; an existing task is not substituted as the result. Distribute tasks now lets a dispatcher assign eligible work across the queue’s workers. Both actions are available under either algorithm mode when the user has the corresponding role. Assignment leaves the Task Idle; it does not start execution.

The bundled algorithm follows effective queue order and projected global assigned load. Custom selectors can come from a .NET package or Net Operation Project. New assignments respect current authorization, availability, capacity and the queue’s Consider work schedule policy, which defaults to enabled. Configured automatic event and schedule triggers use the same assignment boundary.

The action dialog opens immediately, shows progress and keeps the terminal result until closed. Dispatcher results name the tasks and workers actually assigned. Closing an unfinished request and reopening it resumes that intent; replaying its key does not assign another task. A new request after completion is a new intent. If one worker’s schedule cannot be resolved, distribution can process the other eligible workers and retain an explicit schedule warning with completed results. Repeated technical schedule failures stop after three failed attempts. An inaccessible queue shows a stable no-access view with a route back to My tasks.

Menus and record navigation

The User menus designer under Constructor provides a structure tree, drag and drop or Move to, an inspector, role preview and undo for the unsaved draft. Root-level submenus open a separate navigation panel and can contain sections and links; submenus do not nest. Labels can be translated into the supported interface languages. Moving an existing node preserves its identity. A module link can target one active Board and follows Board access; installation packages transport that target by Board key.

A Table Surface can select up to 16 ordered, direct, single-value Reference fields as its primary object. Preview and Open Details open the first populated reference using the destination’s own screens. An unreadable earlier field, missing target, denied target or entirely empty configured selection produces an unavailable result, rather than choosing a different record. With no configuration, navigation continues to open the row itself. Row edits, lifecycle actions, selection and export still operate on the source row.

Workspace UI authors can add a Files action that opens a saved native record directly on Attachments. The destination survives links and reload, opens the desktop panel or mobile Collaboration section, and respects the selected layout and current file/archive permissions. Opening it does not publish pending files. Existing custom pages need an author change and activation to add this action.

Record screens and Cards

Entity and Board item drawers have a compact identity/action header and named section tabs, with a searchable More list when all sections do not fit. Details pages use a navigation rail when space permits and tabs at smaller widths. Width controls, expand/collapse actions and Copy ID are available from More. Collaboration initially uses a collapsed rail below a 1600px viewport unless the user has saved a preference. Kanban fields use compact label/value lines, and numbers follow the interface language, with grouping starting at five digits.

Card authors can put short-field labels Beside the value in sufficiently wide cells and enable Hide empty fields for read-only display. Narrow cells, long text, Markdown and child Tables keep labels above. Zero and false remain visible; restricted fields keep their restricted state. Empty Card subsections can disappear. These options are off by default and do not remove fields from Forms.

Upgrade-visible default: generated Drawer and Details layouts now start related-data sections hidden. Authors must choose Customize and show the sections users need. This affects existing screens still using generated layouts; saved custom layouts retain their configuration.

The UI surface registry distinguishes Uses from Used in. Runtime screen editors show the all-roles selection directly and warn about role rules that cannot apply.

Expressions and related records

Calculations, validation and field conditions, presentation, Statements, eligibility and supported Workflow conditions use the shared expression language and their authorized authoring metadata. Editors share completions, path browsing, language help and diagnostics tied to the original source. Metadata loading leaves the editor typeable; stale metadata is refreshed before validating against it. Persisted authorization and command decisions continue to use PostgreSQL.

Where a profile permits collection predicates, ANY and ALL can inspect related items and nested item collections, including supported Board and Workflow facts. Item scopes nest at most three levels. ANY over an empty collection is false; ALL is true. A missing value can leave either result unknown, while invalid dependencies fail the decision. Existing EXISTS keeps its two-state behavior.

Package saves now select and render record display names and subtitles through the same presentation behavior as the platform. Templates must name a Reference member, such as {Customer.DisplayName}. Converted templates can therefore show a referenced name that an earlier package save left empty. Review NULL-dependent conditions and conversion results when rebuilding extensions.

Merge history and reliable saves

With field history enabled, a record whose inbound References are transferred by a merge receives an Update history entry with old/new values, actor, time and a Record merge source. Multiple scalar references and owned Table cells share an entry for that transfer phase. Survivor changes, Association changes and source Archive retain their own phases. Current field, record and archive permissions filter both values and the related merge-operation link. Exact replay adds no history; missing historical transfers are not reconstructed by the upgrade.

GET /api/workspace/entity-mutation-outcomes lets an authenticated actor check their own unexpired Entity mutation receipt using the original operation handle. It can confirm commitment without returning record identities when current read access is absent. NoConfirmedReceipt does not prove that nothing was saved and does not authorize a new write. The check neither reruns the mutation nor extends receipt retention. Returned versions describe the original result; read the current record before editing it again.

The Workspace UI useEntityMutation helper freezes one request and operation key, prevents duplicate concurrent sends by that controller, and offers explicit result checks and exact retries when allowed by the installed error catalog. The native record lifecycle dialog uses the same mechanism for Archive, Restore and Delete. Optional tab-scoped recovery retains a minimal handle before sending; reload can check it without resending. Recovery does not store the request body, coordinate independent tabs or provide an offline queue. Unlisted errors keep the outcome unknown. Exact retries require the body still in memory, an allowed reaction, fewer than three total sends, and an age below seven days minus one hour.

Composite Entity writes share a host policy across REST and C#: by default, 100 mutation steps, 1 MiB of request data and a 15-second execution budget. Creating one parent and 99 children consumes 100 steps. These limits are admission bounds, not a promise that a heavy request finishes within the budget. Unrelated creates and saves avoid former workspace-wide license accounting and unnecessary authorization-lock waits. Transient database failures inside transactional C# save functions can retry the whole save, so such a function can run more than once. Extension authors must account for this when performing effects outside the database transaction.

Parent/child Forms that stage all related edits for one atomic Save are not delivered here. Existing Related table edits still save independently.

Database and upgrade impact

The Workspace database changes for expressions, Task collaboration and assignment, menus, table navigation, Card options, related-record routing and background license usage. There are no Portal database migration changes in this comparison.

Existing installations need the approved intermediate expression-conversion delivery before this final runtime. This runtime cannot convert old expression source. Conversion readiness includes disabled/deleted rules, templates, active packages, reusable candidates and pending package applies. Resolve every refusal on the intermediate delivery and verify the actual target database before the final replacement. A package version check alone is insufficient. Fresh databases can initialize directly on the final runtime.

The package declares a minimum upgradeable version of 0.0.70-beta. That floor does not establish a direct upgrade path from every later version. The supplied evidence does not establish a published intermediate conversion package or an accepted conversion procedure for the live Managed Apps; resolve this before production promotion.

Plan a maintenance window for conversion, extension rebuilding, runtime replacement and schema changes. This assignment has not measured production downtime. Stop all writers, including external package hosts, for the stopped transitions. Retain verified database backups and the separately required external file-body recovery coverage before conversion and before final replacement. A database-only backup does not preserve those file bodies.

The final expression transition removes information that an older runtime needs. The license usage change also prevents older hosts from using the new schema. Replacing binaries alone is not a supported rollback. Restore the matching pre-upgrade database, runtime and required file recovery state. Task assignment history introduces additional downgrade refusals once used.

Existing Cards retain the default display options and tables retain self-navigation until configured. Existing queues consider work schedules by default. Review the generated related-section visibility change before accepting users’ normal flows.

Deployment and operator actions

Deployment mode: ReplaceRuntime. Managed Apps receive replacement WebApp, Api and Worker components through the supported release workflow. This release does not supply a delta update; FromVersion is not applicable. The documentation comparison base does not identify every Managed App’s installed runtime or prove its conversion readiness.

Before promotion:

1. Identify the exact supported intermediate conversion artifact and its route from each installed app. Resolve the conflicting bundled upgrade guidance described in the internal evidence. Rehearse with isolated database and file storage, compare the old/new rule results, and resolve conversion findings. Do not relabel old expressions or edit version numbers to bypass admission.
2. On the intermediate delivery, rebuild and reapply affected packages, complete or explicitly resolve pending package work, and obtain clean readiness for each database. Retain the intermediate recovery point before the final step.
3. Rebuild custom .NET packages and Net Operation Projects for the new contracts. Run Workspace UI Check → Build → Activate, then fully reload clients. Keep any failed-build warnings and unavailable-function details for the author; a retained old artifact does not prove compatibility.
4. Review schedules, capacity, selector bindings and permissions on queues using automated assignment. Check that needed related-data sections are visible in generated record layouts. Coordinate interruption of active external work through the normal Worker/release procedure.
5. Review host policy settings. OnPrem:LicenseUsage:RefreshIntervalSeconds defaults to 300 and accepts 30–86400 seconds. Growth is checked against the stored usage: it may exceed a limit between refreshes, and reducing usage reopens growth only after another count. Missing or unreadable snapshot values do not establish a limit violation; failed refreshes leave the previous count in use. Monitor successful refreshes. Read-only license enforcement remains.
6. Composite configuration is under Moltaro:EntityMutations:Composite: MaximumSteps accepts 16–10000, MaximumRequestBytes accepts 1–16 MiB and ExecutionBudgetSeconds accepts 5–300. Invalid settings stop startup. Include the additional receipt-lookup pool, capped at 16 connections per process and workspace connection string, in the database connection budget. Observe cold and concurrent C# saves before increasing limits.

Post-deployment scenario

Use designated canary records and authorized accounts, preserving the operation keys and results in release acceptance evidence:

1. In a configured queue with an available Idle task and spare worker capacity, choose Give me work. Confirm that one new task is assigned, remains Idle, and appears in the retained dialog and the worker’s Work Inbox. Reopen the same intent and verify no second assignment. A separate request at full capacity must explain the refusal without opening an old task.
2. Publish a comment and a small file from that Task to its configured Entity or Board context. Verify both permitted views and the download. With an approved restricted account, confirm that hidden sources and destinations disclose no identity or link. Repeat the navigation at 375px.
3. From a table configured to open its Customer reference, use Preview and Open Details and confirm the Customer opens. Confirm a row edit still changes the source record. Open Attachments from the canary Workspace UI action and reload; the destination and authorization must be retained.
4. Merge two designated duplicate canary records with an inbound scalar Reference and an owned Table Reference. Inspect the owning record’s old/new history, source Archive and operation link. Replay the same operation key and verify no duplicate history. A restricted reader must see only permitted values.
5. Submit a canary Entity save with a retained handle, then use the outcome GET to confirm its original result without another write. Exercise an approved lost response in the lifecycle dialog: Check result, including after reload, must confirm rather than repeat the action. Also verify a representative converted calculation/presentation rule and a nested related-record condition against the conversion rehearsal’s expected results.

Generic health checks do not replace these checks. Production acceptance remains Pending until the selected source, app fleet, migrations, recovery points and release-specific scenarios have actual evidence.

Compatibility and breaking changes

• Expressions and imports: only canonical expression source is supported. Entity YAML must be version 10 and Board YAML version 4. Import/convert older documents on the intermediate runtime; changing the document version alone is not conversion. Old-language comparison/conversion commands are absent from the final runtime; use the intermediate tool for comparison and the supported readiness command for admission.
• .NET extensions: core SDK/templates and the affected module SDKs move to 4.0.0; Workflow SDK moves to 5.0.0. Package gateway contract is 14 and Net Operation Project contract is 11. Rebuild older packages/projects and verify their canonical expressions and generated models; older binaries are refused. Package saves depend on platform-managed presentation functions being ready.
• Workspace UI: the host fingerprint changes while HostContractVersion stays
  1. Rebuild and reactivate projects; older compiled assets do not become compatible merely because their source has not changed. The lifecycle dialog exposes a separate confirmation event when a check confirms commitment without a normal mutation response. It does not invent a current record version.
• Content consumers: activity and attachment resource-context Identity can be null when its source cannot be disclosed. Clients must render the safe unavailable state and omit navigation instead of assuming an identity exists.
• Configuration clients: menu replacement must preserve existing node IDs to retain those nodes; omitted nodes are deleted. Card replacement must retain the new display properties along with tabs, items and rules. Generated related sections now require explicit visibility configuration.
• Save behavior: license quotas use background snapshots rather than exact synchronous last-slot accounting. Composite limits are host policy; read the returned limit metadata and handle budget refusals. A committed composite can replay after the host lowers its step limit. C# save functions can rerun on a transient transactional failure.