You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 981cc85
Browse filesBrowse the repository at this point in the historyBrowse files
feat(service-automation)!: a flow whose region body calls a child that can suspend is registered but not armed, and the region refusal cancels the child run it leaves behind (#28897)
7
+
8
+
Clause-②: yes (narrowing)
9
+
Metadata-protocol: none
10
+
11
+
**BREAKING** for a record-triggered flow with a `subflow` or `map` node inside a `loop` body, a `parallel` branch or a `try_catch` slot, whose child flow can suspend the run.
12
+
13
+
-**Before.** A region body cannot carry a durable pause (ruling D on #15646). The flow parse refuses the pausing node types inside a region, but it cannot see into a `subflow` / `map` child. Such a flow armed, and the first time its child suspended, the run failed at the region boundary with the named refusal (`durable pause inside a structured region …`). The child run that node had started was left parked in the suspended-run store: a later resume ran the rest of the child for a caller that had already failed, and then failed to resume that caller.
14
+
-**Now, the first door.** The arming gate in `activateFlowTrigger` declines such a flow, after its disabled-subflow and save-notice halves. "Can suspend" is the save-notice half's reading: the child holds a node of an always-suspending type reachable from its start, or calls, from its top-level graph, a child that can suspend. The flow still registers, is not armed, and warns once, naming the region node (the innermost container), the `subflow` / `map` node and the child's suspending node. `GET /automation/_status` reports it `bound: false` with that reason and the new `unboundCause` value `suspending_subflow_in_region` (added to `FLOW_UNBOUND_CAUSES` in `@objectstack/spec/contracts`). Whenever a flow is registered, every flow whose calls reach it is judged again, so the decline does not depend on load order, and a child republished without its suspension arms the caller again.
15
+
-**Now, the second door.** A run that still meets the region refusal (a direct execute, or a flow with no trigger) fails exactly as before, with the same refusal. Before throwing it, the engine cancels the child run the `subflow` / `map` node parked, and every run that child is parked on, through `cancelRun`. Each cancelled run records `cancelled`, with the refusal as its reason.
16
+
-**Not declined.** A region-nested call whose child cannot suspend, and a top-level call to a child that can (the top-level graph carries the pause). Registration, the save door and `objectstack validate` accept the same flows as before.
17
+
-**The fix.** Move the `subflow` / `map` node the reason names onto the top-level graph and route the region's exit to it, or republish the child without the node that suspends. The flow arms on its own once the shape is gone.
18
+
-**Who moves.** No shipped flow has the shape. HotCRM's `campaign_enrollment` calls two children from loop bodies, and neither child suspends. The showcase and dogfood calls are all top-level.
19
+
20
+
<!-- adr-0087: not-required (no-migration-prescription) no metadata key is added, removed, renamed or re-shaped and the save door accepts the same flows: a flow that registered still registers and is only left unarmed by the runtime, with its own reason naming what to move, a run that failed at the region still fails there with the same refusal, and the one contract change is a new value in the runtime status cause list, which no author writes and no migration could rewrite -->
fix(plugin-calendar): a calendar view with no `endDateField` draws no resize-end handle, and a drop that changes no date writes nothing
6
+
7
+
Clause-②: yes (widening)
8
+
Metadata-protocol: none
9
+
10
+
On a calendar view that declares only `startDateField`, every month-view card still drew the "Resize event end" handle. Dragging it moved nothing, yet wrote the record's unchanged start date, so `updated_at` moved and every after-update trigger and flow ran for an edit nobody made.
11
+
12
+
-**No end field, no end handle.**`CalendarView` takes a new optional `endEditable` prop (default `true`). When it is `false`, the month view draws no "Resize event end" handle and the week and day views draw no bottom "Resize end" handle; moving a card and the top "Resize start" handle are unchanged. `ObjectCalendar` passes `false` when the view declares no `endDateField`. A view that declares one keeps both handles and keeps writing the end, including on a record whose end is empty.
13
+
-**A drop that changes nothing writes nothing.**`ObjectCalendar`'s default drop handler now skips the write when every date it would write is where the record already has it. A press and release on a week-view event without moving it was such a drop, with or without an end field.
fix(studio): a report switched to Joined in Properties is held until its first block is added, instead of autosaving a report the draft door refuses
7
+
8
+
Clause-②: no
9
+
Metadata-protocol: none
10
+
11
+
Setting Report type = Joined clears the report's dataset and measures, because a joined report selects per block. Until a block is added, the report has no `blocks`, and the spec refuses it ("a `joined` report needs `blocks`"). Studio used to autosave that body and get a 422, and every later edit carried the same body and was refused too, then lost on reload. Now the Interfaces pillar holds it unsent, as it already holds an unfinished Order item, block or chart. A neutral line reads "Not saved yet: a Joined report needs at least one block in “Blocks”", its "Show me" focuses the Blocks list, and Studio's leave guard and Publish see the held edit. Adding a block hands the hold to that block until its Name and Dataset are set, and the next autosave then sends every edit kept meanwhile. A joined report with no blocks that also keeps a key the spec refuses is still sent, so that refusal stays on screen.
feat(mobile): native shell mode — the Console detects `window.ObjectStackNative` and talks to the ObjectStack mobile shell that hosts it
7
+
8
+
Clause-②: yes (widening) — `@object-ui/mobile` is published and gains new exports; the seat writes the TIER_DEFAULT contract review.
9
+
Metadata-protocol: none
10
+
11
+
The ObjectStack mobile app hosts the web Console in a WebView and injects a bridge, `window.ObjectStackNative`, before the Console's scripts run (on older Android WebViews, possibly after them). The Console now knows when it is hosted.
12
+
13
+
-**`@object-ui/mobile` gains the bridge type and detection.**`ObjectStackNative` types exactly the members of the shell's bridge contract (`version`, `platform`, `appVersion`, `capabilities`, `safeArea`, `has`, the five calls and the two events). `useNativeHost()` returns it, or `null` outside the shell; it reads the global lazily and re-checks at `DOMContentLoaded`, `load` and a few points after `load`, so a late injection still arrives. `getNativeHost()` is the same read outside React.
14
+
-**Typed calls that never throw.**`nativeGetPushToken`, `nativeHaptic`, `nativeOpenExternal`, `nativeNavigate` and `nativeResetServer` check `has(capability)` and that the method exists, and resolve a `NativeCallResult`: `{ status: 'unavailable' }`, `{ status: 'ok', value }`, or `{ status: 'failed', code, message }`.
15
+
-**Router wiring.**`useNativeHostRouting({ route, navigate })` posts `ready()` once per page load after the first route has rendered, posts `routeChanged(route)` once per route change, and answers the shell's cancelable `objectstack-native:navigate` window event by moving the router to `detail.route` (an in-app path only) and cancelling the event, so a notification tap does not reload the Console. Outside the shell it installs nothing.
16
+
-**The Console uses it.** In the shell the Console posts those events from its router, marks the root element with `data-os-native-shell="ios|android"`, and drops the PWA install manifest. It adds no safe-area padding: the shell already pads its WebView. Without the global the Console behaves exactly as before.
fix(auth): sign-in, password reset and the authenticator set-up work at phone width
8
+
9
+
Clause-②: no
10
+
Metadata-protocol: none
11
+
12
+
Measured in a real Console at 375 and 390 px, against the showcase and CRM examples. No page scrolled sideways, but three things failed on a phone, and all three are fixed. Above the `sm` breakpoint nothing changes.
13
+
14
+
- Every control on the sign-in, forgot-password and reset-password pages, and in the remediation overlay, was under the 44 px touch-target floor: 40 px fields and buttons, a 28 px show-password toggle, text links 14 to 17 px tall, the 32 px language button. Below `sm` each is now at least 44 px. Links inside a sentence keep their size.
15
+
- The sign-in and forgot-password fields used 14 px text, so iOS zoomed the page each time one took focus. They use 16 px on a phone.
16
+
- The authenticator set-up step of the remediation overlay (QR code, backup codes, code field) is taller than a phone screen once the keyboard is up, and the overlay did not scroll: the heading went off the top and the Verify button under the keyboard, out of reach. The overlay now scrolls.
fix(runtime)!: package commit revert and rollback act only on a commit of the package their path names
7
+
8
+
Clause-②: yes (narrowing)
9
+
Metadata-protocol: none
10
+
11
+
<!-- adr-0087: not-required (no-migration-prescription) No metadata key, schema, accepted value, export or error code is removed or renamed. Two REST doors now refuse a request whose path package does not own the commit it names, with the existing COMMIT_NOT_FOUND code and the package-not-found 404 the sibling package doors already give, so no stored metadata changes and there is nothing for objectstack migrate meta to rewrite. The protocol's two request types gain an OPTIONAL member, which no existing caller has to send. -->
12
+
13
+
**BREAKING** for one call shape only: a request that named one package in the path and a commit of another. `POST /api/v1/packages/:id/commits/:commitId/revert` and `POST /api/v1/packages/:id/rollback` (body `{ commitId }`) used to ignore `:id`: a commit of package A, sent through package B's path, answered 200, reverted A's items and recorded a revert commit in A's history, even after A was uninstalled. Such a request now answers `404 COMMIT_NOT_FOUND` ("No commit 'ID' in package 'B'.") and writes nothing. An unknown `:id`, which includes a package that has been uninstalled, answers `404 Package 'ID' not found`, as the draft doors do, so an uninstalled package's history no longer takes new revert commits through its own path either. A commit sent through its own package's path reverts and rolls back exactly as before, with the same response body.
14
+
15
+
-**`@objectstack/runtime`**: both doors hand the path's package to the protocol, after the `manage_metadata`, walled-catalog and query refusals, which keep their order.
16
+
-**`@objectstack/metadata-protocol`**: `revertCommit` and `rollbackToPackageCommit` take an optional `packageId`. When it is sent, a commit of any other package is refused `COMMIT_NOT_FOUND` (404) before anything is written. An in-process caller that sends none reads any commit, as before.
17
+
18
+
A read-only package keeps its commit revert. Its only commits are the publishes of its environment overlays (ADR-0131 D6), and `POST /packages/:id/revert` answers a read-only package's stored rows too.
19
+
20
+
What to do: nothing, unless a script sends commit ids through another package's path. Send each commit through the package that `GET /packages/:id/commits` lists it under.
fix(app-shell): Studio no longer edits the published version over a dashboard draft it is not allowed to read, so the autosave cannot overwrite that draft
7
+
8
+
Clause-②: no
9
+
Metadata-protocol: none
10
+
11
+
-**Before.** A pending draft can carry an audience gate (`requiredPermissions`) its author does not hold, for example one written over the API or MCP. The draft read answers `403 PERMISSION_DENIED` for it, by design. Studio's draft reader (`readDraftForSave`) took every failed read for "no pending draft", so the Interfaces pillar opened the published body in its place and the next autosave sent that body as the draft, with no precondition: the draft lost the gate and every other unpublished change, and publishing it served the dashboard to everyone.
12
+
-**Now.**`readDraftForSave` hands a read refused `403` back as `refused` (with `isDraftReadRefused` to tell it apart). The Interfaces pillar installs no buffer for such a leaf: nothing is shown to edit and the autosave has nothing to send. The refusal strip says the item has an unpublished draft this author may not read, that editing the published version would overwrite it, and that someone who holds the draft's required permissions can edit or publish it; the server's own sentence is behind Details.
13
+
-**Unchanged.** A leaf with no pending draft opens the published body and its first save is still pinned to "no draft row"; a readable draft opens as served. Any other failed draft read is handled as before.
0 commit comments