Merge origin/main into claude/project-thread-f9p63p

Claude-Session: https://claude.ai/code/session_01L6bhgXPvYEKGGY6sms31q2
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/27325-publish-names-uncarried-manifest-keys.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/cli': patch
+---
+
+fix(cli): `os package publish` names the `objectstack.manifest.json` keys it does not send (`tags`, `publisher`, `isStarter`, `preview`, `visibility`) instead of dropping them silently
+
+Clause-②: no
+Metadata-protocol: none
+
+The listing file's schema accepts these keys, but publish never carried them to the control plane, so an author's tags, starter flag or preview simply never reached the catalog and nothing said why. Publish now prints a warning naming each declared catalog key: it is declared but not yet carried by the hosted catalog, with a link to the issue tracking that (#27348). A declared `visibility` gets its own warning pointing at `--visibility`, which does carry it. The publish still succeeds: the bundled blank template ships `isStarter: true`. A test classifies every key of the listing-file schema as sent, warned about, or scaffold-only, so a key the schema gains later fails until publish handles it.

.changeset/27356-studio-readonly-flow-switch.md

@@ -0,0 +1,13 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/console': patch
+---
+
+fix(studio): a read-only package's flow Enabled switch no longer looks like a live control
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** In Studio's Automations pillar, a read-only (code) package's flow showed its Enabled switch with a green track. The switch was already disabled, but it read as one the author could flip.
+- **Now.** On a read-only package the track is muted and a lock sits beside the word. The thumb position, the word (Enabled or Disabled) and `aria-checked` still say whether the flow is on. The read-only reason on the wrapper is unchanged.
+- **Unchanged.** A writable package's switch keeps its green track and stays operable.

.claude/skills/pm-dispatch/references/seat-lifecycle.md

@@ -37,10 +37,10 @@
 - 敲门后满 `RECLAIM_AFTER_HOURS` 无答复即由总监席一笔中继释放,细则 `triage-duties.md`。
 - ⛔ 永不从贴的 `updated_at` 或标题推死活;活性只认在任者自己的产出。
 - 竞态三招:动手前重 fetch 正文、审计评论时间戳先到先得、写后回读。
-- 收班 = 状态 flush + 在飞显式安置,不是在飞归零;派发口径失效,简报 ⛔ 不列作继承裁决。
+- 收班 = 状态 flush + 在飞默认交回队列、不等落地;派发口径失效,简报 ⛔ 不列作继承裁决。
 - 坐席发 `seat-online`、收班简报同一动作发 `seat-offline`,键见 `project-forms.md` 〈信箱 PR〉。
 - 强制接管的新账号代撞墙账号发 `seat-online`;Routine 席唤不醒,读信箱靠巡查。
-- 离任留守只写简报点名的项,⛔ 不读队列、不新派发、不碰未点名卡。
+- 离任留守只写点名的已 ACCEPT 待队列或待人批 PR,⛔ 不读队列、不新派发、不碰未点名卡。
 - 换班报告默认零建议,只收三类:原则错/缺、可机械化项、平台事实变化。
 - 原则错/缺 → 只进简报,维护者点名才立卡;可机械化项 → 门禁/脚本卡,⛔ 不是散文。
 - 平台事实变化 → references 事实表改一行。

.claude/skills/pm-dispatch/references/seat-post-protocol.md

@@ -32,19 +32,19 @@
 - 耐久状态只住正文或以 App 写入;正文守中继上限 60,000 字节,超大贴由半状态巡查浮出。
 - 协议升级迁移状态、或巡检发现正文不符时,当场改正文 + 审计评论。
 - Routine 座位的收尾简报也落自己的座位贴,它是下一轮自退守卫的读数。
-- 安置默认离任留守;留不了才热移交:在飞卡落收单注记 + 点名看护者。
+- 收班默认交回(〈交接收尾清单〉第 2 步);留守只剩已 ACCEPT 待队列或待人批的 PR。
+- 留守写面 = 简报点名的这些 PR,残余定时器同界;留不了才热移交:收单注记 + 点名看护者。
 - 收单注记写评审判据、落地步骤与当前状态;看护只守落地,⛔ 评审判断不可外包。
 - 看护者默认下任座位;在跑云会话经 poke 触发器投递,⛔ 非 `SendMessage` 直投。
-- 收班序列:贴正文与标题刷新在先,简报评论是最终一笔;继任的释放判据 = 简报在。
+- 收班序列不看维护者措辞:`check-handover.mjs` 退出 0 → 刷正文与标题 → 简报最终一笔。
 - 标题滞后是可修半状态,坐席时顺手修,⛔ 不是阻塞。
-- 留守写面恰为简报点名的项:已 ACCEPT 待队列 PR、落地中的评审链载体;残余定时器同界。
 - 末尾巴合并 ⇒ 贴上一条尾清注记;继任立即坐席,点名集作围栏。
 - 标题词表不扩,收班座位恒 `⏳ vacant`;留守登记(谁、哪些尾巴)= 说明段一行。
 
 ## 交接收尾清单(漏一步就是留残缺现场)
 
 1. 立即停止新派发。
-2. 在手工件逐件处置:本席认领的卡落地,或 `Release:` 与清 assignee 同笔释放,转成真实状态。
+2. 认领卡落地,或同笔 `Release:`+`Resume-from:`+清 assignee 交回 `pm:queue`;`needs_decision` 进决策箱。
 3. 全量枚举本车道队列、决策箱与 findings,形成接任台账;等裁决的卡只挂 `needs-user-decision`。
 4. 台账义务逐条带卡号(条件型开 `pm:blocked`+`Blocked-by:`,定时型 `Restart-when:`),正文只放指针。
 5. 第 2、3 步由 `node scripts/pm/check-handover.mjs --session=ID --account=LOGIN` 核,退出 0 才写空座正文。

content/docs/data-modeling/drivers.mdx

@@ -305,6 +305,11 @@ Checks that need no connection can still run in the constructor, which fails
 even earlier — that is where `MongoDBDriver` puts its
 [tenancy guard](#multi-tenancy-not-supported).
 
+A driver need not front a database at all: a plugin can publish one over a REST API or
+any other system, and an `external` object bound to it is served from there on every
+read. The recipe, the rules such a driver keeps and a test template are in
+[Virtual objects](/docs/data-modeling/virtual-objects).
+
 ## PostgreSQL (via `@objectstack/driver-sql`)
 
 ```bash

content/docs/data-modeling/external-datasources.mdx

@@ -17,7 +17,9 @@ auto-connected, validated at boot, and queryable — with no application code.**
 This guide is about reading/writing the *live* remote tables (federation). To
 *copy* rows into ObjectStack-owned tables instead, see seed data / data sync. For
 the plain multi-datasource routing of **managed** databases ObjectStack owns, see
-[Database Drivers](/docs/data-modeling/drivers).
+[Database Drivers](/docs/data-modeling/drivers). When the remote is not a database a
+built-in driver reaches — a REST API, a planning engine, a device gateway — serve the
+object from your own plugin driver instead: [Virtual objects](/docs/data-modeling/virtual-objects).
 </Callout>
 
 ## 1. Declare the datasource
@@ -305,6 +307,8 @@ default allows all connects (subject to the gating above).
 - [Database Drivers](/docs/data-modeling/drivers) — managed multi-datasource routing,
   [read-only via database privileges](/docs/data-modeling/drivers#read-only-grant-it-at-the-database-not-in-metadata),
   and [why the platform does not route read replicas](/docs/data-modeling/drivers#read-replicas-the-platform-does-not-route).
+- [Virtual objects](/docs/data-modeling/virtual-objects) — the same binding served by
+  a plugin driver you write, for a remote that is not a database.
 - [Datasource reference](/docs/references/data/datasource) — every `defineDatasource` field.
 - The `examples/app-showcase` `showcase_external` datasource — a runnable end-to-end demo.
 - ADR-0015 (federation spec) and ADR-0062 (external-datasource runtime).

content/docs/data-modeling/index.mdx

@@ -60,6 +60,7 @@ That one definition is enough to get a persisted table, CRUD + query endpoints,
   <Card href="/docs/data-modeling/import-mappings" title="Import Mappings" description="Named column-to-field projections applied by the import endpoint" />
   <Card href="/docs/data-modeling/external-datasources" title="External Datasources" description="Federate external databases into the model" />
   <Card href="/docs/data-modeling/drivers" title="Database Drivers" description="Configure SQL, MongoDB, in-memory, and WASM drivers" />
+  <Card href="/docs/data-modeling/virtual-objects" title="Virtual Objects" description="Serve an object's rows from your own server through a plugin driver" />
   <Card href="/docs/data-modeling/analytics" title="Analytics Datasets" description="Model datasets for dashboards and reports" />
 </Cards>
 

content/docs/data-modeling/meta.json

@@ -17,6 +17,7 @@
     "import-mappings",
     "external-datasources",
     "drivers",
+    "virtual-objects",
     "analytics"
   ]
 }