fix(storage): bound projection retries and cut v0.40.12

.github/actions/setup-rust/action.yml

@@ -39,3 +39,9 @@ runs:
         shared-key: ${{ inputs.shared-key }}
         key: ${{ inputs.cache-key }}
         save-if: ${{ inputs.save-if }}
+
+    # pdfium-auto fetches chromium%2F7961 (HTTP 504). utoipa-swagger-ui fetches
+    # its zip once and aborts on a dropped connection. Both are prefetched.
+    - name: Prefetch native build downloads
+      shell: bash
+      run: bash "$GITHUB_WORKSPACE/scripts/ci/export-native-deps.sh" "$GITHUB_ENV"

.github/workflows/ci.yml

@@ -142,7 +142,9 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/edgequake-main' || github.ref == 'refs/heads/main' }}
 
       - name: Install bun
-        uses: oven-sh/setup-bun@v2
+        run: |
+          bin="$(bash scripts/ci/install-bun.sh)"
+          echo "$bin" >> "$GITHUB_PATH"
 
       - name: Install frontend dependencies
         working-directory: edgequake_webui
@@ -195,14 +197,16 @@ jobs:
       - name: Run security audit
         working-directory: edgequake
         # SPEC-083 / X-32: audit is a blocking gate (no continue-on-error).
-        # zip extract() advisories (0367/0368/0369) are patched only in zip >= 9.
-        # edgeparse-core 0.3.2 requires zip ^2.2 and only writes archives.
-        # utoipa-swagger-ui 9 requires zip ^3 and copies entries itself; it does
-        # not call ZipArchive::extract(). Neither parent can select zip 9 yet.
+        # zip extract() advisories (0367/0368/0369/0429) are patched only in zip >= 9.
+        # 0429 is the same ZipArchive::extract symlink abort under a new id.
+        # edgeparse-core 0.3.2 (latest) requires zip ^2.2 and only writes archives.
+        # utoipa-swagger-ui 9 requires zip ^3 as a build dependency and copies
+        # the upstream Swagger UI archive itself; it does not call extract().
+        # swagger-ui 10 pulls zip 9, and also utoipa 6. That upgrade is separate.
         # crypto-bigint 0.5.5 (RUSTSEC-2026-0387) is pinned by elliptic-curve 0.13
         # through p256, which openidconnect 4.0.1 requires. The fix is
         # crypto-bigint >=0.7.6, and that curve stack cannot select it.
-        run: cargo audit --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2026-0173 --ignore RUSTSEC-2026-0367 --ignore RUSTSEC-2026-0368 --ignore RUSTSEC-2026-0369 --ignore RUSTSEC-2026-0387
+        run: cargo audit --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2026-0173 --ignore RUSTSEC-2026-0367 --ignore RUSTSEC-2026-0368 --ignore RUSTSEC-2026-0369 --ignore RUSTSEC-2026-0387 --ignore RUSTSEC-2026-0429
 
   docs:
     name: Documentation

.github/workflows/coverage.yml

@@ -35,6 +35,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:

.github/workflows/data-layer-matrix.yml

@@ -37,6 +37,9 @@ jobs:
       - uses: actions/checkout@v6
       - name: Cross-ref lint (inventory ↔ code ↔ docs ↔ tests)
         run: python3 specs/088-data-layer/scripts/lint_dataop_xref.py
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
@@ -65,6 +68,8 @@ jobs:
         profile: [pg16, pg17, pg18]
     steps:
       - uses: actions/checkout@v6
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: stable

.github/workflows/e2e-quality-gates.yml

@@ -38,6 +38,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
@@ -394,7 +397,9 @@ jobs:
           node-version: "20"
 
       - name: Install bun
-        uses: oven-sh/setup-bun@v2
+        run: |
+          bin="$(bash scripts/ci/install-bun.sh)"
+          echo "$bin" >> "$GITHUB_PATH"
 
       - name: Install frontend dependencies
         working-directory: edgequake_webui

.github/workflows/migration-epoch-matrix.yml

@@ -38,6 +38,9 @@ jobs:
         with:
           fetch-depth: 0 # need all tags for git archive replay
 
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:

.github/workflows/migration-guard.yml

@@ -138,6 +138,9 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:

.github/workflows/postgres-integration.yml

@@ -86,6 +86,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
@@ -419,6 +422,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
@@ -560,6 +566,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
@@ -657,6 +666,8 @@ jobs:
         ports: ["7474:7474"]
     steps:
       - uses: actions/checkout@v6
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ env.RUST_TOOLCHAIN }}

.github/workflows/postgres-matrix-nightly.yml

@@ -33,6 +33,9 @@ jobs:
     needs: pin-smoke
     steps:
       - uses: actions/checkout@v6
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
@@ -53,6 +56,9 @@ jobs:
     needs: pin-smoke
     steps:
       - uses: actions/checkout@v6
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
@@ -82,6 +88,9 @@ jobs:
         profile: [pg16, pg17, pg18]
     steps:
       - uses: actions/checkout@v6
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:

.github/workflows/release-docker.yml

@@ -18,7 +18,7 @@ jobs:
   # ── Preflight: fmt, clippy, tests, SPEC-006 + SPEC-018 proofs ─────────────────
   quality-gates:
     runs-on: ubuntu-latest
-    timeout-minutes: 90
+    timeout-minutes: 180
     steps:
       - uses: actions/checkout@v6
         with:
@@ -37,7 +37,9 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y ripgrep
 
       - name: Install bun
-        uses: oven-sh/setup-bun@v2
+        run: |
+          bin="$(bash scripts/ci/install-bun.sh)"
+          echo "$bin" >> "$GITHUB_PATH"
 
       - name: Install frontend dependencies
         working-directory: edgequake_webui

.github/workflows/release-gates.yml

@@ -62,7 +62,9 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y ripgrep
 
       - name: Install bun
-        uses: oven-sh/setup-bun@v2
+        run: |
+          bin="$(bash scripts/ci/install-bun.sh)"
+          echo "$bin" >> "$GITHUB_PATH"
 
       - name: Install frontend dependencies
         working-directory: edgequake_webui

.github/workflows/spec013-proof-pr.yml

@@ -45,6 +45,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:

.github/workflows/spec013-proof.yml

@@ -53,6 +53,10 @@ jobs:
             echo "SKIP_SPEC013_PROOF=1" >> "$GITHUB_ENV"
           fi
 
+      - name: Prefetch pdfium
+        if: env.SKIP_SPEC013_PROOF != '1'
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         if: env.SKIP_SPEC013_PROOF != '1'
         uses: dtolnay/rust-toolchain@master

.github/workflows/spec091-data-layer.yml

@@ -93,6 +93,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
@@ -171,6 +174,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
@@ -449,6 +455,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:

.github/workflows/spec163-onboarding.yml

@@ -28,6 +28,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: 1.95.0
@@ -59,16 +61,21 @@ jobs:
       EDGEQUAKE_ALLOW_MOCK_PROVIDER: "1"
     steps:
       - uses: actions/checkout@v4
+      - name: Prefetch pdfium
+        run: bash scripts/ci/export-native-deps.sh "$GITHUB_ENV"
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: 1.95.0
       - name: Apply connection schema
-        # The live insert writes secret_ref (migration 222). A database that
-        # stops at 169 cannot store a connection the current binary creates.
-        # The rest of 222 needs tenant roles this job does not provision.
+        # The live insert writes secret_ref (migration 222) and google_project
+        # (migration 231). A database that stops at 169 cannot store a
+        # connection the current binary creates. The rest of 222 needs tenant
+        # roles this job does not provision, so those two columns are applied
+        # on their own.
         run: |
           psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f edgequake/migrations/169_spec163_provider_connections.sql
           psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -c "ALTER TABLE public.provider_connections ADD COLUMN IF NOT EXISTS secret_ref JSONB;"
+          psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -c "ALTER TABLE public.provider_connections ADD COLUMN IF NOT EXISTS google_project TEXT;"
       - name: SPEC-163 postgres role wiring
         working-directory: edgequake
         run: |

.github/workflows/test-quality-gates.yml

@@ -90,7 +90,10 @@ jobs:
 
   e2e-ui:
     name: E2E UI Gate (chromium, no backend)
-    runs-on: ubuntu-latest
+    # Playwright 1.58 has no chromium build for ubuntu26.04-x64. ubuntu-latest
+    # moved there in November 2026. 1.61 adds that build; this suite stays on
+    # 1.58, so the job stays on the image that build targets.
+    runs-on: ubuntu-24.04
     # Suite ~565 chromium tests with retries=2; 45m canceled mid-run after
     # cascading failures. Keep headroom once failures are fixed (not a blank check).
     timeout-minutes: 60
@@ -107,8 +110,10 @@ jobs:
         with:
           version: 10.13.1
 
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
+      - name: Install bun
+        run: |
+          bin="$(bash scripts/ci/install-bun.sh)"
+          echo "$bin" >> "$GITHUB_PATH"
 
       - name: Install frontend dependencies
         working-directory: edgequake_webui

AGENTS.md

@@ -861,7 +861,7 @@ Checklist summary:
 5. `git tag vX.Y.Z && git push origin vX.Y.Z` → GHCR via `release-docker.yml`
 6. Verify: `gh release view vX.Y.Z` + `docker buildx imagetools inspect ghcr.io/raphaelmansuy/edgequake:X.Y.Z`
 
-Current product pin: **v0.40.7**.
+Current product pin: **v0.40.12**.
 
 ## Automation & Agent Workflow