biz-a-cli 2.3.80-15419 → 2.3.80

package/engine/domain/applicationConfig.js

@@ -6,47 +6,11 @@ import {
 	buildPublishStatusConfigKey,
 	writePublishStatus,
 	saveConfigRow,
-	appConfigNameFor,
 } from "./appConfig.js";
 import { execPostgres } from "./dialect.js";
 /* Dok. 5 section 3.3 -- a Layer 3 domain contributing its own menus, gated by its own activation
    setting. Read generically: no domain name and no domain code appear in this file. */
-import { mergeDomainNavigation, selectActiveDomainMenus, readActiveModules, resolveMenuLayout } from "./domainNavigation.js";
-import { entryPointsOf } from "../cc/appMenus.js";
-
-/*
- * Doc 8 (2026-10-10) — a SECONDARY application (`metadata.app`, stored as `APPLICATION_CONFIG.<app>`) beside the
- * tenant's host app. It has no Home of its own: `./main` is the tenant's, and the client loads `/main` by bare name
- * across every app, so a second app's main.js could take over the tenant's Home.
- */
-const isSecondaryApp = (parsedApplicationConfig) => {
-	const app = parsedApplicationConfig?.metadata?.app;
-	return app != null && app !== "";
-};
-
-/* Mirrors bin/app.js normalizeAppName: how the host's display name keys its SYS$APPS row. */
-const hostAppNameOf = (displayName) =>
-	String(displayName ?? "")
-		.trim()
-		.replace(/\s+/g, "")
-		.replace(/-/g, "")
-		.toLowerCase();
-
-/*
- * The SYS$APPS row this config publishes to: its name, the display name the client shows on the app's menu node, and
- * the menu layout. Taken from the config BEING published — before this, addApp read them from the newest host
- * APPLICATION_CONFIG whatever was published, so a second app would have overwritten the host's row.
- */
-export const appMetadataOf = (parsedApplicationConfig) => {
-	const metadata = parsedApplicationConfig?.metadata ?? {};
-	const displayName = typeof metadata.name === "string" ? metadata.name.trim() : "";
-	const configName = appConfigNameFor(metadata);
-	return {
-		appName: isSecondaryApp(parsedApplicationConfig) ? configName.slice(configName.indexOf(".") + 1) : hostAppNameOf(displayName),
-		displayName,
-		menuLayout: resolveMenuLayout(parsedApplicationConfig),
-	};
-};
+import { mergeDomainNavigation, selectActiveDomainMenus, readActiveModules } from "./domainNavigation.js";
 
 export const parseConfigData = (rawConfig) => {
 	if (rawConfig == null) {
@@ -123,7 +87,6 @@ export const buildMenuStructureFromApplicationConfig = (parsedApplicationConfig)
 		(menu) => !(menu?.caption === "Home" || (Array.isArray(menu?.link) && menu.link[0] === "./main")),
 	);
 
-	if (isSecondaryApp(parsedApplicationConfig)) return nonHomeMenus;
 	return [{ menuName: "", caption: "Home", link: ["./main"], subMenu: [] }].concat(nonHomeMenus);
 };
 
@@ -135,20 +98,6 @@ export const normalizeTemplateFileName = (rawName) => {
 	return normalized.endsWith(".js") ? normalized : `${normalized}.js`;
 };
 
-/*
- * Fold each domain's live menus into the application's navigation (domainNavigation.js), with the TYPES of that
- * domain's own entry points — Doc 8 M3: a leaf on a list entry point is a list link, so it opens the list and the
- * publish builds a list stub for it (collectFormTargets reads "./list"). `domainMenus`: [domainKey, {menus,
- * domainConfig}] pairs, a Map or an array.
- */
-export const foldDomainNavigation = (navigation, domainMenus) => {
-	let folded = navigation ?? {};
-	for (const [domainKey, { menus, domainConfig }] of domainMenus) {
-		folded = mergeDomainNavigation({ applicationConfig: { navigation: folded }, domainKey, menus, entryPointTypes: entryPointsOf(domainConfig) });
-	}
-	return folded;
-};
-
 export const collectFormTargets = (menuNode, inheritedDomainKey = null) => {
 	const targets = [];
 	const currentDomainKey =
@@ -225,8 +174,7 @@ export const resolveDomainKeyByReference = (domainReference, domainMap) => {
 export const resolveTemplateTargets = (parsedDomainConfig, parsedApplicationConfig) => {
 	const sourceMenus = Array.isArray(parsedApplicationConfig?.navigation?.menus) ? parsedApplicationConfig.navigation.menus : [];
 	const resolvedTargets = [];
-	/* A secondary app never ships a main.js (see isSecondaryApp): marking it seen skips it wherever it comes from. */
-	const seenFileNames = new Set(isSecondaryApp(parsedApplicationConfig) ? ["main.js"] : []);
+	const seenFileNames = new Set();
 
 	for (const menuNode of sourceMenus) {
 		const menuTargets = collectFormTargets(menuNode);
@@ -536,9 +484,8 @@ ${sharedDomainConfigResolverScript}
 					ensureDomainConfig((resolvedConfig) => {
 						this.domainConfig = resolvedConfig || this.domainConfig;
 						console.log('Template Result :', this.domainConfig);
-						/* Doc 8 M3: wait for the app's beforeLoadData handlers (an older client answers nothing). */
-						const waited = this.domainService.doBeforeLoadDataEvent({ config: this.domainConfig, entryPointName: "__ENTRY_POINT_NAME__", runtimeHost: this, id: String(id) });
-						Promise.resolve(waited).then(() => resolve(), () => resolve());
+						this.domainService.doBeforeLoadDataEvent({ config: this.domainConfig, entryPointName: "__ENTRY_POINT_NAME__", runtimeHost: this, id: String(id) });
+						resolve();
 					});
 				});
 			},
@@ -597,10 +544,7 @@ ${sharedDomainConfigResolverScript}
 					ensureDomainConfig((resolvedConfig) => {
 						this.domainConfig = resolvedConfig || this.domainConfig;
 						console.log('Template Result :', this.domainConfig);
-						/* Doc 8 M3: the app's beforeLoadData handlers are waited for below — a FINA master list learns FINA's
-						   database index in one, and the first load must not read the tenant's database instead. An older
-						   client answers nothing; a failed handler does not stop the list loading. */
-						const waited = this.domainService.doBeforeLoadDataEvent({
+						this.domainService.doBeforeLoadDataEvent({
 							config: this.domainConfig,
 							entryPointName: "__ENTRY_POINT_NAME__",
 							runtimeHost: this,
@@ -622,21 +566,13 @@ ${sharedDomainConfigResolverScript}
 							this.buttons = rendered.buttons || [];
 							this.filter = rendered.filter || [];
 							this.distinct = !!rendered.distinct;
-							/* Doc 8 M2: the database a list reads (a FINA list reads FINA), and the list engine options
-							   (search, print, selection) - handed over whole; an older client has no applyListOptions. */
-							if (rendered.dbIndex !== undefined && rendered.dbIndex !== null) {
-								this.dbIndex = rendered.dbIndex;
-							}
-							if (typeof this.applyListOptions === "function") {
-								this.applyListOptions(rendered);
-							}
 							this.functions = Object.assign(this.functions || {}, rendered.functions || {});
 							if (this.helper && typeof this.helper.bindFunctionInObj === "function") {
 								this.helper.bindFunctionInObj(this.functions, this);
 							}
 							this._listDomainInitialized = true;
 						}
-						Promise.resolve(waited).then(() => resolve(), () => resolve());
+						resolve();
 					});
 				});
 			},
@@ -823,15 +759,6 @@ export const publishApplicationConfig = async (payload = {}, argv = {}) => {
 		throw new Error(`SYS$CONFIG record ${applicationConfigName}@${applicationConfigVersion} was not found.`);
 	}
 	let parsedApplicationConfig = parseConfigData(appRow.data) ?? {};
-	/* Doc 8 (2026-10-10): the row's name and the app the config declares must agree — otherwise one app's config would
-	   publish into another app's SYS$APPS row. */
-	const declaredConfigName = appConfigNameFor(parsedApplicationConfig?.metadata);
-	if (declaredConfigName.toUpperCase() !== applicationConfigName.toUpperCase()) {
-		throw new Error(
-			`SYS$CONFIG record ${applicationConfigName}@${applicationConfigVersion} declares itself as ${declaredConfigName} ` +
-				"(metadata.app); publish it under that name.",
-		);
-	}
 
 	/* An app bundle publish is a full replace (addApp() rebuilds the whole bundle from scratch every call), so
 	   template.js scaffolding must be generated for EVERY domain registered in application.js's `domains` map, not
@@ -923,10 +850,7 @@ export const publishApplicationConfig = async (payload = {}, argv = {}) => {
 						exec: execPostgres,
 						dbIndex: Number(config?.dbindex ?? config?.dbIndex),
 					});
-					domainNavigation.set(domainKey, {
-						menus: selectActiveDomainMenus({ menus: declaredMenus, activeModules }),
-						domainConfig: parsedDomainConfig,
-					});
+					domainNavigation.set(domainKey, selectActiveDomainMenus({ menus: declaredMenus, activeModules }));
 				} catch (error) {
 					logger.warn(
 						`[navigation] ${domainKey}: could not resolve its menus, so it contributes none: ` +
@@ -938,7 +862,10 @@ export const publishApplicationConfig = async (payload = {}, argv = {}) => {
 
 		/* Fold the domains' menus in BEFORE the bundle is built from this config. */
 		if (domainNavigation.size > 0) {
-			const navigation = foldDomainNavigation(parsedApplicationConfig?.navigation ?? {}, domainNavigation);
+			let navigation = parsedApplicationConfig?.navigation ?? {};
+			for (const [domainKey, menus] of domainNavigation) {
+				navigation = mergeDomainNavigation({ applicationConfig: { navigation }, domainKey, menus });
+			}
 			parsedApplicationConfig = { ...parsedApplicationConfig, navigation };
 		}
 
@@ -951,8 +878,6 @@ export const publishApplicationConfig = async (payload = {}, argv = {}) => {
 	const publishBody = {
 		verbose: false,
 		fileList: mergedFileList.map(({ name, content }) => ({ name, content })),
-		/* Doc 8 (2026-10-10): the SYS$APPS row is the one THIS config names (addApp's appMeta). */
-		appMeta: appMetadataOf(parsedApplicationConfig),
 		/* Doc 1 0b.3: addApp bundles the working dir's own files too; a caller inside the long-lived hub
 		   (ccpublish) passes an empty scratch dir instead of letting it use process.cwd(). */
 		...(payload?.workingDir ? { workingDir: payload.workingDir } : {}),
@@ -988,7 +913,7 @@ export const publishApplicationConfig = async (payload = {}, argv = {}) => {
 				`get = function () { return ${JSON.stringify(parsedApplicationConfig)}; }`,
 				config,
 			);
-			const counts = [...domainNavigation].map(([key, entry]) => `${key}: ${entry?.menus?.length ?? 0}`).join(", ");
+			const counts = [...domainNavigation].map(([key, menus]) => `${key}: ${menus.length}`).join(", ");
 			logger.info(`[navigation] domain menus published (${counts})`);
 		} catch (error) {
 			/* The bundle is already published and correct; a menu that did not update is a re-publish

package/engine/domain/dialect.js

@@ -13,8 +13,6 @@
  */
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { AsyncLocalStorage } from "node:async_hooks";
-import { logger } from "../../logger.js";
 import * as firebirdDdl from "./firebird-ddl.js";
 import * as postgresDdl from "./postgres-ddl.js";
 import {
@@ -166,9 +164,6 @@ const decorate = (error, statement) => {
  * anything at all.
  */
 export const execPostgres = async (sql, dbIndex) => {
-	const ambient = openAmbient(dbIndex);
-	if (ambient) return inSavepoint(ambient, () => runOn(ambient.client, sql), () => execPostgres(sql, dbIndex));
-
 	const pool = await poolFactory(dbIndex);
 
 	if (!hasTenantContext()) {
@@ -217,20 +212,6 @@ const lowerCaseKeys = (rows) =>
    write puts the master first and callers read `data[0].ID` as the master's key
    (engine/orm/executor.js runStatementsKeepingFirst). One implementation, two shapes. */
 export const execPostgresStatements = async (statements, dbIndex) => {
-	/* Inside a held transaction the group is still atomic — one savepoint around it — but opens no BEGIN of its own. */
-	const ambient = openAmbient(dbIndex);
-	if (ambient) {
-		return inSavepoint(
-			ambient,
-			async () => {
-				const rowsets = [];
-				for (const statement of statements ?? []) rowsets.push(await runOn(ambient.client, statement));
-				return rowsets;
-			},
-			() => execPostgresStatements(statements, dbIndex),
-		);
-	}
-
 	const pool = await poolFactory(dbIndex);
 	const client = await pool.connect();
 	const rowsets = [];
@@ -281,7 +262,6 @@ export const beginPostgresTransaction = async (
 	dbIndex,
 	{ isolation = "READ COMMITTED", tenantId } = {},
 ) => {
-	refuseNesting(dbIndex);
 	const pool = await poolFactory(dbIndex);
 	const client = await pool.connect();
 
@@ -341,121 +321,3 @@ export const beginPostgresTransaction = async (
 		release,
 	};
 };
-
-/*
- * Atomic publish (Agung 2026-10-08) — a transaction the engine's ordinary calls JOIN.
- *
- * A Control Center publish runs through ~20 functions (config rows, DDL, hash rows, SYS$APPS, workflows, draft marks)
- * that call `execPostgres` / `execPostgresStatements`, each its own auto-committed statement. A failure part-way left
- * the earlier steps in place (marketing@0.1.13 recorded after its DDL failed). Inside `withPostgresTransaction` those
- * same calls run on ONE held client, each in its own SAVEPOINT — so code that catches a failure and carries on (the
- * DDL retry loop, a 23505 → null) still can — and nothing is visible to anyone until the COMMIT. Calls are queued:
- * `loadTableSnapshot` fires eight at once, and interleaved savepoints would release each other.
- *
- * ⚠️ Only PostgreSQL DDL is transactional; nothing here runs on Firebird. A table locked by a long user query fails
- * the transaction after `lockTimeout` instead of hanging it — and everyone queued behind its locks.
- */
-const ambientTransactions = new AsyncLocalStorage();
-const LOCK_TIMEOUT = /^\d+(ms|s|min)?$/;
-
-const openAmbient = (dbIndex) => {
-	const store = ambientTransactions.getStore();
-	return store && !store.closed && String(store.dbIndex) === String(dbIndex) ? store : null;
-};
-
-const refuseNesting = (dbIndex) => {
-	if (openAmbient(dbIndex)) throw new Error(`A transaction is already open on database ${dbIndex}; this work runs inside it.`);
-};
-
-const runOn = async (client, sql) => {
-	try {
-		const result = await client.query(sql);
-		return lowerCaseKeys(result?.rows);
-	} catch (error) {
-		throw decorate(error, sql);
-	}
-};
-
-/* One call = one savepoint, queued behind the calls before it. A call that only gets its turn after the transaction
-   closed (async work outliving it) runs on the pool, as it would have outside. */
-const inSavepoint = (store, work, outside) => {
-	const task = async () => {
-		if (store.closed) return outside();
-		const name = `biza_sp_${++store.savepoints}`;
-		await store.client.query(`SAVEPOINT ${name}`);
-		try {
-			const out = await work();
-			await store.client.query(`RELEASE SAVEPOINT ${name}`);
-			return out;
-		} catch (error) {
-			try {
-				await store.client.query(`ROLLBACK TO SAVEPOINT ${name}`);
-			} catch {
-				/* The transaction is unusable anyway; the original error is the one that matters. */
-			}
-			throw error;
-		}
-	};
-	const result = store.queue.then(task, task);
-	store.queue = result.catch(() => {});
-	return result;
-};
-
-/* Run `fn` in one transaction on `dbIndex`: COMMIT when it returns, ROLLBACK when it throws (the error comes through).
-   `afterCommit` work queued inside runs only after a successful COMMIT. */
-export const withPostgresTransaction = async (dbIndex, fn, { lockTimeout = "10s" } = {}) => {
-	refuseNesting(dbIndex);
-	if (lockTimeout !== null && !LOCK_TIMEOUT.test(String(lockTimeout))) throw new Error(`The lock timeout is a duration like "10s", not ${JSON.stringify(lockTimeout)}.`);
-	const pool = await poolFactory(dbIndex);
-	const client = await pool.connect();
-	const store = { dbIndex, client, queue: Promise.resolve(), savepoints: 0, afterCommit: [], closed: false };
-
-	try {
-		await client.query("BEGIN");
-	} catch (error) {
-		/* No ROLLBACK: BEGIN failed, so there is nothing to roll back. */
-		client.release();
-		throw decorate(error, "BEGIN");
-	}
-
-	let out;
-	try {
-		if (lockTimeout !== null) await client.query(`SET LOCAL lock_timeout = '${lockTimeout}'`);
-		await tenantContextApplier(client, { dbIndex });
-		out = await ambientTransactions.run(store, fn);
-		/* Work started inside and not awaited still belongs to this transaction. */
-		await store.queue;
-		await client.query("COMMIT");
-	} catch (error) {
-		store.closed = true;
-		try {
-			await client.query("ROLLBACK");
-		} catch {
-			/* Best-effort: the error that got us here is the useful one. */
-		}
-		client.release();
-		throw error;
-	}
-	store.closed = true;
-	client.release();
-
-	for (const work of store.afterCommit) {
-		try {
-			await work();
-		} catch (error) {
-			logger.error(`[db] after-commit work failed: ${error?.message ?? error}`);
-		}
-	}
-	return out;
-};
-
-/* Work that must not happen before the data it announces is visible (a broadcast to clients): inside an open
-   transaction it waits for the COMMIT — and is dropped on a rollback; outside one it runs at once. */
-export const afterCommit = (work) => {
-	const store = ambientTransactions.getStore();
-	if (store && !store.closed) {
-		store.afterCommit.push(work);
-		return undefined;
-	}
-	return work();
-};

package/engine/domain/domainNavigation.js

@@ -15,25 +15,8 @@
  * and the publish reads it generically. No domain name, no domain code, nothing app-specific here.
  */
 
-import { linkFor as linkForType } from "../cc/appMenus.js";
-
-/*
- * The route shape the client's menu component renders, identical to a hand-declared leaf.
- *
- * Doc 8 M3 — by the entry point's TYPE (`entryPointTypes`, from the domain's structures): a list opens as a list.
- * Every leaf used to be a form link, so a list entry point opened as a form stub. An entry point of unknown type
- * stays a form link, as before.
- */
-const linkFor = (entry, entryPointTypes) => {
-	const entryPoint = String(entry?.entryPoint ?? "").trim();
-	return linkForType(entryPointTypes?.[entryPoint] === "list" ? "list" : "form", entryPoint);
-};
-
-/* A group path: `["FINA", "Master"]`, or a string for the one-level group it always was. */
-const groupPath = (group) =>
-	(Array.isArray(group) ? group : [group]).map((caption) => String(caption ?? "").trim()).filter((caption) => caption !== "");
-
-const isGroup = (node) => Array.isArray(node?.subMenu);
+/* The route shape the client's menu component renders, identical to a hand-declared leaf. */
+const linkFor = (entry) => ["./form", String(entry?.entryPoint ?? "").trim(), null];
 
 /* The menu layouts the client shell can draw. */
 const MENU_LAYOUTS = ["horizontal", "vertical"];
@@ -84,89 +67,70 @@ export const selectActiveDomainMenus = ({ menus, activeModules } = {}) => {
  * something while the tile still opened. Injecting without stripping would also accumulate duplicates
  * that nothing could clear.
  */
-export const mergeDomainNavigation = ({ applicationConfig, domainKey, menus, entryPointTypes } = {}) => {
+export const mergeDomainNavigation = ({ applicationConfig, domainKey, menus } = {}) => {
 	const key = String(domainKey ?? "").trim();
 	const navigation = applicationConfig?.navigation ?? {};
 	const sourceMenus = Array.isArray(navigation.menus) ? navigation.menus : [];
 	const entries = Array.isArray(menus) ? menus : [];
 
-	/* Everything that is NOT this domain's, at every depth, group structure preserved. */
-	const strip = (nodes) =>
-		nodes
-			.filter((node) => String(node?.domain ?? "") !== key)
-			.map((node) => (isGroup(node) ? { ...node, subMenu: strip(node.subMenu) } : node));
-	const kept = strip(sourceMenus);
+	/* Everything that is NOT this domain's, group structure preserved. */
+	const kept = sourceMenus.map((group) => ({
+		...group,
+		subMenu: (Array.isArray(group?.subMenu) ? group.subMenu : []).filter(
+			(leaf) => String(leaf?.domain ?? "") !== key,
+		),
+	}));
 
 	for (const entry of entries) {
-		const path = groupPath(entry?.group);
-		if (path.length === 0 || !entry?.entryPoint) continue;
-
-		let level = kept;
-		path.forEach((caption, depth) => {
-			let group = level.find((node) => isGroup(node) && String(node?.caption ?? "") === caption);
-			if (!group) {
-				group = { caption, link: [], subMenu: [] };
-				/*
-				 * ⚠️ WHERE a group the host does not have is placed. Appending is fine for one stray leaf
-				 * and wrong for a domain that owns a whole group: "HR, beside Setup" appended after every
-				 * group the host emits is a group at the BOTTOM of the menu, which is not what was asked
-				 * for and not where anyone looks.
-				 *
-				 * ⚠️ ON CREATION ONLY, and for the TOP level only. Once the group exists, the find above keeps
-				 * its position, and so does the host's own injector, which concats into a group it finds
-				 * rather than re-appending. Every entry of a multi-screen domain therefore carries the same
-				 * hint and only the first one acts on it.
-				 *
-				 * ⚠️ AN ANCHOR THE HOST DOES NOT HAVE APPENDS. Declining to place the group would hide
-				 * every screen the domain owns — far worse than placing it last, and a domain cannot know
-				 * what groups its host happens to emit.
-				 */
-				const anchor = depth === 0 ? String(entry?.groupAfter ?? "").trim() : "";
-				const at = anchor ? level.findIndex((node) => String(node?.caption ?? "") === anchor) : -1;
-				if (at >= 0) level.splice(at + 1, 0, group);
-				else level.push(group);
-			}
-			level = group.subMenu;
-		});
+		const groupCaption = String(entry?.group ?? "").trim();
+		if (!groupCaption || !entry?.entryPoint) continue;
+
+		let group = kept.find((g) => String(g?.caption ?? "") === groupCaption);
+		if (!group) {
+			group = { caption: groupCaption, link: [], subMenu: [] };
+			/*
+			 * ⚠️ WHERE a group the host does not have is placed. Appending is fine for one stray leaf
+			 * and wrong for a domain that owns a whole group: "HR, beside Setup" appended after every
+			 * group the host emits is a group at the BOTTOM of the menu, which is not what was asked
+			 * for and not where anyone looks.
+			 *
+			 * ⚠️ ON CREATION ONLY. Once the group exists, `kept.find` above keeps its position, and so
+			 * does the host's own injector, which concats into a group it finds rather than
+			 * re-appending. Every entry of a multi-screen domain therefore carries the same hint and
+			 * only the first one acts on it.
+			 *
+			 * ⚠️ AN ANCHOR THE HOST DOES NOT HAVE APPENDS. Declining to place the group would hide
+			 * every screen the domain owns — far worse than placing it last, and a domain cannot know
+			 * what groups its host happens to emit.
+			 */
+			const anchor = String(entry?.groupAfter ?? "").trim();
+			const at = anchor ? kept.findIndex((g) => String(g?.caption ?? "") === anchor) : -1;
+			if (at >= 0) kept.splice(at + 1, 0, group);
+			else kept.push(group);
+		}
+		if (!Array.isArray(group.subMenu)) group.subMenu = [];
 
-		level.push({
+		group.subMenu.push({
 			caption: String(entry.caption ?? entry.entryPoint),
 			menuKey: String(entry.menuKey ?? entry.entryPoint),
-			link: linkFor(entry, entryPointTypes),
+			link: linkFor(entry),
 			/* §3.3's stamp: what the next publish uses to find exactly its own leaves. */
 			domain: key,
 		});
 	}
 
-	/*
-	 * A group that existed only to hold this domain's leaves, and now holds none, goes with them — at every depth,
-	 * so an emptied "FINA | Master" takes "FINA" with it when nothing else is left there. An empty group renders as a
-	 * dead parent nobody can open. A group whose source held another owner's leaf is left alone, because it was not
-	 * this publish's to remove.
-	 */
-	const foreignLeafUnder = (node) =>
-		(node?.subMenu ?? []).some((child) => (isGroup(child) ? foreignLeafUnder(child) : String(child?.domain ?? "") !== key));
-	const keepPaths = new Set();
-	const collectKept = (nodes, prefix) => {
-		for (const node of nodes) {
-			if (!isGroup(node)) continue;
-			const path = [...prefix, String(node?.caption ?? "")];
-			if (foreignLeafUnder(node)) keepPaths.add(path.join("\u0000"));
-			collectKept(node.subMenu, path);
-		}
-	};
-	collectKept(sourceMenus, []);
-	const prune = (nodes, prefix) =>
-		nodes
-			.map((node) => {
-				if (!isGroup(node)) return node;
-				const path = [...prefix, String(node?.caption ?? "")];
-				return { ...node, subMenu: prune(node.subMenu, path), __path: path.join("\u0000") };
-			})
-			.filter((node) => !isGroup(node) || node.subMenu.length > 0 || keepPaths.has(node.__path))
-			.map(({ __path, ...node }) => node);
+	/* A group that existed only to hold this domain's leaves, and now holds none, goes with them —
+	   an empty group renders as a dead parent nobody can open. The host's own empty groups are left
+	   alone, because they were not this publish's to remove. */
+	const hadDomainLeafOnly = (group) =>
+		(group?.subMenu ?? []).length === 0 &&
+		!sourceMenus.some(
+			(original) =>
+				String(original?.caption ?? "") === String(group?.caption ?? "") &&
+				(original?.subMenu ?? []).some((leaf) => String(leaf?.domain ?? "") !== key),
+		);
 
-	return { ...navigation, menus: prune(kept, []) };
+	return { ...navigation, menus: kept.filter((group) => !hadDomainLeafOnly(group)) };
 };
 
 /*

package/engine/domain/entityConfigLoader.js

@@ -12,7 +12,7 @@
  * applicationConfig.js performs at publish time, so the runtime reads exactly what was published.
  */
 import {
-	buildPostgresApplicationConfigsLookupSql,
+	buildPostgresApplicationConfigLookupSql,
 	parseDomainConfig,
 } from "./appConfig.js";
 import { parseConfigData } from "./applicationConfig.js";
@@ -67,22 +67,10 @@ const LATEST_BY_NAME = (name) =>
 	`SELECT version, data FROM ${PG_CONFIG_TABLE} WHERE name = '${String(name).replace(/'/g, "''")}' ORDER BY id DESC LIMIT 1`;
 
 /* Returns PARSED domain configs. `entityConfig.primeEntityConfig` takes this as its
-   `loadDomainConfigs`, which keeps that module a pure cache with no config-access dependency.
-
-   Doc 8 (2026-10-10): the domains of EVERY application on the tenant — the host's APPLICATION_CONFIG and
-   each `APPLICATION_CONFIG.<app>` — each domain once. A second app's entities are this hub's ORM
-   declarations and this tenant's tenancy just the same. */
+   `loadDomainConfigs`, which keeps that module a pure cache with no config-access dependency. */
 export const createDomainConfigLoader = ({ exec, dbIndex }) => async () => {
-	const appRows = await exec(buildPostgresApplicationConfigsLookupSql(), dbIndex);
-	const seen = new Set();
-	const sources = [];
-	for (const appRow of appRows ?? []) {
-		for (const [name, version] of domainSourcesOf(appRow?.data)) {
-			if (seen.has(name)) continue;
-			seen.add(name);
-			sources.push([name, version]);
-		}
-	}
+	const appRows = await exec(buildPostgresApplicationConfigLookupSql(), dbIndex);
+	const sources = domainSourcesOf(appRows?.[0]?.data);
 
 	const parsed = [];
 	for (const [name, namedVersion] of sources) {

package/engine/domain/numericScale.js

@@ -42,8 +42,6 @@ export const findImplicitNumericScale = (config) => {
 	for (const [entityName, entity] of entitiesOf(config)) {
 		const attributes = entity?.attributes;
 		if (!attributes || typeof attributes !== "object" || Array.isArray(attributes)) continue;
-		/* Doc 8 M3: an external entity is another system's table; the publish creates none of its columns. */
-		if (entity?.external === true || String(entity?.external ?? "").trim().toLowerCase() === "true") continue;
 		/* An entity may name no table; the entity key is what a reader would search for. */
 		const table = String(entity?.table ?? entityName);
 

package/engine/domain/system.js

@@ -56,8 +56,6 @@ export const publishApp = async (data, argv = {}) => {
 				data?.domainId,
 			files: params.files || params.fileList,
 			body: publishPayload,
-			/* Doc 8 (2026-10-10): the SYS$APPS row the published config names (publishApplicationConfig). */
-			...(params.appMeta ? { appMeta: params.appMeta } : {}),
 			/* Bundle mode fetches the encryption key from the Biz-A server BEFORE uploading, so a
 			   publish that loses the mode dials production even when the caller asked for local. */
 			serverMode: argv.serverMode || params.serverMode || "prod",

package/engine/ext/publicTheme.js

@@ -23,7 +23,6 @@
 import { APPLICATION_THEME_NAME } from "../domain/themeConfig.js";
 import { resolveThemeTokens } from "../domain/themePresets.js";
 import { COMPANY_THEME_NAME } from "../orm/companyTheme.js";
-import { COMPANY_LOCALE_NAME, readCompanyLocale } from "../orm/companyLocale.js";
 import {
 	COMPANY_LOGO_NAME,
 	readCompanyLogo,
@@ -39,9 +38,6 @@ export const PUBLIC_THEME_KEYS = [
 	APPLICATION_THEME_NAME,
 	COMPANY_THEME_NAME,
 	COMPANY_LOGO_NAME,
-	/* Agung 2026-10-10 — the number format (id / en-US): display only, so a customer page shows the merchant's amounts
-	   the merchant's way. */
-	COMPANY_LOCALE_NAME,
 ];
 
 /*
@@ -122,7 +118,7 @@ export const createPublicThemeReader = ({ resolveTenant, execFor }) => {
 			}
 		};
 
-		const [applicationRow, companyRow, logoRow, localeRow] = await Promise.all([
+		const [applicationRow, companyRow, logoRow] = await Promise.all([
 			readOne(APPLICATION_THEME_NAME, "ID, DATA"),
 			readOne(COMPANY_THEME_NAME, "ID, DATA"),
 			/*
@@ -132,7 +128,6 @@ export const createPublicThemeReader = ({ resolveTenant, execFor }) => {
 			 * time the theme is read. The image has its own endpoint and its own cache lifetime.
 			 */
 			readOne(COMPANY_LOGO_NAME, "ID"),
-			readOne(COMPANY_LOCALE_NAME, "ID, DATA"),
 		]);
 
 		const application = forCustomer(
@@ -149,8 +144,6 @@ export const createPublicThemeReader = ({ resolveTenant, execFor }) => {
 			   three things a customer is allowed to see. */
 			name: company?.name ?? application?.name ?? null,
 			hasLogo: logoRow !== null,
-			/* the merchant's number format; a missing or bad row is Indonesian (readCompanyLocale's rule) */
-			numberLocale: (await readCompanyLocale({ exec: async () => (localeRow ? [localeRow] : []) })).number,
 		};
 	};
 };