[oblomov-dev]

What

The specification was derived from abap2UI5 1.146.0 and conformance/RESULTS.md recorded the cap2UI5 host at plugin 0.4.0. Four commits:

1. Reference hosts moved to @abap2ui5/node-runtime 1.148.0 and @cap2ui5/cds-plugin 0.5.0; traffic re-recorded. The node-runtime host is rebuilt on the package's own recipe (abap2ui5-transpile, importing host.mjs), because 1.148.0 deprecates loading apps/index.mjs; the transpiler pin moves to 2.14.5 as the package requires.
2. New backend check route.app-state-names-no-app (77 checks now): an app-state hash without ?app_start= restores its draft — a new SHOULD in spec/navigation.md.
3. Renamed references fixed: z2ui5_cl_frontend_sim, and two method citations that moved into z2ui5_cl_ui5_util_context.
4. Spec revision 0.4, re-derived from the 1.148.0 release commit.

What changed on the wire, 1.146.0 → 1.148.0

All of it landed in 1.147.0; c_protocol stays 2, the schemas, the portable profile and the action vocabulary are unchanged.

• Error body: the request URL is stripped to an allow-list — error.no-reflection passes on both hosts now, so its pin is removed (test/lib/expected.mjs pins nothing).
• App start from an app-state hash (the new check above).
• Session block: S_UI5 may arrive alone and is merged, not replaced.
• Event arguments: a binding context travels as {PATH, OBJECT}, $event as {ID, SOURCE, PARAMETERS}.
• Follow-up actions: the UI5 frontend resolves ${/PATH} arguments against the model — recorded as description only, with open question 11 on whether it becomes a rule for every frontend.
• Embedded frontends (ownsPage), the devtools bundle GET, the host guard of serve().

Not in the spec, deliberately: windowed tables, set_app_full_width, cross_app_nav_get_links and the removal of the invisible custom controls are on abap2UI5 main but not in 1.148.0; the CHANGELOG names them as unreleased.

Decisions worth a look

• Suite runs start the node-runtime host with allowedHosts: "*": with the host's own guard on, a foreign-Origin POST gets the host's 403 before the framework's CSRF gate, so transport.csrf-origin would no longer test the framework. npm run serve:node-runtime keeps the guard.
• The frontend check request.config-cadence flagged a static block sent for the first time; it now flags only blocks the backend already has.
• CI: the frontend job pins the 1.148.0 release commit; the cache path moved.

Verified

Command	Result
npm run lint:abap	0 issues, 18 files
PROTOCOL_REQUIRE_BROWSER=1 npm test (both backends, UI5 SPA in Chromium)	89 pass, 0 fail, 0 skipped
npm run generate && git diff --exit-code	clean
backend conformance, node-runtime	77 passed, 0 failed, 0 warnings
backend conformance, cap2ui5	76 passed, 0 failed, 1 warning (error.details, the known SHOULD)
frontend suite, UI5 SPA of 1.148.0	77 pass, 0 fail, 4 skip
frontend suite, agent / adaptive-cards / terminal	61 / 66 / 72 pass, 0 fail

Not verified

• The CI workflow edits have not run on GitHub.
• The Web Components frontend was not re-run; its RESULTS row is still the 2026-10-03 run.
• No ABAP system, as before.
• The cap2UI5 host runs runtime 1.147.0 (what plugin 0.5.0 pins), not 1.148.0 — RESULTS.md states the split.
• The frontend-side statements (${/PATH} resolution, ownsPage, event marshalling, late S_UI5) are confirmed in the 1.148.0 source only; no recorded scenario exercises them.
• Left alone: the docs name the vendored agent client as a4d9f07 while vendor/mcp-server/source.json says 82b75d8.

---

Generated by Claude Code