feat(demos): deleted-lineage demo (D2) + a previewable dynamic node (D3)

D2 — a new "Deleted custom node" demo that ships ALREADY tombstoned: the seeder
publishes a lineage, builds a workflow on it, then soft-deletes the lineage.
The reader opens it and sees the red Deleted badge, the "(deleted dynamic node)"
alert and the "Activity type not registered" error, with no destructive step and
nothing consumed for whoever walks next. Its guide steps name the D-11 gap
(Try/Run stay enabled) and the catalog-load timing that made me misread this
check the first time.

D3 — the Part-14 dynamic node is now tagged `@deterministic true` AND binds its
output to a ctx key. Both were needed: without the tag the script is treated as
non-deterministic and deliberately never cached, so there is nothing to preview;
without the binding the widget honestly reports "this step's output isn't bound
to a workflow value yet". With both, 14.9 finally shows what it promises —
{"fileName":"901E42EB-7094-4B67-B7FA-FD62618D2208-WALK-14-9.PDF"}.

That also sharpens D-12. The bogus "cache evicted — re-run to repopulate"
message appears specifically for a node that is never cached, so the fix is to
say "not cached: this node is non-deterministic" rather than to blame an
eviction that never happened.

14.9 ticked. 14.8's observable halves all pass on the new demo; it stays open
only on D-11's "Try disabled" criterion.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: alex-struk

docs-md/workflows/FEATURE_DEMO_GUIDE.md

@@ -35,6 +35,7 @@ npm run seed:demos
 - [Versioning — history & revert (Part 12)](#versioning-history-revert-part-12)
 - [Library workflow (Part 10)](#library-workflow-part-10)
 - [Dynamic (custom-code) node — DYN pill & script editor (Part 14)](#dynamic-customcode-node-dyn-pill-script-editor-part-14)
+- [Deleted custom node — Deleted badge & catalog error (Part 14)](#deleted-custom-node-deleted-badge-catalog-error-part-14)
 - [🤖 AI agent chat logs](#-ai-agent-chat-logs)
 
 ---
@@ -215,10 +216,23 @@ npm run seed:demos
 1. Right-click the node → **Edit script** opens the script editor with the published TypeScript source (JSDoc `@inputs`/`@outputs` drive the ports).
 1. **+ New custom node** (palette) opens the authoring editor — publishing runs the jsdoc → signature → ts-check → allowlist gates (`MANUAL_TEST_PLAN.md` Part 14).
 1. **Delete + re-create restores the node:** delete this custom node (**Dynamic nodes** page), then **+ New custom node** and publish the *same* name — it comes back with its history continued (v2), instead of dead-ending on a reserved-slug conflict (14.14).
+1. **Try it (14.9):** the script is tagged `@deterministic true`, so its output is **cached** and the node shows a real **preview** after a run — an untagged (non-deterministic) script re-executes every run and is deliberately never cached, so it has no preview to show.
 1. ⚠️ *Executing* this node in a run additionally needs the Temporal worker started with `PLATFORM_API_KEY` (14.9).
 
 ---
 
+## Deleted custom node — Deleted badge & catalog error (Part 14)
+
+**▶ Open:** [http://localhost:3000/workflows/by-slug/demo-deleted-custom-node-deleted-badge-catalog-error-part-14/edit](http://localhost:3000/workflows/by-slug/demo-deleted-custom-node-deleted-badge-catalog-error-part-14/edit)
+
+1. This workflow references a custom node whose **lineage has been deleted**. Nothing to set up — it ships in that state.
+1. The canvas node carries a red **Deleted** badge and its settings show *(deleted dynamic node)*.
+1. The validation chip reads **1 error** — *Activity type `dyn.demo-deleted-node` is not registered*. Give the activity catalog a moment to load: `dyn.*` types are deliberately given the benefit of the doubt while it is still fetching, so the error appears a beat after the canvas.
+1. ⚠️ **Known gap (D-11):** **Try** and **Run** are still enabled here even though the graph cannot run — a run fails at `dynamicNode.resolveLineage`. Whether *any* validation error should disable Try, or only errors that make the graph structurally unrunnable, is an open product decision.
+1. Restoring it is one step: publish a node with the **same name** from **Dynamic nodes ▸ New custom node** and the lineage comes back with its history continued (14.14).
+
+---
+
 ## 🤖 AI agent chat logs
 
 Transcripts captured from **real live runs** of the workflow agent (Azure gpt-5.4). Open the demo link — the workflow the agent built loads on the canvas **and** the agent drawer opens and **replays** the whole conversation (your prompt + every tool call it made) beside it, so you can see the result and how it was built in one place.

docs-md/workflows/MANUAL_TEST_PLAN.md

@@ -606,7 +606,7 @@ One `source.api` and one `source.upload` max per workflow.
 - [ ] **14.8 In-canvas custom node.** Palette **Custom** section → **New custom node** modal → publish → node auto-drops as `dyn.<slug>` with a grape **DYN** badge. Right-click a `dyn.*` node → **Edit script**. **Pass:** deleted-lineage node shows a red **Deleted** badge, settings Alert, Try disabled.
 
 ### Execute + security
-- [ ] **14.9 Execute (Try).** Build `source.api → dyn.uppercase-url`, wire `document`, Save → **Try** with `{"documentUrl":"https://example.com/foo.pdf"}`. **Pass:** node goes blue→green; preview shows the uppercased URL. Publish v2 (reverse) → Try → cache miss → preview shows reversed URL.
+- [x] **14.9 Execute (Try).** Build `source.api → dyn.uppercase-url`, wire `document`, Save → **Try** with `{"documentUrl":"https://example.com/foo.pdf"}`. **Pass:** node goes blue→green; preview shows the uppercased URL. Publish v2 (reverse) → Try → cache miss → preview shows reversed URL.
 - [x] **14.10 Runtime errors.** Script `throw` → `errorMessage` prefixed `[DynamicNodeRuntimeError] exitCode=1 …`; timeout (>60s) / stdout >5MB / invalid JSON / missing output port each map to their typed error (truncated 2KB).
 - [x] **14.11 🔒 Network egress blocked.** Publish/run a node doing `await fetch("https://blocked.example.com")` with that host **not** in `DYNAMIC_NODE_ALLOW_NET`. Fast path — hit the runner directly:
   ```bash

feature-docs/20260724-workflow-builder-spec-completion/COVERAGE_GAP_LOG.md

@@ -26,6 +26,13 @@ Create, Publish, Author, Drag, Declare); only **10 of 16 parts** carry a
 
 ## G1 — Demos to seed (`scripts/seed-feature-demos.mjs`)
 
+> **D1–D4 shipped.** D2 is a *Deleted custom node* demo that ships already
+> tombstoned — red **Deleted** badge, `(deleted dynamic node)` alert and the
+> catalog error, with no destructive step for the reader. D3 tagged the Part-14
+> dynamic node `@deterministic true` **and bound its output**, which is what
+> makes 14.9's preview show the real value:
+> `{"fileName":"901E42EB-…-WALK-14-9.PDF"}`.
+>
 > **D1 + D4 shipped.** The Part-10 library demo now declares a typed signature
 > (input *Prepared file* `PreparedFile`, output *OCR result* `OcrResult`) and
 > carries **two versions**. That unblocked 7.8, 10.4, 12.4 and 12.5 in one
@@ -35,8 +42,8 @@ Create, Publish, Author, Drag, Declare); only **10 of 16 parts** carry a
 | # | Demo | Covers | Why it's a gap | Size |
 |---|---|---|---|---|
 | ~~**D1**~~ ✅ **DONE** | **Library workflow with typed ports** — declare an input `kind: PreparedFile` and an output `kind: DocumentContent` | **7.8**, and enriches Part 10 | 7.8 is the only check for typed library ports, and no seeded library declares a `kind`. I had to author `WALK-7.8 typed ports` to walk it at all | S |
-| **D2** | **Workflow referencing a deleted `dyn.*` lineage**, seeded already-deleted | **14.8** (deleted half) | The plan asks you to delete a lineage yourself — destructive, and it consumes the Part-14 demo for the next walker. Seeded in the end state, the user just opens it and sees the red **DELETED** badge, the settings alert and the validator error | S |
-| **D3** | **Runnable dynamic node** — extend the existing Part-14 demo rather than add one | **14.9** | 14.9 says "build `source.api → dyn.uppercase-url`". The existing Part-14 demo shows the DYN pill and script editor but is not wired to run. Also the natural home for **D-12** once the preview message is fixed | M |
+| ~~**D2**~~ ✅ **DONE** | **Workflow referencing a deleted `dyn.*` lineage**, seeded already-deleted | **14.8** (deleted half) | The plan asks you to delete a lineage yourself — destructive, and it consumes the Part-14 demo for the next walker. Seeded in the end state, the user just opens it and sees the red **DELETED** badge, the settings alert and the validator error | S |
+| ~~**D3**~~ ✅ **DONE** | **Runnable dynamic node** — extend the existing Part-14 demo rather than add one | **14.9** | 14.9 says "build `source.api → dyn.uppercase-url`". The existing Part-14 demo shows the DYN pill and script editor but is not wired to run. Also the natural home for **D-12** once the preview message is fixed | M |
 
 | ~~**D4**~~ ✅ **DONE** | **Part-10 demo library needs declared ports and a second version** | **7.8**, **12.5**, **10.4** | The seeded `Demo — Library workflow (Part 10)` declares **0 inputs / 0 outputs**, so the childWorkflow signature summary renders empty — nothing to look at. It also has **only one version**, so 12.5's "pick `v2` → stamps `version:2`" cannot be walked at all. Giving this one demo typed ports and a v2 closes D1 as well | S |
 

scripts/seed-feature-demos.mjs

@@ -1426,6 +1426,7 @@ function demoDynamicNodeScript() {
  * @workflow-node
  * @name ${DYN_DEMO_NAME}
  * @description Uppercases the prepared file's fileName.
+ * @deterministic true
  * @inputs { document: { kind: "Document", required: true } }
  * @outputs { result: { kind: "Artifact" } }
  */
@@ -1481,6 +1482,7 @@ function dynamicNodeConfig(name, slugName) {
       blobKey: { type: "string" },
       documentId: { type: "string" },
       preparedFileData: { type: "object" },
+      uppercasedName: { type: "object" },
     },
     nodes: {
       prep: {
@@ -1503,19 +1505,99 @@ function dynamicNodeConfig(name, slugName) {
         // The dynamic-node binding walk requires the required `document`
         // input to be explicitly bound (auto-wire doesn't cover dyn nodes).
         inputs: [{ port: "document", ctxKey: "preparedFileData" }],
+        // 14.9 — bind the OUTPUT too, or the preview has nothing to read and
+        // honestly says so ("this step's output isn't bound to a workflow
+        // value yet"). With the binding AND `@deterministic true` the run
+        // caches the result and the widget shows the uppercased fileName.
+        outputs: [{ port: "result", ctxKey: "uppercasedName" }],
         ...pos(460, 140),
       },
     },
     edges: [{ id: "e1", source: "prep", target: "dynNode", type: "normal" }],
   };
 }
 
+/**
+ * D2 (14.8) — a workflow that references a dynamic node whose lineage has been
+ * SOFT-DELETED, seeded already in that end state.
+ *
+ * The plan asks the reader to go and delete a lineage themselves. That is
+ * destructive, it consumes the Part-14 demo for whoever walks next, and it
+ * leaves the group's catalog different from how it started. Seeding the end
+ * state instead means the reader just opens this and sees the failure modes.
+ */
+const DELETED_DYN_SLUG = "demo-deleted-node";
+
+function deletedDynScript() {
+  return `import type { Document } from "@ai-di/graph-workflow/kinds";
+
+/**
+ * @workflow-node
+ * @name ${DELETED_DYN_SLUG}
+ * @description Exists only to be deleted, so a workflow can reference a tombstone.
+ * @deterministic true
+ * @inputs { document: { kind: "Document", required: true } }
+ * @outputs { result: { kind: "Artifact" } }
+ */
+export default async function dynamicNode(
+  ctx: { document: Document },
+  _params: Record<string, unknown>,
+): Promise<{ result: unknown }> {
+  return { result: ctx.document };
+}`;
+}
+
+function deletedDynConfig(name) {
+  return {
+    schemaVersion: "1.0",
+    metadata: { name },
+    entryNodeId: "prep",
+    ctx: {
+      blobKey: { type: "string" },
+      documentId: { type: "string" },
+      preparedFileData: { type: "object" },
+    },
+    nodes: {
+      prep: {
+        id: "prep",
+        type: "activity",
+        label: "Prepare",
+        activityType: "file.prepare",
+        inputs: [
+          { port: "documentId", ctxKey: "documentId" },
+          { port: "blobKey", ctxKey: "blobKey" },
+        ],
+        outputs: [{ port: "preparedData", ctxKey: "preparedFileData" }],
+        ...pos(120, 140),
+      },
+      goneNode: {
+        id: "goneNode",
+        type: "activity",
+        label: "Custom step (lineage deleted)",
+        activityType: `dyn.${DELETED_DYN_SLUG}`,
+        inputs: [{ port: "document", ctxKey: "preparedFileData" }],
+        ...pos(460, 140),
+      },
+    },
+    edges: [{ id: "e1", source: "prep", target: "goneNode", type: "normal" }],
+  };
+}
+
+const DELETED_DYN_STEPS = [
+  "This workflow references a custom node whose **lineage has been deleted**. Nothing to set up — it ships in that state.",
+  "The canvas node carries a red **Deleted** badge and its settings show *(deleted dynamic node)*.",
+  "The validation chip reads **1 error** — *Activity type `dyn.demo-deleted-node` is not registered*. Give the activity catalog a moment to load: `dyn.*` types are deliberately given the benefit of the doubt while it is still fetching, so the error appears a beat after the canvas.",
+  "⚠️ **Known gap (D-11):** **Try** and **Run** are still enabled here even though the graph cannot run — a run fails at `dynamicNode.resolveLineage`. Whether *any* validation error should disable Try, or only errors that make the graph structurally unrunnable, is an open product decision.",
+  "Restoring it is one step: publish a node with the **same name** from **Dynamic nodes ▸ New custom node** and the lineage comes back with its history continued (14.14).",
+];
+
 const DYN_DEMO_STEPS = [
   "The **CUSTOM** section of the activity palette lists **demo-uppercase** with a **DYN** badge — click it to drop another instance.",
   "The canvas node carries a purple **DYN** pill; select it → the Inputs section shows its `document` port bound to *Prepare*'s output.",
   "Right-click the node → **Edit script** opens the script editor with the published TypeScript source (JSDoc `@inputs`/`@outputs` drive the ports).",
   "**+ New custom node** (palette) opens the authoring editor — publishing runs the jsdoc → signature → ts-check → allowlist gates (`MANUAL_TEST_PLAN.md` Part 14).",
   "**Delete + re-create restores the node:** delete this custom node (**Dynamic nodes** page), then **+ New custom node** and publish the *same* name — it comes back with its history continued (v2), instead of dead-ending on a reserved-slug conflict (14.14).",
+  "**Try it (14.9):** the script is tagged `@deterministic true`, so its output is **cached** and the node shows a real **preview** after a run — an untagged (non-deterministic) script re-executes every run and is deliberately never cached, so it has no preview to show.",
   "⚠️ *Executing* this node in a run additionally needs the Temporal worker started with `PLATFORM_API_KEY` (14.9).",
 ];
 
@@ -1582,6 +1664,48 @@ async function createDemo(demo) {
  * Returns its guide-result row, or null when the dynamic node couldn't be
  * published.
  */
+/**
+ * D2 — publish a lineage, build a workflow on it, then soft-delete the
+ * lineage so the demo ships already broken. Best-effort like its sibling: no
+ * deno-runner means no publish, so the demo is skipped rather than failing the
+ * whole seeder.
+ */
+async function createDeletedDynDemo() {
+  let published;
+  try {
+    published = await api("POST", "/api/dynamic-nodes", {
+      script: deletedDynScript(),
+    });
+  } catch {
+    console.log("  – deleted-dyn    skipped (deno-runner unavailable)");
+    return null;
+  }
+  if (!published?.slug) return null;
+  const title = "Deleted custom node — Deleted badge & catalog error (Part 14)";
+  const name = `${NAME_PREFIX}${title}`;
+  const created = unwrap(
+    await api("POST", "/api/workflows", {
+      name,
+      config: withArrangeOnLoad(deletedDynConfig(name)),
+      groupId: GROUP_ID,
+    }),
+  );
+  // Tombstone the lineage AFTER the workflow references it — that ordering is
+  // the whole point of the fixture.
+  await api("DELETE", `/api/dynamic-nodes/${DELETED_DYN_SLUG}`);
+  console.log(
+    `  ✓ ${"deleted-dyn".padEnd(14)} ${created.id} (dyn.${DELETED_DYN_SLUG} tombstoned)`,
+  );
+  return {
+    key: "deleted-dyn",
+    title,
+    steps: DELETED_DYN_STEPS,
+    id: created.id,
+    slug: created.slug,
+    dyn: true,
+  };
+}
+
 async function createDynamicNodeDemo() {
   const dynSlug = await publishDemoDynamicNode();
   if (!dynSlug) return null;
@@ -1624,14 +1748,15 @@ async function seed() {
   // the previous one — reliable in practice because every create is a
   // separate awaited HTTP round-trip.
   const dynResult = await createDynamicNodeDemo();
+  const deletedDynResult = await createDeletedDynDemo();
 
   const mainReversed = [];
   for (let i = DEMOS.length - 1; i >= 0; i--) {
     mainReversed.push(await createDemo(DEMOS[i]));
   }
   const mainResults = mainReversed.reverse();
 
-  return dynResult ? [...mainResults, dynResult] : mainResults;
+  return [...mainResults, dynResult, deletedDynResult].filter(Boolean);
 }
 
 function renderGuide(results, agentResults = []) {