fix: sweep accumulated reviewer nits from the 2026-06 campaign (#2992)

* fix: sweep accumulated reviewer nits from the 2026-06 campaign

Behavior fixes: LCase word-form operators in $evaluateLogicalExpression
(uppercase EQ threw on Adobe CF); /wheels/cli gate reads the reload
password from the form scope only (query-string password satisfied the
gate while landing in access logs); dbRollback counts applied
migrations by tracked status, not the version<=current heuristic
(shared-dev-DB skew); NPE guard for null getErrorStream() in the three
CLI HTTP bridge helpers; migrator column cache keys verbatim (no case
folding); $getForeignKeys throws on missing adapter instead of
emitting unquoted SQL; real \d escapes in $convertToString's dead ISO
branch. Plus stale-docblock updates (#2903 references, renderWith/
onlyProvides enforcement notes, debug-panel guide note, .ai finally-
loop note, migrator CLAUDE.md cache docs) and spec backfills
(waitForText timeout, $get without request.wheels, typed-column
outlier defaults, conditional loadRoutesSpec restore, uppercase-EQ
conditions, dbDrop/dbRestore stub note).

Fixes #2977

Signed-off-by: Peter Amiri <peter@alurium.com>

* chore(docs): move changelog entry to changelog.d fragment

Eliminates the [Unreleased]-anchor merge conflicts across campaign PRs;
fragments are assembled into CHANGELOG.md at release promotion.

Signed-off-by: Peter Amiri <peter@alurium.com>

---------

Signed-off-by: Peter Amiri <peter@alurium.com>

Author: bpamiri

.ai/wheels/cross-engine-compatibility.md

@@ -172,7 +172,7 @@ createDynamicProxy(consumer, ["java.util.function.Consumer"]);
 
 ### `for` Loops Inside `finally` Blocks Miscompile on Lucee 7
 
-Lucee 7.0.1+100 throws `variable [local] doesn't exist` at runtime when a `for` loop declares or iterates `local`-/`var`-scoped variables inside a `finally` block. Isolated with minimal probes: bare assignments and function calls inside `finally` compile and run fine; loops do not. One probe shape even produced a JVM `Expecting a stackmap frame` bytecode-verifier error, pointing at a codegen bug in Lucee's `finally`-block compilation.
+Lucee 7.0.1+100 throws `variable [local] doesn't exist` at runtime when a `for` loop declares or iterates `local`-/`var`-scoped variables inside a `finally` block. Both loop forms are affected — `for (init; cond; step)` and `for (item in collection)`. Isolated with minimal probes: bare assignments and function calls inside `finally` compile and run fine; loops do not. One probe shape even produced a JVM `Expecting a stackmap frame` bytecode-verifier error, pointing at a codegen bug in Lucee's `finally`-block compilation.
 
 ```cfm
 // WRONG — crashes at runtime on Lucee 7

changelog.d/reviewer-nit-sweep.fixed.md

@@ -0,0 +1 @@
+- Reviewer-nit sweep from the 2026-06 remediation campaign (#2977). Behavior fixes: conditional validations with uppercase word-form operators (`condition="1 EQ 0"`) no longer throw on Adobe CF (`$evaluateLogicalExpression` now lowercases the operator); the `/wheels/cli` mutation gate reads the reload password from the form scope ONLY, so a `?password=...` query string can no longer satisfy the gate while logging the password in access logs; `dbRollback` over the `/wheels/cli` bridge counts applied migrations by tracked `status` instead of the `version <= current` heuristic, so peer-applied versions on a shared dev database no longer skew `steps=N`; the CLI's three HTTP bridge helpers guard against `getErrorStream()` returning Java null on bodiless 4xx/5xx responses (was an NPE surfacing as a useless "null" error); the migrator's per-request column cache keys on the verbatim table name (case-folding let `Authors`/`authors` share a slot on case-sensitive databases); `$getForeignKeys()` throws `Wheels.Migrator.MissingAdapter` instead of silently interpolating an unquoted table name when the adapter is missing; and the dead ISO-date fallback branch in `$convertToString` uses real `\d` regex escapes. Plus assorted stale-docblock/comment updates (#2903 references, `renderWith`/`onlyProvides` enforcement notes, debug-panel guide note) and spec backfills (`waitForText` timeout surface, `$get()` without `request.wheels`, typed-column outlier defaults, conditional spec-state restore) (#2977)

cli/lucli/Module.cfc

@@ -6417,6 +6417,12 @@ component extends="modules.BaseModule" {
 
 		var responseCode = conn.getResponseCode();
 		var inputStream = responseCode >= 400 ? conn.getErrorStream() : conn.getInputStream();
+		// getErrorStream() returns Java null on a bodiless 4xx/5xx response;
+		// Scanner.init(null) NPEs on Lucee and surfaces as a useless "null"
+		// error message (#2947 review, #2977). No body — return empty.
+		if (isNull(inputStream)) {
+			return "";
+		}
 		var scanner = createObject("java", "java.util.Scanner").init(inputStream, "UTF-8");
 		var response = "";
 		while (scanner.hasNextLine()) {
@@ -6450,6 +6456,12 @@ component extends="modules.BaseModule" {
 
 		var responseCode = conn.getResponseCode();
 		var inputStream = responseCode >= 400 ? conn.getErrorStream() : conn.getInputStream();
+		// getErrorStream() returns Java null on a bodiless 4xx/5xx response;
+		// Scanner.init(null) NPEs on Lucee and surfaces as a useless "null"
+		// error message (#2947 review, #2977). No body — return empty.
+		if (isNull(inputStream)) {
+			return "";
+		}
 		var scanner = createObject("java", "java.util.Scanner").init(inputStream, "UTF-8");
 		var response = "";
 		while (scanner.hasNextLine()) {
@@ -6480,6 +6492,12 @@ component extends="modules.BaseModule" {
 		// Read response (handle both success and error streams)
 		var responseCode = conn.getResponseCode();
 		var inputStream = responseCode >= 400 ? conn.getErrorStream() : conn.getInputStream();
+		// getErrorStream() returns Java null on a bodiless 4xx/5xx response;
+		// Scanner.init(null) NPEs on Lucee and surfaces as a useless "null"
+		// error message (#2947 review, #2977). No body — return empty.
+		if (isNull(inputStream)) {
+			return "";
+		}
 		var scanner = createObject("java", "java.util.Scanner").init(inputStream, "UTF-8");
 		var response = "";
 		while (scanner.hasNextLine()) {

vendor/wheels/Global.cfc

@@ -2880,9 +2880,13 @@ return local.$wheels;
 						// fallback parsing attempts for common formats
 
 						// 1) ISO YYYY-MM-DD[ hh[:mm[:ss]]]
-						if (ReFind("(?i)^(\\d{4})-(\\d{2})-(\\d{2})(?:[ T](\\d{1,2}):(\\d{2})(?::(\\d{2}))?)?$", local.s2)) {
-							local.parts = ReReplace(local.s2, "^(\\d{4})-(\\d{2})-(\\d{2}).*$", "\\1-\\2-\\3", "all");
-							local.timePart = ReReplace(local.s2, ".*[ T](\\d{1,2}:\\d{2}(?::\\d{2})?).*$", "\\1", "all");
+						// Single-backslash escapes: in CFML "\\d" is a literal
+						// backslash + d in the compiled regex, which never matches a
+						// digit — the branch was dead. Mirrors the already-fixed
+						// slash-format branch below (#2933 carry-forward, #2977).
+						if (ReFind("(?i)^(\d{4})-(\d{2})-(\d{2})(?:[ T](\d{1,2}):(\d{2})(?::(\d{2}))?)?$", local.s2)) {
+							local.parts = ReReplace(local.s2, "^(\d{4})-(\d{2})-(\d{2}).*$", "\1-\2-\3", "all");
+							local.timePart = ReReplace(local.s2, ".*[ T](\d{1,2}:\d{2}(?::\d{2})?).*$", "\1", "all");
 							if (Len(local.timePart) AND local.timePart NEQ local.s2) {
 								// has time
 								local.dt = ParseDateTime(local.parts & " " & local.timePart);

vendor/wheels/Public.cfc

@@ -228,8 +228,9 @@ component output="false" displayName="Internal GUI" extends="wheels.Global" {
 
 	/**
 	 * Returns a struct { packages: [...], error: "" } populated from the
-	 * wheels-packages registry. Short-circuits in production (defense in
-	 * depth — the handler is already $blockInProduction()-gated). Captures
+	 * wheels-packages registry. Short-circuits outside development (defense in
+	 * depth — the handler is already $blockInProduction()-gated, which since
+	 * #2903 is a development-only allowlist). Captures
 	 * any registry error into the `error` field so the view can render a
 	 * friendly banner instead of a stack trace.
 	 *

vendor/wheels/controller/provides.cfc

@@ -30,6 +30,9 @@ component {
 	/**
 	 * Use this in an individual controller action to define which formats the action will respond with.
 	 * This can be used to define provides behavior in individual actions or to override a global setting set with `provides` in the controller's `config()`.
+	 * Restrictions are enforced (since 4.0.4): `renderWith()` falls back to the `html` view for a
+	 * format outside the list, and the automatic render in `$callAction()` skips view rendering for
+	 * non-acceptable, non-html formats.
 	 *
 	 * [section: Controller]
 	 * [category: Provides Functions]

vendor/wheels/controller/rendering.cfc

@@ -176,6 +176,9 @@ component {
 	 * Instructs the controller to render the data passed in to the format that is requested.
 	 * If the format requested is `json` or `xml`, Wheels will transform the data into that format automatically.
 	 * For other formats (or to override the automatic formatting), you can also create a view template in this format: `nameofaction.xml.cfm`, `nameofaction.json.cfm`, `nameofaction.pdf.cfm`, etc.
+	 * Per-action format restrictions set with `onlyProvides()` are enforced here (since 4.0.4):
+	 * when the requested format is not acceptable for the action, `renderWith()` falls back to
+	 * rendering the `html` view — even when `html` itself is not in the `onlyProvides()` list.
 	 *
 	 * [section: Controller]
 	 * [category: Rendering Functions]

vendor/wheels/migrator/Base.cfc

@@ -109,7 +109,16 @@ component extends="wheels.Global"{
 		// rather than assigning a bare local inside catch: BoxLang discards
 		// `local.X = ...` assignments made in a catch body.)
 		local.state = {tableExists = true};
-		local.quotedTable = StructKeyExists(this, "adapter") ? this.adapter.quoteTableName(arguments.table) : arguments.table;
+		// Migration.init() always sets this.adapter, so a missing adapter is a
+		// broken instantiation — fail loudly rather than silently interpolating
+		// an UNQUOTED table name into SQL (#2937 review, #2977).
+		if (!StructKeyExists(this, "adapter")) {
+			Throw(
+				type = "Wheels.Migrator.MissingAdapter",
+				message = "$getForeignKeys() requires an initialized database adapter. Instantiate migrations through Migration.init()."
+			);
+		}
+		local.quotedTable = this.adapter.quoteTableName(arguments.table);
 		try {
 			$query(
 				datasource = application[local.appKey].dataSourceName,
@@ -206,7 +215,10 @@ component extends="wheels.Global"{
 		// would otherwise issue a full table-metadata round-trip per row.
 		// $execute() drops the cache whenever a statement runs, so DDL in the
 		// same request (addColumn() etc.) is reflected on the next read.
-		local.cacheKey = LCase(application[local.appKey].dataSourceName & "|" & arguments.tableName);
+		// Key on the VERBATIM table name: the $dbinfo probe below uses original
+		// case, so case-folding the key would let `Authors` and `authors` share
+		// one slot on case-sensitive databases (#2937 review, #2977).
+		local.cacheKey = application[local.appKey].dataSourceName & "|" & arguments.tableName;
 		if (
 			StructKeyExists(request, "$wheelsMigratorColumns")
 			&& StructKeyExists(request.$wheelsMigratorColumns, local.cacheKey)

vendor/wheels/migrator/CLAUDE.md

@@ -58,6 +58,13 @@ The flag is read via `$get("useUnderscoreReferenceColumns")` inside `references(
 2. **Hard-coding `& "id"` or `& "type"` concatenations.** All four sites in this directory resolve the reference-column suffix through `$get("useUnderscoreReferenceColumns")` — `TableDefinition.cfc::references()` (id + polymorphic type), `Migration.cfc::removeColumn` (referenceName branch), and `Migration.cfc::addReference`. If you add new code that builds a reference column name, route it through `$get` too rather than hard-coding `& "id"`.
 3. **`required` on column-name parameters.** Use `$combineArguments(... required=true)` instead. Declaring CFML-level `required` blocks the alias path because validation runs before the function body.
 
+## Internal caches
+
+Two caches introduced in #2937 — know their scopes before adding probes:
+
+- `application[appKey].$migratorAdapterNames` — application-scoped, keyed by datasource name. Memoized migrator adapter name, written by `Base.cfc::$getDBType()`. Survives requests; rebuilt on reload (a datasource's driver can't change without one).
+- `request.$wheelsMigratorColumns` — request-scoped, keyed by `dsName|tableName` (table name VERBATIM — no case folding, since the `$dbinfo` probe uses original case and case-sensitive databases can host `Authors` and `authors` separately). Column list per table, written by `Base.cfc::$getColumns()`, dropped wholesale by `$execute()` so DDL in the same request is reflected on the next read.
+
 ## Tests
 
 Specs live in `vendor/wheels/tests/specs/migrator/`. `referencesSpec.cfc` exercises `TableDefinition::references()` (the `columnNames` alias plus the suffix flag) at the unit layer — inspecting `t.columns` / `t.foreignKeys` directly without `t.create()` so the assertions are adapter-independent. `primaryKeySpec.cfc` mirrors that shape for `TableDefinition::primaryKey()` — the `columnName` / `columnNames` aliases plus precedence semantics (#2803). `migrationSpec.cfc` covers Migration.cfc command-version helpers via real DDL roundtrips — its "Tests addReference" describe block guards the `useUnderscoreReferenceColumns` path on `Migration.cfc::addReference()`. Most FK-related tests in `migrationSpec.cfc` skip on SQLite (which doesn't support altering CONSTRAINTS) but run on every other engine in CI.

vendor/wheels/model/validations.cfc

@@ -962,7 +962,11 @@ component {
 		}
 		local.leftOperand = IsNumeric(local.tokens[1]) ? JavaCast("double", local.tokens[1]) : local.tokens[1];
 		local.rightOperand = IsNumeric(local.tokens[3]) ? JavaCast("double", local.tokens[3]) : local.tokens[3];
-		return $resolveOperator(local.leftOperand, local.rightOperand, local.tokens[2]);
+		// LCase keeps word-form operators ("1 EQ 0") compatible with the
+		// case-sensitive switch in $resolveOperator on Adobe CF — symbolic
+		// operators are already lowercased by $normalizeConditionOperators,
+		// but word-form ones arrive raw (#2977).
+		return $resolveOperator(local.leftOperand, local.rightOperand, LCase(local.tokens[2]));
 	}
 
 	/**