Merge remote-tracking branch 'origin/main' into jg/3122-rolling-deploy-adapter

* origin/main:
  feat(pro): Async props & incremental RSC rendering + length-prefixed streaming protocol (#2903)
  fix: stale references and lost Gemfile pins after Pro migration (#3104)
  Restore Metrics/ModuleLength limit to 180
  Clarify RuboCop lint contract
  Exclude dead project URLs from markdown link check (#3306)
  Canonicalize GitHub links in docs
  Reduce `react-on-rails-pro-node-renderer` package size (#3304)
  fix: format stray markdown files and correct broken link breaking CI on main (#3301)
  docs(planning): JSON render-request body migration plan (#3280) (#3299)
  docs: experiment plan for decoupling props from JS source (#3281) (#3297)
  docs: memory leakage investigation report for SSR pipeline (#3296)
  docs: fix MDX-incompatible patterns blocking sc-website docs sync (#3275)
  docs: document RSC node renderer test setup (#3223)
  Clarify Pro pricing and license guidance (#3272)
  docs: add AI security scanner evaluation plan (#3236)
  fix: pin pnpm version in scaffolded CI when packageManager is absent (#3172) (#3174)
  docs: document RSC HTTP response ownership (#3222)
  docs: document legacy Webpacker compatibility shims (#3225)
  chore: sync address-review command and import prompt variant (#3271)

# Conflicts:
#	.lychee.toml
#	react_on_rails/spec/lib/react_on_rails/doctor_spec.rb
#	react_on_rails_pro/lib/react_on_rails_pro/pre_seed_renderer_cache.rb

Author: justin808

.claude/commands/address-review.md

@@ -102,3 +102,15 @@ junit.xml
 .lycheecache
 .playwright-cli/
 .gstack/
+
+# Security scanner output (per internal/planning/ai-security-scanner-evaluation.md):
+# raw findings, SARIF reports, and intermediate artifacts must stay out of this
+# public repo. Commit only sanitized summaries to internal/planning/.
+# *.sarif and *.sarif.json are intentionally non-anchored so they match SARIF
+# files emitted into any subdirectory; the directory entries below stay anchored
+# to the repo root.
+/security-scans/
+*.sarif
+*.sarif.json
+/scanner-output/
+/scanner-findings/

.claude/prompts/address-review.md

@@ -41,6 +41,7 @@ exclude = [
   '^https://your-shared-addr\.c9users\.io',
   '^https://hichee\.com',
   '^https?://rubyonrails\.org/doctrine',  # DNS issues
+  '^https://www\.oppenheimerfunds\.com/?$',  # DNS no longer resolves
 
   # ============================================================================
   # SSL CERTIFICATE ISSUES
@@ -93,6 +94,7 @@ exclude = [
   '^https://(www\.)?guavapass\.com',  # TLS handshake failures from CI
   '^https?://(www\.)?hvmn\.com',  # Returns 503 from CI
   '^https://(www\.)?hawaiichee\.com/?$', # Intermittent 500 from CI
+  '^https://deliveroo\.co\.uk/?$', # Returns 403 for automated requests
 
   # ============================================================================
   # EXTERNAL SITES THAT TIMEOUT DURING CI CHECKS
@@ -114,14 +116,24 @@ exclude = [
   # return 5xx responses to lychee in CI, even when the pages are live.
   '^https://github\.com/shakacode/react_on_rails/compare/',
   '^https://github\.com/shakacode/react_on_rails/pull/[0-9]+$',  # Intermittent 5xx from GitHub PR pages in CI
+  '^https://github\.com/shakacode/react_on_rails/actions/workflows/pro-test-package-and-gem\.yml$',  # Intermittent 502 from GitHub Actions workflow pages in CI
+  '^https://github\.com/shakacode/react_on_rails/issues/2766$',  # Intermittent 502 from GitHub issue pages in CI
+  '^https://github\.com/rack/rack/blob/main/SPEC\.rdoc$',  # Intermittent 502 from GitHub blob pages in CI
   '^https://github\.com/shakacode/shakapacker/blob/cdf32835d3e0949952b8b4b53063807f714f9b24/package/environments/base\.js(#.*)?$',  # Intermittent 502 from GitHub blob view in CI
   '^https://github\.com/K4sku$',  # Intermittent 502 from GitHub user page in CI
+  '^https://github\.com/npm/cli/issues/6253$',  # Intermittent 502 from GitHub issue pages in CI
+  '^https://github\.com/search\?q=gem\+react_on_rails&ref=advsearch&type=repositories&utf8=%E2%9C%93$',  # Intermittent 502 from GitHub search in CI
+
+  # ============================================================================
+  # EXTERNAL DOC PAGES WITH CI CONNECTIVITY FAILURES
+  # ============================================================================
+  '^https://tanstack\.com/query/latest/docs/framework/react/guides/ssr$',  # Connection failed from CI
 
   # ============================================================================
   # DELETED GITHUB USER ACCOUNTS (return 502/404 from CI)
   # ============================================================================
   # Contributors whose accounts no longer exist
-  '^https://github\.com/(alleycat-at-git|Conturbo|jblasco3|nostophilia|railsme|samphilipd|wouldntsavezion)$',
+  '^https://github\.com/(alleycat-at-git|Conturbo|jblasco3|nostophilia|pulkitkkr|railsme|samphilipd|wouldntsavezion)$',
 
   # ============================================================================
   # PRIVATE REPOSITORIES

.gitignore

@@ -28,6 +28,10 @@ AllCops:
     - 'node_modules/**/*'
     - 'spec/fixtures/**/*'
     - 'spec/react_on_rails/dummy-for-generators/**/*'
+    # Root-wide RuboCop uses root-relative paths. Keep generated/package-specific
+    # exclusions here so the root sweep does not fail on files package CI exempts.
+    - 'react_on_rails_pro/spec/dummy/db/schema.rb'
+    - 'react_on_rails_pro/spec/dummy/db/seeds.rb'
     - '**/vendor/**/*'
 
 Naming/FileName:
@@ -74,7 +78,7 @@ Metrics/MethodLength:
   Max: 41
 
 Metrics/ModuleLength:
-  Max: 200
+  Max: 180
 
 RSpec/DescribeClass:
   Enabled: false

.lychee.toml

@@ -33,10 +33,15 @@ bundle && pnpm install
 pnpm run build
 
 # Lint (MANDATORY before every commit)
-bundle exec rubocop                  # Ruby — must pass with zero offenses
-pnpm run lint                        # JS/TS via ESLint
-pnpm start format.listDifferent      # Check Prettier formatting
-rake lint                            # All linting (Ruby + JS + formatting)
+(cd react_on_rails && bundle exec rubocop)                       # OSS Ruby lint — CI-equivalent
+# Pro Ruby lint — CI-equivalent when Pro files or RuboCop config change
+(cd react_on_rails_pro && bundle exec rubocop --ignore-parent-exclusion)
+pnpm run lint                                                    # JS/TS via ESLint
+pnpm start format.listDifferent                                  # Check Prettier formatting
+rake lint                                                        # All linting (Ruby + JS + formatting)
+
+# Optional Ruby diagnostic from the repo root (not the CI contract)
+bundle exec rubocop
 
 # Auto-fix formatting
 rake autofix                         # Preferred for all formatting
@@ -177,7 +182,13 @@ For small, focused PRs (roughly 5 files changed or fewer and one clear purpose):
 
 ### Always
 
-- Run `bundle exec rubocop` before committing — CI will reject violations
+- Run the CI-equivalent Ruby lint before committing, not the root `bundle exec rubocop`:
+  ```bash
+  (cd react_on_rails && bundle exec rubocop)
+  # Also run when touching Pro Ruby or RuboCop config:
+  (cd react_on_rails_pro && bundle exec rubocop --ignore-parent-exclusion)
+  ```
+  Root `bundle exec rubocop` is a broad local sweep, not the CI contract.
 - Use `pnpm` for all JS operations — never `npm` or `yarn`
 - Use `bundle exec` for Ruby commands
 - Ensure all files end with a newline