@praxisui/core 9.0.37 → 9.0.39

package/README.md

@@ -290,6 +290,12 @@ export const appConfig = {
 
 Use `GlobalActionRef` and the catalog helpers when declaring or validating action payloads. The host remains responsible for registered executors and policy.
 
+`GlobalActionService.has(actionId)` proves only that a handler is registered. Before claiming that a materialized action is executable, use `getReadiness(actionId, context?)`; it checks the handler plus the provider, platform API, or ephemeral runtime context declared by the Core-owned handler without executing the side effect. The result distinguishes host-scoped proof from context-scoped proof. Contributed `GLOBAL_ACTION_HANDLERS` must publish the same non-executing proof through `GlobalActionHandlerEntry.readiness`; omitting, returning an empty array, or returning malformed evidence fails closed. Only Core built-ins that are genuinely self-contained may publish an explicit empty probe.
+
+This was classified as `lacuna-real-de-contrato`: an injector token alone could not distinguish an operational host adapter from a fallback or placeholder that always fails. Official provider factories therefore bind their adapters with `markGlobalActionProviderOperational(...)`, and Core validates the exact action through `getGlobalActionProviderEvidence(...)`. Direct adapters supplied by a host must carry the same evidence; unmarked adapters remain unavailable even when their token exists. This marker is non-executing operational evidence for the current host injector, not a security boundary or proof that every future browser/runtime context will succeed. For example, `surface.open` is not ready without an adapter produced by the official surface factory, and the default `dialog.open`/API fallbacks remain fail-closed.
+
+Isolated target injectors that use the official analytics adapter should install `...providePraxisTelemetry()` before `providePraxisAnalyticsGlobalActions()`. This bootstraps the same `TelemetryService`/transport contract used by application hosts, and lets a certification gate observe a deliberately safe `trackEvent` separately from non-executing readiness.
+
 Resource action discovery also carries an optional `execution` contract. Consumers must materialize its interaction, idempotency, correlation, resource-version, selection, outcome and refresh policies instead of inferring command behavior from labels or HTTP methods. `ResourceDiscoveryService.getActionsByResourceKey(...)` resolves the canonical `/schemas/actions?resource=...` catalog without requiring the consumer to know a resource path. A collection action may declare `resourceVersionTargetResourceKey` and `resourceVersionTargetIdField` when its `If-Match` belongs to another canonical resource. `ResourceActionOpenAdapterService` then projects that exact pair into Dynamic Form runtime inputs when no version is available at open time; after the request payload is prepared, Dynamic Form reads only the declared scalar id field, resolves the exact target resource catalog, fetches its current representation and requires the response ETag before executing the command. Missing pairs, divergent catalogs, absent ids and absent ETags fail closed. This path does not deduce targets from URLs, labels, lookup display objects or action names. The adapter also uses transient schema-owned command layout and keeps materialized host inputs authoritative over saved preferences.
 
 ## Collection Export

package/ai/component-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-08-30T00:46:55.066Z",
+  "generatedAt": "2026-08-30T06:49:42.426Z",
   "packageName": "@praxisui/core",
-  "packageVersion": "9.0.37",
+  "packageVersion": "9.0.39",
   "sourceRegistry": "praxis-component-registry-ingestion",
   "sourceRegistryVersion": "1.0.0",
   "componentCount": 4,