docs(ci): make the Auto Changelog lane honestly dispatch-only (#5409)

.github/workflows/changelog.yml

@@ -1,8 +1,21 @@
 name: Auto Changelog
 
+# Dispatch-only, deliberately (objectui#5409).
+#
+# This lane also declared `release: types: [published]` until 2026-08-23. That
+# trigger was dead configuration, not a fallback: every release in this
+# repository is authored by `github-actions[bot]`, created by the Changesets
+# action in `changeset-release.yml` using `secrets.GITHUB_TOKEN`, and GitHub
+# does not start workflow runs from events raised with that token (the
+# recursive-trigger guard). Measured before removal: this workflow had 0 runs
+# across the repository's whole life, against `changeset-release.yml`'s 4049
+# through the identical API call — so the zero was the trigger, not the query.
+#
+# When to run it: at release time, as part of cutting the release. Nothing else
+# invokes this workflow. The root CHANGELOG.md is a periodically hand-curated
+# summary; the per-package CHANGELOG.md files that Changesets writes on the
+# release commit are the source of truth for granular and current history.
 on:
-  release:
-    types: [published]
   workflow_dispatch:
 
 permissions:
@@ -40,5 +53,5 @@ jobs:
           git config --local user.email "github-actions[bot]@users.noreply.github.com"
           git config --local user.name "github-actions[bot]"
           git add CHANGELOG.md
-          git commit -m "docs: update CHANGELOG.md for ${{ github.event.release.tag_name }}" || echo "No changes to commit"
+          git commit -m "docs: update CHANGELOG.md" || echo "No changes to commit"
           git push

CHANGELOG.md

@@ -1,6 +1,13 @@
 # Changelog
 
-All notable changes to this project will be documented in this file.
+This file is a **hand-curated summary** of notable changes across the monorepo. It is
+updated at release time by whoever cuts the release — it is not generated. The `Auto
+Changelog` workflow (`.github/workflows/changelog.yml`) exists to regenerate it with
+git-cliff, and runs on manual dispatch only.
+
+For granular, always-current history, read the `CHANGELOG.md` published inside each
+`@object-ui/*` package — Changesets writes those on every release commit, and they are
+the source of truth where the two disagree.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

QUICK_REFERENCE.md

@@ -103,7 +103,8 @@ pnpm changeset publish         # Publish to npm (CI only)
 ## Key Documents
 
 - [README.md](./README.md) — project overview & quick start
-- [CHANGELOG.md](./CHANGELOG.md) — release notes
+- [CHANGELOG.md](./CHANGELOG.md) — hand-curated release summary; each package's own
+  `CHANGELOG.md` (written by Changesets on every release) is the granular, current history
 - [ROADMAP.md](./ROADMAP.md) — development plan
 - [CONTRIBUTING.md](./CONTRIBUTING.md) — contribution workflow
 - [`content/docs/`](./content/docs/) — full documentation source

README.md

@@ -13,7 +13,7 @@
 [![React](https://img.shields.io/badge/React-18+-61dafb.svg)](https://reactjs.org/)
 [![Tailwind CSS](https://img.shields.io/badge/Tailwind-3.0+-38bdf8.svg)](https://tailwindcss.com/)
 
-[**Documentation**](https://www.objectui.org) | [**Quick Start**](#quick-start) | [**Changelog**](./CHANGELOG.md) | [**Roadmap**](./ROADMAP.md)
+[**Documentation**](https://www.objectui.org) | [**Quick Start**](#quick-start) | [**Changelog (summary)**](./CHANGELOG.md) | [**Roadmap**](./ROADMAP.md)
 
 </div>
 

content/docs/guide/ci-cd-pipeline.md

@@ -38,7 +38,7 @@ one has its own section below.
 | `dependabot-auto-merge.yml` | Dependabot Auto-merge | PR to `main`/`develop` authored by `dependabot[bot]` | No — but it gates *its own* merge, and goes red instead of merging when the check set is not green |
 | `cross-repo-issue-closer.yml` | Cross-repo Issue Closer | PR `closed` (acts only when merged) | No — runs after merge |
 | `changeset-release.yml` | Changeset Release | Push to `main` (publish half); 6-hourly cron `0 */6 * * *`; manual (version-PR refresh half) | n/a |
-| `changelog.yml` | Auto Changelog | GitHub Release published; manual | n/a |
+| `changelog.yml` | Auto Changelog | Manual dispatch only — nothing triggers it automatically | n/a |
 | `stale.yml` | Stale Issues & PRs | Daily cron `0 0 * * *`; manual | n/a |
 | `shadcn-check.yml` | Check Shadcn Components | Weekly cron `0 9 * * 1`; manual | n/a |
 | `check-links.yml` | Check Links | Weekly cron `17 4 * * 0`; manual | n/a — reports, never gates |
@@ -933,11 +933,28 @@ surface, and every loud-failure path.
 
 ### Changelog Generation (`changelog.yml`)
 
-**Trigger:** `release` event (when a GitHub Release is published), or manual dispatch.
+**Trigger:** manual dispatch only. Nothing triggers this workflow automatically.
 
-Uses [git-cliff](https://git-cliff.org/) with `cliff.toml` configuration to auto-generate `CHANGELOG.md` and commit it to the repository. Because it commits back to a branch that may have
+Uses [git-cliff](https://git-cliff.org/) with `cliff.toml` configuration to regenerate the root
+`CHANGELOG.md` and commit it to the repository. Because it commits back to a branch that may have
 moved, it configures the lockfile merge driver first (see **Lockfile Merge Driver** below).
 
+**When to run it:** at release time, as part of cutting the release — that is the ritual it
+belongs to, and there is no other owner.
+
+The lane also declared `release: types: [published]` until
+[#5409](https://github.com/objectstack-ai/objectui/issues/5409), and that half never fired once.
+Every release here is authored by `github-actions[bot]`, created by the Changesets action in
+`changeset-release.yml` using `secrets.GITHUB_TOKEN`, and GitHub does not start workflow runs from
+events raised with that token — so the automated release path structurally cannot wake this
+workflow. Measured before the trigger came off: 0 runs across the repository's whole life, against
+`changeset-release.yml`'s 4049 through the identical API call. It was removed rather than left
+implying an automation that cannot happen.
+
+What follows for readers: the root `CHANGELOG.md` is a **periodically hand-curated summary**, not
+an auto-maintained full history. The per-package `CHANGELOG.md` files that Changesets writes on
+each release commit are the source of truth for granular and current history.
+
 ## Repository Maintenance
 
 ### Auto-Labeler (`labeler.yml`)

content/docs/guide/release-notes.md

@@ -5,9 +5,13 @@ description: "Release notes for ObjectUI — highlights, breaking changes and mi
 
 # Release Notes
 
-This page summarises every released version of ObjectUI. For the granular
-package-level changelog, see the monorepo
-[CHANGELOG.md](https://github.com/objectstack-ai/objectui/blob/main/CHANGELOG.md).
+This page summarises every released version of ObjectUI. For granular, per-release
+detail, read the `CHANGELOG.md` published inside each `@object-ui/*` package —
+Changesets writes those on every release commit, so they are the source of truth
+for current history. The monorepo
+[CHANGELOG.md](https://github.com/objectstack-ai/objectui/blob/main/CHANGELOG.md)
+is a periodically hand-curated summary, not an auto-maintained record, and can lag
+the latest releases.
 
 ## v3.3.0 — 2026-04-17 · First Official Release 🚀
 
@@ -62,4 +66,6 @@ If you were pinning to the earlier `0.x` prerelease tags:
 ## Previous Versions
 
 See the [monorepo CHANGELOG](https://github.com/objectstack-ai/objectui/blob/main/CHANGELOG.md)
-for the full history, including the `0.x` development series.
+for the hand-curated summary of earlier versions, including the `0.x` development
+series. It is maintained by hand rather than generated, so treat each package's own
+`CHANGELOG.md` as authoritative where the two disagree.