v0.9.15: mship improvements, memory improvements, nextjs bump, plane and ramp integrations, outbox hardening

.agents/skills/add-settings-page/SKILL.md

@@ -66,8 +66,8 @@ Each grep lists candidates; review every match against the expected ones named b
    - Editable pages: confirm Save/Discard go through `saveDiscardActions()` and
      dirty is wired via `useSettingsUnsavedGuard` (called before early-return
      gates) — flag any hand-rolled Save button, `beforeunload`, or unsaved modal.
-     `git grep -n "beforeunload" -- 'apps/sim/**/settings/**' 'apps/sim/ee/'`
-     should only hit the centralized `use-settings-before-unload.ts`.
+     `git grep -n "beforeunload" -- 'apps/sim/**/settings/**' 'apps/sim/ee/' 'apps/sim/components/settings/' ':(exclude,glob)**/*.test.*'`
+     should only hit the centralized `use-settings-browser-navigation.ts`.
 5. Fix each finding with the smallest structural change that satisfies the checklist;
    do not touch handlers, state, queries, or gate returns. A pixel-size fix swaps
    only the size class for its exact-pixel token (`text-[12px]` → `text-caption`).

.agents/skills/ship/SKILL.md

@@ -47,7 +47,7 @@ When the user runs `/ship`:
   - Run `/db-migrate` to review the migration for zero-downtime safety (expand/contract phasing, backward-compatibility with the deployed app version).
   - `(cd packages/db && bunx drizzle-kit generate && git status --porcelain ./migrations)` must print nothing (CI's schema/migration sync step).
   - `bun run check:migrations origin/staging` must pass (staging is the PR base). Do not silence a flagged statement with a `-- migration-safe:` annotation unless `/db-migrate` confirmed the old code no longer depends on it; otherwise split the destructive change into a later deploy.
-6. **Run pre-ship checks** from the repo root before staging. This has two phases: first **regenerate** every committed artifact so generated files never drift into a CI failure (this is what catches things like `agent-stream-docs` going stale after a `models.ts` edit), then run the **full audit suite** CI's `Lint and Test` job enforces. Both phases parallelize — but only across commands that write **disjoint** outputs — and a bare `wait` swallows child exit codes, so both phases below explicitly collect each job's status and abort ship if any failed.
+6. **Run pre-ship checks** from the repo root before staging. This has two phases: first **regenerate** every committed artifact so generated files never drift into a CI failure (this is what catches things like `agent-stream-docs` going stale after a `models.ts` edit), then run the **full audit suite** CI's `lint` job enforces. Both phases parallelize — but only across commands that write **disjoint** outputs — and a bare `wait` swallows child exit codes, so both phases below explicitly collect each job's status and abort ship if any failed.
 
   **Phase A — regenerate the always-in-repo committed artifacts (parallel), then let step 7 stage whatever changed.** Regenerate only the generators whose inputs live entirely in this repo and that any ordinary code change can drift — `agent-stream-docs:generate` (derives from the provider model registry), `docs-manifest:generate` (derives from docs page paths), and `skills:sync` (derives from `.agents/skills/**`). They write disjoint outputs (`apps/docs/…/agent.mdx`, `apps/sim/lib/mothership/generated/docs-manifest.ts`, and `.claude/skills` links), so they parallelize safely, and each is idempotent (a no-op when already in sync):
   ```bash
@@ -66,7 +66,7 @@ When the user runs `/ship`:
 
   **Do NOT blanket-run the domain generators here.** `mship:generate` (`generate-mship-contracts.ts`) is an **umbrella** that drives all nine mothership contract generators (`mship-contracts`, `billing-protocol-contract`, `mship-tools`, the four `trace-*`, `metrics-contract`, `vfs-snapshot-contract`) and biome-formats `apps/sim/lib/mothership/generated/` — never run it *and* its constituents (they write the same files and corrupt each other in parallel), and never run it on an ordinary ship: it reads an **external** copilot-contract source that isn't checked out in most worktrees, so it hard-fails with `ENOENT` and would abort ship for an unrelated reason. `generate:pi-model-catalog` (under `apps/sim`) likewise regenerates from the installed Pi package, not repo source. `scripts/generate-docs.ts` rewrites the integration docs and client-safe catalog; run it when this PR changes their block/icon/landing-content inputs or when `integration-catalog:check` reports drift, then review its broad generated diff. Only when **this PR's diff actually touches** a domain generator's input do you regenerate it deliberately and run its matching `:check` (`bun run mship:check` / the individual `*:check`) — with the external source present.
 
-  **Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/test-build.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
+  **Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/checks.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
   ```bash
   # autofix formatting first (mutating; not parallel-safe with the audits). Gate its exit too —
   # a non-zero lint (unfixable errors) must abort before the audits run, not be ignored.
@@ -77,6 +77,9 @@ When the user runs `/ship`:
   }
   # Runs every audit CI runs, concurrently, and replays the output of any that fail.
   # The audit list is derived in scripts/run-audits.ts — do not hand-list audits here.
+  # Install CI's pinned actionlint version for the host OS/architecture and verify its
+  # artifact against the official release checksums in a local mktemp directory.
+  # Preserve CI's -shellcheck= -pyflakes= flags; lint all workflows and abort ship if it fails.
   bun run check:audits || { echo "❌ audit(s) failed — do not ship"; exit 1; }
   bun run type-check || { echo "❌ type-check failed — do not ship"; exit 1; }
   # CI's "Verify docs manifest is in sync" step is not a `check:*` script, so the runner above

.claude/rules/landing-seo-geo.md

@@ -17,6 +17,7 @@ paths:
 - All copy is server-rendered text: no text baked into images, no content that exists only after a client effect runs.
 - Navbar is a Server Component (no `'use client'`) for immediate crawlability. Logo `<Image>` has `priority` (LCP element). The navbar `<nav>` carries `SiteNavigationElement` schema.org markup.
 - Structured data: emit JSON-LD (`Organization`, `WebSite`, `WebApplication` with `featureList`, `FAQPage` if an FAQ exists) from a server component rendered before visible content. Keep `featureList` in sync with the features the page shows (`apps/sim/app/(landing)/components/home-structured-data/`).
+- `/library` and `/blog` pagination stays server-rendered with real next/previous links. Each unfiltered page is indexable and uses its own canonical URL (`?page=2`, etc.); page 1 canonicalizes to the bare index. Tag-filtered variants remain `noindex,follow`. See [Google pagination guidance](https://developers.google.com/search/docs/specialty/ecommerce/pagination-and-incremental-page-loading).
 - After adding routes or anchors, verify `app/sitemap.ts` and `app/robots.ts` still reflect reality.
 
 ## GEO (Generative Engine Optimisation)

.claude/rules/sim-settings-pages.md

@@ -339,34 +339,33 @@ rendered through `<SettingsActionChips actions={…} />` from
 `@/components/settings/settings-header` — that is the shared chip path, and it
 is what keeps tone/icon/variant/tooltip handling from drifting between the two
 shells. Reach for it before hand-rolling a `Chip`.
-- **`useSettingsUnsavedGuard({ isDirty })`** (`…/settings/hooks/use-settings-unsaved-guard`)
-  — syncs the page's local `isDirty` into the shared `useSettingsDirtyStore` (so
-  the sidebar's **section-switch** confirm + the centralized `beforeunload` both
-  apply for free) and returns `{ showUnsavedModal, setShowUnsavedModal, guardBack,
-  confirmDiscard }` for a detail view's **in-view back** chip.
-  - **Top-level pages** (whitelabeling, sso): call it **unassigned** —
-    `useSettingsUnsavedGuard({ isDirty: hasChanges })` — they only need the
-    store-sync; the sidebar/`beforeunload` do the rest.
-  - **Detail sub-views** (data-retention, access-control group-detail): route the
-    back chip through `onClick={() => guard.guardBack(closeFn)}` and render the
-    shared `<UnsavedChangesModal open={guard.showUnsavedModal}
-    onOpenChange={guard.setShowUnsavedModal} onDiscard={guard.confirmDiscard} />`
-    (from `@/app/workspace/[workspaceId]/components/credential-detail`). The
-    in-view header **Discard** chip (via `saveDiscardActions({ onDiscard })`) is a
-    *reset to original* — distinct from the back-confirm's discard, which leaves.
-- **`useSettingsBeforeUnload`** is mounted by the settings shells
-  (`settings/layout.tsx` and `components/settings/standalone-settings-shell.tsx`) —
-  never add a per-page `beforeunload`.
-- **Dirty *computation* stays local** (shapes differ: field-compare vs
-  normalize+stringify) — only how dirty is *consumed* is shared. Derive it (a
-  `const`/`useMemo`), never store it in `useState`.
-- **CRITICAL — rules of hooks:** call `useSettingsUnsavedGuard(...)`
-  **unconditionally, before every early-return gate** (entitlement / loading /
-  not-entitled `return <SettingsEmptyState>`). A hook placed after a gate is
-  skipped on gated renders and crashes.
-- The route-based credential detail keeps its own `useUnsavedChangesGuard` (it
-  guards real `router.push` navigation + browser Back via a history sentinel);
-  it already shares `UnsavedChangesModal`, so copy stays unified.
+- **`useSettingsUnsavedGuard({ isDirty, navigationBlocked, onDiscard })`** from
+  `@/components/settings/use-settings-unsaved-guard` registers one editor with the
+  shared settings store. Register every full-page draft, including inline creation
+  forms. Dirty computation stays local and derived; fetched defaults stay clean.
+- **`onDiscard` resets the registered draft.** The root `SettingsNavigationGuard`
+  owns the discard dialog, internal link interception, browser Back/Forward, and
+  refresh protection for registered editors. Do not add a per-page dialog or
+  history listener for an editor using this hook. Skill create/detail pages retain
+  their existing `useUnsavedChangesGuard` and local dialog until they migrate to
+  the shared registration.
+- **Native history needs entry indexes.** The Navigation API supplies them for
+  legacy entries. Without it, native traversal to an unindexed entry cannot be
+  cancelled reliably; never guess a direction or rewrite the history stack.
+- **History confirmation authorizes traversal before discarding.** Drafts are
+  discarded only when the browser reports the confirmed traversal, so a no-op
+  Back or Forward retains edits. Known cross-document traversal uses native unload
+  protection. An unknown cross-document target on a classic History browser can
+  require a second native confirmation after the shared dialog.
+- **Detail back controls** call `guard.guardBack(closeFn)`. Other destructive view
+  transitions, such as switching an editor's direction or environment, also use
+  the shared `requestLeave` action before resetting their draft.
+- **`navigationBlocked` covers pending saves and uploads.** The shared guard blocks
+  navigation while requests are pending. Attempts are not queued; retry after they
+  settle. Disable or preserve edits made during requests;
+  failed saves retain drafts, and successful saves only clear committed values.
+- **Call the hook unconditionally, before every early-return gate** (entitlement,
+  loading, or empty-state return), so gated renders preserve hook order.
 
 ## Detail sub-views
 

.claude/rules/sim-testing.md

@@ -32,11 +32,11 @@ contracts, and demonstrated regressions.
 
 | Suffix | Needs | Run with | In CI |
 |--------|-------|----------|-------|
-| `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `vitest run` | Lint and Test job |
-| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `vitest run --mode integration` | `PostgreSQL integration` job, by glob |
+| `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `vitest run` | `test` jobs (sharded) |
+| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `vitest run --mode integration` | `integration` jobs, by glob (sharded per provisioning path) |
 | `*.live.test.ts` | provider APIs, hosted sandboxes, local runtimes, or sibling checkouts | `vitest run --mode live <file>` (apps/sim) | never |
 | `apps/desktop/e2e/*.spec.ts` | the packaged Electron app | Playwright | desktop E2E workflow |
-| `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | End-to-end over real HTTP job |
+| `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | `e2e` jobs (`.github/scripts/http-e2e.sh`) |
 
 - A unit test lives next to its source: `feature.ts` → `feature.test.ts`. No network, no database,
   no real timers.

.cursor/rules/landing-seo-geo.mdc

@@ -17,6 +17,7 @@ globs: ["apps/sim/app/(landing)/**/*.tsx","apps/sim/content/**/*.mdx"]
 - All copy is server-rendered text: no text baked into images, no content that exists only after a client effect runs.
 - Navbar is a Server Component (no `'use client'`) for immediate crawlability. Logo `<Image>` has `priority` (LCP element). The navbar `<nav>` carries `SiteNavigationElement` schema.org markup.
 - Structured data: emit JSON-LD (`Organization`, `WebSite`, `WebApplication` with `featureList`, `FAQPage` if an FAQ exists) from a server component rendered before visible content. Keep `featureList` in sync with the features the page shows (`apps/sim/app/(landing)/components/home-structured-data/`).
+- `/library` and `/blog` pagination stays server-rendered with real next/previous links. Each unfiltered page is indexable and uses its own canonical URL (`?page=2`, etc.); page 1 canonicalizes to the bare index. Tag-filtered variants remain `noindex,follow`. See [Google pagination guidance](https://developers.google.com/search/docs/specialty/ecommerce/pagination-and-incremental-page-loading).
 - After adding routes or anchors, verify `app/sitemap.ts` and `app/robots.ts` still reflect reality.
 
 ## GEO (Generative Engine Optimisation)

.cursor/rules/sim-settings-pages.mdc

@@ -336,34 +336,33 @@ rendered through `<SettingsActionChips actions={…} />` from
 `@/components/settings/settings-header` — that is the shared chip path, and it
 is what keeps tone/icon/variant/tooltip handling from drifting between the two
 shells. Reach for it before hand-rolling a `Chip`.
-- **`useSettingsUnsavedGuard({ isDirty })`** (`…/settings/hooks/use-settings-unsaved-guard`)
-  — syncs the page's local `isDirty` into the shared `useSettingsDirtyStore` (so
-  the sidebar's **section-switch** confirm + the centralized `beforeunload` both
-  apply for free) and returns `{ showUnsavedModal, setShowUnsavedModal, guardBack,
-  confirmDiscard }` for a detail view's **in-view back** chip.
-  - **Top-level pages** (whitelabeling, sso): call it **unassigned** —
-    `useSettingsUnsavedGuard({ isDirty: hasChanges })` — they only need the
-    store-sync; the sidebar/`beforeunload` do the rest.
-  - **Detail sub-views** (data-retention, access-control group-detail): route the
-    back chip through `onClick={() => guard.guardBack(closeFn)}` and render the
-    shared `<UnsavedChangesModal open={guard.showUnsavedModal}
-    onOpenChange={guard.setShowUnsavedModal} onDiscard={guard.confirmDiscard} />`
-    (from `@/app/workspace/[workspaceId]/components/credential-detail`). The
-    in-view header **Discard** chip (via `saveDiscardActions({ onDiscard })`) is a
-    *reset to original* — distinct from the back-confirm's discard, which leaves.
-- **`useSettingsBeforeUnload`** is mounted by the settings shells
-  (`settings/layout.tsx` and `components/settings/standalone-settings-shell.tsx`) —
-  never add a per-page `beforeunload`.
-- **Dirty *computation* stays local** (shapes differ: field-compare vs
-  normalize+stringify) — only how dirty is *consumed* is shared. Derive it (a
-  `const`/`useMemo`), never store it in `useState`.
-- **CRITICAL — rules of hooks:** call `useSettingsUnsavedGuard(...)`
-  **unconditionally, before every early-return gate** (entitlement / loading /
-  not-entitled `return <SettingsEmptyState>`). A hook placed after a gate is
-  skipped on gated renders and crashes.
-- The route-based credential detail keeps its own `useUnsavedChangesGuard` (it
-  guards real `router.push` navigation + browser Back via a history sentinel);
-  it already shares `UnsavedChangesModal`, so copy stays unified.
+- **`useSettingsUnsavedGuard({ isDirty, navigationBlocked, onDiscard })`** from
+  `@/components/settings/use-settings-unsaved-guard` registers one editor with the
+  shared settings store. Register every full-page draft, including inline creation
+  forms. Dirty computation stays local and derived; fetched defaults stay clean.
+- **`onDiscard` resets the registered draft.** The root `SettingsNavigationGuard`
+  owns the discard dialog, internal link interception, browser Back/Forward, and
+  refresh protection for registered editors. Do not add a per-page dialog or
+  history listener for an editor using this hook. Skill create/detail pages retain
+  their existing `useUnsavedChangesGuard` and local dialog until they migrate to
+  the shared registration.
+- **Native history needs entry indexes.** The Navigation API supplies them for
+  legacy entries. Without it, native traversal to an unindexed entry cannot be
+  cancelled reliably; never guess a direction or rewrite the history stack.
+- **History confirmation authorizes traversal before discarding.** Drafts are
+  discarded only when the browser reports the confirmed traversal, so a no-op
+  Back or Forward retains edits. Known cross-document traversal uses native unload
+  protection. An unknown cross-document target on a classic History browser can
+  require a second native confirmation after the shared dialog.
+- **Detail back controls** call `guard.guardBack(closeFn)`. Other destructive view
+  transitions, such as switching an editor's direction or environment, also use
+  the shared `requestLeave` action before resetting their draft.
+- **`navigationBlocked` covers pending saves and uploads.** The shared guard blocks
+  navigation while requests are pending. Attempts are not queued; retry after they
+  settle. Disable or preserve edits made during requests;
+  failed saves retain drafts, and successful saves only clear committed values.
+- **Call the hook unconditionally, before every early-return gate** (entitlement,
+  loading, or empty-state return), so gated renders preserve hook order.
 
 ## Detail sub-views