feat: harden orchestrator execution runtime

page-data-html-detect.test.mjs

@@ -26,6 +26,30 @@ test('detectPageDataDatasetUsageFromHtml treats browser deleteRow as a soft dele
   assert.deepEqual(usage.get('tkmind_exp_survey'), { insert: true, read: true, softDelete: true });
 });
 
+test('detectPageDataDatasetUsageFromHtml detects updateRow for literal and constant datasets', () => {
+  const usage = detectPageDataDatasetUsageFromHtml(`
+    const PRODUCTS = 'products';
+    await c.updateRow(PRODUCTS, 1, { status: 'inactive' });
+    await c.updateRow('orders', 2, { status: 'shipped' });
+  `);
+  assert.deepEqual(usage.get('products'), { update: true });
+  assert.deepEqual(usage.get('orders'), { update: true });
+});
+
+test('buildPageDataPolicyDatasetsFromRegistry grants registered update columns', () => {
+  const datasets = buildPageDataPolicyDatasetsFromRegistry({
+    html: `await c.listRows('orders'); await c.updateRow('orders', 1, { status: 'shipped' });`,
+    registryDatasets: [{
+      name: 'orders',
+      actions: ['read', 'update'],
+      columns: { read: ['id', 'status'], update: ['status'] },
+    }],
+  });
+  assert.equal(datasets.orders.read, true);
+  assert.equal(datasets.orders.update, true);
+  assert.deepEqual(datasets.orders.columns.update, ['status']);
+});
+
 test('buildPageDataPolicyDatasetsFromRegistry grants registered soft delete when HTML uses deleteRow', () => {
   const datasets = buildPageDataPolicyDatasetsFromRegistry({
     html: `const DATASET = 'mood_notes'; await c.deleteRow(DATASET, 1);`,