What the site claims about the framework, checked against the framework — plus a sixth gate so it stays checked

[oblomov-dev]

Eight commits, all from one method: read each page against z2ui5_if_client at the release this site names, and against the framework source, rather than against itself.

The corrections

abap_bool does not travel as "X". The data-type table said it arrives as the JSON string "X" / "", and the Boolean section built two workarounds on that: an expression binding {= ${/MV_FLAG} === 'X' }, and a parallel string attribute translated before and after every event. AJSON maps the boolean ABAP types to a JSON boolean and boolc( )s them back; z2ui5_cl_ui5_srv_model's own tests assert "VALIDATED":true on the wire, and not one sample in abap2UI5/samples compares a bound value to 'X' — they bind abap_bool straight onto selected. The first workaround can never tick a box; the second is boilerplate for nothing. Rewritten to "bind it directly", keeping the thing that does bite: the mapping is keyed on the type, so a flag declared c LENGTH 1 travels as a string.

The app state does not travel to the browser, and it is not only the public half. Six places said the controller is "serialized to the client and back" and that only PUBLIC SECTION attributes survive. db_save hands all_xml_stringify( ) to z2ui5_cl_ui5_srv_draft=>create( ), which does MODIFY z2ui5_t_01: the state is a row in the database and never leaves the server; the browser carries a draft id and gets a new one every roundtrip. And serialization is CALL TRANSFORMATION id over the whole instance — PUBLIC is what _bind( ) needs to reach an attribute, not what keeps it alive (z2ui5_cl_smp_app_009 keeps its whole employee table protected across events). The advice that followed from the wrong version pushed working state into the public section, which is the opposite of what the framework's own guide says.

The binding error is not silent. Four pages said a PROTECTED/PRIVATE attribute passed to _bind( ) fails silently with "no compile-time or runtime error", and sent the reader to the browser console. main_attri_search raises BINDING_ERROR - No class attribute for binding found …, nothing catches it, and it lands in the error view.

The Security page credited a CSP directive the framework deliberately omits. The quoted default policy ended frame-ancestors 'self'; the framework stops two directives earlier and says why at the line where it is not — browsers ignore frame-ancestors in a <meta> CSP, so framing is blocked by the X-Frame-Options header instead. The page named the wrong mechanism and handed the reader that directive twice more to copy. Also: t_security_header was the one cs_config field no page mentioned, so the seven response headers the framework sets now have a section.

API that 1.143.0 removed, still being taught on five pages: client->set_nav_routing( ) (a deleted method) in routing.md and navigation.md, cs_event-nav_to_route and cs_event-history_back in the cs_event block and the browser-history section, view_model_update( ) recommended as a fix in nested_views.md, _event_client( ) and the Z2UI5_CL_HTTP_HANDLER shim in logout.md and authorization.md.

Smaller ones: control_global has seven whitelisted objects, the reference table listed four (POPUP, INVISIBLE_MESSAGE and FORMATTING were missing — understating a whitelist tells the reader something is impossible); p/decfloat* and timestamp/timestampl are JSON numbers, not strings; the User Exits page linked Z2UI5_IF_EXIT at a path it left when it was retired to src/99, so the link 404'd; four references to Z2UI5_CL_DEMO_APP_* classes that exist under no prefix; the size-limit page presented all five view slots as independent when MAIN/NEST/NEST2 share one model and the largest limit wins; and the formatter module the framework ships (z2ui5/model/formatter — the four helpers 26 samples use) was documented nowhere, while the formatter page told the reader three times to write a custom JS formatter.

The gate

Finding those took reading every page against the interface at the release tag. check:examples is the check that should have caught them and cannot: it compiles the fenced blocks that are whole classes, and almost every one of these lived somewhere it does not reach — a sentence, a two-line snippet, a constant block reproduced for reference. That is most of what a reader copies.

check:api-names asks four questions of every page, against z2ui5_if_client fetched at the release this site names:

client->NAME(              is NAME a method?
NAME = inside that call    is it one of its parameters?   (fenced ABAP only)
cs_GROUP-MEMBER            is MEMBER in that constant group?
blob/main/… link           does it resolve?

1543 names and 8 source links across 137 pages, in about a second. Truth is the release, never main — a page is correct when it matches what the reader can install; A2UI5_REF points it at main for a canary run. Unreachable network skips rather than fails, like check:samples. Pages whose subject is the removed names (deprecations, changelog, the action page) are exempt, or the gate would forbid documenting a migration.

Wired into npm run check, check.yml and deploy.yml in the same position; the gate table in AGENTS.md goes from five to six.

How to test

npm run check. All six gates green on this branch, including against the ten-step walkthrough and the new home page that landed on main in the meantime.

---

Generated by Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.