unoverse 0.1.176 → 0.1.178

package/operator/lib/check.sh

@@ -138,7 +138,29 @@ cmd_check() {
     fail "Canvas ${DIM}http://localhost:3001 → $canvas_code${NC}"
   fi
 
-  # 6. NOTHING BILLING THAT TERRAFORM HAS LOST SIGHT OF.
+  # 6. NO PUBLISHED ITEM IS AN ORPHAN OF A RENAME.
+  #
+  # Publishing is a pure per-item upsert and the publisher cannot read this universe's
+  # rows, so a RENAME is invisible to it: the new name lands as a create and the old row is
+  # never touched. A caller picking the old name then gets an older vintage of the same UI,
+  # and nothing anywhere goes red. That is a property of THIS universe's data, which is why
+  # it is asked here and not in the release gate — a stale row on one box must never stop
+  # anybody shipping code (server/tests/items/orphaned-rows.check.ts carries the history).
+  if [ -d "$ROOT/apps/unoverse" ] && [ -d "$ROOT/node_modules" ]; then
+    total=$((total + 1))
+    if (cd "$ROOT/apps/unoverse" && npm run --silent check:universe >/dev/null 2>&1); then
+      ok "No orphaned item rows ${DIM}(every published item is still authored)${NC}"
+      pass=$((pass + 1))
+    else
+      fail "Orphaned item rows ${DIM}(a rename left a stale row behind)${NC}"
+      (cd "$ROOT/apps/unoverse" && npm run --silent check:universe 2>&1) | grep -E '^\s+better-|^\s+[a-z0-9-]+/' | while read -r o; do
+        [ -n "$o" ] && echo -e "      ${DIM}$o${NC}"
+      done
+      info "  Retire each row: ${BOLD}POST /marketplace/uninstall {kind, name}${NC} — deleting the folder does nothing"
+    fi
+  fi
+
+  # 7. NOTHING BILLING THAT TERRAFORM HAS LOST SIGHT OF.
   #
   # Terraform records what it creates as it creates it, so an interrupted apply does not
   # duplicate anything — the next run continues from state. Two cases break that, and both

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.176",
+  "version": "0.1.178",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",

package/vendor/base/lint/design/index.mjs

@@ -705,18 +705,20 @@ for (const orgDir of [DS, ...orgDirs]) {
       if (hookYaml && !Array.isArray(readDef(mf).allowedHosts))
         report("error", mf, `${custom} makes requests, so this manifest must declare "allowedHosts". Deny by default: no list, no network`);
 
-      // A NAME with no definition behind it is a key nobody can ever enter: nothing offers
-      // a form for it, the hook runs credential-less, the vendor refuses, and the card
-      // renders its preview defaults with no error anywhere. Caught here instead. Skipped
-      // when no definition was found at all, since that means the nodes tree is absent
-      // rather than the name being wrong.
+      // A credential is a NAME (owner ruling 2026-08-26): it references a value that
+      // exists in the universe or does not, and shipping NEVER blocks on it — the gap is
+      // a WARNING here and a loud runtime warning when the hook runs without it
+      // (resolveCredentials says so on every keyless run). A missing DEFINITION only
+      // means no package offers a pre-built entry form; the value can still be provided.
+      // This was an org-blocking error until it stopped a yasisland deploy over a form
+      // nobody needed that day.
       if (credentialDefs.size)
         for (const cname of Array.isArray(readDef(mf).credentials) ? readDef(mf).credentials : [])
           if (!credentialDefs.has(String(cname)))
             report(
-              "error",
+              "warn",
               mf,
-              `credential "${cname}" has no definition in any installed node package, so nothing can offer a form to enter it. Install the package that defines it, or name one that exists: ${[...credentialDefs].sort().join(", ")}`,
+              `credential "${cname}" has no definition in any installed node package, so no pre-built form exists to enter it — the hook will run without it until a value is provided. Installed definitions: ${[...credentialDefs].sort().join(", ")}`,
             );
 
     }