chore(ci): retire the StackBlitz demo and the npm lockfile it existed for

.changeset/retire-stackblitz-and-the-npm-lockfile.md

@@ -0,0 +1,32 @@
+---
+'hotcrm': patch
+---
+
+Retire the StackBlitz browser demo and the second lockfile it existed for.
+
+The "Try it in your browser (no install)" badge and its paragraph are gone from
+the README, along with `.stackblitzrc`, `package-lock.json`, and the CI gate
+that watched that lockfile (`scripts/check-stackblitz-lock.mjs`). HotCRM now has
+exactly one lockfile — `pnpm-lock.yaml` — and one way to install it.
+
+Why: the repo carried two lockfiles derived from one `package.json`, and only
+one of them had an owner. Dependabot updates `package.json` and
+`pnpm-lock.yaml` and has no way to know about the npm one, so every npm-ecosystem
+dependency PR opened with the second lockfile already stale, failed the lock
+gate as the first step after install, and could never go green no matter how
+often it was rebased. Five of them stalled that way, the oldest since
+2026-08-01, and a security update would have sat in the same trap.
+
+The demo's install could not simply switch to pnpm. It ran `npm install
+--omit=dev --omit=optional` because WebContainers cannot compile the native
+`better-sqlite3` add-on, and the pnpm route is blocked in two measured places:
+`package.json` declares `engines.pnpm: ">=10.0.0"` with `engine-strict=true` in
+`.npmrc`, so any older pnpm is refused before the lockfile is even read, and
+`pnpm-lock.yaml` is lockfileVersion 9.0, which pnpm 8 cannot parse at all.
+pnpm's own remedy for the first is to install the required version globally,
+which is the one operation the sandbox was already documented to forbid.
+
+Nothing else in the repo read `package-lock.json`. Local development,
+`pnpm verify`, CI, and the marketplace one-click install are unchanged; the
+seeded dev credentials the README paragraph carried are documented in
+`AGENTS.md`.

.github/labeler.yml

@@ -23,7 +23,7 @@ documentation:
 
 dependencies:
   - changed-files:
-    - any-glob-to-any-file: ['package.json', 'package-lock.json', 'pnpm-lock.yaml', 'apps/docs/package.json', 'apps/docs/pnpm-lock.yaml']
+    - any-glob-to-any-file: ['package.json', 'pnpm-lock.yaml', 'apps/docs/package.json', 'apps/docs/pnpm-lock.yaml']
 
 # CI plumbing and the verification pipeline itself — workflows, helper scripts,
 # and the test suites those workflows run.

.github/workflows/ci.yml

@@ -34,9 +34,6 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Check the StackBlitz npm lockfile is in sync
-        run: node scripts/check-stackblitz-lock.mjs
-
       - name: Source hygiene (scripts/check-source-hygiene.mjs)
         run: node scripts/check-source-hygiene.mjs
 

README.md

@@ -25,12 +25,8 @@
 [![Version](https://img.shields.io/badge/version-3.0.0-brightgreen)](CHANGELOG.md)
 [![Marketplace](https://img.shields.io/badge/marketplace-cloud.objectos.app-orange)](https://cloud.objectos.app)
 
-[![Open in StackBlitz](https://developer.stackblitz.com/img/open_in_stackblitz.svg)](https://stackblitz.com/github/objectstack-ai/hotcrm)
-
 HotCRM is a complete, opinionated CRM built as the **first official application** on the [ObjectStack](https://cloud.objectos.app) marketplace. Install it into any ObjectStack environment in one click and get a working CRM in 30 seconds — or fork it as the canonical example of how to build your own marketplace app.
 
-> **Try it in your browser (no install):** click the StackBlitz badge above. It boots HotCRM in a WebContainer using `@objectstack/driver-sqlite-wasm` (sql.js) instead of `better-sqlite3`, which can't compile inside the WebContainer sandbox. `.stackblitzrc` sets `OS_DATABASE_DRIVER=sqlite-wasm` so the runtime picks the WASM driver automatically. The sandbox boots with `npm install --omit=dev --omit=optional` — WebContainers forbid `npm i -g`, and their bundled pnpm 8 can't read this repo's lockfile. `package-lock.json` is committed for that install only (nothing else in the repo reads it): without it npm re-resolves ~500 packages on every cold container, which is the difference between a 15-second install and a six-minute one. It also sets `OS_OIDC_PROVIDER_ENABLED=false`: the OIDC provider signs tokens with Ed25519, which the WebContainer's WebCrypto can't generate, and the failure surfaced as a 500 on login. Sign in with `admin@objectos.ai` / `admin123`. Local development still uses pnpm 10 with every feature on.
-
 ---
 
 ## 📸 Screenshots