From d1790b7464c4bba638bb12a361fc5f0cfaff4d6c Mon Sep 17 00:00:00 2001
From: Claude <tmswyer@gmail.com>
Date: Fri, 21 Aug 2026 16:31:48 +0000
Subject: [PATCH 1/6] P0/P1: route the backend on BTP, and close the app's
 security gaps

ROUTING (P0) -- the deployed app could not have worked. mta.yaml has always
declared an abap2UI5-srv destination pointing at the CAP module, and
xs-app.json never routed anything to it: its last route is a catch-all to the
static HTML5 repository, so every POST /rest/root/z2ui5 roundtrip went to the
file store instead of the service. Nothing noticed, because jest runs against a
local cds server that never sees the approuter and deploy-check deliberately
skips mbt build. Routes added for the roundtrip, the OData service and /health;
src/test/approuter-routes.test.js pins the contract, the order (backend routes
must beat the catch-all), the auth types, and that every destination a route
names exists in mta.yaml.

csrfProtection is false on the roundtrip route deliberately: the webapp posts
with no CSRF token and never fetches one, so the approuter's default would 403
every roundtrip. CSRF is defended one layer down instead -- see below.

SECURITY (P1):

- The services now require the declared `User` role instead of merely
  `authenticated-user`. xs-security.json had declared the $XSAPPNAME.User scope
  and a role template since the beginning and nothing referenced them, so the
  authorization model existed on paper while every authenticated user in the
  subaccount passed, role collection assigned or not. The mocked development
  users carry the same role, so local and test flows are unchanged.
- Security headers now reach the DATA endpoints. Only the bootstrap page
  applied the framework's t_security_header; the roundtrip and the OData
  entities -- the responses that actually carry application state -- answered
  with no nosniff, no frame guard, and cacheable by any intermediary.
- The request body is capped explicitly (Z2UI5_MAX_BODY, default 2mb). The
  action takes an @open object, so CDS validates nothing, and the only limit
  was express's 100kb default applying by accident rather than by decision.
- Draft retention had disagreed with the framework about its own TTL -- this
  job deleted at 24h while the exit's draft_exp_time_in_hours said 4h, with
  nothing connecting them. The framework value is now the source of truth and
  the env var overrides both. It also ran on every instance, so N instances
  meant N concurrent hourly DELETEs over the same rows; it now runs on one
  (Z2UI5_DRAFT_RETENTION_INSTANCE, default CF instance 0).
- Indexes for the two non-primary-key access paths, as HANA design-time
  artifacts in db/src: createdAt, because the hourly retention DELETE was a
  full scan whose cost grew with the very table it exists to contain, and
  owner, because the service projection filters on it. Verified to reach
  gen/db/src through `cds build --production`.
- mta.yaml declares instances: 1. Sticky app state lives in the serving
  process with no session affinity configured, so scaling out produces
  intermittent, hard-to-reproduce state loss. The comment says what to fix
  before raising it.
- dependabot gains the npm ecosystem in the app repo, which it never had -- no
  runtime dependency of the deployed app was ever proposed for update. CAP
  packages are grouped (they version together); openui5-dist is ignored,
  because that pin is a compatibility decision tracked upstream.
- npm audit runs on the shipped lock in the app repo's CI, advisory for now.

README's security section documented the role and CSRF gaps honestly; it now
documents what replaced them, and the sticky/multi-instance limitation that
remains.

builder 30 tests, app 44 tests (was 23), lint clean, cds build --production ok.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2gZuy95uKcT2zngQd1sAL
---
 run/input/UPSTREAM_COMMIT                     |   2 +-
 run/input/core/package.json                   |   1 +
 run/input/core/srv/z2ui5/00/03/z2ui5_html.js  |  73 +++++++++++
 .../srv/z2ui5/01/02/z2ui5_cl_ui5_app_cont.js  |   9 ++
 .../z2ui5/01/03/z2ui5_cl_ui5f_index_html.js   |  31 ++++-
 .../srv/z2ui5/01/04/z2ui5_cl_ui5_user_exit.js |  21 +++
 .../srv/z2ui5/02/z2ui5_cl_ui5_http_handler.js |  53 ++++++--
 run/input/core/srv/z2ui5/02/z2ui5_if_types.js |   1 +
 run/input/core/srv/z2ui5/z2ui5_port.js        |  60 ++++++++-
 src/README.md                                 |  41 +++++-
 src/app/z2ui5/xs-app.json                     |  19 +++
 src/db/schema.cds                             |   6 +
 src/db/src/z2ui5_t_01_createdat.hdbindex      |   9 ++
 src/db/src/z2ui5_t_01_owner.hdbindex          |   8 ++
 src/mta.yaml                                  |  12 ++
 src/package.json                              |   6 +-
 src/srv/draft-retention.js                    |  63 ++++++++-
 src/srv/server.js                             |  30 +++++
 src/srv/z2ui5-service.cds                     |  27 ++--
 src/test/approuter-routes.test.js             | 100 +++++++++++++++
 src/test/security.test.js                     | 121 ++++++++++++++++++
 21 files changed, 653 insertions(+), 40 deletions(-)
 create mode 100644 run/input/core/srv/z2ui5/00/03/z2ui5_html.js
 create mode 100644 src/db/src/z2ui5_t_01_createdat.hdbindex
 create mode 100644 src/db/src/z2ui5_t_01_owner.hdbindex
 create mode 100644 src/test/approuter-routes.test.js
 create mode 100644 src/test/security.test.js

diff --git a/run/input/UPSTREAM_COMMIT b/run/input/UPSTREAM_COMMIT
index b29afff..fa85b1e 100644
--- a/run/input/UPSTREAM_COMMIT
+++ b/run/input/UPSTREAM_COMMIT
@@ -1 +1 @@
-7d1d58fb03e25330c632466412fd3824a7ee9ca8
+21bf2a69ea941e0c522eaf85c2495e0eff5bc87d
diff --git a/run/input/core/package.json b/run/input/core/package.json
index ec820a6..d6b2cff 100644
--- a/run/input/core/package.json
+++ b/run/input/core/package.json
@@ -19,6 +19,7 @@
     "./cx_root": "./srv/z2ui5/00/00/cx_root.js",
     "./z2ui5_cl_ui5_util_*": "./srv/z2ui5/00/03/z2ui5_cl_ui5_util_*.js",
     "./z2ui5_cx_ui5_util_error": "./srv/z2ui5/00/03/z2ui5_cx_ui5_util_error.js",
+    "./z2ui5_html": "./srv/z2ui5/00/03/z2ui5_html.js",
     "./z2ui5_cl_ui5_srv_draft": "./srv/z2ui5/01/01/z2ui5_cl_ui5_srv_draft.js",
     "./z2ui5_cl_ui5_app_cont": "./srv/z2ui5/01/02/z2ui5_cl_ui5_app_cont.js",
     "./z2ui5_cl_ui5_app_*": "./srv/z2ui5/01/04/z2ui5_cl_ui5_app_*.js",
diff --git a/run/input/core/srv/z2ui5/00/03/z2ui5_html.js b/run/input/core/srv/z2ui5/00/03/z2ui5_html.js
new file mode 100644
index 0000000..b4f32f6
--- /dev/null
+++ b/run/input/core/srv/z2ui5/00/03/z2ui5_html.js
@@ -0,0 +1,73 @@
+/**
+ * z2ui5_html — HTML escaping for the bootstrap page.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * The bootstrap page (z2ui5_cl_ui5f_index_html, and the equivalent builder in
+ * z2ui5_cl_ui5_http_handler._http_get) interpolates exit-supplied configuration
+ * straight into markup: the tab title into <title>, the favicon URI into a
+ * <link href>, the bootstrap src and theme into script attributes, and every
+ * t_add_config row into a single-quoted data-sap-ui-* attribute.
+ *
+ * None of it was escaped. That was survivable only as long as every value is a
+ * constant the framework itself sets — but the exit receives the request
+ * context (init_context / set_config_http_get see path, params and headers), so
+ * the moment an app reflects a query parameter into its title or into an extra
+ * config row, the page hands an attacker an injection point. A `'` closes the
+ * attribute; a `</title>` closes the element.
+ *
+ * These helpers make that impossible by construction, and give an exit author
+ * something to call for their own interpolation:
+ *
+ *   const { escape_text, escape_attr } = require("abap2UI5/z2ui5_html");
+ *
+ * Escaping is deliberately conservative — the same replacements in both
+ * helpers plus the quote characters — so a value is safe in element text, in a
+ * single-quoted attribute and in a double-quoted one alike, and a caller
+ * cannot pick the wrong one.
+ */
+"use strict";
+
+const REPLACEMENTS = [
+  [/&/g, `&amp;`],   // first, or it would double-escape the entities below
+  [/</g, `&lt;`],
+  [/>/g, `&gt;`],
+  [/"/g, `&quot;`],
+  [/'/g, `&#39;`],
+];
+
+function escape(val) {
+  let out = val === null || val === undefined ? `` : String(val);
+  for (const [re, to] of REPLACEMENTS) out = out.replace(re, to);
+  return out;
+}
+
+/** Escape a value for HTML element text (e.g. between <title> and </title>). */
+module.exports.escape_text = escape;
+
+/** Escape a value for an HTML attribute, single- or double-quoted. */
+module.exports.escape_attr = escape;
+
+/**
+ * Escape a URI destined for a DOUBLE-QUOTED attribute (href="…", src="…"),
+ * and reject the schemes a URI context makes dangerous: `javascript:` and
+ * `vbscript:` execute on click or on load. A rejected value yields the empty
+ * string, which callers treat as "not configured" and omit the element
+ * entirely rather than emitting a live but broken attribute.
+ *
+ * Escapes only `&` and `"` — the two characters that can end the attribute or
+ * start an entity in this context. It deliberately does NOT escape `<`, `>`
+ * or `'`: they are inert inside a double-quoted attribute value, and encoding
+ * them would corrupt legitimate URIs. The shipped favicon is the worked
+ * example — `data:image/svg+xml,<svg …fill='%23fff'>` has to survive intact,
+ * and upstream's own test asserts the page contains `data:image/svg+xml,<svg`
+ * literally. Use escape_attr, not this, for a single-quoted attribute.
+ */
+module.exports.escape_uri = function escape_uri(val) {
+  const raw = val === null || val === undefined ? `` : String(val);
+  // Strip control characters and whitespace before sniffing the scheme:
+  // `java\tscript:` and `java\nscript:` are parsed as javascript: by browsers.
+  const sniff = raw.replace(/[\u0000-\u0020]/g, ``).toLowerCase();
+  if (sniff.startsWith(`javascript:`) || sniff.startsWith(`vbscript:`)) return ``;
+  return raw.replace(/&/g, `&amp;`).replace(/"/g, `&quot;`);
+};
diff --git a/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_app_cont.js b/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_app_cont.js
index 7e2fcf3..596bb2c 100644
--- a/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_app_cont.js
+++ b/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_app_cont.js
@@ -96,7 +96,16 @@ class z2ui5_cl_ui5_app_cont {
   db_save() {
     if (this.mo_app) {
       this.mo_app.id_draft = this.ms_draft.id;
+      // Upstream keeps the lifecycle latch on the WRAPPER (mv_check_initialized
+      // on z2ui5_cl_ui5_app_cont), not on z2ui5_if_app. This port reads it off
+      // the app — the field is excluded from serialization there
+      // (srv_model's skip set, client's _FRAMEWORK_FIELDS) and the client's
+      // check_on_init decision is built around that, so moving it wholesale is
+      // a refactor, not a fix. Stamp both: the app copy stays the one the port
+      // reads, and the container carries upstream's documented field so
+      // anything reading the ABAP contract sees the same answer.
       this.mo_app.check_initialized = true;
+      this.mv_check_initialized = true;
     }
     const blob = this.all_xml_stringify();
     new DB().create({ draft: this.ms_draft, model_xml: blob });
diff --git a/run/input/core/srv/z2ui5/01/03/z2ui5_cl_ui5f_index_html.js b/run/input/core/srv/z2ui5/01/03/z2ui5_cl_ui5f_index_html.js
index 2eaa9ce..aee7041 100644
--- a/run/input/core/srv/z2ui5/01/03/z2ui5_cl_ui5f_index_html.js
+++ b/run/input/core/srv/z2ui5/01/03/z2ui5_cl_ui5f_index_html.js
@@ -25,15 +25,34 @@ class z2ui5_cl_ui5f_index_html {
    */
   static get_source(config) {
     const cfg = config || z2ui5_cl_ui5f_index_html._default_config();
+    // Everything below is interpolated into markup, and an exit can derive any
+    // of it from the request (it receives path/params/headers). Escape at the
+    // boundary so a reflected value cannot close an attribute or an element.
+    // `content_security_policy` is deliberately NOT escaped: it is a whole
+    // <meta> tag by contract, not a value.
+    const html = require(`../../00/03/z2ui5_html`);
     const csp   = cfg.content_security_policy || ``;
-    const title = cfg.title || `cap2UI5`;
-    const theme = cfg.theme || `sap_horizon`;
-    const src   = cfg.src   || `https://sdk.openui5.org/resources/sap-ui-cachebuster/sap-ui-core.js`;
+    const title = html.escape_text(cfg.title || `cap2UI5`);
+    const theme = html.escape_attr(cfg.theme || `sap_horizon`);
+    const src   = html.escape_uri(cfg.src || `https://sdk.openui5.org/resources/sap-ui-cachebuster/sap-ui-core.js`);
 
-    // Extra <script> data-sap-ui-* params from t_add_config.
+    // The tab icon, same contract as in z2ui5_cl_ui5_http_handler._http_get:
+    // the exit sets a URI and the page carries it as <link rel="icon">; an
+    // exit that clears the field gets no <link> at all rather than one
+    // pointing nowhere. This is the page CAP actually serves (via
+    // engine.bootstrap_html), so without it the deployed app had no tab icon
+    // even though the exit set one.
+    const faviconUri = html.escape_uri(cfg.favicon);
+    const favicon = faviconUri ? `\t<link rel="icon" href="${faviconUri}">\n` : ``;
+
+    // Extra <script> data-sap-ui-* params from t_add_config. The NAME is
+    // restricted rather than escaped — an attribute name is not a quoted
+    // context, so anything outside the allowed shape is dropped, not encoded.
     let addAttrs = ``;
     for (const row of (cfg.t_add_config || [])) {
-      addAttrs += ` ${row.n}='${row.v}'`;
+      const n = String(row?.n ?? ``);
+      if (!/^[A-Za-z_][A-Za-z0-9_:.-]*$/.test(n)) continue;
+      addAttrs += ` ${n}='${html.escape_attr(row.v)}'`;
     }
 
     return `<!DOCTYPE html>
@@ -43,7 +62,7 @@ ${csp}
 \t<meta charset="UTF-8">
 \t<meta name="viewport" content="width=device-width, initial-scale=1.0">
 \t<title>${title}</title>
-
+${favicon}
 \t<script
 \t\tid="sap-ui-bootstrap"
 \t\tsrc="${src}"
diff --git a/run/input/core/srv/z2ui5/01/04/z2ui5_cl_ui5_user_exit.js b/run/input/core/srv/z2ui5/01/04/z2ui5_cl_ui5_user_exit.js
index d906646..66c00e2 100644
--- a/run/input/core/srv/z2ui5/01/04/z2ui5_cl_ui5_user_exit.js
+++ b/run/input/core/srv/z2ui5/01/04/z2ui5_cl_ui5_user_exit.js
@@ -121,6 +121,20 @@ class z2ui5_cl_ui5_user_exit {
   _config_http_get(is_context, cs_config = {}) {
     cs_config.title = `abap2UI5`;
     cs_config.theme = `sap_horizon`;
+
+    // The tab icon, next to the tab title. An SVG data URI rather than a file:
+    // the page is built here and has no static resources of its own, and the
+    // default CSP below already allows `data:`. An app that wants its own icon
+    // sets this field in its exit the way it sets the title — or clears it, and
+    // gets no <link> at all (the browser then falls back to /favicon.ico).
+    cs_config.favicon =
+      `data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' ` +
+      `viewBox='0 0 40 40' fill='%23fff' font-family='sans-serif' ` +
+      `font-size='11' font-weight='bold' text-anchor='middle'>` +
+      `<circle cx='20' cy='20' r='20' fill='%23d03c4a'/>` +
+      `<text x='20' y='18'>abap</text>` +
+      `<text x='20' y='31'>2UI5</text></svg>`;
+
     // Local UI5 runtime served by the CAP server at /resources (openui5-dist
     // dependency, see srv/server.js) — keeps the stack offline-capable.
     cs_config.src   = `/resources/sap-ui-core.js`;
@@ -188,6 +202,13 @@ class z2ui5_cl_ui5_user_exit {
   _config_http_post(is_context, cs_config = {}) {
     cs_config.draft_exp_time_in_hours = 4;
 
+    // CSRF protection is ON by default (2026-08). It used to be opt-in and
+    // nothing opted in, so the shipped app ran with the gate inert. The check
+    // costs nothing for first-party traffic — the frontend posts JSON from the
+    // same origin — and an app that fronts this endpoint with its own
+    // protection can still set `false` in its own exit.
+    cs_config.check_csrf_active = true;
+
     if (z2ui5_cl_ui5_user_exit._gi_user_exit) {
       const ctx = is_context ?? z2ui5_cl_ui5_user_exit._get_context();
       const ret = z2ui5_cl_ui5_user_exit._gi_user_exit.set_config_http_post(ctx, cs_config);
diff --git a/run/input/core/srv/z2ui5/02/z2ui5_cl_ui5_http_handler.js b/run/input/core/srv/z2ui5/02/z2ui5_cl_ui5_http_handler.js
index 969eca0..15ce533 100644
--- a/run/input/core/srv/z2ui5/02/z2ui5_cl_ui5_http_handler.js
+++ b/run/input/core/srv/z2ui5/02/z2ui5_cl_ui5_http_handler.js
@@ -33,12 +33,13 @@ module.exports = async function service(req) {
   }
 
   // CSRF gate (ABAP main( ), POST branch): a CDS action call is always a
-  // POST, the only method that can change state. Opt-in via the exit config
-  // (check_csrf_active, default off — nothing is rejected then).
+  // POST, the only method that can change state. ON by default since 2026-08
+  // (the shipped exit sets check_csrf_active); an app that fronts the endpoint
+  // with its own protection can still switch it off in its exit.
   try {
     const cfg = {};
     require(`../01/04/z2ui5_cl_ui5_user_exit`).get_instance().set_config_http_post({ cs_config: cfg });
-    if (cfg.check_csrf_active === true) {
+    if (cfg.check_csrf_active !== false) {
       const h = innerReq?.headers || {};
       const rejected = module.exports._check_csrf_rejected({
         active: true,
@@ -89,10 +90,29 @@ module.exports._csrf_host_authority = function _csrf_host_authority(val) {
 
 /**
  * ABAP CLASS-METHODS _check_csrf_rejected — pure and side-effect free so it
- * is unit-testable without a server mock. Returns true only when csrf is
- * active AND an Origin/Referer is present AND its host authority differs
- * from the app's own Host header. Lenient by design: nothing to compare →
- * allow (do not lock out proxies/old clients that strip these headers).
+ * is unit-testable without a server mock. Returns true when the request must
+ * be rejected as cross-site.
+ *
+ * Rejects when an Origin (preferred) or Referer is present and its host
+ * authority differs from the app's own Host. A browser always sends Origin on
+ * a cross-origin POST and cannot be talked out of it, so this catches the case
+ * that matters.
+ *
+ * With NEITHER header present it allows, matching upstream
+ * (ltcl_test_http_handler~test_csrf_no_headers pins this: "lenient: no Origin
+ * and no Referer -> allowed (proxies / old clients)"). A stricter rule was
+ * tried here in 2026-08 — require a JSON content type, on the reasoning that a
+ * cross-site <form> can only send the three simple types — and reverted: it
+ * contradicts that published contract and breaks non-browser callers that post
+ * without either header. The vector it aimed at is already closed one layer up
+ * in this deployment: CDS accepts an action call only as `application/json`,
+ * which a form cannot produce, and the approuter forwards a JWT the attacker's
+ * page cannot obtain. An app that terminates HTTP itself, without those two
+ * properties, should add its own check in the exit.
+ *
+ * What DID change: the gate is now active by default (see
+ * z2ui5_cl_ui5_user_exit._config_http_post). It was opt-in, and nothing opted
+ * in, so every cross-origin POST was accepted.
  */
 module.exports._check_csrf_rejected = function _check_csrf_rejected(a) {
   const { active = false, origin = ``, referer = ``, host = `` } = a || {};
@@ -129,6 +149,18 @@ module.exports._http_get = function _http_get() {
     if (typeof pre.get === `function`) preload = pre.get({ styles_css: styles, custom_js: cfg.custom_js || `` });
   } catch { /* optional — the webapp is served statically on JS platforms */ }
 
+  // Everything the exit supplies is interpolated into markup, and an exit can
+  // derive any of it from the request, so escape at the boundary. `escape_uri`
+  // additionally drops javascript:/vbscript: — an href is a live context, and
+  // an empty result means "not configured", which the callers already handle.
+  const html = require(`../00/03/z2ui5_html`);
+
+  // The tab icon is config, like the title: the exit sets a URI and the page
+  // carries it as <link rel="icon">. An exit that clears the field gets no
+  // <link> at all rather than one pointing nowhere.
+  const faviconUri = html.escape_uri(cfg.favicon);
+  const favicon = faviconUri ? `    <link rel="icon" href="${faviconUri}">\n` : ``;
+
   const body =
     `<!DOCTYPE html>\n` +
     `<html lang="en">\n` +
@@ -136,11 +168,12 @@ module.exports._http_get = function _http_get() {
     `${cfg.content_security_policy || ``}\n` +
     `    <meta charset="UTF-8">\n` +
     `    <meta name="viewport" content="width=device-width, initial-scale=1.0">\n` +
-    `    <title>${cfg.title || `abap2UI5`}</title>\n` +
+    `    <title>${html.escape_text(cfg.title || `abap2UI5`)}</title>\n` +
+    favicon +
     `    <style> html, body, body > div, #container, #container-uiarea { height: 100%; } </style>\n` +
     `    <script>${preload}</script>\n` +
-    `    <script id="sap-ui-bootstrap" src="${cfg.src || `/resources/sap-ui-core.js`}"\n` +
-    `        data-sap-ui-theme="${cfg.theme || `sap_horizon`}"\n` +
+    `    <script id="sap-ui-bootstrap" src="${html.escape_uri(cfg.src || `/resources/sap-ui-core.js`)}"\n` +
+    `        data-sap-ui-theme="${html.escape_attr(cfg.theme || `sap_horizon`)}"\n` +
     `        data-sap-ui-async="true"\n` +
     `        data-sap-ui-bindingSyntax="complex"\n` +
     `        data-sap-ui-resourceroots='{ "z2ui5": "./" }'>\n` +
diff --git a/run/input/core/srv/z2ui5/02/z2ui5_if_types.js b/run/input/core/srv/z2ui5/02/z2ui5_if_types.js
index 9449099..796a4ff 100644
--- a/run/input/core/srv/z2ui5/02/z2ui5_if_types.js
+++ b/run/input/core/srv/z2ui5/02/z2ui5_if_types.js
@@ -44,6 +44,7 @@ const z2ui5_if_types = Object.freeze({
    * @property {ty_t_name_value} t_add_config
    * @property {string} custom_js
    * @property {ty_t_name_value} t_security_header
+   * @property {string} favicon  tab icon URI; empty means no <link rel="icon">
    */
 
   /**
diff --git a/run/input/core/srv/z2ui5/z2ui5_port.js b/run/input/core/srv/z2ui5/z2ui5_port.js
index c9c8400..bb796bd 100644
--- a/run/input/core/srv/z2ui5/z2ui5_port.js
+++ b/run/input/core/srv/z2ui5/z2ui5_port.js
@@ -25,12 +25,61 @@
  *
  * `sy_subrc` mirrors ABAP: 0 when a row was found/affected, 4 otherwise. The
  * generated code reads it right after each op.
+ *
+ * ON PLATFORMS WITH A REAL DATABASE THIS IS A CACHE, NOT THE TRUTH
+ * ----------------------------------------------------------------
+ * Read this before concluding (as a 2026-08 review did) that the port keeps
+ * two rival draft stores and wires only one. On CAP the app wires an async,
+ * CDS-backed store through `engine.set_store()`, and the two layers compose
+ * deliberately:
+ *
+ *   z2ui5_cl_ui5_app_cont.db_load(id)
+ *     1. process buffer
+ *     2. THIS store, synchronously          ← the fast path
+ *     3. await the async platform store     ← the truth (CDS / HANA)
+ *
+ * The sync ABAP-shaped methods (`create`, `read_draft`, `read_info`,
+ * `check_exists`, `count_entries*`) exist because the transpiled ABAP is
+ * synchronous and cannot await. They answer from this store; a miss is not an
+ * error, it falls through to the real one. That is why back-navigation still
+ * works on a cold process or a second CF instance: `check_exists` answering
+ * false takes the "new app — keep the current chain" branch rather than
+ * breaking.
+ *
+ * What that composition does NOT excuse, and what the bound below fixes: this
+ * store held every draft payload ever written, for the life of the process,
+ * with nothing evicting them. `cleanup()` only ever ran against whatever the
+ * app asked for, so on a long-lived server the cache grew without limit —
+ * duplicating in RAM data the database already had. It is now bounded per
+ * table (oldest-written evicted first), which is safe precisely because a miss
+ * costs a fall-through to the durable store rather than a wrong answer.
+ *
+ * Two properties consumers should know: it is per-process (never shared
+ * between CF instances) and it does not survive a restart. Anything needing
+ * either must go through the async store.
  */
 "use strict";
 
 // primary key per table — MODIFY upserts on it. z2ui5_t_91 is keyed by id.
 const TABLE_KEYS = { z2ui5_t_91: ["id"] };
 
+// Per-table row cap. Draft rows carry a full serialized app in `data`, so an
+// unbounded table is a real leak on a long-running server. Sized like the
+// engine's sticky-handler bound: big enough that an interactive session keeps
+// hitting the fast path, small enough to stay bounded. Override for a process
+// that legitimately needs more (or 0 to disable eviction entirely).
+//
+// Read per call rather than captured at load: a host that sets the variable
+// after requiring the module still gets the bound it asked for, and the value
+// is one env lookup against an array scan that is already O(rows).
+const DEFAULT_MAX_ROWS_PER_TABLE = 500;
+function maxRowsPerTable() {
+  const raw = process.env.Z2UI5_PORT_MAX_ROWS;
+  if (raw === undefined || raw === ``) return DEFAULT_MAX_ROWS_PER_TABLE;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : DEFAULT_MAX_ROWS_PER_TABLE;
+}
+
 class InMemoryStore {
   constructor() { this.tables = new Map(); }
   _rows(table) {
@@ -42,8 +91,15 @@ class InMemoryStore {
     const keys = TABLE_KEYS[table] || ["id"];
     const rows = this._rows(table);
     const i = rows.findIndex((r) => keys.every((k) => r[k] === row[k]));
-    if (i >= 0) rows[i] = { ...row };
-    else rows.push({ ...row });
+    if (i >= 0) {
+      rows[i] = { ...row };
+    } else {
+      rows.push({ ...row });
+      // Evict oldest-written first. Insertion order is append order, so the
+      // front of the array is the coldest entry.
+      const cap = maxRowsPerTable();
+      if (cap > 0 && rows.length > cap) rows.splice(0, rows.length - cap);
+    }
   }
   remove(table, where) {
     const rows = this._rows(table);
diff --git a/src/README.md b/src/README.md
index 5d05fea..f13a5ce 100644
--- a/src/README.md
+++ b/src/README.md
@@ -149,11 +149,13 @@ covers the view builder.
 
 ## Security model
 
-**Authenticated by default.** Both services carry
-`@(requires: 'authenticated-user')` ([`srv/z2ui5-service.cds`](srv/z2ui5-service.cds)),
+**Role-restricted by default.** Both services carry
+`@(requires: 'User')` ([`srv/z2ui5-service.cds`](srv/z2ui5-service.cds)),
 `package.json` binds `cds.requires.auth` to `xsuaa` in the production profile
 and to mocked users in development, and [`xs-security.json`](xs-security.json)
-declares the `$XSAPPNAME.User` scope with a matching role template.
+declares the `$XSAPPNAME.User` scope with the matching role template CAP maps
+that name onto. Authentication alone is not enough: a user of the subaccount
+who was never granted the role gets a 403, not a session.
 
 What is authenticated, and what is not:
 
@@ -178,10 +180,35 @@ sticky app state is keyed per session through the framework's identity port
 [`test/isolation.test.js`](test/isolation.test.js) holds the regression net for
 all of it.
 
-**Before going productive**, review two things this repository leaves at demo
-level: the services require `authenticated-user` rather than the declared
-`User` scope (so every subaccount user passes, whether or not the role is
-assigned), and the CSRF gate in the framework's user exit is off by default.
+**Hardening applied here** (each of these was a gap until 2026-08, and each
+has a regression test in [`test/security.test.js`](test/security.test.js)):
+
+- the services require the declared `User` role, not merely
+  `authenticated-user` -- the scope had been declared and never referenced, so
+  every authenticated subaccount user passed regardless of role assignment;
+- the framework's CSRF gate is **on** by default (it was opt-in, and nothing
+  opted in), rejecting a POST whose `Origin`/`Referer` does not match the
+  application host. With neither header present it allows, matching upstream:
+  the cross-site form vector is closed a layer up, since CDS accepts an action
+  call only as `application/json` and the approuter forwards a JWT;
+- the roundtrip and the OData entities answer with `X-Content-Type-Options`,
+  `X-Frame-Options`, `Referrer-Policy` and `Cache-Control: no-store` -- only
+  the bootstrap page carried headers before;
+- the request body is capped explicitly (`Z2UI5_MAX_BODY`, default 2mb) rather
+  than relying on the express default applying by accident;
+- draft retention follows the framework's own expiry instead of disagreeing
+  with it, runs on one instance rather than all of them, and the two columns it
+  and the owner filter scan (`createdAt`, `owner`) are indexed
+  ([`db/src/`](db/src)).
+
+**Before going productive**, two properties are still worth knowing. The
+`GET`/`HEAD` bootstrap routes are public by design (see the table above). And
+retained *sticky* app state lives in the serving process, so it is neither
+shared between instances nor restored after a restart -- scale beyond one
+instance and a sticky session can land on an instance that never saw it. The
+draft chain itself is durable in the database and unaffected; `mta.yaml`
+therefore declares a single instance until session affinity or a shared sticky
+store exists.
 
 ## Transpiling from ABAP
 
diff --git a/src/app/z2ui5/xs-app.json b/src/app/z2ui5/xs-app.json
index 3bdf638..e7d3716 100644
--- a/src/app/z2ui5/xs-app.json
+++ b/src/app/z2ui5/xs-app.json
@@ -14,6 +14,25 @@
       "destination": "ui5",
       "authenticationType": "none"
     },
+    {
+      "source": "^/rest/root/z2ui5(.*)$",
+      "target": "/rest/root/z2ui5$1",
+      "destination": "abap2UI5-srv",
+      "authenticationType": "xsuaa",
+      "csrfProtection": false
+    },
+    {
+      "source": "^/odata/(.*)$",
+      "target": "/odata/$1",
+      "destination": "abap2UI5-srv",
+      "authenticationType": "xsuaa"
+    },
+    {
+      "source": "^/health$",
+      "target": "/health",
+      "destination": "abap2UI5-srv",
+      "authenticationType": "none"
+    },
     {
       "source": "^(.*)$",
       "target": "$1",
diff --git a/src/db/schema.cds b/src/db/schema.cds
index e8ec3e9..523e451 100644
--- a/src/db/schema.cds
+++ b/src/db/schema.cds
@@ -19,3 +19,9 @@ entity z2ui5_t_01 {
         data      : LargeString;
         createdAt : Timestamp @cds.on.insert: $now;
 }
+
+// Indexes on `createdAt` and `owner` are shipped as HANA design-time
+// artifacts in db/src/*.hdbindex — see the comment in those files for why
+// each one exists. They are deliberately not CDS annotations: CAP has no
+// portable index syntax, and the production database is HANA
+// (package.json → cds.requires.db."[production]").
diff --git a/src/db/src/z2ui5_t_01_createdat.hdbindex b/src/db/src/z2ui5_t_01_createdat.hdbindex
new file mode 100644
index 0000000..9ac0a23
--- /dev/null
+++ b/src/db/src/z2ui5_t_01_createdat.hdbindex
@@ -0,0 +1,9 @@
+-- Retention scan index.
+--
+-- srv/draft-retention.js runs `DELETE ... WHERE createdAt < cutoff` once an
+-- hour, forever, against a table that gains one row per roundtrip -- dozens
+-- per minute per active user. Without this index that delete is a full table
+-- scan whose cost grows with the table, so the job that exists to contain the
+-- growth was itself scaling with it.
+INDEX "CAP2UI5_Z2UI5_T_01_CREATEDAT_IDX"
+  ON "CAP2UI5_Z2UI5_T_01" ("CREATEDAT" ASC)
diff --git a/src/db/src/z2ui5_t_01_owner.hdbindex b/src/db/src/z2ui5_t_01_owner.hdbindex
new file mode 100644
index 0000000..76e6fba
--- /dev/null
+++ b/src/db/src/z2ui5_t_01_owner.hdbindex
@@ -0,0 +1,8 @@
+-- Owner-filter index.
+--
+-- The AdminService projection restricts every read to `owner = $user`
+-- (srv/z2ui5-service.cds), and the draft store filters on owner again on its
+-- own path (srv/server.js). Single-row loads hit the primary key and were
+-- always fine; anything that lists or counts a user's drafts was a full scan.
+INDEX "CAP2UI5_Z2UI5_T_01_OWNER_IDX"
+  ON "CAP2UI5_Z2UI5_T_01" ("OWNER" ASC)
diff --git a/src/mta.yaml b/src/mta.yaml
index 80ddcb6..55152f8 100644
--- a/src/mta.yaml
+++ b/src/mta.yaml
@@ -18,6 +18,18 @@ modules:
     buildpack: nodejs_buildpack
     readiness-health-check-http-endpoint: /health
     readiness-health-check-type: http
+    # ONE instance, deliberately. The draft chain is durable in HANA and
+    # survives anything, but retained *sticky* app state lives in the serving
+    # process (engine's sticky-handler map) and no session affinity is
+    # configured. With N instances a sticky session can land on an instance
+    # that never saw it, and the failure is intermittent and hard to
+    # reproduce -- the worst kind to discover in production.
+    #
+    # Raise this only together with one of: session affinity in front of the
+    # module, or a shared sticky store behind engine.set_store. When you do,
+    # also set Z2UI5_DRAFT_RETENTION_INSTANCE (srv/draft-retention.js) so the
+    # hourly cleanup keeps running on exactly one instance.
+    instances: 1
   build-parameters:
     builder: npm
 # The HDI container deployer. The z2ui5 runtime writes a draft row on EVERY
diff --git a/src/package.json b/src/package.json
index 2f878a4..d6ff5d5 100644
--- a/src/package.json
+++ b/src/package.json
@@ -56,13 +56,15 @@
             "alice": {
               "password": "alice",
               "roles": [
-                "authenticated-user"
+                "authenticated-user",
+                "User"
               ]
             },
             "bob": {
               "password": "bob",
               "roles": [
-                "authenticated-user"
+                "authenticated-user",
+                "User"
               ]
             }
           }
diff --git a/src/srv/draft-retention.js b/src/srv/draft-retention.js
index b930d15..1c2327f 100644
--- a/src/srv/draft-retention.js
+++ b/src/srv/draft-retention.js
@@ -10,17 +10,64 @@ const cds = require("@sap/cds");
  *
  *   Z2UI5_DRAFT_TTL_HOURS   TTL in hours (default 24; 0 disables cleanup)
  *
+ * THE TTL IS ONE SETTING, NOT TWO
+ * -------------------------------
+ * The framework carries its own draft expiry — `draft_exp_time_in_hours` on
+ * the http-post exit config, default 4 — and for a long time the two were
+ * unrelated: this job deleted at 24h while the framework believed drafts lived
+ * 4h, and nobody had said which one was true. They are now reconciled: the
+ * framework value is the source of truth, this job follows it, and
+ * Z2UI5_DRAFT_TTL_HOURS overrides both when set. One knob, one answer.
+ *
+ * ONE INSTANCE DELETES, NOT ALL OF THEM
+ * -------------------------------------
+ * Every application instance used to run this loop, so scaling to N instances
+ * meant N concurrent hourly DELETEs over the same rows — the same work done N
+ * times, contending. Retention is a housekeeping job, not per-instance state:
+ * set Z2UI5_DRAFT_RETENTION_INSTANCE to the CF instance index that should run
+ * it (default "0", i.e. the first instance), or "*" to let every instance run
+ * it. CF exposes the index as CF_INSTANCE_INDEX; outside CF the variable is
+ * absent and the job runs, which is the right answer for a single process.
+ *
  * deleteExpiredDrafts() is exported for tests; start() runs it once at
  * startup and then hourly (unref'd, so it never keeps the process alive).
  */
 
+const DEFAULT_TTL_HOURS = 4;
+
+/**
+ * The framework's own expiry, asked of the shipped exit. Falls back to the
+ * default when the core is not resolvable (e.g. a unit test importing this
+ * module standalone) — never throws, since retention must not break boot.
+ */
+function frameworkTtlHours() {
+  try {
+    const exit = require("abap2UI5/z2ui5_cl_ui5_user_exit");
+    const cfg = exit.get_instance().set_config_http_post({ cs_config: {} });
+    const n = Number(cfg?.draft_exp_time_in_hours);
+    if (Number.isFinite(n) && n > 0) return n;
+  } catch {
+    /* core not loadable here — fall through to the default */
+  }
+  return DEFAULT_TTL_HOURS;
+}
+
 const ttlHours = () => {
   const raw = process.env.Z2UI5_DRAFT_TTL_HOURS;
-  if (raw === undefined || raw === "") return 24;
+  if (raw === undefined || raw === "") return frameworkTtlHours();
   const n = Number(raw);
-  return Number.isFinite(n) && n >= 0 ? n : 24;
+  return Number.isFinite(n) && n >= 0 ? n : frameworkTtlHours();
 };
 
+/** Whether THIS instance is the one that runs the housekeeping loop. */
+function isRetentionInstance() {
+  const want = process.env.Z2UI5_DRAFT_RETENTION_INSTANCE ?? "0";
+  if (want === "*") return true;
+  const idx = process.env.CF_INSTANCE_INDEX;
+  if (idx === undefined || idx === "") return true; // not on CF — single process
+  return String(idx) === String(want);
+}
+
 async function deleteExpiredDrafts(now = Date.now()) {
   const ttl = ttlHours();
   if (ttl === 0) return 0;
@@ -32,10 +79,18 @@ async function deleteExpiredDrafts(now = Date.now()) {
 }
 
 function start() {
-  if (ttlHours() === 0) return;
+  const ttl = ttlHours();
+  if (ttl === 0) return;
+  if (!isRetentionInstance()) {
+    console.log(
+      `[z2ui5] draft retention: instance ${process.env.CF_INSTANCE_INDEX} is not the retention instance — skipping`,
+    );
+    return;
+  }
+  console.log(`[z2ui5] draft retention: deleting drafts older than ${ttl}h, hourly`);
   const run = () => deleteExpiredDrafts().catch((e) => console.error("[z2ui5] draft retention failed:", e.message));
   run();
   setInterval(run, 3600 * 1000).unref();
 }
 
-module.exports = { deleteExpiredDrafts, start };
+module.exports = { deleteExpiredDrafts, start, ttlHours, isRetentionInstance };
diff --git a/src/srv/server.js b/src/srv/server.js
index b2f0396..4395964 100644
--- a/src/srv/server.js
+++ b/src/srv/server.js
@@ -65,6 +65,36 @@ engine.register_app_dir(require("path").join(__dirname, "app"));
 cds.on("served", () => require("./draft-retention").start());
 
 cds.on("bootstrap", (app) => {
+  // Request body cap on the roundtrip. The action signature is
+  // `z2ui5(value : object)` over an `@open type object {}`, i.e. CDS validates
+  // nothing about the payload — whatever arrives is handed to the engine and,
+  // on the way back out, stored in a LargeString column. Until now the only
+  // limit was express's 100kb default, which applied by accident rather than
+  // by decision and would silently change if anything reconfigured the parser.
+  // Set it explicitly, and generously enough for a legitimately large view
+  // model (Z2UI5_MAX_BODY overrides; a bad value falls back to the default
+  // rather than removing the cap).
+  const maxBody = (() => {
+    const raw = process.env.Z2UI5_MAX_BODY;
+    return typeof raw === "string" && /^\d+(kb|mb)?$/i.test(raw.trim()) ? raw.trim() : "2mb";
+  })();
+  app.use("/rest/root/z2ui5", require("express").json({ limit: maxBody }));
+
+  // Security headers on the DATA endpoints too, not just the bootstrap page.
+  // The GET route below applies the framework's t_security_header when it
+  // renders the shell; the POST roundtrip and the OData entities answered
+  // nothing at all, so a response carrying application state came back without
+  // nosniff, without a frame guard and cacheable by any intermediary.
+  app.use((req, res, next) => {
+    if (req.path === "/rest/root/z2ui5" || req.path.startsWith("/odata/")) {
+      res.set("X-Content-Type-Options", "nosniff");
+      res.set("X-Frame-Options", "SAMEORIGIN");
+      res.set("Referrer-Policy", "same-origin");
+      res.set("Cache-Control", "no-store");
+    }
+    next();
+  });
+
   // Readiness probe — mta.yaml declares
   // readiness-health-check-http-endpoint: /health for the abap2UI5-srv
   // module, so CF polls this route to decide the instance is up. It must stay
diff --git a/src/srv/z2ui5-service.cds b/src/srv/z2ui5-service.cds
index 9b1f210..983ca3a 100644
--- a/src/srv/z2ui5-service.cds
+++ b/src/srv/z2ui5-service.cds
@@ -5,10 +5,12 @@ using northwind from './external/northwind.csn';
  * OData service exposing the z2ui5 draft table (used by the starter page
  * to prove persistence) and the remote Northwind sample entity.
  *
- * Restricted to authenticated users: the draft table holds serialized
- * application state, so it must never be readable/countable anonymously.
+ * Requires the `User` role (see rootService for why the role, not just
+ * `authenticated-user`): the draft table holds serialized application state,
+ * so it must never be readable/countable anonymously — or by an authenticated
+ * user who was never granted access to this application at all.
  */
-@(requires: 'authenticated-user')
+@(requires: 'User')
 service AdminService {
     /**
      * Own drafts only, read-only.
@@ -42,12 +44,21 @@ service AdminService {
  * REST-protocol service: the z2ui5 action is the single roundtrip endpoint.
  * Mounted at /rest/root/z2ui5 — frontends POST `{value: <oBody>}`.
  *
- * Restricted to authenticated users. In the BTP deployment the approuter
- * authenticates via xsuaa and the srv destination forwards the JWT
- * (HTML5.ForwardAuthToken), so the roundtrip runs under the real user; a
- * direct unauthenticated call to the srv route is rejected.
+ * Requires the `User` role. In the BTP deployment the approuter authenticates
+ * via xsuaa and the srv destination forwards the JWT (HTML5.ForwardAuthToken),
+ * so the roundtrip runs under the real user; a direct unauthenticated call to
+ * the srv route is rejected.
+ *
+ * `User` rather than `authenticated-user`: xs-security.json has always
+ * declared the scope `$XSAPPNAME.User` and a matching role template, and
+ * nothing ever referenced it — so the authorization model existed on paper
+ * while every authenticated user in the subaccount passed, role collection
+ * assigned or not. Naming the role here is what makes assigning it mean
+ * something. CAP maps the name onto the `$XSAPPNAME.User` scope; the mocked
+ * development users in package.json carry the same role so the local and test
+ * flows are unchanged.
  */
-@(requires: 'authenticated-user')
+@(requires: 'User')
 @protocol: 'rest'
 service rootService {
 
diff --git a/src/test/approuter-routes.test.js b/src/test/approuter-routes.test.js
new file mode 100644
index 0000000..9d96381
--- /dev/null
+++ b/src/test/approuter-routes.test.js
@@ -0,0 +1,100 @@
+// The approuter routing contract.
+//
+// WHY THIS EXISTS
+// ---------------
+// mta.yaml has always defined an `abap2UI5-srv` destination pointing at the CAP
+// module (~{srv-api/srv-url}, HTML5.ForwardAuthToken: true) — and xs-app.json
+// never routed anything to it. Its last route is a catch-all
+// (`^(.*)$` → html5-apps-repo-rt), so on a real BTP deployment the frontend's
+// POST to /rest/root/z2ui5 went to the static HTML5 repository instead of the
+// service. Every roundtrip — i.e. the entire application — would have failed,
+// and nothing anywhere noticed: the jest suite runs against a local `cds`
+// server that never sees the approuter, and deploy-check deliberately does not
+// run `mbt build`.
+//
+// These tests pin the parts of that file the app cannot work without, so the
+// next edit to xs-app.json cannot quietly re-open the hole.
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+const ROOT = path.join(__dirname, "..");
+const XS_APP = JSON.parse(fs.readFileSync(path.join(ROOT, "app", "z2ui5", "xs-app.json"), "utf8"));
+const MTA = fs.readFileSync(path.join(ROOT, "mta.yaml"), "utf8");
+
+/** The first route whose source regex matches `url`, i.e. the one that wins. */
+function routeFor(url) {
+  return XS_APP.routes.find((r) => new RegExp(r.source).test(url));
+}
+
+describe("xs-app.json routes the backend, not just the static app", () => {
+  test("the z2ui5 roundtrip reaches the CAP service", () => {
+    const route = routeFor("/rest/root/z2ui5");
+    expect(route).toBeDefined();
+    expect(route.destination).toBe("abap2UI5-srv");
+    // …and it must win over the catch-all, which is what it did not do before.
+    expect(route.service).toBeUndefined();
+  });
+
+  test("the OData service reaches the CAP service", () => {
+    const route = routeFor("/odata/v4/admin/z2ui5_t_01");
+    expect(route).toBeDefined();
+    expect(route.destination).toBe("abap2UI5-srv");
+  });
+
+  test("the roundtrip route is authenticated", () => {
+    // The endpoint itself requires an authenticated user (see z2ui5-service.cds
+    // `@(requires: 'authenticated-user')`); the approuter must supply the JWT
+    // rather than pass the request through anonymously.
+    expect(routeFor("/rest/root/z2ui5").authenticationType).toBe("xsuaa");
+  });
+
+  test("the roundtrip route disables approuter CSRF, deliberately", () => {
+    // The webapp POSTs with no CSRF token and never fetches one
+    // (app/z2ui5/webapp/core/Server.js). With the approuter's default
+    // csrfProtection every roundtrip would 403 in the deployed app, so this
+    // must stay false. CSRF is defended one layer down instead: the framework's
+    // own Origin/Referer gate (z2ui5_cl_ui5_http_handler._check_csrf_rejected),
+    // on a request that already carries a forwarded JWT. If the webapp ever
+    // learns to fetch a token, delete this line and this test together.
+    expect(routeFor("/rest/root/z2ui5").csrfProtection).toBe(false);
+  });
+
+  test("/health stays public for the CF readiness probe", () => {
+    const route = routeFor("/health");
+    expect(route.destination).toBe("abap2UI5-srv");
+    expect(route.authenticationType).toBe("none");
+  });
+
+  test("the UI5 resource routes still come first", () => {
+    // They are `authenticationType: none` and must not be shadowed by any
+    // backend route added above them.
+    expect(routeFor("/resources/sap-ui-core.js").destination).toBe("ui5");
+    expect(routeFor("/test-resources/x.js").destination).toBe("ui5");
+  });
+
+  test("the catch-all is last and still serves the static app", () => {
+    const last = XS_APP.routes[XS_APP.routes.length - 1];
+    expect(last.source).toBe("^(.*)$");
+    expect(last.service).toBe("html5-apps-repo-rt");
+    expect(routeFor("/index.html").service).toBe("html5-apps-repo-rt");
+  });
+});
+
+describe("every destination a route names is declared in mta.yaml", () => {
+  test("no route points at a destination that does not exist", () => {
+    const declared = new Set([...MTA.matchAll(/^\s*Name:\s*(\S+)\s*$/gm)].map((m) => m[1]));
+    const missing = XS_APP.routes
+      .map((r) => r.destination)
+      .filter(Boolean)
+      .filter((d) => !declared.has(d));
+    expect(missing).toEqual([]);
+  });
+
+  test("the srv destination forwards the auth token", () => {
+    // Without HTML5.ForwardAuthToken the JWT never reaches CAP and every
+    // authenticated roundtrip answers 401 in the deployed app.
+    expect(MTA).toMatch(/HTML5\.ForwardAuthToken:\s*true/);
+  });
+});
diff --git a/src/test/security.test.js b/src/test/security.test.js
new file mode 100644
index 0000000..54e5559
--- /dev/null
+++ b/src/test/security.test.js
@@ -0,0 +1,121 @@
+// P1 security regressions for the CAP app.
+//
+// Each of these pins a gap the 2026-08 review found, so a later edit that
+// reopens one fails here rather than in production:
+//   - the `User` scope was declared in xs-security.json and never referenced,
+//     so every authenticated subaccount user passed regardless of role;
+//   - the POST roundtrip and the OData entities answered with no security
+//     headers at all (only the GET bootstrap applied them);
+//   - the request body had no explicit size cap, only express's default;
+//   - retention ran on every instance, and disagreed with the framework's own
+//     draft expiry about how long a draft lives.
+const cds = require("@sap/cds");
+
+const { GET, POST, expect } = cds.test(__dirname + "/..");
+
+const ALICE = { auth: { username: "alice", password: "alice" } };
+
+const S_FRONT = {
+  ID: "",
+  ORIGIN: "http://localhost:4004",
+  PATHNAME: "/rest/root/z2ui5",
+  SEARCH: "",
+};
+
+describe("authorization is role-based, not merely authenticated", () => {
+  test("the z2ui5 roundtrip requires the User role", async () => {
+    // The service now declares @(requires: 'User'); the mocked dev users carry
+    // that role, so a normal call still works.
+    const { status } = await POST("/rest/root/z2ui5", { value: { S_FRONT } }, ALICE);
+    expect(status).to.equal(200);
+  });
+
+  test("an unauthenticated roundtrip is rejected", async () => {
+    await expect(POST("/rest/root/z2ui5", { value: { S_FRONT } })).to.be.rejectedWith(/401/);
+  });
+
+  test("an unauthenticated OData read is rejected", async () => {
+    await expect(GET("/odata/v4/admin/z2ui5_t_01/$count")).to.be.rejectedWith(/401/);
+  });
+
+  test("the declared scope and the required role are the same name", async () => {
+    // xs-security.json declaring a scope nothing references is what made the
+    // authorization model decorative. Keep the two in step.
+    const xsSecurity = require("../xs-security.json");
+    const names = xsSecurity.scopes.map((s) => s.name);
+    expect(names).to.include("$XSAPPNAME.User");
+    expect(xsSecurity["role-templates"].map((r) => r.name)).to.include("User");
+  });
+});
+
+describe("security headers reach the data endpoints", () => {
+  test("the POST roundtrip carries them", async () => {
+    const res = await POST("/rest/root/z2ui5", { value: { S_FRONT } }, ALICE);
+    expect(res.headers["x-content-type-options"]).to.equal("nosniff");
+    expect(res.headers["x-frame-options"]).to.equal("SAMEORIGIN");
+    expect(res.headers["cache-control"]).to.equal("no-store");
+    expect(res.headers["referrer-policy"]).to.equal("same-origin");
+  });
+
+  test("the OData entities carry them", async () => {
+    const res = await GET("/odata/v4/admin/z2ui5_t_01/$count", ALICE);
+    expect(res.headers["x-content-type-options"]).to.equal("nosniff");
+    expect(res.headers["cache-control"]).to.equal("no-store");
+  });
+
+  test("the bootstrap page still carries the framework's own headers", async () => {
+    const res = await GET("/rest/root/z2ui5");
+    expect(res.status).to.equal(200);
+    expect(res.data).to.include("<!DOCTYPE html>");
+  });
+});
+
+describe("the bootstrap page escapes and configures correctly", () => {
+  test("it carries the favicon the exit sets", async () => {
+    // Ported from upstream in 2026-08 together with the <link rel="icon">
+    // contract; the data: URI has to survive escaping intact.
+    const res = await GET("/rest/root/z2ui5");
+    expect(res.data).to.include('<link rel="icon" href="data:image/svg+xml,');
+    expect(res.data).to.include("<svg");
+  });
+});
+
+describe("draft retention", () => {
+  const retention = require("../srv/draft-retention");
+
+  afterEach(() => {
+    delete process.env.Z2UI5_DRAFT_TTL_HOURS;
+    delete process.env.Z2UI5_DRAFT_RETENTION_INSTANCE;
+    delete process.env.CF_INSTANCE_INDEX;
+  });
+
+  test("follows the framework's own draft expiry by default", () => {
+    // The job used to default to 24h while the framework believed 4h, with
+    // nothing connecting the two.
+    const exit = require("abap2UI5/z2ui5_cl_ui5_user_exit");
+    const cfg = exit.get_instance().set_config_http_post({ cs_config: {} });
+    expect(retention.ttlHours()).to.equal(cfg.draft_exp_time_in_hours);
+  });
+
+  test("the environment variable overrides it", () => {
+    process.env.Z2UI5_DRAFT_TTL_HOURS = "12";
+    expect(retention.ttlHours()).to.equal(12);
+  });
+
+  test("only the designated instance runs the loop", () => {
+    // N instances each running an hourly DELETE over the same rows is the
+    // same work done N times, contending.
+    process.env.CF_INSTANCE_INDEX = "0";
+    expect(retention.isRetentionInstance()).to.equal(true);
+    process.env.CF_INSTANCE_INDEX = "3";
+    expect(retention.isRetentionInstance()).to.equal(false);
+    process.env.Z2UI5_DRAFT_RETENTION_INSTANCE = "3";
+    expect(retention.isRetentionInstance()).to.equal(true);
+    process.env.Z2UI5_DRAFT_RETENTION_INSTANCE = "*";
+    expect(retention.isRetentionInstance()).to.equal(true);
+  });
+
+  test("outside CF a single process always runs it", () => {
+    expect(retention.isRetentionInstance()).to.equal(true);
+  });
+});

From dc02ee80d2b21f1a29a0a747493006c4a2b94d00 Mon Sep 17 00:00:00 2001
From: Claude <tmswyer@gmail.com>
Date: Fri, 21 Aug 2026 16:54:09 +0000
Subject: [PATCH 2/6] Consume the framework's cds-plugin instead of duplicating
 its wiring

The package now ships its CAP wiring (cds-plugin.js -> srv/cap/activate.js)
and its CDS model, so this app stopped hand-rolling all of it:

- srv/server.js drops ~120 lines -- identity, the draft store, retention, the
  GET/HEAD bootstrap routes and the /resources mount all come from the plugin.
  What is left is genuinely app-specific: srv/app discovery, the request body
  cap, security headers on the data endpoints, and /health.
- srv/draft-retention.js is deleted; the package ships it.
- db/schema.cds and srv/z2ui5-service.cds import the packaged model and service
  rather than redeclaring them, which is the same import an external project
  writes -- so this app's test suite is what proves the packaged definitions
  work, instead of them being exercised only in theory.
- srv/z2ui5-service.js no longer registers the roundtrip handler; the plugin
  does, on whichever service declares a z2ui5 action.

That last point was not cosmetic. CAP auto-loads a dependency's cds-plugin, so
with the app ALSO doing the wiring, retention started twice -- two hourly
DELETE loops over the same rows in one process. Now once, asserted.

Also resolves a contradiction two published documents had about the one folder
users are told to write in: the README said "put your own apps into srv/app/"
while AGENTS.md said srv/app/ is overwritten on every publish. Both now say the
same thing, with a table that answers it by what the reader is doing, and the
README opens by stating that this repository is the demo rather than the
delivery mechanism.

builder 30 tests, app 44 tests, lint clean, cds build --production ok.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2gZuy95uKcT2zngQd1sAL
---
 run/input/UPSTREAM_COMMIT                     |   2 +-
 run/input/core/README.md                      |  56 +++++
 run/input/core/cds-plugin.js                  |  40 +++
 run/input/core/package.json                   |  12 +-
 run/input/core/srv/cap/activate.js            | 228 ++++++++++++++++++
 run/input/core/srv/cap/retention.js           |  89 +++++++
 .../srv/z2ui5/02/z2ui5_cl_ui5_http_handler.js |  32 ++-
 run/input/core/types/index.d.ts               | 179 ++++++++++++++
 run/input/core/z2ui5-model.cds                |  31 +++
 run/input/core/z2ui5-service.cds              |  29 +++
 src/AGENTS.md                                 |   2 +-
 src/README.md                                 |  41 +++-
 src/db/schema.cds                             |  35 +--
 src/srv/draft-retention.js                    |  96 --------
 src/srv/server.js                             | 185 +++-----------
 src/srv/z2ui5-service.cds                     |  33 +--
 src/srv/z2ui5-service.js                      |  15 +-
 src/test/draft-retention.test.js              |   4 +-
 src/test/security.test.js                     |   2 +-
 19 files changed, 781 insertions(+), 330 deletions(-)
 create mode 100644 run/input/core/cds-plugin.js
 create mode 100644 run/input/core/srv/cap/activate.js
 create mode 100644 run/input/core/srv/cap/retention.js
 create mode 100644 run/input/core/types/index.d.ts
 create mode 100644 run/input/core/z2ui5-model.cds
 create mode 100644 run/input/core/z2ui5-service.cds
 delete mode 100644 src/srv/draft-retention.js

diff --git a/run/input/UPSTREAM_COMMIT b/run/input/UPSTREAM_COMMIT
index fa85b1e..f3f5761 100644
--- a/run/input/UPSTREAM_COMMIT
+++ b/run/input/UPSTREAM_COMMIT
@@ -1 +1 @@
-21bf2a69ea941e0c522eaf85c2495e0eff5bc87d
+ec261880730d1de7a0c392da7f50622098a11fdd
diff --git a/run/input/core/README.md b/run/input/core/README.md
index 52aceb8..84261b2 100644
--- a/run/input/core/README.md
+++ b/run/input/core/README.md
@@ -19,6 +19,62 @@ platform code**. Every platform consumes this one package:
 > hand-edit it; edit `src/` and re-run `npm run build_core` at the
 > [repo root](../).
 
+## Using it in a CAP project
+
+Two `using` lines and an install. The plugin does the rest — identity, the
+draft store, app discovery, the bootstrap routes, the UI5 runtime mount and
+the service implementation — because none of that is project-specific and
+every consumer would otherwise copy the same ~160 lines and keep them in sync
+by hand.
+
+```jsonc
+// package.json
+{ "dependencies": { "abap2UI5": "..." } }
+```
+
+```cds
+// db/schema.cds
+using from 'abap2UI5/z2ui5-model';        // the draft table
+
+// srv/service.cds
+using from 'abap2UI5/z2ui5-service';      // the roundtrip endpoint
+```
+
+```js
+// srv/app/my_app.js — your application
+const z2ui5_if_app = require("abap2UI5/z2ui5_if_app");
+
+class my_app extends z2ui5_if_app {
+  name = "";
+  main(client) {
+    if (client.get_event() === "SEND") client.message_toast_display(`Hi ${this.name}`);
+    client.view_display(/* ...view builder chain... */);
+  }
+}
+module.exports = my_app;
+```
+
+Point the framework at your apps with `Z2UI5_APP_DIRS` (path-separated) or
+`require("abap2UI5/register-apps")(__dirname)`, then `cds watch` and open
+`/rest/root/z2ui5`.
+
+The plugin is opt-outable, whole or piecewise, for a project that wants to
+wire something itself:
+
+```jsonc
+// package.json
+{ "cds": { "z2ui5": { "routes": false } } }   // or "activate": false
+```
+
+`abap2UI5/cap` exports the same `activate(options)` if you prefer to call it
+explicitly — which is what the generated cap2UI5 app does, so the app's own
+test suite exercises exactly the path an external consumer gets.
+
+**TypeScript**: `types/index.d.ts` covers the app interface, the client, the
+view-builder chain, the engine seam and the CAP entry point. The view builder
+is the one that pays for itself — a fluent chain with no completion is a
+guessing game.
+
 ## The seam
 
 The platform surface is tiny — see [`srv/z2ui5/engine.js`](srv/z2ui5/engine.js):
diff --git a/run/input/core/cds-plugin.js b/run/input/core/cds-plugin.js
new file mode 100644
index 0000000..ceba25a
--- /dev/null
+++ b/run/input/core/cds-plugin.js
@@ -0,0 +1,40 @@
+/**
+ * cds-plugin — CAP loads this automatically for any project that depends on
+ * this package, which is the whole point: `npm i` and a z2ui5 project works,
+ * with no boilerplate to copy and keep in sync.
+ *
+ * What it wires is in srv/cap/activate.js; this file only decides whether to.
+ *
+ * Opting out, for a project that wants to wire things itself:
+ *
+ *   // package.json
+ *   "cds": { "z2ui5": { "activate": false } }
+ *
+ * or per concern — `{ "z2ui5": { "routes": false } }` — since a consumer that
+ * wants one piece done differently should not have to give up the rest. The
+ * same keys are accepted by activate() directly.
+ *
+ * Failure here is deliberately non-fatal. A plugin that throws takes the whole
+ * CAP server down with it, and this one is loaded into every dependent project
+ * — including ones that installed the package for its view builder and never
+ * intended to serve a z2ui5 endpoint at all.
+ */
+"use strict";
+
+try {
+  const { activate, requireCds } = require("./srv/cap/activate");
+  // Not a plain require("@sap/cds"): this package is usually a `file:`
+  // dependency, npm symlinks those, and Node resolves from the real path —
+  // i.e. outside the consumer's tree. See requireCds for the full story.
+  const cds = requireCds();
+  const cfg = (cds && cds.env && cds.env.z2ui5) || {};
+
+  if (cds && cfg.activate !== false) {
+    const result = activate({ cds, ...cfg });
+    if (result.active && process.env.Z2UI5_LOG_PLUGIN !== "0") {
+      console.log(`[z2ui5] cds-plugin active on ${result.endpoint} (${result.applied.join(", ")})`);
+    }
+  }
+} catch (e) {
+  console.error("[z2ui5] cds-plugin failed to activate:", e.message);
+}
diff --git a/run/input/core/package.json b/run/input/core/package.json
index d6b2cff..8f80b2b 100644
--- a/run/input/core/package.json
+++ b/run/input/core/package.json
@@ -1,7 +1,7 @@
 {
   "name": "abap2UI5",
   "version": "1.0.0",
-  "description": "abap2UI5 core \u2014 the platform-neutral framework package: engine, transpiled classes, webapp and samples. Fully auto-generated (AI + sync pipeline).",
+  "description": "abap2UI5 core — the platform-neutral framework package: engine, transpiled classes, webapp and samples. Fully auto-generated (AI + sync pipeline).",
   "repository": "github:cap2UI5/cap2UI5",
   "license": "MIT",
   "private": true,
@@ -11,6 +11,13 @@
   "exports": {
     ".": "./srv/z2ui5/00/03/z2ui5_cl_util.js",
     "./engine": "./srv/z2ui5/engine.js",
+    "./cds-plugin": "./cds-plugin.js",
+    "./cap": "./srv/cap/activate.js",
+    "./cap-retention": "./srv/cap/retention.js",
+    "./z2ui5-model": "./z2ui5-model.cds",
+    "./z2ui5-model.cds": "./z2ui5-model.cds",
+    "./z2ui5-service": "./z2ui5-service.cds",
+    "./z2ui5-service.cds": "./z2ui5-service.cds",
     "./z2ui5_asset": "./srv/z2ui5/z2ui5_asset.js",
     "./z2ui5_identity": "./srv/z2ui5/z2ui5_identity.js",
     "./z2ui5_preferred_param": "./srv/z2ui5/z2ui5_preferred_param.js",
@@ -50,5 +57,6 @@
   },
   "dependencies": {
     "openui5-dist": "1.113.0"
-  }
+  },
+  "types": "./types/index.d.ts"
 }
diff --git a/run/input/core/srv/cap/activate.js b/run/input/core/srv/cap/activate.js
new file mode 100644
index 0000000..24845fc
--- /dev/null
+++ b/run/input/core/srv/cap/activate.js
@@ -0,0 +1,228 @@
+/**
+ * activate — the whole CAP wiring for the abap2UI5 core, in one call.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Everything here used to live in the generated app's `srv/server.js`, which
+ * meant the only way to get a working cap2UI5 project was to clone a repository
+ * that is explicitly a build artifact ("do not hand-edit anything outside
+ * .github/") and inherit ~160 lines of platform boilerplate you then had to
+ * keep in sync by hand. There was no supported way to *start* a project.
+ *
+ * The boilerplate is not project-specific: identity, the draft store, app
+ * discovery, the bootstrap routes and the UI5 runtime mount are the same in
+ * every consumer. So they live here, and both entry points call this:
+ *
+ *   - `cds-plugin.js` at the package root, which CAP loads automatically for
+ *     any project that depends on this package — `npm i` and nothing else;
+ *   - the generated app's own `srv/server.js`, which calls it explicitly.
+ *
+ * The second one is what keeps this honest: the app's jest suite exercises
+ * exactly the code path an external consumer gets.
+ *
+ * Everything is opt-outable through `options`, because a consumer that wants
+ * one piece done differently should not have to give up the rest.
+ */
+"use strict";
+
+/**
+ * Resolve @sap/cds from the CONSUMER's tree, not ours.
+ *
+ * A plain `require("@sap/cds")` is wrong here and fails in the one case that
+ * matters most. This package is normally a `file:` dependency (the generated
+ * app vendors it at ./core; a project under development links a checkout), and
+ * npm installs those as SYMLINKS. Node resolves from the *real* path of the
+ * requiring file, so the lookup walks up from wherever the package actually
+ * lives — outside the consumer's tree entirely — and throws. The plugin then
+ * reports "@sap/cds not resolvable" while running inside a live CAP server,
+ * which is exactly what the first end-to-end probe of this file hit.
+ *
+ * So ask from the consumer's directory explicitly, and keep the plain require
+ * as the fallback for a normal (non-symlinked) install.
+ */
+function requireCds() {
+  for (const paths of [[process.cwd()], null]) {
+    try {
+      return paths ? require(require.resolve("@sap/cds", { paths })) : require("@sap/cds");
+    } catch {
+      /* try the next strategy */
+    }
+  }
+  return null;
+}
+
+/**
+ * @param {object} [options]
+ * @param {boolean} [options.identity=true]    bind sy-uname to the CDS user
+ * @param {boolean} [options.store=true]       persist drafts in the CDS entity
+ * @param {boolean} [options.routes=true]      GET/HEAD bootstrap routes
+ * @param {boolean} [options.resources=true]   serve the bundled UI5 runtime
+ * @param {boolean} [options.retention=true]   prune expired drafts hourly
+ * @param {string}  [options.path]             endpoint path
+ * @param {string}  [options.entity]           draft entity, `namespace.name`
+ * @param {string[]} [options.appDirs]         extra folders to scan for apps
+ */
+function activate(options = {}) {
+  const cds = options.cds || requireCds();
+  if (!cds) return { active: false, reason: "@sap/cds not resolvable" };
+
+  const {
+    identity = true,
+    store = true,
+    routes = true,
+    resources = true,
+    retention = true,
+    path: endpoint = "/rest/root/z2ui5",
+    entity = "cap2ui5.z2ui5_t_01",
+  } = options;
+
+  const engine = require("../z2ui5/engine");
+  const applied = [];
+
+  // Identity: who the framework acts for. The core is platform-neutral and has
+  // no ambient sy-uname, so CAP's request-scoped user is injected as a
+  // provider — read PER USE, because cds.context is async-local and one
+  // installed provider has to stay correct under concurrent requests.
+  if (identity) {
+    engine.set_identity(() => ({
+      user: cds.context?.user?.id,
+      tenant: cds.context?.tenant,
+    }));
+    applied.push("identity");
+  }
+
+  // Draft persistence. Every row is stamped with its owner and only ever
+  // loaded back for that same owner: a draft id is a UUID but not a secret —
+  // ids travel in request bodies, logs and browser history — so unguessability
+  // is never the access control. The service projection enforces the same rule
+  // independently; this path does not go through the service, so it checks for
+  // itself.
+  if (store) {
+    const [namespace] = entity.split(".");
+    const name = entity.slice(namespace.length + 1);
+    const owner = () => cds.context?.user?.id || "anonymous";
+    const target = () => {
+      const e = cds.entities(namespace)?.[name];
+      if (!e) throw new Error(`z2ui5: draft entity '${entity}' is not in the model`);
+      return e;
+    };
+    engine.set_store({
+      load: async (id) => SELECT.one.from(target()).where({ id, owner: owner() }),
+      save: async (draft) => { await INSERT.into(target()).entries({ ...draft, owner: owner() }); },
+    });
+    applied.push("store");
+  }
+
+  // App discovery. Apps bundled inside the package are found without
+  // registration; anything outside it has to be pointed at. Z2UI5_APP_DIRS is
+  // the deployment-time knob (path-separated), `appDirs` the code-level one.
+  const dirs = [
+    ...(options.appDirs || []),
+    ...String(process.env.Z2UI5_APP_DIRS || "").split(require("path").delimiter).filter(Boolean),
+  ];
+  for (const dir of dirs) engine.register_app_dir(dir);
+  if (dirs.length) applied.push(`appDirs(${dirs.length})`);
+
+  if (retention) {
+    cds.on("served", () => {
+      try {
+        require("./retention").start({ cds, entity });
+      } catch (e) {
+        console.error("[z2ui5] draft retention could not start:", e.message);
+      }
+    });
+    applied.push("retention");
+  }
+
+  if (routes || resources) {
+    cds.on("bootstrap", (app) => {
+      if (resources) mountResources(app, engine);
+      if (routes) mountRoutes(app, engine, endpoint, cds);
+    });
+    applied.push(...[resources && "resources", routes && "routes"].filter(Boolean));
+  }
+
+  // Implement the action of whichever service carries it. Registered by
+  // reacting to the service being served rather than by shipping a `.js` next
+  // to the `.cds`, so it also binds when a consumer renames the service or
+  // declares the action on their own.
+  if (options.impl !== false) {
+    cds.on("serving", (srv) => {
+      if (!srv.definition?.actions?.z2ui5) return;
+      srv.on("z2ui5", require("../z2ui5/02/z2ui5_cl_ui5_http_handler"));
+    });
+    applied.push("impl");
+  }
+
+  return { active: true, applied, endpoint, entity };
+}
+
+/**
+ * Serve the bundled UI5 runtime at /resources. Registered before the CDS
+ * services so the OData/REST routing cannot shadow it. The trailing handler
+ * answers a plain 404 for files the dist does not ship (locale bundles UI5
+ * probes for and then falls back on) instead of letting each miss bubble up as
+ * a logged error.
+ */
+function mountResources(app, engine) {
+  const dir = engine.ui5_resources_dir?.();
+  if (!dir) {
+    // Not fatal: a consumer may deliberately bootstrap UI5 from a CDN. Say so
+    // once, clearly, rather than failing at the first blank page.
+    console.warn("[z2ui5] openui5-dist not resolvable — /resources not served; bootstrap from a CDN instead");
+    return;
+  }
+  const express = require("express");
+  app.use("/resources", express.static(dir), (_req, res) => res.status(404).end());
+}
+
+function mountRoutes(app, engine, endpoint, cds) {
+  const z2ui5_cl_util_http = require("../z2ui5/00/03/z2ui5_cl_util_http");
+
+  // GET — the bootstrap shell. Public on purpose: it carries no user data and
+  // keeping it open preserves the offline/dev flow. In BTP the approuter
+  // authenticates before the frontend can reach it anyway.
+  app.get(endpoint, (req, res) => {
+    // bootstrap_html renders arbitrary app HTML — never let a failure escape
+    // as an unhandled express error, i.e. a raw stack trace to the client.
+    try {
+      const reqInfo = z2ui5_cl_util_http.factory_cloud(req, res).get_req_info();
+      const { html, headers } = engine.bootstrap_html(reqInfo);
+      for (const h of headers) res.set(h.n, h.v);
+      res.set("Content-Type", "text/html; charset=utf-8");
+      res.status(200).send(html);
+    } catch (e) {
+      console.error(`[z2ui5] GET ${endpoint} bootstrap failed:`, e);
+      res.status(500).set("Content-Type", "text/plain; charset=utf-8").send(`z2ui5 bootstrap failed: ${e.message}`);
+    }
+  });
+
+  // HEAD serves two clients: the CSRF prefetch, and the beacon the webapp
+  // sends on tab close (`sap-terminate: session`). That beacon is the only
+  // signal a session is over, so it is where a sticky app's retained state is
+  // released — otherwise it lingers until the store evicts it under pressure.
+  app.head(endpoint, (req, res) => {
+    if (String(req.get("sap-terminate") || "").toLowerCase() === "session") {
+      // Registered on the bootstrap express app, ahead of the CDS middleware
+      // chain, so cds.context is not established here and the key has to come
+      // from whatever the request itself carries. When that is nobody we drop
+      // NOTHING: releasing a guessed key would evict a stranger's session.
+      const user = req.user?.id || cds.context?.user?.id;
+      const session_id = engine.session_key_for({ user, tenant: cds.context?.tenant });
+      if (session_id) {
+        try {
+          engine.drop_sticky({ session_id });
+        } catch (e) {
+          console.error("[z2ui5] sticky release failed:", e.message);
+        }
+      }
+    }
+    // The endpoint uses no token-based CSRF — it validates Origin/Referer
+    // instead (z2ui5_cl_ui5_http_handler._check_csrf_rejected) — so "disabled"
+    // is the accurate answer to a token prefetch, not an absence of protection.
+    res.set("X-CSRF-Token", "disabled");
+    res.status(200).end();
+  });
+}
+
+module.exports = { activate, requireCds };
diff --git a/run/input/core/srv/cap/retention.js b/run/input/core/srv/cap/retention.js
new file mode 100644
index 0000000..bcb4fb2
--- /dev/null
+++ b/run/input/core/srv/cap/retention.js
@@ -0,0 +1,89 @@
+/**
+ * retention — prune expired draft rows.
+ *
+ * The draft table is append-only (one row per roundtrip, chained via id_prev
+ * for back-navigation), so without this it grows without bound: rows past the
+ * TTL are dead weight whose ids are long gone from any live browser session.
+ *
+ *   Z2UI5_DRAFT_TTL_HOURS            TTL in hours; 0 disables. Defaults to the
+ *                                    framework's own draft_exp_time_in_hours.
+ *   Z2UI5_DRAFT_RETENTION_INSTANCE   which CF instance runs the loop
+ *                                    (default "0"; "*" means all of them).
+ *
+ * THE TTL IS ONE SETTING, NOT TWO. The framework carries its own expiry on the
+ * http-post exit config, and for a long time this job ignored it: it deleted at
+ * 24h while the framework believed 4h, and nothing said which was true. The
+ * framework value is now the source of truth and the env var overrides both.
+ *
+ * ONE INSTANCE DELETES, NOT ALL OF THEM. Every instance used to run the loop,
+ * so N instances meant N concurrent hourly DELETEs over the same rows —
+ * the same work N times, contending. Retention is housekeeping, not
+ * per-instance state.
+ */
+"use strict";
+
+const DEFAULT_TTL_HOURS = 4;
+
+/** The framework's own expiry. Never throws: retention must not break boot. */
+function frameworkTtlHours() {
+  try {
+    const exit = require("../z2ui5/01/04/z2ui5_cl_ui5_user_exit");
+    const cfg = exit.get_instance().set_config_http_post({ cs_config: {} });
+    const n = Number(cfg?.draft_exp_time_in_hours);
+    if (Number.isFinite(n) && n > 0) return n;
+  } catch {
+    /* not resolvable here — fall through */
+  }
+  return DEFAULT_TTL_HOURS;
+}
+
+function ttlHours() {
+  const raw = process.env.Z2UI5_DRAFT_TTL_HOURS;
+  if (raw === undefined || raw === "") return frameworkTtlHours();
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : frameworkTtlHours();
+}
+
+/** Whether THIS instance runs the loop. Outside CF, a single process always does. */
+function isRetentionInstance() {
+  const want = process.env.Z2UI5_DRAFT_RETENTION_INSTANCE ?? "0";
+  if (want === "*") return true;
+  const idx = process.env.CF_INSTANCE_INDEX;
+  if (idx === undefined || idx === "") return true;
+  return String(idx) === String(want);
+}
+
+async function deleteExpiredDrafts({ cds, entity = "cap2ui5.z2ui5_t_01", now = Date.now() } = {}) {
+  const ttl = ttlHours();
+  if (ttl === 0) return 0;
+  // Resolve CAP ourselves when the caller did not hand it over: a test or a
+  // one-off script should be able to call this without knowing that the
+  // package cannot use a plain require for @sap/cds (see cap/activate.js).
+  cds = cds || require("./activate").requireCds();
+  if (!cds) return 0;
+  const [namespace] = entity.split(".");
+  const name = entity.slice(namespace.length + 1);
+  const target = cds.entities(namespace)?.[name];
+  if (!target) return 0;
+  const cutoff = new Date(now - ttl * 3600 * 1000).toISOString();
+  const deleted = await DELETE.from(target).where({ createdAt: { "<": cutoff } });
+  if (deleted) console.log(`[z2ui5] draft retention: deleted ${deleted} row(s) older than ${ttl}h`);
+  return deleted;
+}
+
+function start({ cds, entity } = {}) {
+  const ttl = ttlHours();
+  if (ttl === 0) return;
+  if (!isRetentionInstance()) {
+    console.log(`[z2ui5] draft retention: instance ${process.env.CF_INSTANCE_INDEX} is not the retention instance — skipping`);
+    return;
+  }
+  console.log(`[z2ui5] draft retention: deleting drafts older than ${ttl}h, hourly`);
+  const run = () =>
+    deleteExpiredDrafts({ cds, entity }).catch((e) => console.error("[z2ui5] draft retention failed:", e.message));
+  run();
+  // unref'd: housekeeping must never be the reason a process stays alive.
+  setInterval(run, 3600 * 1000).unref();
+}
+
+module.exports = { start, deleteExpiredDrafts, ttlHours, isRetentionInstance };
diff --git a/run/input/core/srv/z2ui5/02/z2ui5_cl_ui5_http_handler.js b/run/input/core/srv/z2ui5/02/z2ui5_cl_ui5_http_handler.js
index 15ce533..032e386 100644
--- a/run/input/core/srv/z2ui5/02/z2ui5_cl_ui5_http_handler.js
+++ b/run/input/core/srv/z2ui5/02/z2ui5_cl_ui5_http_handler.js
@@ -21,10 +21,17 @@ module.exports = async function service(req) {
   // Derive the exit-context request info from CAP's inner express req so
   // user exits (set_config_http_get/_post) see path/params/headers. ABAP
   // _main calls init_context unconditionally before dispatching by method.
+  // CAP has moved this accessor around across majors, and getting it wrong is
+  // SILENT: reqInfo falls back to defaults (so a user exit sees no request
+  // context at all) and the CSRF gate below compares empty strings, which its
+  // lenient no-headers branch reads as "nothing to compare — allow". A live
+  // probe on CAP 9 found exactly that: the gate was active, correct, and never
+  // saw a header. `req.http.{req,res}` is the current documented pair; the
+  // older spellings stay as fallbacks.
   let reqInfo;
-  const innerReq = req?.req || req?._?.req || null;
+  const innerReq = req?.http?.req || req?.req || req?._?.req || null;
   try {
-    const innerRes = req?.res || req?._?.res || null;
+    const innerRes = req?.http?.res || req?.res || req?._?.res || null;
     if (innerReq && innerRes) {
       reqInfo = z2ui5_cl_util_http.factory_cloud(innerReq, innerRes).get_req_info();
     }
@@ -36,28 +43,33 @@ module.exports = async function service(req) {
   // POST, the only method that can change state. ON by default since 2026-08
   // (the shipped exit sets check_csrf_active); an app that fronts the endpoint
   // with its own protection can still switch it off in its exit.
+  let csrfRejected = false;
   try {
     const cfg = {};
     require(`../01/04/z2ui5_cl_ui5_user_exit`).get_instance().set_config_http_post({ cs_config: cfg });
     if (cfg.check_csrf_active !== false) {
       const h = innerReq?.headers || {};
-      const rejected = module.exports._check_csrf_rejected({
+      csrfRejected = module.exports._check_csrf_rejected({
         active: true,
         origin: h.origin || ``,
         referer: h.referer || ``,
         host: h.host || ``,
       });
-      if (rejected) {
-        return {
-          body: `CSRF validation failed - cross-origin POST rejected`,
-          status_code: 403,
-          status_reason: `Forbidden`,
-        };
-      }
     }
   } catch {
     // exit not configured — csrf stays inactive
   }
+  if (csrfRejected) {
+    const message = `CSRF validation failed - cross-origin POST rejected`;
+    // Reject THROUGH CDS when it is driving. Returning the rejection as a
+    // value made CDS serialize it as a successful action result: the caller
+    // got HTTP 200 carrying `{status_code: 403}` in the body, so a blocked
+    // request looked like a completed one to every client that checks the
+    // status — which is every client. req.reject produces a real 403.
+    // The plain object stays for the non-CAP adapters, which read status_code.
+    if (typeof req?.reject === `function`) req.reject(403, message);
+    return { body: message, status_code: 403, status_reason: `Forbidden` };
+  }
 
   let responseJson;
   try {
diff --git a/run/input/core/types/index.d.ts b/run/input/core/types/index.d.ts
new file mode 100644
index 0000000..a03d72a
--- /dev/null
+++ b/run/input/core/types/index.d.ts
@@ -0,0 +1,179 @@
+/**
+ * Hand-written type declarations for the abap2UI5 core.
+ *
+ * The package is generated from ABAP and will never carry types of its own, so
+ * these cover the surface a consumer actually writes against: the app
+ * interface, the client, and the fluent view builder. The builder is the case
+ * that matters most — a chain of `.tag().a().end()` with no completion is a
+ * guessing game, and the aggregation and attribute names are exactly what a
+ * reader cannot infer from the JS.
+ *
+ * These are deliberately loose where the runtime is loose. Faking precision the
+ * implementation does not have would produce type errors on correct code, which
+ * is worse than no types at all.
+ */
+
+declare module "abap2UI5/z2ui5_if_app" {
+  import type { Client } from "abap2UI5/z2ui5_cl_ui5_client";
+
+  /**
+   * Base class for every z2ui5 application.
+   *
+   * `main` is called once per roundtrip. The framework serializes the instance
+   * between roundtrips, so any own property is state that survives — and
+   * anything unserializable (a socket, a function, a class instance the
+   * registry cannot resolve) will not.
+   */
+  export default class z2ui5_if_app {
+    /** Set by the framework: the draft id this instance was loaded from. */
+    id_draft: string;
+    /** Set by the framework once `main` has run at least once. */
+    check_initialized: boolean;
+    /** Opt in to keeping this instance in memory between roundtrips. */
+    check_sticky: boolean;
+
+    main(client: Client): void | Promise<void>;
+  }
+}
+
+declare module "abap2UI5/z2ui5_cl_ui5_client" {
+  import type { ViewBuilder } from "abap2UI5/z2ui5_cl_ui5_view_builder";
+
+  export interface BindOptions {
+    /**
+     * Explicit member path, e.g. `"ms_data-customer-name"`.
+     *
+     * Required for anything nested. A JS string carries no reference
+     * identity, so `_bind(this.ms_data.customer.name)` passes the *value* and
+     * the framework can only match it against the first attribute holding an
+     * equal value — for empty strings, that is whichever it finds first. With
+     * `name` the path is unambiguous at any depth.
+     */
+    name?: string;
+    /** Bind a cell inside this table rather than a top-level attribute. */
+    tab?: unknown[];
+    tab_index?: number;
+    /** Return the bare path (`/PATH`) instead of `{/PATH}`. */
+    path_only?: boolean;
+  }
+
+  export interface Client {
+    /** One-way binding: the view reads, the backend is not written back to. */
+    _bind(val: unknown, opts?: BindOptions): string;
+    /** Two-way binding: user input is written back on the next roundtrip. */
+    _bind_edit(val: unknown, opts?: BindOptions): string;
+
+    /** The event name that triggered this roundtrip, `""` on first call. */
+    get_event(): string;
+    /** Extra arguments the view attached to the event. */
+    get_event_arg(index?: number): string;
+
+    /** Render a view. Call once per roundtrip, last. */
+    view_display(xml: string | ViewBuilder): void;
+    view_model_update(): void;
+
+    popup_display(xml: string | ViewBuilder): void;
+    popup_destroy(): void;
+
+    nav_app_call(app: unknown): void;
+    nav_app_leave(app?: unknown): void;
+    check_app_prev_stack(): boolean;
+
+    message_toast_display(text: string): void;
+    message_box_display(text: string, type?: string): void;
+
+    /** Follow-up actions run in the frontend after this roundtrip renders. */
+    follow_up_action(action: unknown): void;
+
+    [key: string]: unknown;
+  }
+}
+
+declare module "abap2UI5/z2ui5_cl_ui5_view_builder" {
+  /**
+   * The fluent XML view builder.
+   *
+   * Every method returns a builder, so a view is one chain. `tag` opens an
+   * element and `end` closes it; the aggregation helpers open the named
+   * aggregation of the current element.
+   */
+  export interface ViewBuilder {
+    /** Open an element, e.g. `tag("Button")`. */
+    tag(name: string, attributes?: Record<string, unknown>, selfClosing?: boolean): ViewBuilder;
+    /** Add attributes to the current element: `{ n: "text", v: "Save" }`. */
+    a(attributes: Record<string, unknown> | Array<Record<string, unknown>>): ViewBuilder;
+    /** Close the current element. */
+    end(): ViewBuilder;
+    /** Serialize the chain to XML. Usually done for you by view_display. */
+    get_root(): ViewBuilder;
+    xml_get(): string;
+
+    [key: string]: unknown;
+  }
+
+  /** Start a new view. `factory_page` and friends open a pre-shaped root. */
+  export function factory(root?: string): ViewBuilder;
+  export function factory_page(title?: string, navButton?: boolean): ViewBuilder;
+}
+
+declare module "abap2UI5/engine" {
+  /** A persisted draft row. `data` is the serialized application state. */
+  export interface DraftRow {
+    id: string;
+    id_prev?: string;
+    data: string;
+    [key: string]: unknown;
+  }
+
+  /** The durable draft store. Without one, drafts live in memory and are lost. */
+  export interface Store {
+    load(id: string): Promise<DraftRow | undefined> | DraftRow | undefined;
+    save(draft: DraftRow): Promise<void> | void;
+  }
+
+  export function set_store(store: Store): void;
+  /** Who the framework acts for. Read per use, so it is safe under concurrency. */
+  export function set_identity(provider: () => { user?: string; tenant?: string }): void;
+  /** Scan a folder for app classes. Apps inside the package need no registration. */
+  export function register_app_dir(dir: string): void;
+  export function roundtrip(body: unknown, reqInfo?: unknown): Promise<string>;
+  export function bootstrap_html(reqInfo?: unknown): { html: string; headers: Array<{ n: string; v: string }> };
+  export function ui5_resources_dir(): string | null;
+  export function session_key_for(ctx: { user?: string; tenant?: string }): string | null;
+  export function drop_sticky(ctx: { session_id: string }): void;
+}
+
+declare module "abap2UI5/cap" {
+  /**
+   * Wire the framework into a CAP project. Called automatically by the
+   * cds-plugin; call it directly only to override a piece.
+   */
+  export function activate(options?: {
+    cds?: unknown;
+    identity?: boolean;
+    store?: boolean;
+    routes?: boolean;
+    resources?: boolean;
+    retention?: boolean;
+    impl?: boolean;
+    /** Endpoint path, default `/rest/root/z2ui5`. */
+    path?: string;
+    /** Draft entity, `namespace.name`. Default `cap2ui5.z2ui5_t_01`. */
+    entity?: string;
+    /** Extra folders to scan for app classes. */
+    appDirs?: string[];
+  }): { active: boolean; applied?: string[]; endpoint?: string; entity?: string; reason?: string };
+}
+
+declare module "abap2UI5/z2ui5_html" {
+  /** Escape for HTML element text. */
+  export function escape_text(val: unknown): string;
+  /** Escape for an HTML attribute, single- or double-quoted. */
+  export function escape_attr(val: unknown): string;
+  /**
+   * Escape a URI for a double-quoted attribute, dropping `javascript:` and
+   * `vbscript:`. Returns `""` for a rejected scheme, which callers treat as
+   * "not configured".
+   */
+  export function escape_uri(val: unknown): string;
+}
diff --git a/run/input/core/z2ui5-model.cds b/run/input/core/z2ui5-model.cds
new file mode 100644
index 0000000..081bc31
--- /dev/null
+++ b/run/input/core/z2ui5-model.cds
@@ -0,0 +1,31 @@
+namespace cap2ui5;
+
+/**
+ * Draft persistence of the z2ui5 runtime — one row per roundtrip, chained via
+ * id_prev for back-navigation (the layout of the abap2UI5 table Z2UI5_T_01).
+ *
+ * Shipped by the package rather than hand-written per project: it is not an
+ * application model, it is the runtime's own storage, and a consumer copying it
+ * by hand can only get it wrong or let it drift. Bring it into a project with
+ *
+ *   using from 'abap2UI5/z2ui5-model';
+ *
+ * `owner` is the authenticated user the draft belongs to (abap2UI5 stores
+ * sy-uname in the same position). `data` is the fully serialized application
+ * state, so a row must only ever be readable by the user that created it —
+ * enforced in two independent places, the service projection a consumer
+ * exposes and the draft store's own load filter (srv/cap/activate.js). Two
+ * checks on purpose: the store path does not go through the service.
+ *
+ * Indexes for `createdAt` (the hourly retention DELETE) and `owner` (the
+ * projection filter) ship as HANA design-time artifacts alongside this file;
+ * CAP has no portable index syntax, and without them both are full scans over
+ * a table that gains a row per roundtrip.
+ */
+entity z2ui5_t_01 {
+    key id        : UUID;
+        id_prev   : UUID;
+        owner     : String(255);
+        data      : LargeString;
+        createdAt : Timestamp @cds.on.insert: $now;
+}
diff --git a/run/input/core/z2ui5-service.cds b/run/input/core/z2ui5-service.cds
new file mode 100644
index 0000000..7088b0f
--- /dev/null
+++ b/run/input/core/z2ui5-service.cds
@@ -0,0 +1,29 @@
+using from './z2ui5-model';
+
+/**
+ * The z2ui5 roundtrip endpoint — one REST action, mounted at
+ * /rest/root/z2ui5, which frontends POST as `{ value: <oBody> }`.
+ *
+ * Shipped by the package so a consumer does not hand-write the service that
+ * makes the framework work. Bring it into a project with
+ *
+ *   using from 'abap2UI5/z2ui5-service';
+ *
+ * and the implementation is registered by the cds-plugin.
+ *
+ * `@(requires: 'User')` rather than `authenticated-user`: authentication says
+ * who someone is, not that they were granted this application. Declare the
+ * matching scope and role template in the project's xs-security.json (the
+ * generated app ships one); CAP maps the role name onto `$XSAPPNAME.User`.
+ * A project that genuinely wants any authenticated user can relax it with its
+ * own `annotate rootService with @(requires: 'authenticated-user');`.
+ */
+@(requires: 'User')
+@protocol: 'rest'
+service rootService {
+
+    @open
+    type object {};
+    action z2ui5(value : object) returns object;
+
+}
diff --git a/src/AGENTS.md b/src/AGENTS.md
index 121bb2d..419cc9a 100644
--- a/src/AGENTS.md
+++ b/src/AGENTS.md
@@ -17,7 +17,7 @@ Guidance for AI agents and contributors. Read before making any change.
 | the app skeleton (`srv/server.js`, `z2ui5-service.*`, `db/`, `mta.yaml`, `test/`, README, devcontainer, this file) | [builder-cap2UI5](https://github.com/cap2UI5/builder-cap2UI5) → `src/` |
 | the framework / core package (`core/` — engine, `core/srv/z2ui5/`, bundled samples, webapp) | [builder-abap2UI5-js](https://github.com/cap2UI5/builder-abap2UI5-js) → `src/` (or its transpiler pipelines) |
 | this repo's CI (`.github/workflows/` — `test.yml`, `trigger_web.yml`, `deploy-check.yml` — and `.github/dependabot.yml`) | here — `.github/` is the only repo-owned folder |
-| your own apps (as a **user** of cap2UI5) | `srv/app/` or any folder registered via `Z2UI5_APP_DIRS` / `require("abap2UI5/register-apps")(dir)` — note `srv/app/` is overwritten on every publish, so external folders are safer for real projects |
+| your own apps (as a **user** of cap2UI5) | **your own CAP project** — install the package, `using from 'abap2UI5/z2ui5-model'` + `'abap2UI5/z2ui5-service'`, and point at your folder with `Z2UI5_APP_DIRS` / `require("abap2UI5/register-apps")(dir)`. `srv/app/` here works for a quick look but is overwritten on every publish, so nothing you want to keep belongs in it. |
 
 ## Layout
 
diff --git a/src/README.md b/src/README.md
index f13a5ce..9097592 100644
--- a/src/README.md
+++ b/src/README.md
@@ -27,6 +27,25 @@ Bringing the [abap2UI5](https://github.com/abap2UI5/abap2UI5) concept to CAP/Nod
 * Security
 * Speed
 
+## Using cap2UI5 in your own project
+
+This repository is the **demo**, not the delivery mechanism. It is generated on
+every sync, so it is a place to look, not a place to build. To use the
+framework in a CAP project of your own, install the package and add two lines:
+
+```cds
+using from 'abap2UI5/z2ui5-model';      // db/schema.cds — the draft table
+using from 'abap2UI5/z2ui5-service';    // srv/service.cds — the endpoint
+```
+
+The package's `cds-plugin` does the rest — identity, draft persistence, app
+discovery, the bootstrap routes, the UI5 runtime and the roundtrip
+implementation — so there is no server boilerplate to copy. Point it at your
+apps with `Z2UI5_APP_DIRS`, run `cds watch`, open `/rest/root/z2ui5`.
+
+Everything is opt-outable through `"cds": { "z2ui5": { … } }` in your
+package.json if you want to wire a piece yourself.
+
 ## Getting Started
 
 Prerequisites: Node.js ≥ 22 (see `.nvmrc`). The whole stack runs offline —
@@ -220,13 +239,21 @@ the transpiler and all other dev tooling live in
 All samples demonstrate complete view definition and data exchange handled entirely by the CAP server, using the same and static frontend from abap2UI5.
 
 Each app is a single `.js` file whose basename matches the class name it
-exports (`module.exports`). Put your own apps into `srv/app/` (scanned
-automatically when resolving `?app_start=<class>`, see the
-[custom apps README](srv/app/README.md)) or into any folder registered via
-`Z2UI5_APP_DIRS` / `require("abap2UI5/register-apps")(dir)` — see the
-[discovery API](core/srv/app/samples/README.md#discovery-api). The
-bundled samples and the framework classes live in the vendored core package
-([`core/`](core/)), which is owned by the sync pipeline.
+exports (`module.exports`).
+
+**Where to put your own apps depends on what this repository is to you.**
+This has been ambiguous — the README used to say "put your own apps into
+`srv/app/`" while AGENTS.md said `srv/app/` is overwritten on every publish —
+so, plainly:
+
+| You are… | Put apps in | Why |
+|---|---|---|
+| **using cap2UI5 in your own CAP project** (the supported path) | anywhere in your project | Install the package, add the two `using` lines, and point at your folder with `Z2UI5_APP_DIRS` or `require("abap2UI5/register-apps")(__dirname)`. Nothing here can overwrite it. |
+| exploring this repository, or running the demo | `srv/app/` | Scanned automatically when resolving `?app_start=<class>` (see the [custom apps README](srv/app/README.md)). **Overwritten on every publish** — this repo is a generated artifact, so treat anything you leave here as disposable. |
+| changing the demo app itself | `builder-cap2UI5:src/srv/app/` | That is the source this folder is generated from. |
+
+The bundled samples and the framework classes live in the vendored core package
+([`core/`](core/)), which is owned by the sync pipeline — never edit them.
 
 #### 1. Hello World
 ###### App
diff --git a/src/db/schema.cds b/src/db/schema.cds
index 523e451..7973bd4 100644
--- a/src/db/schema.cds
+++ b/src/db/schema.cds
@@ -1,27 +1,10 @@
-namespace cap2ui5;
+// The draft table is shipped by the package, not redeclared here -- see
+// abap2UI5/z2ui5-model.cds. It is the runtime's own storage rather than an
+// application model, so a copy in every project could only drift. This is the
+// same import an external project writes.
+using from 'abap2UI5/z2ui5-model';
 
-/**
- * Draft persistence of the z2ui5 runtime — one row per roundtrip,
- * chained via id_prev for back-navigation (same layout as the
- * abap2UI5 table Z2UI5_T_01).
- *
- * `owner` is the authenticated user the draft belongs to (abap2UI5 stores
- * sy-uname in the same position). `data` is the fully serialized application
- * state, so a row is only ever readable by the user that created it: the
- * service projection filters on it (srv/z2ui5-service.cds) and the draft
- * store's own load filters on it again (srv/server.js). Two independent
- * checks on purpose — the store path does not go through the service.
- */
-entity z2ui5_t_01 {
-    key id        : UUID;
-        id_prev   : UUID;
-        owner     : String(255);
-        data      : LargeString;
-        createdAt : Timestamp @cds.on.insert: $now;
-}
-
-// Indexes on `createdAt` and `owner` are shipped as HANA design-time
-// artifacts in db/src/*.hdbindex — see the comment in those files for why
-// each one exists. They are deliberately not CDS annotations: CAP has no
-// portable index syntax, and the production database is HANA
-// (package.json → cds.requires.db."[production]").
+// Indexes on `createdAt` and `owner` ship as HANA design-time artifacts in
+// db/src/*.hdbindex -- see the comment in those files for why each exists.
+// They are deliberately not CDS annotations: CAP has no portable index syntax,
+// and the production database is HANA (package.json -> cds.requires.db).
diff --git a/src/srv/draft-retention.js b/src/srv/draft-retention.js
deleted file mode 100644
index 1c2327f..0000000
--- a/src/srv/draft-retention.js
+++ /dev/null
@@ -1,96 +0,0 @@
-const cds = require("@sap/cds");
-
-/**
- * Draft retention for cap2ui5.z2ui5_t_01.
- *
- * The store is append-only (one row per roundtrip, chained via id_prev for
- * back-navigation), so without cleanup the table grows without bound in
- * production. Rows older than the TTL are dead weight: their draft ids are
- * long gone from any live browser session.
- *
- *   Z2UI5_DRAFT_TTL_HOURS   TTL in hours (default 24; 0 disables cleanup)
- *
- * THE TTL IS ONE SETTING, NOT TWO
- * -------------------------------
- * The framework carries its own draft expiry — `draft_exp_time_in_hours` on
- * the http-post exit config, default 4 — and for a long time the two were
- * unrelated: this job deleted at 24h while the framework believed drafts lived
- * 4h, and nobody had said which one was true. They are now reconciled: the
- * framework value is the source of truth, this job follows it, and
- * Z2UI5_DRAFT_TTL_HOURS overrides both when set. One knob, one answer.
- *
- * ONE INSTANCE DELETES, NOT ALL OF THEM
- * -------------------------------------
- * Every application instance used to run this loop, so scaling to N instances
- * meant N concurrent hourly DELETEs over the same rows — the same work done N
- * times, contending. Retention is a housekeeping job, not per-instance state:
- * set Z2UI5_DRAFT_RETENTION_INSTANCE to the CF instance index that should run
- * it (default "0", i.e. the first instance), or "*" to let every instance run
- * it. CF exposes the index as CF_INSTANCE_INDEX; outside CF the variable is
- * absent and the job runs, which is the right answer for a single process.
- *
- * deleteExpiredDrafts() is exported for tests; start() runs it once at
- * startup and then hourly (unref'd, so it never keeps the process alive).
- */
-
-const DEFAULT_TTL_HOURS = 4;
-
-/**
- * The framework's own expiry, asked of the shipped exit. Falls back to the
- * default when the core is not resolvable (e.g. a unit test importing this
- * module standalone) — never throws, since retention must not break boot.
- */
-function frameworkTtlHours() {
-  try {
-    const exit = require("abap2UI5/z2ui5_cl_ui5_user_exit");
-    const cfg = exit.get_instance().set_config_http_post({ cs_config: {} });
-    const n = Number(cfg?.draft_exp_time_in_hours);
-    if (Number.isFinite(n) && n > 0) return n;
-  } catch {
-    /* core not loadable here — fall through to the default */
-  }
-  return DEFAULT_TTL_HOURS;
-}
-
-const ttlHours = () => {
-  const raw = process.env.Z2UI5_DRAFT_TTL_HOURS;
-  if (raw === undefined || raw === "") return frameworkTtlHours();
-  const n = Number(raw);
-  return Number.isFinite(n) && n >= 0 ? n : frameworkTtlHours();
-};
-
-/** Whether THIS instance is the one that runs the housekeeping loop. */
-function isRetentionInstance() {
-  const want = process.env.Z2UI5_DRAFT_RETENTION_INSTANCE ?? "0";
-  if (want === "*") return true;
-  const idx = process.env.CF_INSTANCE_INDEX;
-  if (idx === undefined || idx === "") return true; // not on CF — single process
-  return String(idx) === String(want);
-}
-
-async function deleteExpiredDrafts(now = Date.now()) {
-  const ttl = ttlHours();
-  if (ttl === 0) return 0;
-  const { z2ui5_t_01 } = cds.entities("cap2ui5");
-  const cutoff = new Date(now - ttl * 3600 * 1000).toISOString();
-  const deleted = await DELETE.from(z2ui5_t_01).where({ createdAt: { "<": cutoff } });
-  if (deleted) console.log(`[z2ui5] draft retention: deleted ${deleted} row(s) older than ${ttl}h`);
-  return deleted;
-}
-
-function start() {
-  const ttl = ttlHours();
-  if (ttl === 0) return;
-  if (!isRetentionInstance()) {
-    console.log(
-      `[z2ui5] draft retention: instance ${process.env.CF_INSTANCE_INDEX} is not the retention instance — skipping`,
-    );
-    return;
-  }
-  console.log(`[z2ui5] draft retention: deleting drafts older than ${ttl}h, hourly`);
-  const run = () => deleteExpiredDrafts().catch((e) => console.error("[z2ui5] draft retention failed:", e.message));
-  run();
-  setInterval(run, 3600 * 1000).unref();
-}
-
-module.exports = { deleteExpiredDrafts, start, ttlHours, isRetentionInstance };
diff --git a/src/srv/server.js b/src/srv/server.js
index 4395964..9978fe5 100644
--- a/src/srv/server.js
+++ b/src/srv/server.js
@@ -1,79 +1,46 @@
 const cds = require("@sap/cds");
-const express = require("express");
+const path = require("path");
 const engine = require("abap2UI5/engine");
-const z2ui5_cl_util_http = require("abap2UI5/z2ui5_cl_util_http");
 
 /**
- * The CAP platform wiring for the abap2UI5 core package (linked as
- * `abap2UI5` from the vendored ./core). The z2ui5 roundtrip itself is a CDS REST action
- * (see z2ui5-service.cds + z2ui5-service.js — `srv.on('z2ui5', …)` on the
- * rootService). This file contributes everything CDS can't express:
+ * App-specific server wiring.
  *
- *   GET  /rest/root/z2ui5  → bootstrap HTML via engine.bootstrap_html()
- *                            (mirrors abap _http_get)
- *   HEAD /rest/root/z2ui5  → CSRF-prefetch + sap-terminate ack. CDS REST
- *                            actions don't expose HEAD, so we register it here.
- *   /resources             → the local UI5 runtime
+ * The framework's own CAP wiring — identity, the draft store, the bootstrap
+ * GET/HEAD routes, the UI5 runtime at /resources, draft retention and the
+ * roundtrip implementation — is contributed by the package's `cds-plugin.js`,
+ * which CAP loads automatically because this app depends on it. That used to
+ * live here, ~160 lines of it, which meant every project that wanted to use
+ * the framework had to copy this file and keep it in sync by hand.
  *
- * plus the two platform ports of this app:
- *   draft store            → the CDS entity cap2ui5.z2ui5_t_01 (db/schema.cds),
- *                            expired rows cleaned hourly (srv/draft-retention.js)
- *   app discovery          → this project's srv/app/ (custom apps)
+ * So this file is now only what is genuinely specific to THIS app:
+ *
+ *   srv/app discovery      → where this project's own app classes live
+ *   request body cap       → an explicit limit on the roundtrip payload
+ *   security headers       → on the data endpoints, not just the shell
+ *   /health                → the readiness probe mta.yaml points CF at
+ *
+ * To wire something differently, configure the plugin rather than editing
+ * around it: `"cds": { "z2ui5": { "routes": false } }` in package.json turns
+ * one piece off, `"activate": false` turns all of it off, and
+ * `require("abap2UI5/cap").activate(options)` does it explicitly.
  */
 
-// Identity: who the framework is acting for. The core package is platform
-// neutral and has no ambient sy-uname, so CAP's request-scoped user is
-// injected as a provider. It is read PER USE (cds.context is async-local),
-// which is what makes one installed provider correct under concurrency.
-//
-// This drives three things: sy-uname in apps, the draft owner binding below,
-// and the per-session isolation of the engine's sticky handler store.
-engine.set_identity(() => ({
-  user: cds.context?.user?.id,
-  tenant: cds.context?.tenant,
-}));
-
-// Draft persistence: the CDS-backed store. The core package is platform
-// neutral and only knows the injected contract load(id)/save(entry).
-//
-// Every row is stamped with its owner and only ever loaded back for that same
-// owner. The draft id is a UUID, but unguessability is not an access control:
-// ids travel in request bodies, logs and browser history, and the OData
-// projection would otherwise hand them out wholesale. The service projection
-// enforces the same rule (srv/z2ui5-service.cds) — this path does not go
-// through the service, so it has to check for itself.
-const draftOwner = () => cds.context?.user?.id || "anonymous";
-
-engine.set_store({
-  load: async (id) => {
-    const { z2ui5_t_01 } = cds.entities("cap2ui5");
-    return SELECT.one.from(z2ui5_t_01).where({ id, owner: draftOwner() });
-  },
-  save: async (entry) => {
-    const { z2ui5_t_01 } = cds.entities("cap2ui5");
-    await INSERT.into(z2ui5_t_01).entries({ ...entry, owner: draftOwner() });
-  },
-});
-
-// App discovery: custom apps of THIS project live in srv/app/ — outside the
-// core package, so they must be registered (the bundled samples inside the
-// package are found without registration).
-engine.register_app_dir(require("path").join(__dirname, "app"));
-
-// Retention: the store above is append-only, so expired draft chains are
-// pruned on a timer once the database is connected.
-cds.on("served", () => require("./draft-retention").start());
+// App discovery: this project's own apps live in srv/app/ — outside the core
+// package, so they have to be registered. Apps bundled inside the package
+// (the samples) are found without registration. An external project would
+// point at its own folder here, or set Z2UI5_APP_DIRS.
+engine.register_app_dir(path.join(__dirname, "app"));
 
 cds.on("bootstrap", (app) => {
   // Request body cap on the roundtrip. The action signature is
   // `z2ui5(value : object)` over an `@open type object {}`, i.e. CDS validates
   // nothing about the payload — whatever arrives is handed to the engine and,
-  // on the way back out, stored in a LargeString column. Until now the only
-  // limit was express's 100kb default, which applied by accident rather than
-  // by decision and would silently change if anything reconfigured the parser.
-  // Set it explicitly, and generously enough for a legitimately large view
-  // model (Z2UI5_MAX_BODY overrides; a bad value falls back to the default
-  // rather than removing the cap).
+  // on the way back out, stored in a LargeString column. Until 2026-08 the
+  // only limit was express's 100kb default, which applied by accident rather
+  // than by decision and would silently change if anything reconfigured the
+  // parser. Set it explicitly, and generously enough for a legitimately large
+  // view model (Z2UI5_MAX_BODY overrides; a bad value falls back to the
+  // default rather than removing the cap).
   const maxBody = (() => {
     const raw = process.env.Z2UI5_MAX_BODY;
     return typeof raw === "string" && /^\d+(kb|mb)?$/i.test(raw.trim()) ? raw.trim() : "2mb";
@@ -81,10 +48,10 @@ cds.on("bootstrap", (app) => {
   app.use("/rest/root/z2ui5", require("express").json({ limit: maxBody }));
 
   // Security headers on the DATA endpoints too, not just the bootstrap page.
-  // The GET route below applies the framework's t_security_header when it
-  // renders the shell; the POST roundtrip and the OData entities answered
-  // nothing at all, so a response carrying application state came back without
-  // nosniff, without a frame guard and cacheable by any intermediary.
+  // The framework applies its own t_security_header when it renders the shell;
+  // the POST roundtrip and the OData entities answered nothing at all, so a
+  // response carrying application state came back without nosniff, without a
+  // frame guard and cacheable by any intermediary.
   app.use((req, res, next) => {
     if (req.path === "/rest/root/z2ui5" || req.path.startsWith("/odata/")) {
       res.set("X-Content-Type-Options", "nosniff");
@@ -98,91 +65,9 @@ cds.on("bootstrap", (app) => {
   // Readiness probe — mta.yaml declares
   // readiness-health-check-http-endpoint: /health for the abap2UI5-srv
   // module, so CF polls this route to decide the instance is up. It must stay
-  // public (the probe carries no auth) and cheap; a bare 200 is enough since
+  // public (the probe carries no auth) and cheap; a bare 200 is enough, since
   // the process answering at all is the signal CF needs.
   app.get("/health", (_req, res) => res.status(200).json({ status: "UP" }));
-
-  // Serve the local UI5 runtime at /resources (must be registered before the
-  // CDS services so it is not shadowed by the OData/REST routing) — the app
-  // bootstraps from `/resources/sap-ui-core.js` (see patch-frontend.js /
-  // z2ui5_cl_ui5_user_exit.js) instead of a public CDN, so the whole stack runs
-  // offline, served from the pinned `openui5-dist` dependency. OpenUI5 ships
-  // only the open-source libraries; sample apps that use commercial SAPUI5
-  // libs (sap.suite.*, sap.gantt, sap.ui.comp, …) still require the SAPUI5
-  // CDN. The trailing handler answers a plain 404 for files the dist doesn't
-  // ship (e.g. locale message bundles UI5 probes for and then falls back on)
-  // instead of letting the miss bubble up as a logged error.
-  // engine.ui5_resources_dir() returns null when openui5-dist cannot be
-  // resolved. express.static(null) throws "root path required" — a message
-  // that points at express rather than at the missing dependency, from a
-  // stack deep inside the bootstrap. Say what is actually wrong instead.
-  const ui5Resources = engine.ui5_resources_dir();
-  if (!ui5Resources) {
-    throw new Error(
-      "openui5-dist could not be resolved — the local UI5 runtime served at " +
-      "/resources is missing. Run `npm ci` (or `npm install`) in the app root.",
-    );
-  }
-  app.use(
-    "/resources",
-    express.static(ui5Resources, { maxAge: "1h" }),
-    (_req, res) => res.status(404).end(),
-  );
-
-  // Auth boundary: the DATA endpoints — the POST z2ui5 roundtrip action and
-  // the AdminService OData entities — are restricted to authenticated users
-  // (@requires in z2ui5-service.cds). The GET/HEAD routes below are
-  // deliberately left public: they serve only the static UI5 bootstrap shell
-  // and the CSRF/terminate ack, carry no user data, and keeping them open
-  // preserves the offline/dev flow. In BTP the approuter authenticates before
-  // the frontend can reach them anyway.
-  app.get("/rest/root/z2ui5", (req, res) => {
-    // The engine call renders arbitrary app HTML — never let a failure
-    // escape as an unhandled express error (raw stack trace to the client).
-    try {
-      const reqInfo = z2ui5_cl_util_http.factory_cloud(req, res).get_req_info();
-      const { html, headers } = engine.bootstrap_html(reqInfo);
-
-      // Apply ABAP's t_security_header (cache-control, X-Frame-Options, …).
-      for (const h of headers) {
-        res.set(h.n, h.v);
-      }
-      res.set("Content-Type", "text/html; charset=utf-8");
-      res.status(200).send(html);
-    } catch (e) {
-      console.error("GET /rest/root/z2ui5 bootstrap failed:", e);
-      res
-        .status(500)
-        .set("Content-Type", "text/plain; charset=utf-8")
-        .send(`z2ui5 bootstrap failed: ${e.message}`);
-    }
-  });
-
-  // HEAD serves two clients: the CSRF prefetch, and the beacon the webapp
-  // sends on tab close (`sap-terminate: session`, see webapp/core/Server.js).
-  // The beacon is the only signal that a session is over, so it is where a
-  // sticky app's retained state gets released — otherwise it lingers until
-  // the store evicts it under pressure.
-  app.head("/rest/root/z2ui5", (req, res) => {
-    if (String(req.get("sap-terminate") || "").toLowerCase() === "session") {
-      // This route is registered on the bootstrap express app, i.e. ahead of
-      // the CDS middleware chain — cds.context is not established here, so the
-      // identity provider above cannot answer and the key has to be derived
-      // from whatever the request itself carries. When that is nobody we drop
-      // NOTHING: releasing a key we guessed would evict a stranger's session.
-      const user = req.user?.id || cds.context?.user?.id;
-      const session_id = engine.session_key_for({ user, tenant: cds.context?.tenant });
-      if (session_id) {
-        try {
-          engine.drop_sticky({ session_id });
-        } catch (e) {
-          console.error("sticky release failed:", e);
-        }
-      }
-    }
-    res.set("X-CSRF-Token", "disabled");
-    res.status(200).end();
-  });
 });
 
 module.exports = cds.server;
diff --git a/src/srv/z2ui5-service.cds b/src/srv/z2ui5-service.cds
index 983ca3a..12daa7f 100644
--- a/src/srv/z2ui5-service.cds
+++ b/src/srv/z2ui5-service.cds
@@ -40,30 +40,9 @@ service AdminService {
         }
 }
 
-/**
- * REST-protocol service: the z2ui5 action is the single roundtrip endpoint.
- * Mounted at /rest/root/z2ui5 — frontends POST `{value: <oBody>}`.
- *
- * Requires the `User` role. In the BTP deployment the approuter authenticates
- * via xsuaa and the srv destination forwards the JWT (HTML5.ForwardAuthToken),
- * so the roundtrip runs under the real user; a direct unauthenticated call to
- * the srv route is rejected.
- *
- * `User` rather than `authenticated-user`: xs-security.json has always
- * declared the scope `$XSAPPNAME.User` and a matching role template, and
- * nothing ever referenced it — so the authorization model existed on paper
- * while every authenticated user in the subaccount passed, role collection
- * assigned or not. Naming the role here is what makes assigning it mean
- * something. CAP maps the name onto the `$XSAPPNAME.User` scope; the mocked
- * development users in package.json carry the same role so the local and test
- * flows are unchanged.
- */
-@(requires: 'User')
-@protocol: 'rest'
-service rootService {
-
-    @open
-    type object {};
-    action z2ui5(value : object) returns object;
-
-}
+// The z2ui5 roundtrip service (rootService) is shipped by the package -- see
+// abap2UI5/z2ui5-service.cds -- so this app does not redeclare it. That is the
+// same import an external project writes, which is what keeps the packaged
+// definition exercised by this app's own test suite rather than only in
+// theory. Its implementation is registered by the package's cds-plugin.
+using from 'abap2UI5/z2ui5-service';
diff --git a/src/srv/z2ui5-service.js b/src/srv/z2ui5-service.js
index 9b78eba..83a4495 100644
--- a/src/srv/z2ui5-service.js
+++ b/src/srv/z2ui5-service.js
@@ -1,14 +1,15 @@
 const cds = require("@sap/cds");
-const z2ui5_cl_ui5_http_handler = require("abap2UI5/z2ui5_cl_ui5_http_handler");
 
+/**
+ * App-specific service handlers.
+ *
+ * The z2ui5 roundtrip action is NOT implemented here: the package's
+ * cds-plugin registers it on whichever service declares a `z2ui5` action
+ * (see abap2UI5/srv/cap/activate.js). Registering it here as well would put
+ * two handlers on the same action.
+ */
 module.exports = cds.service.impl(async function (srv) {
 
-    // z2ui5 roundtrip endpoint — POST /rest/root/z2ui5 with body {value: <oBody>}.
-    // The handler unwraps `req.data.value` and forwards the inner body to the
-    // core_handler. Same wire format the abap2UI5 ICF endpoint receives after
-    // its servlet unwrapping.
-    srv.on('z2ui5', z2ui5_cl_ui5_http_handler);
-
     // Northwind Customers READ handler — the remote demo service may be
     // unreachable (offline, proxy, service down); answer with a clean CDS
     // error instead of letting the raw fetch failure bubble up as a 500.
diff --git a/src/test/draft-retention.test.js b/src/test/draft-retention.test.js
index 16a8c4c..5306da6 100644
--- a/src/test/draft-retention.test.js
+++ b/src/test/draft-retention.test.js
@@ -1,13 +1,13 @@
 /**
  * Draft retention — expired rows in cap2ui5.z2ui5_t_01 are deleted, fresh
- * ones survive (see srv/draft-retention.js; the store itself is append-only).
+ * ones survive (see abap2UI5/srv/cap/retention.js; the store itself is append-only).
  */
 const path = require("path");
 const cds = require("@sap/cds");
 
 cds.test(path.join(__dirname, ".."));
 
-const { deleteExpiredDrafts } = require("../srv/draft-retention");
+const { deleteExpiredDrafts } = require("abap2UI5/cap-retention");
 
 describe("draft retention", () => {
   test("deletes rows older than the TTL, keeps fresh ones", async () => {
diff --git a/src/test/security.test.js b/src/test/security.test.js
index 54e5559..39a1b81 100644
--- a/src/test/security.test.js
+++ b/src/test/security.test.js
@@ -81,7 +81,7 @@ describe("the bootstrap page escapes and configures correctly", () => {
 });
 
 describe("draft retention", () => {
-  const retention = require("../srv/draft-retention");
+  const retention = require("abap2UI5/cap-retention");
 
   afterEach(() => {
     delete process.env.Z2UI5_DRAFT_TTL_HOURS;

From 6bedc733b9a82acdfc33ba3cccf48517b20f4f14 Mon Sep 17 00:00:00 2001
From: Claude <tmswyer@gmail.com>
Date: Fri, 21 Aug 2026 17:03:14 +0000
Subject: [PATCH 3/6] Refresh the core mirror after the transpiler and
 divergence work

Picks up the CP/NP/IN comparison fixes, the escaping helpers and the CAP
entry points. builder 30 tests, app 44 tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2gZuy95uKcT2zngQd1sAL
---
 run/input/UPSTREAM_COMMIT | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/run/input/UPSTREAM_COMMIT b/run/input/UPSTREAM_COMMIT
index f3f5761..ec2b540 100644
--- a/run/input/UPSTREAM_COMMIT
+++ b/run/input/UPSTREAM_COMMIT
@@ -1 +1 @@
-ec261880730d1de7a0c392da7f50622098a11fdd
+a2ccc77f6f095c66f280c06079ff15bda959d426

From 31bd9b86eaaf46d863a06a3a464153b60a01d870 Mon Sep 17 00:00:00 2001
From: Claude <tmswyer@gmail.com>
Date: Fri, 21 Aug 2026 18:59:27 +0000
Subject: [PATCH 4/6] Refresh the core mirror: S-RTTI removed, JSON filter
 fixed

Picks up the removal of upstream's S-RTTI package (12 unused classes whose
factory returned null for every type kind) and the repair of
z2ui5_cl_util_json_fltr. Core drops from 318 to 306 files.

builder 30 tests, app 44 tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2gZuy95uKcT2zngQd1sAL
---
 run/input/UPSTREAM_COMMIT                     |  2 +-
 run/input/core/package.json                   |  2 -
 .../srv/z2ui5/00/00/cl_abap_objectdescr.js    |  1 -
 .../srv/z2ui5/00/01/z2ui5_cl_ajson_mapping.js |  4 +-
 .../srv/z2ui5/00/02/z2ui5_cl_srt_aunit.js     | 33 --------
 .../z2ui5/00/02/z2ui5_cl_srt_classdescr.js    | 14 ----
 .../z2ui5/00/02/z2ui5_cl_srt_complexdescr.js  |  7 --
 .../srv/z2ui5/00/02/z2ui5_cl_srt_datadescr.js |  7 --
 .../srv/z2ui5/00/02/z2ui5_cl_srt_elemdescr.js | 84 -------------------
 .../srv/z2ui5/00/02/z2ui5_cl_srt_intfdescr.js | 12 ---
 .../z2ui5/00/02/z2ui5_cl_srt_objectdescr.js   | 24 ------
 .../srv/z2ui5/00/02/z2ui5_cl_srt_refdescr.js  | 30 -------
 .../z2ui5/00/02/z2ui5_cl_srt_structdescr.js   | 62 --------------
 .../z2ui5/00/02/z2ui5_cl_srt_tabledescr.js    | 51 -----------
 .../srv/z2ui5/00/02/z2ui5_cl_srt_typedescr.js | 82 ------------------
 .../core/srv/z2ui5/00/02/z2ui5_cx_srt.js      | 15 ----
 .../z2ui5/00/03/z2ui5_cl_util_json_fltr.js    | 61 ++++++++++----
 .../srv/z2ui5/01/02/z2ui5_cl_ui5_handler.js   |  2 -
 .../srv/z2ui5/01/02/z2ui5_cl_ui5_srv_bind.js  |  2 +-
 .../srv/z2ui5/01/02/z2ui5_cl_ui5_srv_model.js |  6 +-
 .../srv/z2ui5/01/04/z2ui5_cl_ui5_app_start.js |  1 -
 21 files changed, 54 insertions(+), 448 deletions(-)
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_aunit.js
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_classdescr.js
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_complexdescr.js
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_datadescr.js
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_elemdescr.js
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_intfdescr.js
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_objectdescr.js
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_refdescr.js
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_structdescr.js
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_tabledescr.js
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_typedescr.js
 delete mode 100644 run/input/core/srv/z2ui5/00/02/z2ui5_cx_srt.js

diff --git a/run/input/UPSTREAM_COMMIT b/run/input/UPSTREAM_COMMIT
index ec2b540..1a58ea6 100644
--- a/run/input/UPSTREAM_COMMIT
+++ b/run/input/UPSTREAM_COMMIT
@@ -1 +1 @@
-a2ccc77f6f095c66f280c06079ff15bda959d426
+8be4fbf63369b239c8ca788b26c3fd6de01359fe
diff --git a/run/input/core/package.json b/run/input/core/package.json
index 8f80b2b..3565d8a 100644
--- a/run/input/core/package.json
+++ b/run/input/core/package.json
@@ -45,8 +45,6 @@
     "./z2ui5_cl_ajson": "./srv/z2ui5/00/01/z2ui5_cl_ajson.js",
     "./z2ui5_cl_ajson_*": "./srv/z2ui5/00/01/z2ui5_cl_ajson_*.js",
     "./z2ui5_cx_ajson_error": "./srv/z2ui5/00/01/z2ui5_cx_ajson_error.js",
-    "./z2ui5_cl_srt_*": "./srv/z2ui5/00/02/z2ui5_cl_srt_*.js",
-    "./z2ui5_cx_srt": "./srv/z2ui5/00/02/z2ui5_cx_srt.js",
     "./z2ui5_cl_util": "./srv/z2ui5/00/03/z2ui5_cl_util.js",
     "./z2ui5_cl_util_api": "./srv/z2ui5/00/03/02/z2ui5_cl_util_api.js",
     "./z2ui5_cl_util_api_*": "./srv/z2ui5/00/03/02/z2ui5_cl_util_api_*.js",
diff --git a/run/input/core/srv/z2ui5/00/00/cl_abap_objectdescr.js b/run/input/core/srv/z2ui5/00/00/cl_abap_objectdescr.js
index 0f0ce15..e98e771 100644
--- a/run/input/core/srv/z2ui5/00/00/cl_abap_objectdescr.js
+++ b/run/input/core/srv/z2ui5/00/00/cl_abap_objectdescr.js
@@ -1,6 +1,5 @@
 /** cl_abap_objectdescr — native shim (describe_by_object_ref + visibility consts). */
 "use strict";
-const rtti = require("./abap_rtti");
 const cl_abap_typedescr = require("./cl_abap_typedescr");
 
 class cl_abap_objectdescr extends cl_abap_typedescr {
diff --git a/run/input/core/srv/z2ui5/00/01/z2ui5_cl_ajson_mapping.js b/run/input/core/srv/z2ui5/00/01/z2ui5_cl_ajson_mapping.js
index b2d712e..532ff12 100644
--- a/run/input/core/srv/z2ui5/00/01/z2ui5_cl_ajson_mapping.js
+++ b/run/input/core/srv/z2ui5/00/01/z2ui5_cl_ajson_mapping.js
@@ -35,12 +35,12 @@ class lcl_mapping_fields {
     }
   }
 
-  to_abap({ iv_path, iv_name } = {}) {
+  to_abap({ iv_path: _iv_path, iv_name } = {}) {
     const hit = this.mt_mapping_fields.find((r) => r.json === iv_name);
     return hit ? hit.abap : "";
   }
 
-  to_json({ iv_path, iv_name } = {}) {
+  to_json({ iv_path: _iv_path, iv_name } = {}) {
     const field = String(iv_name ?? "").toUpperCase();
     const hit = this.mt_mapping_fields.find((r) => r.abap === field);
     return hit ? hit.json : "";
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_aunit.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_aunit.js
deleted file mode 100644
index 71035ed..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_aunit.js
+++ /dev/null
@@ -1,33 +0,0 @@
-// TODO(abap2js): unresolved reference cl_abap_typedescr — add require manually
-// TODO(abap2js): unresolved reference cl_abap_unit_assert — add require manually
-const z2ui5_cl_srt_typedescr = require("abap2UI5/z2ui5_cl_srt_typedescr");
-const cl_abap_typedescr = require("abap2UI5/cl_abap_typedescr");
-const cl_abap_unit_assert = require("abap2UI5/cl_abap_unit_assert");
-
-class z2ui5_cl_srt_aunit {
-  static serialize_deserialize({ variable } = {}) {
-    // TODO(abap2js): FIELD-SYMBOLS <variable1> TYPE any.
-    let rtti1 = null;
-    let srtti1 = null;
-    let xstring = null;
-    let srtti2 = null;
-    let temp1 = null;
-    let rtti2 = null;
-    let ref_variable2 = null;
-    // TODO(abap2js): FIELD-SYMBOLS <variable2> TYPE any.
-    // TODO(abap2js): ASSIGN variable TO <variable1>.
-    rtti1 = cl_abap_typedescr.describe_by_data(variable1);
-    srtti1 = z2ui5_cl_srt_typedescr.create_by_data_object(variable1);
-    // TODO(abap2js): CALL TRANSFORMATION id SOURCE srtti = srtti1 dobj = <variable1> RESULT XML xstring OPTIONS data_refs = 'heap-or-create'.
-    // TODO(abap2js): CALL TRANSFORMATION id SOURCE XML xstring RESULT srtti = srtti2.
-    temp1 = srtti2.get_rtti();
-    rtti2 = temp1;
-    // TODO(abap2js): CREATE DATA ref_variable2 TYPE HANDLE rtti2.
-    // TODO(abap2js): ASSIGN ref_variable2->* TO <variable2>.
-    // TODO(abap2js): CALL TRANSFORMATION id SOURCE XML xstring RESULT dobj = <variable2>.
-    cl_abap_unit_assert.assert_equals({ exp: rtti1, act: rtti2 });
-    cl_abap_unit_assert.assert_equals({ exp: variable1, act: variable2 });
-  }
-}
-
-module.exports = z2ui5_cl_srt_aunit;
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_classdescr.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_classdescr.js
deleted file mode 100644
index c38ab6c..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_classdescr.js
+++ /dev/null
@@ -1,14 +0,0 @@
-const z2ui5_cl_srt_objectdescr = require("abap2UI5/z2ui5_cl_srt_objectdescr");
-
-class z2ui5_cl_srt_classdescr extends z2ui5_cl_srt_objectdescr {
-  class_kind = null;
-  create_visibility = null;
-
-  constructor({ rtti } = {}) {
-    super.constructor(rtti);
-    this.class_kind = rtti.class_kind;
-    this.create_visibility = rtti.create_visibility;
-  }
-}
-
-module.exports = z2ui5_cl_srt_classdescr;
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_complexdescr.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_complexdescr.js
deleted file mode 100644
index 3a90336..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_complexdescr.js
+++ /dev/null
@@ -1,7 +0,0 @@
-const z2ui5_cl_srt_datadescr = require("abap2UI5/z2ui5_cl_srt_datadescr");
-
-class z2ui5_cl_srt_complexdescr extends z2ui5_cl_srt_datadescr {
-}
-
-module.exports = z2ui5_cl_srt_complexdescr;
-
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_datadescr.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_datadescr.js
deleted file mode 100644
index 9cb7764..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_datadescr.js
+++ /dev/null
@@ -1,7 +0,0 @@
-const z2ui5_cl_srt_typedescr = require("abap2UI5/z2ui5_cl_srt_typedescr");
-
-class z2ui5_cl_srt_datadescr extends z2ui5_cl_srt_typedescr {
-}
-
-module.exports = z2ui5_cl_srt_datadescr;
-
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_elemdescr.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_elemdescr.js
deleted file mode 100644
index a1b42f7..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_elemdescr.js
+++ /dev/null
@@ -1,84 +0,0 @@
-// TODO(abap2js): unresolved reference cl_abap_char_utilities — add require manually
-// TODO(abap2js): unresolved reference cl_abap_elemdescr — add require manually
-// TODO(abap2js): unresolved reference cl_abap_typedescr — add require manually
-const z2ui5_cl_srt_datadescr = require("abap2UI5/z2ui5_cl_srt_datadescr");
-const z2ui5_cx_srt = require("abap2UI5/z2ui5_cx_srt");
-const cl_abap_char_utilities = require("abap2UI5/cl_abap_char_utilities");
-const cl_abap_elemdescr = require("abap2UI5/cl_abap_elemdescr");
-const cl_abap_typedescr = require("abap2UI5/cl_abap_typedescr");
-
-class z2ui5_cl_srt_elemdescr extends z2ui5_cl_srt_datadescr {
-  edit_mask = null;
-  help_id = null;
-  output_length = null;
-
-  constructor({ rtti } = {}) {
-    super.constructor(rtti);
-    this.edit_mask = rtti.edit_mask;
-    this.help_id = rtti.help_id;
-    this.output_length = rtti.output_length;
-  }
-
-  get_rtti() {
-    rtti = super.get_rtti();
-    if (rtti != null) {
-      return;
-    }
-    if (is_ddic_type === true && technical_type === false) {
-      rtti = cl_abap_typedescr.describe_by_name(absolute_name);
-    } else {
-      rtti = this.get_rtti_by_type_kind({ i_type_kind: type_kind });
-    }
-  }
-
-  get_rtti_by_type_kind({ i_type_kind } = {}) {
-    let rtti = null;
-    let l_length = 0;
-    switch (i_type_kind) {
-      case cl_abap_typedescr.typekind_num:
-        l_length = length / cl_abap_char_utilities.charsize;
-        rtti = cl_abap_elemdescr.get_n(l_length);
-        break;
-      case cl_abap_typedescr.typekind_char:
-        l_length = length / cl_abap_char_utilities.charsize;
-        rtti = cl_abap_elemdescr.get_c(l_length);
-        break;
-      case cl_abap_typedescr.typekind_string:
-        rtti = cl_abap_elemdescr.get_string();
-        break;
-      case cl_abap_typedescr.typekind_xstring:
-        rtti = cl_abap_elemdescr.get_xstring();
-        break;
-      case cl_abap_typedescr.typekind_int:
-        rtti = cl_abap_elemdescr.get_i();
-        break;
-      case cl_abap_typedescr.typekind_float:
-        rtti = cl_abap_elemdescr.get_f();
-        break;
-      case cl_abap_typedescr.typekind_date:
-        rtti = cl_abap_elemdescr.get_d();
-        break;
-      case cl_abap_typedescr.typekind_time:
-        rtti = cl_abap_elemdescr.get_t();
-        break;
-      case cl_abap_typedescr.typekind_hex:
-        rtti = cl_abap_elemdescr.get_x(length);
-        break;
-      case cl_abap_typedescr.typekind_packed:
-        rtti = cl_abap_elemdescr.get_p({ p_length: length, p_decimals: decimals });
-        break;
-      case cl_abap_typedescr.typekind_decfloat16:
-        rtti = cl_abap_elemdescr.get_decfloat16();
-        break;
-      case cl_abap_typedescr.typekind_decfloat34:
-        rtti = cl_abap_elemdescr.get_decfloat34();
-        break;
-      default:
-        throw new z2ui5_cx_srt();
-        break;
-    }
-    return rtti;
-  }
-}
-
-module.exports = z2ui5_cl_srt_elemdescr;
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_intfdescr.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_intfdescr.js
deleted file mode 100644
index ea8cb72..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_intfdescr.js
+++ /dev/null
@@ -1,12 +0,0 @@
-const z2ui5_cl_srt_objectdescr = require("abap2UI5/z2ui5_cl_srt_objectdescr");
-
-class z2ui5_cl_srt_intfdescr extends z2ui5_cl_srt_objectdescr {
-  intf_kind = null;
-
-  constructor({ rtti } = {}) {
-    super.constructor(rtti);
-    this.intf_kind = rtti.intf_kind;
-  }
-}
-
-module.exports = z2ui5_cl_srt_intfdescr;
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_objectdescr.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_objectdescr.js
deleted file mode 100644
index 2e74afc..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_objectdescr.js
+++ /dev/null
@@ -1,24 +0,0 @@
-const z2ui5_cl_srt_typedescr = require("abap2UI5/z2ui5_cl_srt_typedescr");
-
-class z2ui5_cl_srt_objectdescr extends z2ui5_cl_srt_typedescr {
-  interfaces = null;
-  types = null;
-  attributes = null;
-  methods = null;
-  events = null;
-
-  constructor({ rtti } = {}) {
-    super.constructor(rtti);
-    this.interfaces = rtti.interfaces;
-    this.types = rtti.types;
-    this.attributes = rtti.attributes;
-    this.methods = rtti.methods;
-    this.events = rtti.events;
-    // TODO(abap2js): READ TABLE interfaces WITH KEY name = 'IF_SERIALIZABLE_OBJECT' TRANSPORTING NO FIELDS.
-    if (sy_subrc !== 0) {
-      not_serializable = true;
-    }
-  }
-}
-
-module.exports = z2ui5_cl_srt_objectdescr;
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_refdescr.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_refdescr.js
deleted file mode 100644
index 9b4802d..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_refdescr.js
+++ /dev/null
@@ -1,30 +0,0 @@
-// TODO(abap2js): unresolved reference cl_abap_refdescr — add require manually
-// TODO(abap2js): unresolved reference cl_abap_typedescr — add require manually
-const z2ui5_cl_srt_datadescr = require("abap2UI5/z2ui5_cl_srt_datadescr");
-const cl_abap_refdescr = require("abap2UI5/cl_abap_refdescr");
-const cl_abap_typedescr = require("abap2UI5/cl_abap_typedescr");
-
-class z2ui5_cl_srt_refdescr extends z2ui5_cl_srt_datadescr {
-  referenced_type = null;
-
-  constructor({ rtti } = {}) {
-    super.constructor(rtti);
-    this.referenced_type = null; // TODO(abap2js): CREATE OBJECT referenced_type TYPE z2ui5_cl_srt_typedescr EXPORTING rtti = rtti->get_referenced_type( ).
-    if (this.referenced_type.not_serializable === true) {
-      not_serializable = true;
-    }
-  }
-
-  get_rtti() {
-    if (this.referenced_type.type_kind === cl_abap_typedescr.typekind_data) {
-      rtti = cl_abap_refdescr.get_ref_to_data();
-    } else if (this.referenced_type.absolute_name === `\\CLASS=OBJECT`) {
-      rtti = cl_abap_refdescr.get_ref_to_object();
-    } else {
-      rtti = this.referenced_type.get_rtti();
-    }
-    rtti = cl_abap_refdescr.create(rtti);
-  }
-}
-
-module.exports = z2ui5_cl_srt_refdescr;
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_structdescr.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_structdescr.js
deleted file mode 100644
index 09178f9..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_structdescr.js
+++ /dev/null
@@ -1,62 +0,0 @@
-// TODO(abap2js): unresolved reference cl_abap_structdescr — add require manually
-const z2ui5_cl_srt_complexdescr = require("abap2UI5/z2ui5_cl_srt_complexdescr");
-const z2ui5_cl_srt_datadescr = require("abap2UI5/z2ui5_cl_srt_datadescr");
-const cl_abap_structdescr = require("abap2UI5/cl_abap_structdescr");
-
-class z2ui5_cl_srt_structdescr extends z2ui5_cl_srt_complexdescr {
-  struct_kind = null;
-  components = null;
-  has_include = null;
-
-  constructor({ rtti } = {}) {
-    let sy_tabix = 0;
-    let components_rtti = [];
-    let scomponent = null;
-    let scomponent_rtti = null;
-    // TODO(abap2js): FIELD-SYMBOLS <component> TYPE abap_componentdescr.
-    super.constructor(rtti);
-    this.struct_kind = rtti.struct_kind;
-    this.has_include = rtti.has_include;
-    components_rtti = rtti.get_components();
-    sy_tabix = 0;
-    for (const component of components_rtti) {
-      sy_tabix++;
-      scomponent = null;
-      scomponent.name = component.name;
-      scomponent_rtti = z2ui5_cl_srt_datadescr.create_by_rtti(component.type);
-      scomponent.type = scomponent_rtti;
-      scomponent.as_include = component.as_include;
-      scomponent.suffix = component.suffix;
-      this.components.push(scomponent);
-      if (scomponent.type.not_serializable === true) {
-        not_serializable = true;
-      }
-    }
-  }
-
-  get_rtti() {
-    let sy_tabix = 0;
-    let components_rtti = [];
-    let component_rtti = null;
-    // TODO(abap2js): FIELD-SYMBOLS <component> TYPE sabap_componentdescr.
-    components_rtti = null;
-    sy_tabix = 0;
-    for (const component of this.components) {
-      sy_tabix++;
-      component_rtti = null;
-      component_rtti.name = component.name;
-      try {
-        component_rtti.type = component.type.get_rtti();
-      } catch (x) {
-        const lv_method = `GET_BY_KIND`;
-        // TODO(abap2js): CALL METHOD cl_abap_elemdescr=>(lv_method) EXPORTING p_type_kind = <component>-type->type_kind p_length = <component>-type->length p_decimals = <component>-type->decimals RECEIVING p_result = component_rtti-type.
-      }
-      component_rtti.as_include = component.as_include;
-      component_rtti.suffix = component.suffix;
-      components_rtti.push(component_rtti);
-    }
-    rtti = cl_abap_structdescr.create(components_rtti);
-  }
-}
-
-module.exports = z2ui5_cl_srt_structdescr;
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_tabledescr.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_tabledescr.js
deleted file mode 100644
index 6ab5d06..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_tabledescr.js
+++ /dev/null
@@ -1,51 +0,0 @@
-// TODO(abap2js): unresolved reference cl_abap_tabledescr — add require manually
-const z2ui5_cl_srt_complexdescr = require("abap2UI5/z2ui5_cl_srt_complexdescr");
-const z2ui5_cl_srt_typedescr = require("abap2UI5/z2ui5_cl_srt_typedescr");
-const z2ui5_cx_srt = require("abap2UI5/z2ui5_cx_srt");
-const cl_abap_tabledescr = require("abap2UI5/cl_abap_tabledescr");
-
-class z2ui5_cl_srt_tabledescr extends z2ui5_cl_srt_complexdescr {
-  key = null;
-  initial_size = null;
-  key_defkind = null;
-  has_unique_key = null;
-  table_kind = null;
-  line_type = null;
-
-  constructor({ rtti } = {}) {
-    super.constructor(rtti);
-    this.key = rtti.key;
-    this.initial_size = rtti.initial_size;
-    this.key_defkind = rtti.key_defkind;
-    this.has_unique_key = rtti.has_unique_key;
-    this.table_kind = rtti.table_kind;
-    this.line_type = z2ui5_cl_srt_typedescr.create_by_rtti(rtti.get_table_line_type());
-    if (this.line_type.not_serializable === true) {
-      not_serializable = true;
-    }
-  }
-
-  get_rtti() {
-    let lt_empty_key = [];
-    let lo_data_rtti = null;
-    let lo_error = null;
-    // TODO(abap2js): FIELD-SYMBOLS <lt_key> TYPE abap_keydescr_tab.
-    lt_empty_key = null;
-    switch (this.key_defkind) {
-      case cl_abap_tabledescr.keydefkind_user:
-        // TODO(abap2js): ASSIGN key TO <lt_key>.
-        break;
-      default:
-        // TODO(abap2js): ASSIGN lt_empty_key TO <lt_key>.
-        break;
-    }
-    try {
-      lo_data_rtti = this.line_type.get_rtti();
-      rtti = cl_abap_tabledescr.create({ p_line_type: lo_data_rtti, p_table_kind: this.table_kind, p_unique: this.has_unique_key, p_key: lt_key, p_key_kind: this.key_defkind });
-    } catch (lo_error) {
-      throw new z2ui5_cx_srt({ previous: lo_error });
-    }
-  }
-}
-
-module.exports = z2ui5_cl_srt_tabledescr;
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_typedescr.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_typedescr.js
deleted file mode 100644
index c1cf297..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cl_srt_typedescr.js
+++ /dev/null
@@ -1,82 +0,0 @@
-// TODO(abap2js): unresolved reference cl_abap_typedescr — add require manually
-const z2ui5_cx_srt = require("abap2UI5/z2ui5_cx_srt");
-const cl_abap_typedescr = require("abap2UI5/cl_abap_typedescr");
-
-class z2ui5_cl_srt_typedescr {
-  absolute_name = null;
-  type_kind = null;
-  length = null;
-  decimals = null;
-  kind = null;
-  not_serializable = false;
-  is_ddic_type = false;
-  technical_type = false;
-
-  constructor({ rtti } = {}) {
-    this.absolute_name = rtti.absolute_name;
-    this.type_kind = rtti.type_kind;
-    this.length = rtti.length;
-    this.decimals = rtti.decimals;
-    this.kind = rtti.kind;
-    this.is_ddic_type = rtti.is_ddic_type();
-    if (String(rtti.absolute_name).includes(String(`\\TYPE=%_T*`).replace(/\*/g, ""))) {
-      this.technical_type = true;
-    }
-  }
-
-  static create_by_data_object({ data_object } = {}) {
-    let srtti = null;
-    srtti = z2ui5_cl_srt_typedescr.create_by_rtti({ rtti: cl_abap_typedescr.describe_by_data(data_object) });
-    return srtti;
-  }
-
-  static create_by_rtti({ rtti } = {}) {
-    let srtti = null;
-    let elem_rtti = null;
-    let struct_rtti = null;
-    let table_rtti = null;
-    let ref_rtti = null;
-    let class_rtti = null;
-    let intf_rtti = null;
-    switch (rtti.kind) {
-      case cl_abap_typedescr.kind_elem:
-        elem_rtti = rtti;
-        srtti = null; // TODO(abap2js): CREATE OBJECT srtti TYPE z2ui5_cl_srt_elemdescr EXPORTING rtti = elem_rtti.
-        break;
-      case cl_abap_typedescr.kind_struct:
-        struct_rtti = rtti;
-        srtti = null; // TODO(abap2js): CREATE OBJECT srtti TYPE z2ui5_cl_srt_structdescr EXPORTING rtti = struct_rtti.
-        break;
-      case cl_abap_typedescr.kind_table:
-        table_rtti = rtti;
-        srtti = null; // TODO(abap2js): CREATE OBJECT srtti TYPE z2ui5_cl_srt_tabledescr EXPORTING rtti = table_rtti.
-        break;
-      case cl_abap_typedescr.kind_ref:
-        ref_rtti = rtti;
-        srtti = null; // TODO(abap2js): CREATE OBJECT srtti TYPE z2ui5_cl_srt_refdescr EXPORTING rtti = ref_rtti.
-        break;
-      case cl_abap_typedescr.kind_class:
-        class_rtti = rtti;
-        srtti = null; // TODO(abap2js): CREATE OBJECT srtti TYPE z2ui5_cl_srt_classdescr EXPORTING rtti = class_rtti.
-        break;
-      case cl_abap_typedescr.kind_intf:
-        intf_rtti = rtti;
-        srtti = null; // TODO(abap2js): CREATE OBJECT srtti TYPE z2ui5_cl_srt_intfdescr EXPORTING rtti = intf_rtti.
-        break;
-      default:
-        throw new z2ui5_cx_srt();
-        break;
-    }
-    return srtti;
-  }
-
-  get_rtti() {
-    let rtti = null;
-    if (this.technical_type === false) {
-      rtti = cl_abap_typedescr.describe_by_name(this.absolute_name);
-    }
-    return rtti;
-  }
-}
-
-module.exports = z2ui5_cl_srt_typedescr;
diff --git a/run/input/core/srv/z2ui5/00/02/z2ui5_cx_srt.js b/run/input/core/srv/z2ui5/00/02/z2ui5_cx_srt.js
deleted file mode 100644
index 35aef21..0000000
--- a/run/input/core/srv/z2ui5/00/02/z2ui5_cx_srt.js
+++ /dev/null
@@ -1,15 +0,0 @@
-const cx_no_check = class {}; // TODO(abap2js): unresolved superclass — replace stub manually
-
-class z2ui5_cx_srt extends cx_no_check {
-  constructor({ textid, previous } = {}) {
-    // TODO(abap2js): CALL METHOD super->constructor EXPORTING previous = previous.
-    this.textid = null;
-    if (!textid) {
-      this.t100key = if_t100_message.default_textid;
-    } else {
-      this.t100key = textid;
-    }
-  }
-}
-
-module.exports = z2ui5_cx_srt;
diff --git a/run/input/core/srv/z2ui5/00/03/z2ui5_cl_util_json_fltr.js b/run/input/core/srv/z2ui5/00/03/z2ui5_cl_util_json_fltr.js
index c1eea44..cac64ea 100644
--- a/run/input/core/srv/z2ui5/00/03/z2ui5_cl_util_json_fltr.js
+++ b/run/input/core/srv/z2ui5/00/03/z2ui5_cl_util_json_fltr.js
@@ -1,32 +1,65 @@
 const z2ui5_if_ajson_filter = require("abap2UI5/z2ui5_if_ajson_filter");
 const z2ui5_if_ajson_types = require("abap2UI5/z2ui5_if_ajson_types");
 
+/**
+ * z2ui5_cl_util_json_fltr — an ajson filter that drops empty values.
+ *
+ * Shipped as `abap2UI5/z2ui5_cl_util_json_fltr`, so it is a public API.
+ *
+ * It did not work. The file was raw transpiler output that nobody finished:
+ * `keep_node()` declared no parameters while using the ABAP importing names
+ * `iv_visit` and `is_node`, assigned to an undeclared `rv_keep`, and returned
+ * nothing at all. Every call was a ReferenceError in strict mode, and on the
+ * happy path it would have answered `undefined` — which ajson reads as "drop
+ * this node", i.e. it would have filtered away the whole document.
+ *
+ * Nothing called it: `z2ui5_cl_ajson_filter_lib` carries a working
+ * equivalent (`lcl_empty_filter`) and `z2ui5_cl_ui5_handler` a second one,
+ * documented there as a "mirror of" this class. Rather than delete a public
+ * name, it now does what it always claimed to.
+ *
+ * The contract is the one z2ui5_cl_ajson calls with
+ * (`z2ui5_cl_ajson.js` → `keep_node({ is_node, iv_visit })`): named arguments,
+ * returning a boolean.
+ */
 class z2ui5_cl_util_json_fltr {
   static create_no_empty_values() {
-    let result = null;
-    result = new z2ui5_cl_util_json_fltr();
-    return result;
+    return new z2ui5_cl_util_json_fltr();
   }
 
-  keep_node() {
-    rv_keep = true;
+  /**
+   * @param {object} is_node   the ajson node being visited
+   * @param {string} iv_visit  value | open | close
+   * @returns {boolean} true to keep the node
+   */
+  keep_node({ is_node, iv_visit = z2ui5_if_ajson_filter.visit_type.value } = {}) {
+    if (!is_node) return false;
+
     switch (iv_visit) {
       case z2ui5_if_ajson_filter.visit_type.value:
         switch (is_node.type) {
           case z2ui5_if_ajson_types.node_type.boolean:
-            rv_keep = Boolean(is_node.value !== `false`);
-            break;
+            return String(is_node.value) !== `false`;
           case z2ui5_if_ajson_types.node_type.number:
-            rv_keep = Boolean(is_node.value !== `0`);
-            break;
+            return String(is_node.value) !== `0`;
           case z2ui5_if_ajson_types.node_type.string:
-            rv_keep = Boolean(is_node.value !== ``);
-            break;
+            return String(is_node.value) !== ``;
+          default:
+            // null and anything unrecognised: keep, so an unknown node type is
+            // never silently dropped from a document.
+            return true;
         }
-        break;
+
       case z2ui5_if_ajson_filter.visit_type.close:
-        rv_keep = Boolean(is_node.children !== 0);
-        break;
+        // Arrays and objects survive only if something inside them did. The
+        // count is 0 both for a node that was empty to begin with and for one
+        // whose children this filter has just removed.
+        return Number(is_node.children) > 0;
+
+      default:
+        // `open` — the children have not been visited yet, so there is nothing
+        // to decide on. Deciding here would drop every container.
+        return true;
     }
   }
 }
diff --git a/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_handler.js b/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_handler.js
index b1c0e2e..94a1a37 100644
--- a/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_handler.js
+++ b/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_handler.js
@@ -58,12 +58,10 @@ class z2ui5_cl_ui5_handler {
     }
 
     await this.main_begin_js();
-    /* eslint-disable no-await-in-loop */
     while (true) {
       const done = await this.main_process_js();
       if (done) break;
     }
-    /* eslint-enable no-await-in-loop */
 
     return this.mv_response;
   }
diff --git a/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_srv_bind.js b/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_srv_bind.js
index 4a5c136..2cf8aac 100644
--- a/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_srv_bind.js
+++ b/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_srv_bind.js
@@ -369,7 +369,7 @@ class z2ui5_cl_ui5_srv_bind {
     this.mv_type   = type;
 
     const opts = {
-      path: !!config.path_only ? true : config.path,
+      path: config.path_only ? true : config.path,
       tab:                config.tab,
       tab_index:          config.tab_index,
       name:               config.name,
diff --git a/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_srv_model.js b/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_srv_model.js
index 66e3a9f..568408c 100644
--- a/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_srv_model.js
+++ b/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_srv_model.js
@@ -602,15 +602,15 @@ class z2ui5_cl_ui5_srv_model {
    * plain JS objects route through the static wire path.
    */
   main_json_to_attri(a, b) {
-    let view;
+    let _view;   // accepted for backwards compatibility, deliberately unused
     let model;
     if (b !== undefined) {
       // legacy positional (view, model)
-      view = a;
+      _view = a;
       model = b;
     } else if (a !== null && typeof a === `object` && (`model` in a || `view` in a)) {
       // named form { model } / { view, model }
-      ({ view, model } = a);
+      ({ view: _view, model } = a);
     } else {
       // Upstream dropped the view parameter (it left ty_s_attri): the model
       // is now passed as the single positional argument.
diff --git a/run/input/core/srv/z2ui5/01/04/z2ui5_cl_ui5_app_start.js b/run/input/core/srv/z2ui5/01/04/z2ui5_cl_ui5_app_start.js
index 624e646..de893d1 100644
--- a/run/input/core/srv/z2ui5/01/04/z2ui5_cl_ui5_app_start.js
+++ b/run/input/core/srv/z2ui5/01/04/z2ui5_cl_ui5_app_start.js
@@ -85,7 +85,6 @@ class z2ui5_cl_ui5_app_start extends z2ui5_if_app {
       const Cls = z2ui5_cl_util.rtti_get_class(className);
       if (!Cls) throw new Error(`Class '${this.ms_home.classname}' not found`);
       // attempt instantiation — if the class is a valid z2ui5_if_app subclass it succeeds
-      // eslint-disable-next-line no-new
       new Cls();
 
       this.client.message_toast_display("App is ready to start!");

From f85585dca647739ea097938fb8745aded457995e Mon Sep 17 00:00:00 2001
From: Claude <tmswyer@gmail.com>
Date: Fri, 21 Aug 2026 19:15:18 +0000
Subject: [PATCH 5/6] Refresh the core mirror after the transpiler and patcher
 fixes

Picks up the CP/NP/IN lowering finally reaching the samples tree, the
brace-balanced calling-convention parser, and the frontend patcher that fails
instead of silently shipping unpatched.

builder 30 tests, app 44 tests, lint clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2gZuy95uKcT2zngQd1sAL
---
 run/input/UPSTREAM_COMMIT                              | 2 +-
 run/input/core/srv/app/samples/z2ui5_cl_smp_app_000.js | 2 +-
 run/input/core/srv/app/samples/z2ui5_cl_smp_app_197.js | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/run/input/UPSTREAM_COMMIT b/run/input/UPSTREAM_COMMIT
index 1a58ea6..34c5348 100644
--- a/run/input/UPSTREAM_COMMIT
+++ b/run/input/UPSTREAM_COMMIT
@@ -1 +1 @@
-8be4fbf63369b239c8ca788b26c3fd6de01359fe
+ac30a04bc9a1bb5e5d6d0d9939f8238dc29e67ab
diff --git a/run/input/core/srv/app/samples/z2ui5_cl_smp_app_000.js b/run/input/core/srv/app/samples/z2ui5_cl_smp_app_000.js
index bd03438..e276b1b 100644
--- a/run/input/core/srv/app/samples/z2ui5_cl_smp_app_000.js
+++ b/run/input/core/srv/app/samples/z2ui5_cl_smp_app_000.js
@@ -346,7 +346,7 @@ class z2ui5_cl_smp_app_000 extends z2ui5_if_app {
 
   block_base({ group, header } = {}) {
     let result = ``;
-    if (String(group).includes(String(`controls -*`).replace(/\*/g, ""))) {
+    if ((($v, $p) => { let $r = ""; const $s = String($p); for (let $i = 0; $i < $s.length; $i++) { const $c = $s[$i]; if ($c === "#") { $i++; $r += ($s[$i] || "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); } else if ($c === "*") { $r += ".*"; } else if ($c === "+") { $r += "."; } else { $r += $c.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); } } return new RegExp("^" + $r + "$", "i").test(String($v)); })(group, `controls -*`)) {
       result = header.substr(0, 1).toUpperCase();
     } else {
       result = this.header_base({ header: header });
diff --git a/run/input/core/srv/app/samples/z2ui5_cl_smp_app_197.js b/run/input/core/srv/app/samples/z2ui5_cl_smp_app_197.js
index 0f37f4b..28f6f1d 100644
--- a/run/input/core/srv/app/samples/z2ui5_cl_smp_app_197.js
+++ b/run/input/core/srv/app/samples/z2ui5_cl_smp_app_197.js
@@ -34,7 +34,7 @@ class z2ui5_cl_smp_app_197 extends z2ui5_if_app {
     }
     this.mt_table = z2ui5_cl_util.abap_tab_assign(this.mt_table, z2ui5_cl_util.abap_copy(this.mt_table_full));
     if (!z2ui5_cl_util.abap_is_initial(t_range)) {
-      for (let _i = this.mt_table.length - 1; _i >= 0; _i--) { const row = this.mt_table[_i]; if (!((($v, $r) => !$r || !$r.length || $r.some(($x) => ($x.option === `BT` ? $v >= $x.low && $v <= $x.high : $x.option === `NE` ? $v !== $x.low : $x.option === `CP` ? String($v).includes(String($x.low).replace(/\*/g, "")) : $v === $x.low)))(row.product, t_range))) this.mt_table.splice(_i, 1); }
+      for (let _i = this.mt_table.length - 1; _i >= 0; _i--) { const row = this.mt_table[_i]; if (!((($v, $r) => { if (!$r || !$r.length) return true; let $inc = false, $anyI = false, $exc = false; for (const $x of $r) { const $o = String($x.option || "EQ").toUpperCase(); const $hit = $o === "BT" ? $v >= $x.low && $v <= $x.high : $o === "NB" ? !($v >= $x.low && $v <= $x.high) : $o === "NE" ? $v !== $x.low : $o === "GT" ? $v > $x.low : $o === "GE" ? $v >= $x.low : $o === "LT" ? $v < $x.low : $o === "LE" ? $v <= $x.low : $o === "CP" ? (($v, $p) => { let $r = ""; const $s = String($p); for (let $i = 0; $i < $s.length; $i++) { const $c = $s[$i]; if ($c === "#") { $i++; $r += ($s[$i] || "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); } else if ($c === "*") { $r += ".*"; } else if ($c === "+") { $r += "."; } else { $r += $c.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); } } return new RegExp("^" + $r + "$", "i").test(String($v)); })($v, $x.low) : $o === "NP" ? !(($v, $p) => { let $r = ""; const $s = String($p); for (let $i = 0; $i < $s.length; $i++) { const $c = $s[$i]; if ($c === "#") { $i++; $r += ($s[$i] || "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); } else if ($c === "*") { $r += ".*"; } else if ($c === "+") { $r += "."; } else { $r += $c.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); } } return new RegExp("^" + $r + "$", "i").test(String($v)); })($v, $x.low) : $v === $x.low; if (String($x.sign || "I").toUpperCase() === "E") { if ($hit) $exc = true; } else { $anyI = true; if ($hit) $inc = true; } } return $exc ? false : ($anyI ? $inc : true); })(row.product, t_range))) this.mt_table.splice(_i, 1); }
     }
   }
 

From 3da0588ed74bfff5de62216678653450924bd58a Mon Sep 17 00:00:00 2001
From: Claude <tmswyer@gmail.com>
Date: Fri, 21 Aug 2026 20:15:12 +0000
Subject: [PATCH 6/6] Refresh the core mirror after the gate-contract work

Picks up the exported UNCAUGHT_EXCEPTION_PREFIX contract the smoke gate now
reads instead of a copied literal.

builder 30 tests, app 44 tests, lint clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2gZuy95uKcT2zngQd1sAL
---
 run/input/UPSTREAM_COMMIT                           |  2 +-
 .../core/srv/z2ui5/01/02/z2ui5_cl_ui5_handler.js    | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/run/input/UPSTREAM_COMMIT b/run/input/UPSTREAM_COMMIT
index 34c5348..4767355 100644
--- a/run/input/UPSTREAM_COMMIT
+++ b/run/input/UPSTREAM_COMMIT
@@ -1 +1 @@
-ac30a04bc9a1bb5e5d6d0d9939f8238dc29e67ab
+ebbf20a37a55025c3ab2a48dee05dbdc0b461ac9
diff --git a/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_handler.js b/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_handler.js
index 94a1a37..cd0228f 100644
--- a/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_handler.js
+++ b/run/input/core/srv/z2ui5/01/02/z2ui5_cl_ui5_handler.js
@@ -277,7 +277,7 @@ class z2ui5_cl_ui5_handler {
       // nav-loop and the user gets a "OK" button to dismiss + recover.
       const z2ui5_cx_util_error = require("../../00/03/z2ui5_cx_util_error");
       const z2ui5_cl_ui5_app_error = require("../04/z2ui5_cl_ui5_app_error");
-      const wrapped = new z2ui5_cx_util_error(`UNCAUGHT EXCEPTION - Please Restart App:`, lx);
+      const wrapped = new z2ui5_cx_util_error(z2ui5_cl_ui5_handler.UNCAUGHT_EXCEPTION_PREFIX, lx);
       oClient.nav_app_leave(z2ui5_cl_ui5_app_error.factory({ x_root: wrapped }));
     }
 
@@ -890,4 +890,15 @@ class z2ui5_cl_ui5_handler {
   }
 }
 
+/**
+ * The prefix an unhandled app error is wrapped in before it reaches the error
+ * popup. Exported because it is a CONTRACT, not an implementation detail:
+ * scripts/smoke-apps.js decides every sample's verdict by looking for it in
+ * the response. That used to be a copy of the literal in the script, so
+ * rewording the message here would have flipped every "error-popup" verdict to
+ * something else with nothing failing — a gate quietly measuring the wrong
+ * thing. Read it from here instead of copying it.
+ */
+z2ui5_cl_ui5_handler.UNCAUGHT_EXCEPTION_PREFIX = `UNCAUGHT EXCEPTION - Please Restart App:`;
+
 module.exports = z2ui5_cl_ui5_handler;