fix(templates): a user update must not take system-owned fields from the payload

[delchev]

What

A generated update() persisted the caller's partial payload whole, so a header-only edit erased the system-owned money columns.

The UI form PUTs only the fields it edits. Paid (the allocation roll-up target) took the payload's null, and Balance was recomputed before recalculate() from those nulls and persisted as 0.

Observed in production: invoice 0000000181 printed a total due of 0 on an 8,556.00 invoice after exactly one draft header edit. The data was repaired by hand.

Fix

In Repository.java.template:

• Collect the system-owned properties at generation time — an author's readOnly, roll-up/aggregate targets, the document number and uuid — into $preservedOnUpdate.
• In update(), read the stored row once (findById) and take those values from there, never from the payload.
• Move recalculate(entity) before the update-time calculated fields, so an expression like Balance = Total - Paid reads the freshly resummed Total and the preserved Paid.

This is the #6226/#6306 lost-update family, user-update edition.

Deliberately not preserved

An aggregate that is itself recomputed on update (an expressionUpdate such as Balance) is exempt — update() reassigns it after recalculate(). A calculated create-only field that stays user-editable (a Currency relation defaulted from the company) carries neither flag, so a user's edit of it is respected.

Safe against workflow writes by construction: every system writer (number stamp, status transitions, roll-ups) uses the targeted updateProperty / updateProperties / updateDerived primitives, which bypass update() entirely.

Verification

On a live instance (registry wipe + template reseed + regen of sales-invoices and timesheets):

• the emitted update() preserves Number / Net / Vat / Discount / Total / Paid / Uuid / ProcessId / audit, and recomputes Balance after recalculate();
• runtime reproduction — create invoice + item, then PUT a header-only payload — keeps Paid 0.00 / Balance 120.00 / Number intact, where the previous build persisted Paid null / Balance 0;
• client-Java batch: 256 units, 261 class files;
• audit-dsl-emission.py: 729 OK, 1 pre-existing unrelated FAIL (timesheets personal-group, regen owed).

🤖 Generated with Claude Code