Backlog 4: P5 started edc16b3ab30f

- 2026-10-01 03:10 **Hub issues** (item 7): #56 done (a Flow job's log names the pinned subrepos it was not given, and why; 1ffde26b), #41 part 2 done (runners scoped to the site, an owner or one repository; claims filtered in the query; ceaf0ed2), #20 and #29 closed as already done (the required-checks API and every Oxygen repository's required checks; CI without debug info and with prebuilt dependencies, build 270 s). oxygenhub-vscode#4 closed: the authentication provider has been declared since d6657e33. Skipped: item 4, the Android build image (it means accepting the Android SDK licences, Andy's to accept). All deployed; hub Flow runs #63 and #64 pass. H4 is running again on Earth: the 10 000-commit vscode slice now imports in 136 s and 2.2 GB, and the whole history was at 2.3 to 2.5 GB after 20 minutes.

- 2026-10-01 04:00 **Items 8 and 9.** Review requests (oxygenhub#68, deployed, run #65 passes): ask someone to review on the page or through the API, notified, answered by their review, the author told of every review. The organisation webhooks page and hub-side landing through the delegate key already existed: plan items ticked, as were `oxy seal --proposal` and `oxy proposal show|land` in oxygen's plan. CHANGELOG.md for oxygen, oxygenhub and oxygenflow. Email verification, password reset (SMTP) and passkeys left for Andy, as the backlog says.