Merge remote-tracking branch 'origin/main' into claude/project-thread-ybjm3h

Author: claude

.changeset/25992-objectview-toolbar-affordances-split.md

@@ -0,0 +1,12 @@
+---
+'@object-ui/app-shell': patch
+---
+
+refactor(app-shell): the Console `ObjectView`'s list toolbar affordances move into a sibling hook
+
+Clause-②: no
+Metadata-protocol: none
+
+The environment list's entitlements, the object's list actions and their localized toolbar copies, and the create and import buttons' toolbar-scope predicates move verbatim out of `ObjectViewInner` in `views/ObjectView.tsx` into `useObjectViewToolbarAffordances` in `objectViewToolbarAffordances.ts` beside it. The object-level verdicts (`resolveAffordance`) stay in the component and are passed in with every other input. No logic, name or rendered output changes, and the package entry is unchanged.
+
+What to do: nothing.

.changeset/26349-package-bound-wiring.md

@@ -0,0 +1,12 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): the permission editor tells the delegated-admin companion list whether it edits under a package, instead of the list guessing from its presentation
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`@object-ui/app-shell`:** `PermissionMatrixEditPage` now passes `packageBound={!!packageId}` to `PermissionAdvancedFacets` at both of its mounts (Setup's stacked page and the Studio Access pillar's tabs). The facet's `packageBound` prop defaults to `false` and no longer reads its value from `only`, which picks a presentation, not a binding. What an author sees does not change today: the Studio Access pillar always edits under a package and Setup's permission page never does. A host that sets one without the other now gets the face that matches its binding: under a package the companion grants are listed unmarked with the package note, otherwise they are marked with the one-click grant.
+
+What to do: nothing.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,30 @@
+Fixes #
+
+## What changes
+
+## Why
+
+## Verification
+
+Clause-②: yes | no
+Metadata-protocol: added | narrowed | semantic | none
+
+_Keep one value on each of the two lines above, each line starting with its key.
+[Human Minimum](https://github.com/objectstack-ai/objectstack/blob/main/CONTRIBUTING.md#human-minimum)
+item 5 says what they mean._
+
+## Human Minimum
+
+Each item is one rule from
+[CONTRIBUTING.md › Human Minimum](https://github.com/objectstack-ai/objectstack/blob/main/CONTRIBUTING.md#human-minimum),
+which links the AGENTS.md text that states it.
+
+- [ ] 1. Schemas start as Zod; `packages/spec` holds no runtime logic.
+- [ ] 2. Every name I added uses the casing for its kind.
+- [ ] 3. No formatter ran; `pnpm lint` passes.
+- [ ] 4. One issue, one branch off an up-to-date `main`, one pull request.
+- [ ] 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
+- [ ] 6. `packages/spec` touched: its generated artifacts are regenerated and committed.
+- [ ] 7. No hand edits to `content/docs/references/`, `packages/*/CHANGELOG.md` or `content/docs/releases/`.
+- [ ] 8. Title, body and comments are in English.
+- [ ] The *Before Submitting* list in CONTRIBUTING.md is done.

.github/workflows/check-links.yml

@@ -20,16 +20,56 @@ name: Check Links
 # "the anchors are fine". The fragment half is owned by `pnpm check:doc-anchors`
 # in `lint.yml`, which is REQUIRED where this lane is advisory; `lychee.toml`'s
 # `include_fragments` comment records why the enum is not the fix.
+#
+# `paths:` is what the two checks read: lychee's input globs in `LYCHEE_ARGS`
+# below (taken as whole `content/` and `docs/` trees, so an image or page a
+# link points at inside them counts too), its config, and the ADR step's
+# `docs/adr/**` and script. Measured on the last 49 landings of `main`
+# (6390fe52): 10 touched one of these, so the other 39 would not have run it.
+# ⚠️ The filter is blind to the TARGET side outside those trees: a PR that
+# only renames or deletes a file a doc links to (a `packages/*` directory
+# from CONTRIBUTING.md, `LICENSE` from LICENSING.md) skips this lane, and the
+# break shows on the next PR that touches a doc, or on a `workflow_dispatch`
+# run. Keep this list equal to `LYCHEE_ARGS`. ⛔ Promoting the lane into the
+# required set removes this filter in the same change: a required check
+# skipped by `paths:` never reports, the #6121 stall above.
 on:
   workflow_dispatch:
   pull_request:
     branches:
       - main
+    paths:
+      - 'content/**'
+      - 'docs/**'
+      - 'README.md'
+      - 'ARCHITECTURE.md'
+      - 'CHANGELOG.md'
+      - 'RELEASE_NOTES.md'
+      - 'CONTRIBUTING.md'
+      - 'ROADMAP.md'
+      - 'LICENSING.md'
+      - 'CODE_OF_CONDUCT.md'
+      - 'lychee.toml'
+      - '.lycheeignore'
+      - 'scripts/check-adr-links.mjs'
+      - 'scripts/invoked-as.mjs'
+      - '.github/workflows/check-links.yml'
+
+# A newer run for the same pull request supersedes this one, so the older run is
+# cancelled. The group key is ci.yml's shape; `cancel-in-progress` is true only on
+# `pull_request`, so no other event's run is ever cancelled.
+concurrency:
+  group: check-links-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.event.after || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   link-checker:
     name: Check Documentation Links
     runs-on: ubuntu-latest
+    # Run wall over the 100 most recent completed runs to 2026-10-27: p99 0.8 min, max
+    # 1.0. The bound covers the lychee retry path (two binary downloads and the 15 s wait)
+    # with headroom.
+    timeout-minutes: 10
     # Least privilege: the job only reads the tree and runs lychee offline.
     # There is no issue-filing step, and `--offline` makes zero network
     # requests, so neither `issues: write` nor a GITHUB_TOKEN is needed.

.github/workflows/ci.yml

@@ -4148,12 +4148,12 @@ jobs:
       # 81bba6c3f), then it enumerates the registry under plain Node (~8 s; ~6 s
       # for the whole run when nothing moved). It serialises through the
       # @objectstack/sdui-parser the step above built, so a parser edit moves
-      # this verdict too, which no committed digest does. On merge_group it runs
-      # on the queue's combined tree, the one run that sees two entries' effect
-      # on the manifest together. Only the artefact is compared: the records the
-      # generator rewrites beside it are held by `check-sdui-manifest` in
-      # lint.yml. The Console build below reads the registry through its src/
-      # aliases, so the dist this step builds does not reach it.
+      # this verdict too. On merge_group it runs on the queue's combined tree,
+      # the one run that sees two entries' effect on the manifest together.
+      # Only the artefact is compared: the record the generator rewrites beside
+      # it is held by `check-sdui-manifest` in lint.yml. The Console build below
+      # reads the registry through its src/ aliases, so the dist this step
+      # builds does not reach it.
       - name: The committed SDUI manifest is the one this tree generates
         run: |
           node scripts/gen-sdui-manifest-node.mjs

.github/workflows/codeql.yml

@@ -27,6 +27,9 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    # Run wall of the 22 analyses that completed (success) in the last 100 runs,
+    # 2026-10-24..26: p99 59.0 min, max 63.1. The bound is that p99 plus about half again.
+    timeout-minutes: 90
     permissions:
       actions: read
       contents: read

.github/workflows/cross-repo-issue-closer.yml

@@ -124,6 +124,9 @@ jobs:
     name: Close issues referenced in other repositories
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
+    # Run wall over the 100 most recent completed runs to 2026-10-27: p99 0.2 min, max
+    # 0.3.
+    timeout-minutes: 5
     steps:
       - name: Close (or report) cross-repo closing keywords
         uses: actions/github-script@v9

.github/workflows/docker-publish.yml

@@ -36,6 +36,11 @@ jobs:
   publish:
     name: Build & push ghcr.io/objectstack-ai/objectstack
     runs-on: ubuntu-latest
+    # Job wall, all four readings on record: 3.5 and 3.5 min (the two dispatch runs), 4.3
+    # min (18.1.0, Release run 40078805767, attempt 2) and 1.4 min (attempt 1, red). Four
+    # readings make p99 the max, 4.3; the bound is wide because the image is built for two
+    # platforms, arm64 under QEMU, and a cold layer cache is unmeasured.
+    timeout-minutes: 30
     permissions:
       contents: read
       packages: write

.github/workflows/docs-drift-check.yml

@@ -72,10 +72,20 @@ permissions:
   contents: read
   pull-requests: write
 
+# A newer run for the same pull request supersedes this one, so the older run is
+# cancelled. The group key is ci.yml's shape; `cancel-in-progress` is true only on
+# `pull_request`, so no other event's run is ever cancelled.
+concurrency:
+  group: docs-drift-check-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.event.after || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   docs-drift:
     name: Flag docs affected by code changes
     runs-on: ubuntu-latest
+    # Run wall over the 100 most recent completed runs to 2026-10-27: p99 2.1 min, max
+    # 6.2.
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7

.github/workflows/duplicate-fix-guard.yml

@@ -27,10 +27,20 @@ on:
 permissions:
   pull-requests: read
 
+# A newer run for the same pull request supersedes this one, so the older run is
+# cancelled. The group key is ci.yml's shape; `cancel-in-progress` is true only on
+# `pull_request`, so no other event's run is ever cancelled.
+concurrency:
+  group: duplicate-fix-guard-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.event.after || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   duplicate-fix-guard:
     name: No other open PR may claim the same issue
     runs-on: ubuntu-latest
+    # Run wall over the 100 most recent completed runs to 2026-10-27: p99 0.3 min, max
+    # 0.8.
+    timeout-minutes: 5
     steps:
       - name: Check declared issues against other open PRs
         uses: actions/github-script@v9