Merge remote-tracking branch 'origin/main' into claude/project-thread-g33h31

# Conflicts:
#	scripts/sdui-manifest.sources/components.json
#	scripts/sdui-manifest.sources/plugin-list.json

Author: claude

.changeset/25779-seed-files.md

@@ -0,0 +1,39 @@
+---
+'@objectstack/spec': minor
+'@objectstack/metadata-protocol': minor
+'@objectstack/service-storage': minor
+'@objectstack/runtime': minor
+'@objectstack/cli': minor
+---
+
+feat(spec,metadata-protocol,service-storage,runtime,cli)!: a seed record can carry a file the package ships, `seedFile(path)`, and a file field's id that names no stored file is refused
+
+Clause-②: yes (narrowing)
+Metadata-protocol: narrowed
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any metadata schema is removed, renamed or re-shaped. The narrowing is a seed load refusing a value it used to write: an id-shaped string in a file field that names no stored file. There is nothing for `objectstack migrate meta` to rewrite and no tombstone; the fix is the author's choice of the file the field should hold. -->
+
+A `file`, `image`, `avatar`, `video` or `audio` field stores the id of a stored file, and only an upload made one, so a seed could not fill a required file field at all. A seed record now names the file by the path the package ships it at:
+
+```ts
+import { defineSeed, seedFile } from '@objectstack/spec/data';
+
+defineSeed(ContractVersion, {
+  externalId: 'code',
+  records: [
+    { code: 'NDA-001-V1', file: seedFile('fixtures/nda-v1.pdf') },
+    { code: 'NDA-002-V1', file: seedFile('fixtures/nda-v2', { name: 'NDA v2.pdf', contentType: 'application/pdf' }) },
+  ],
+});
+```
+
+- **The path** is relative to the directory holding `objectstack.config.ts`, uses `/`, and stays inside it: an absolute path, a drive letter, a `\`, or an empty, `.` or `..` segment is refused at parse. A `multiple: true` file field takes an array of `seedFile(...)` values. `defineSeed` refuses `seedFile(...)` in a field that does not store a file.
+- **`os build` / `os compile`** reads each referenced file and writes its bytes into the dataset's new `files` map (`{ contentType, size, sha256, data }`, base64), so the compiled artifact carries them to every boot that loads it: `os dev`, `os serve`, a published package, an artifact URL. A path that names no file, or a file whose type is neither named with `contentType` nor known by its extension, fails the build, and `os validate` refuses the same paths. `os serve` / `os dev` booting a config rather than an artifact reads the files the same way, so both boots seed the same files.
+- **The seed loader** stores the bytes through the new `field-files` service (`FIELD_FILE_SERVICE`, `IFieldFileService`, registered by `@objectstack/service-storage`), writes the file's id into the field, and makes the written record the file's owner, the (object, record, field) ownership an upload gets. Each row gets a file of its own. A replay that finds the row holding a file stored from the same path with the same bytes, name and type keeps it, so a restart does not store a new file for an unchanged fixture. A file stays `pending` until its row lands, so a file whose row is refused is reclaimed by the pending-upload retention.
+- **Refused, by row, before the row is written**: a reference whose bytes the dataset does not carry, bytes that do not match their recorded size and SHA-256, a load with no `field-files` service, a field mixing `seedFile(...)` with other values, and several `seedFile(...)` values in a one-file field. Each is counted, reported in the load's errors and logged at `error`.
+- **The inline boot seed** of an app whose datasets carry seed files runs at `kernel:bootstrapped` (as one with `demoStaff` already does), once the storage service has read its settings, so the files land in the store the deployment serves from.
+- `SeedLoaderService` takes an optional fourth argument, `{ getFieldFiles }`; every platform caller passes the kernel's `field-files` service.
+
+**BREAKING** (a seed-load narrowing). A seed record whose file field holds an id-shaped string (letters, digits, `_` and `-`, at most 64 characters) that names no stored file in the row's organization is now refused, by row, with an error naming the field and the value. Before, it was written as given, and the field then read as holding no file. An external URL or an inline value is not an id and is written as before; so is any value on a deployment without `@objectstack/service-storage`.
+
+**What to do.** If a seed load now reports `… holds '<value>', which names no stored file`, replace the value with the file the field should hold, `seedFile('<path in the package>')`, or remove it.

.changeset/25992-objectview-toolbar-affordances-split.md

@@ -0,0 +1,12 @@
+---
+'@object-ui/app-shell': patch
+---
+
+refactor(app-shell): the Console `ObjectView`'s list toolbar affordances move into a sibling hook
+
+Clause-②: no
+Metadata-protocol: none
+
+The environment list's entitlements, the object's list actions and their localized toolbar copies, and the create and import buttons' toolbar-scope predicates move verbatim out of `ObjectViewInner` in `views/ObjectView.tsx` into `useObjectViewToolbarAffordances` in `objectViewToolbarAffordances.ts` beside it. The object-level verdicts (`resolveAffordance`) stay in the component and are passed in with every other input. No logic, name or rendered output changes, and the package entry is unchanged.
+
+What to do: nothing.

.changeset/26182-related-list-empty-actions-new.md

@@ -0,0 +1,13 @@
+---
+'@object-ui/plugin-detail': minor
+---
+
+fix(plugin-detail): `record:related_list` with `actions: []` no longer draws the built-in New
+
+Clause-②: no
+Metadata-protocol: semantic
+
+- **Before.** `actions: []` on a `record:related_list` hid the list's authored and default actions, but the built-in **New** stayed whenever the host offered create. The only way to drop it was the child object's `userActions.create`, which removes New from every list of that object. A page could not say that one list's children must be created through a process (a renewal through its flow, a version through upload), and the generic create form, with the relationship prefilled, bypassed that process.
+- **Now.** An authored `actions: []` is the author's choice of no actions on that list, New included. It holds per list and does not depend on the child object's `userActions.create`. Every list that does not author `[]` keeps the host's verdict.
+- **Unchanged.** A list with no `actions`, or with a non-empty `actions` list, draws New exactly as before. The row affordances (View, Edit, Delete) and the `add` (link existing) button are not governed by this key. No key is added and none is removed.
+- **What to do.** Nothing for a list that should keep New. A page that authored `actions: []` and still wants New on that list deletes the key.

.changeset/26349-package-bound-wiring.md

@@ -0,0 +1,12 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): the permission editor tells the delegated-admin companion list whether it edits under a package, instead of the list guessing from its presentation
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`@object-ui/app-shell`:** `PermissionMatrixEditPage` now passes `packageBound={!!packageId}` to `PermissionAdvancedFacets` at both of its mounts (Setup's stacked page and the Studio Access pillar's tabs). The facet's `packageBound` prop defaults to `false` and no longer reads its value from `only`, which picks a presentation, not a binding. What an author sees does not change today: the Studio Access pillar always edits under a package and Setup's permission page never does. A host that sets one without the other now gets the face that matches its binding: under a package the companion grants are listed unmarked with the package note, otherwise they are marked with the one-click grant.
+
+What to do: nothing.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,30 @@
+Fixes #
+
+## What changes
+
+## Why
+
+## Verification
+
+Clause-②: yes | no
+Metadata-protocol: added | narrowed | semantic | none
+
+_Keep one value on each of the two lines above, each line starting with its key.
+[Human Minimum](https://github.com/objectstack-ai/objectstack/blob/main/CONTRIBUTING.md#human-minimum)
+item 5 says what they mean._
+
+## Human Minimum
+
+Each item is one rule from
+[CONTRIBUTING.md › Human Minimum](https://github.com/objectstack-ai/objectstack/blob/main/CONTRIBUTING.md#human-minimum),
+which links the AGENTS.md text that states it.
+
+- [ ] 1. Schemas start as Zod; `packages/spec` holds no runtime logic.
+- [ ] 2. Every name I added uses the casing for its kind.
+- [ ] 3. No formatter ran; `pnpm lint` passes.
+- [ ] 4. One issue, one branch off an up-to-date `main`, one pull request.
+- [ ] 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
+- [ ] 6. `packages/spec` touched: its generated artifacts are regenerated and committed.
+- [ ] 7. No hand edits to `content/docs/references/`, `packages/*/CHANGELOG.md` or `content/docs/releases/`.
+- [ ] 8. Title, body and comments are in English.
+- [ ] The *Before Submitting* list in CONTRIBUTING.md is done.

.github/workflows/check-links.yml

@@ -20,16 +20,56 @@ name: Check Links
 # "the anchors are fine". The fragment half is owned by `pnpm check:doc-anchors`
 # in `lint.yml`, which is REQUIRED where this lane is advisory; `lychee.toml`'s
 # `include_fragments` comment records why the enum is not the fix.
+#
+# `paths:` is what the two checks read: lychee's input globs in `LYCHEE_ARGS`
+# below (taken as whole `content/` and `docs/` trees, so an image or page a
+# link points at inside them counts too), its config, and the ADR step's
+# `docs/adr/**` and script. Measured on the last 49 landings of `main`
+# (6390fe52): 10 touched one of these, so the other 39 would not have run it.
+# ⚠️ The filter is blind to the TARGET side outside those trees: a PR that
+# only renames or deletes a file a doc links to (a `packages/*` directory
+# from CONTRIBUTING.md, `LICENSE` from LICENSING.md) skips this lane, and the
+# break shows on the next PR that touches a doc, or on a `workflow_dispatch`
+# run. Keep this list equal to `LYCHEE_ARGS`. ⛔ Promoting the lane into the
+# required set removes this filter in the same change: a required check
+# skipped by `paths:` never reports, the #6121 stall above.
 on:
   workflow_dispatch:
   pull_request:
     branches:
       - main
+    paths:
+      - 'content/**'
+      - 'docs/**'
+      - 'README.md'
+      - 'ARCHITECTURE.md'
+      - 'CHANGELOG.md'
+      - 'RELEASE_NOTES.md'
+      - 'CONTRIBUTING.md'
+      - 'ROADMAP.md'
+      - 'LICENSING.md'
+      - 'CODE_OF_CONDUCT.md'
+      - 'lychee.toml'
+      - '.lycheeignore'
+      - 'scripts/check-adr-links.mjs'
+      - 'scripts/invoked-as.mjs'
+      - '.github/workflows/check-links.yml'
+
+# A newer run for the same pull request supersedes this one, so the older run is
+# cancelled. The group key is ci.yml's shape; `cancel-in-progress` is true only on
+# `pull_request`, so no other event's run is ever cancelled.
+concurrency:
+  group: check-links-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.event.after || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   link-checker:
     name: Check Documentation Links
     runs-on: ubuntu-latest
+    # Run wall over the 100 most recent completed runs to 2026-10-27: p99 0.8 min, max
+    # 1.0. The bound covers the lychee retry path (two binary downloads and the 15 s wait)
+    # with headroom.
+    timeout-minutes: 10
     # Least privilege: the job only reads the tree and runs lychee offline.
     # There is no issue-filing step, and `--offline` makes zero network
     # requests, so neither `issues: write` nor a GITHUB_TOKEN is needed.

.github/workflows/ci.yml

@@ -4148,12 +4148,12 @@ jobs:
       # 81bba6c3f), then it enumerates the registry under plain Node (~8 s; ~6 s
       # for the whole run when nothing moved). It serialises through the
       # @objectstack/sdui-parser the step above built, so a parser edit moves
-      # this verdict too, which no committed digest does. On merge_group it runs
-      # on the queue's combined tree, the one run that sees two entries' effect
-      # on the manifest together. Only the artefact is compared: the records the
-      # generator rewrites beside it are held by `check-sdui-manifest` in
-      # lint.yml. The Console build below reads the registry through its src/
-      # aliases, so the dist this step builds does not reach it.
+      # this verdict too. On merge_group it runs on the queue's combined tree,
+      # the one run that sees two entries' effect on the manifest together.
+      # Only the artefact is compared: the record the generator rewrites beside
+      # it is held by `check-sdui-manifest` in lint.yml. The Console build below
+      # reads the registry through its src/ aliases, so the dist this step
+      # builds does not reach it.
       - name: The committed SDUI manifest is the one this tree generates
         run: |
           node scripts/gen-sdui-manifest-node.mjs

.github/workflows/codeql.yml

@@ -27,6 +27,9 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    # Run wall of the 22 analyses that completed (success) in the last 100 runs,
+    # 2026-10-24..26: p99 59.0 min, max 63.1. The bound is that p99 plus about half again.
+    timeout-minutes: 90
     permissions:
       actions: read
       contents: read

.github/workflows/cross-repo-issue-closer.yml

@@ -124,6 +124,9 @@ jobs:
     name: Close issues referenced in other repositories
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
+    # Run wall over the 100 most recent completed runs to 2026-10-27: p99 0.2 min, max
+    # 0.3.
+    timeout-minutes: 5
     steps:
       - name: Close (or report) cross-repo closing keywords
         uses: actions/github-script@v9

.github/workflows/docker-publish.yml

@@ -36,6 +36,11 @@ jobs:
   publish:
     name: Build & push ghcr.io/objectstack-ai/objectstack
     runs-on: ubuntu-latest
+    # Job wall, all four readings on record: 3.5 and 3.5 min (the two dispatch runs), 4.3
+    # min (18.1.0, Release run 40078805767, attempt 2) and 1.4 min (attempt 1, red). Four
+    # readings make p99 the max, 4.3; the bound is wide because the image is built for two
+    # platforms, arm64 under QEMU, and a cold layer cache is unmeasured.
+    timeout-minutes: 30
     permissions:
       contents: read
       packages: write