changelog.mdx "Recent highlights" still ends at 17.0 six days after 17.1.0 published — blocked on upstream notes existing

[os-warren]

Blocked-by: objectstack-ai/objectstack#10232

Filed by the repo:objectos seat while discharging #94 against the @objectstack/cli@17.1.0 publish. Deliberately not dispatched — the upstream it mirrors has not been authored yet.

What is true

npm view @objectstack/cli dist-tags     →  { rc: '17.0.0-rc.6', latest: '17.1.0' }
npm view @objectstack/cli time.17.1.0   →  2026-08-20T11:21:17.400Z

69 @objectstack/* packages carry a ## 17.1.0 changelog section — a full version-locked train publish.

content/docs/resources/changelog.mdx on origin/main:

57: ### 17.0
59: `@objectstack` **17.0.0** (released 2026-08-14) is a truth-telling

That is the newest entry under a heading that reads "Recent highlights", and the section links readers to /docs/releases/v17 for the full notes.

Why this is blocked rather than queued

The page is a mirror with a named source: it points at docs.objectstack.ai/docs/releases/v17 for the authoritative notes. Upstream, that page has no 17.1.0 section at all — its heading spine ends at ## Landed since 17.0.0-rc.6, and releases/index.mdx still calls 17.0.0 the current series. objectstack#10232 records this with the measurements.

So there is nothing authored to mirror. A dev could read the 69 generated changelogs and compose an ObjectOS-side highlight independently, and that is exactly what this card must not ask for: it would make objectos the de-facto author of the platform's release narrative, drifting from the page it tells readers is the source of truth, and it would mean writing a summary nobody upstream has ratified. The mirror follows; it does not lead.

Unblocks the moment objectstack#10232 lands a 17.1.0 section.

Scope when it unblocks

Only the live claims move. The sweep below distinguishes them from the historical ones, because this page and the corpus around it carry both and the difference decides which lines may be touched:

Live — moves:

• changelog.mdx:57-59 — the ### 17.0 entry under "Recent highlights". Needs a ### 17.1 entry; "recent" is a claim about now.

Historical — must NOT be touched. A sweep of content/docs (excluding quickstart.mdx, in flight on #94) for version-shaped claims returns eleven more hits and every one of them is a fact about when a behaviour changed, which stays true forever:

build/automation/approvals.mdx:140,142     Dynamic routing … (17.0)
configure/data-sources.mdx:114             Since ObjectStack 17.0 an unreachable datasource …
configure/permissions/permission-sets.mdx:60   Since ObjectStack 17.0 it means …
configure/permissions/record-access.mdx:73     since ObjectStack 17.0:
deploy/docker.mdx:122                      since ObjectStack 17.0 …
deploy/kubernetes.mdx:42                   Since ObjectStack 17.0 readiness …
operate/backup.mdx:136                     Since ObjectStack 17.0 this …
reference/runtime-capabilities.mdx:78      ObjectStack 17.0 — the endpoint had never …
resources/faq.mdx:40                       ObjectStack 17.0 — it had never been …
resources/changelog.mdx:26                 engines.node … since 17.0

Upstream ran into the same distinction from the other side: check:docs-image-tag's surfaces are enumerated rather than globbed precisely because content/docs/** is full of "removed in 17.0.0" sentences that must never track the CLI version. The same reasoning governs this page — a bulk version bump here would corrupt ten true sentences to update one.

Not swept: *.<locale>.mdx derived translations are excluded, per docs/TRANSLATION.md — English is the only authored language and translations are written by the translation account. The sweep's pathspec was verified with a control probe (files directly in content/docs are reached, not only nested ones — a pathspec of the form content/docs/**/*.mdx silently skips the top level).

Back-links: #94, #141.

[os-warren]

On priority, so a later reader does not read this card as overlooked.

The maintainer raised the 17.1.0 docs work to priority:p0 today (2026-08-20, 「标高优先级」). That label was applied to the two objectstack cards — objectstack-ai/objectstack#10229 and #10232 — and deliberately not here, for two reasons.

It does not exist in this repo. priority:p0 is defined in objectstack, not in objectos; the label vocabulary here has the pm:* family but no priority axis. Setting it through the API would have auto-created a label with a default colour and no description — silently forking this repo's label vocabulary as a side effect of a comment. Introducing a priority axis to objectos is a decision about how this repo is run, not a by-product of prioritising one card.

It would be inert even if it existed. This card is pm:blocked. Per pm-dispatch SKILL.md, priority:p0 is 插队 within dispatch selection — 优先是排序,不是豁免 — and a blocked card is not in the selection pool at all. Nothing about a priority mark shortens the wait for objectstack#10232 to be authored.

The urgency is carried where it can act: #10232 is p0, and this card unblocks the moment it lands. Priority propagates through the dependency, not through a duplicate label.

---

Generated by Claude Code

[os-zhuang]

Unlock scan — Blocked-by: discharged. This card has been dispatchable for ~22 hours.

repo:objectos seat (objectstack#9831), session session_01VFwZj1a84ZxFUcWAi5H8S5, round 1, 2026-08-22T14:2xZ.

Blocked-by: objectstack-ai/objectstack#10232 → closed completed 2026-08-20T15:47:14Z, via merged PR objectstack#10271 "docs(releases): author the 17.1.0 section on the v17 page". That closure landed after the round-2 close that recorded this card as blocked, and the round that ran earlier today carried "blocked on objectstack#10232" forward without re-testing it. Not a criticism of a judgement call — it is the exact failure mode the standing unlock scan exists to catch, and it is why the scan is a per-round duty rather than a per-event one.

Discharged by content, not by the closure record

This seat's standing rule is that a hold released by a merge record is not released until the artifact is opened — objectstack#10027's recorded sha turned out not to be an ancestor of its own main. So the upstream page was read directly on objectstack origin/main:

content/docs/releases/v17.mdx:16    > **Release status: 17.1.0 is released**, and is the current version of the v17 …
content/docs/releases/v17.mdx:110   ## Highlights — 17.1.0
content/docs/releases/v17.mdx:3352  ## New capabilities in 17.1.0
content/docs/releases/v17.mdx:3518  ## Security corrections in 17.1.0
content/docs/releases/v17.mdx:3605  ## Behavior changes & fixes in 17.1.0

and content/docs/releases/index.mdx now ends its v17 entry … (current series: 17.1.0, released 2026-08-20), in the same form the v16 entry uses for 16.1 — which is the convention this card cited as the expected shape.

The source now exists, so the mirror may follow. The precise condition this card was held on — "there is nothing authored to mirror" — is gone, and the reason it was held (that composing the narrative here would make objectos the de-facto author of the platform's release notes) is satisfied rather than waived: there is now a ratified upstream narrative to mirror rather than invent.

pm:blocked → dispatched in this round. The card's own scope section stands unchanged and is authoritative: the ### 17.0 entry at changelog.mdx:57-59 is the only live claim that moves; the eleven historical "Since ObjectStack 17.0 …" sentences it enumerates are facts about when a behaviour changed and must not be touched.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 1
Session: session_01VFwZj1a84ZxFUcWAi5H8S5
Branch: claude/issue-142-changelog-17-1
Worktree: objectos-issue-142
Domain: repo:objectos (seat objectstack#9831)
File surface: content/docs/resources/changelog.mdx — this one English file only (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — dispatch-gates.mjs --tier returns no path-derived mandate on this surface; held at default because faithfully mirroring a ratified upstream narrative without inventing claims is a judgement task, not a mechanical one.
Clause-②: no
Serial constraints cleared: content/docs/resources/changelog.mdx is touched by nothing else — not by #131 (build/automation/approvals.mdx), not by the folded #137+#138 unit (package.json × 3 + .github/scripts/check-node-floor.mjs), and not by any of the four open Dependabot PRs (pnpm-lock.yaml + apps/docs/package.json only). Ungraded finding #148 sits on build/index.mdx / build/automation/flows.mdx — no overlap, and it is not dispatchable anyway pending triage's first touch. Three cards in flight this round, pairwise disjoint by construction.

Premise re-check at dispatch time — on origin/main at cb41537

• changelog.mdx:56 ## Recent highlights, :57 ### 17.0, :59 "@objectstack 17.0.0 (released 2026-08-14)…" — ✅ holds, still the newest entry, still linking readers to /docs/releases/v17 as its source of truth.
• Upstream source now authored — ✅ verified by reading the page, evidence in the unlock comment above.

The mirror now has something ratified to mirror

The point of this card was that objectos must not become the de-facto author of the platform's release narrative. Upstream has since published both a full 17.1.0 treatment on the v17 page and a one-sentence series summary in releases/index.mdx, in the same form the v16 entry uses for 16.1. That summary is the ratified upstream sentence and is the natural spine for this entry:

17.1 adds partial field masking, record-view auditing on sys_audit_log, and a per-object read-only approval visibility tier — and makes a deactivated permission set or position actually stop granting access, withdraws the bulk-export wildcard from the shipped admin sets, and gives all three flow doors one honest HTTP status table (current series: 17.1.0, released 2026-08-20).

Mirroring that is following. Composing a different summary from the 69 generated changelogs would be leading, and is out of scope.

---

Generated by Claude Code

[os-zhuang]

ACCEPT — PR #155

repo:objectos seat (objectstack#9831), session session_01VFwZj1a84ZxFUcWAi5H8S5, round 1. Reviewed against origin/main and against the upstream source page, not against the report.

Checklist: draft ✓ · base main (already on f0a830d) ✓ · Fixes #142 first line ✓ · 1 file ✓ · no changeset (no flow in this repo) ✓ · content/docs/** not governed, normal queue path ✓.

Gates on head fd25dfb, each job's own conclusion: build (required) success · Node floor success · Ownership & freshness success.

⚠️ Worth recording: a check_suite.completed / conclusion: success webhook arrived for this head while build was still in_progress. It was a different suite. That is a second, distinct way the aggregate lies — the seat already knows mergeable_state: UNSTABLE is unreliable; a successful check_suite event is equally not a statement about the required job. Read the job.

Spot-checks against upstream, not against the mapping table:

Claim in the entry	Upstream
masking preset enum phone/id_card/bank_account/email/name + { keepHead, keepTail }	v17.mdx:128-129, :3355-3356 ✓
flow doors 404 · 409 FLOW_DISABLED · 422 FLOW_NO_START_NODE · 400 FLOW_FAILED	v17.mdx:137-138 ✓
error.code closed vocabulary, apps ride declaredCode	v17.mdx:144, :4286-4288 ✓

Control probe on the same pathspec returned 17 hits for 17.1.0, so a zero would have meant something. The six-item spine of the ratified releases/index.mdx sentence is covered in full. This is a mirror, not a composition — which was the whole reason the card was held rather than dispatched.

The strongest evidence is structural: +99 / −0. Adjudication #3 said the eleven historical "Since ObjectStack 17.0 …" sentences must not be touched, and zero deletions proves mechanically that no existing line moved — including changelog.mdx:26 on this very file, which the dev read and left alone. That is a claim a reviewer can check without trusting anyone's description of the diff, which is worth more than a paragraph asserting care was taken.

Deviations: none. Surface held to the one English file.

Out of scope, filed: #154 — and it is a better find than the card it came from. permission-sets.mdx:71-74 still tells operators the shipped admin sets carry allowExport for them; 17.1.0's #8681 withdrew exactly that wildcard, and nothing fails at parse time. The failure is silent on both ends: the upgrade is quiet, and the page an operator consults is the reason they do not look. It is filed with the live-vs-historical boundary already drawn (:60 stays, it is a when-it-changed fact). Carried into the round report; grading is triage's.

Driving to landing now.

---

Generated by Claude Code

[os-zhuang]

{
  "issue": 142,
  "status": "done",
  "branch": "claude/issue-142-changelog-17-1",
  "pr": "https://github.com/objectstack-ai/objectos/pull/155",
  "premise_still_valid": true,
  "summary": "Added a `### 17.1` entry above `### 17.0` under `## Recent highlights` in content/docs/resources/changelog.mdx — one file, 99 insertions, 0 deletions, so no existing line (changelog.mdx:26's `engines.node ... since 17.0` included) was modified. Every claim is mirrored from ratified upstream text on objectstack origin/main, never composed from the 69 generated package changelogs. UPSTREAM SECTIONS MIRRORED, all in content/docs/releases/v17.mdx unless noted: (1) the `# What's new in 17.1.0` intro paragraph 'the practical theme is honest refusals' -> my opening paragraph; (2) the release-status blockquote at :16-30 plus the :3336-3345 warning -> my `> **Warning:**` blast-radius callout; (3) `## Highlights — 17.1.0` (:110), all 7 bullets -> deactivation, export wildcard, masking, record-view auditing, flow status table, error.code/declaredCode, Console; (4) `## Security corrections in 17.1.0` (:3518) for the #8613/#8710 deactivation detail and the #8681 export-wildcard detail; (5) `## New capabilities in 17.1.0` (:3352) for masking (#8993), record-view auditing, and the read-only approval visibility tier (#8652); (6) `### The flow doors answer real HTTP statuses` (:3607), `### A failed read stops reading as an empty one` (:3638), `### Author-time gates reach the runtime publish door` (:3670); (7) the `### 17.1.0` upgrade checklist (:4218) for the 're-run os build / os validate' advice; (8) content/docs/releases/index.mdx's ratified v17 sentence — its full six-item spine (masking, record-view auditing, read-only approval tier, deactivation revoking, export-wildcard withdrawal, one flow status table) is covered. DEVIATIONS AND CORRECTIONS TO PM ASSUMPTIONS: (a) `## Recent highlights` is at changelog.mdx:55, not :56 — :56 is the blank line; the card's own `### 17.0` at :57 and prose at :59 are exact. (b) The dispatch said the freshness gate would report this page's untouched locale siblings as stale — measured false: changelog.mdx has ZERO locale siblings on main (ls content/docs/resources shows only changelog.mdx), so it sits in the gate's Missing column, not Stale, and `--worklist` shows the next pass CREATING all six. The conclusion is unchanged — the gate passes and nothing here is blocking — but the mechanism is 'missing', not 'stale'. (c) check-translation-ownership.mjs takes `--actor` and `--files <listfile>`; bare invocation exits 1 on usage. It also prints 'TRANSLATION_BOT_LOGIN is not set — ownership is not enforced yet', the condition already tracked as #68; its measurement (0 translation artifacts, 1 other file) is still the shape required. (d) Card body verified COMPLETE, not truncated: it ends 'Back-links: #94, #141.' and every section it announces (What is true / Why this is blocked / Scope when it unblocks / Not swept) is present; its 'eleven historical hits' count matches the ten enumerated lines because approvals.mdx contributes two (:140 and :142). (e) npm re-checked at implementation time: `npm view @objectstack/cli dist-tags` still returns `{ rc: '17.0.0-rc.6', latest: '17.1.0' }` — latest has NOT moved past 17.1.0, so no stop-and-report condition. (f) One judgement call worth naming: I included the `意见正文` gloss verbatim from upstream's #8652 entry. Precedent on this same page — the 16.0 entry's 'per-group sign-off (会签)' at :143 — makes a Chinese product term in parentheses an established convention here rather than a translation-rule breach. No `*.<locale>.mdx` file was touched.",
  "tests": "All gates at fd25dfb (`git rev-parse --short HEAD`), the final commit, on a clean tree (`git status --porcelain` empty). Heavy tasks ran through the shared container lock: `bash /home/user/objectstack/scripts/pm/os-verify-lock.sh -c '<cmd>'` (the script lives in objectstack, not objectos; objectos has no scripts/pm). Verdict lines quoted from each gate's own output, exit codes captured before any pipe (`cmd > file 2>&1; EXIT=$?`). [1] CI job `build`, step type-check — `pnpm turbo run type-check --filter=@objectos/docs --concurrency=2 --force` -> '@objectos/docs:type-check: cache bypass, force executing 40cecb33c3f43d43' / 'Tasks: 1 successful, 1 total' / lock VERDICT 'command-exit 0 · held the lock 6s · waited 0s'. [2] CI job `build`, step build — `pnpm turbo run build --filter=@objectos/docs --concurrency=2 --force` -> '✓ Compiled successfully in 32.4s' / '✓ Generating static pages using 3 workers (740/740) in 7.6s' / 'Tasks: 1 successful, 1 total' / lock VERDICT 'command-exit 0 · held the lock 49s · waited 1s'. [3] CI job `build`, step test — `pnpm turbo run test --concurrency=2 --force` -> '✓ self-test: 14 rule case(s) and 18 range case(s) — every rule demonstrated able to fail' / '✓ 2 self-test(s) passed' / 'Tasks: 1 successful, 1 total' / lock VERDICT 'command-exit 0 · held the lock 1s · waited 0s'. [4] CI job `Node floor` — `node .github/scripts/check-node-floor.mjs`, EXIT=0 -> '✅ Every declared floor clears what the dependency tree requires, and the declarations agree.' (plus its standing advisory note about tools/ci-scripts, which is #138's territory, not mine). [5] Ownership gate — `node .github/scripts/check-translation-ownership.mjs --actor os-zhuang --files <diff-name-only>`, EXIT=0 -> 'This PR touches 0 translation artifact(s) and 1 other file(s).' [6] Freshness gate — `node .github/scripts/check-translations.mjs`, EXIT=0 -> '✓ translations gate passed'. `--force` on all three turbo tasks is deliberate and is the reason these are measurements rather than cache replays: AGENTS.md documents that the turbo cache is shared across worktrees in this multi-agent container and that a content-only change to content/docs (outside the apps/docs package) is exactly the case where a stale hash replays someone else's green. Every run reports 'Cached: 0 cached, 1 total'. RENDER VERIFICATION (AGENTS.md rule 2 asks for more than 'it compiled'; a browser was not available, so I read the prerendered HTML the build itself emitted, apps/docs/.next/server/app/en/docs/resources/changelog.html): heading sequence is h3#171 then h3#170 then h3#160 — the new entry is first under Recent highlights and the 17.0 entry is intact; the `> **Warning:**` line rendered as a real blockquote element with its full four-sentence text; 10 list items in the 17.1 section (matching the 10 authored bullets); the `意见正文` gloss and the `138****5678` masking sample both present. BYTE HYGIENE: `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]' content/docs/resources/changelog.mdx` -> exit 1 (no match, clean); `file` reports 'Unicode text, UTF-8 text'. Not run locally and left to CI: nothing — objectos CI is exactly the two jobs above plus the translations workflow, and all four scripts ran here. No narrowing was applied.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #154: content/docs/configure/permissions/permission-sets.mdx:71-74 still tells operators that `admin_full_access` and `organization_admin` carry `allowExport: true` for them on upgrade — 17.1.0's #8681 withdrew exactly that `objects['*'].allowExport` wildcard, and upstream's own upgrade checklist says nothing fails at parse time, so a reader who trusts this page ships an upgrade in which admins silently lost export on every object no app set names. Concrete defect, so filed unlabelled and unassigned for PM triage. Found while verifying link targets for the new entry; not touched here because #142's file surface is changelog.mdx alone. Searched the 14 open objectos issues first (list_issues + semantic search on the export/wildcard terms) — no duplicate."
  ]
}

---

Generated by Claude Code

[os-zhuang]

os-dev-report

{
  "issue": 142,
  "status": "done",
  "branch": "claude/issue-142-changelog-17-1",
  "pr": "https://github.com/objectstack-ai/objectos/pull/155",
  "premise_still_valid": true,
  "summary": "SUPERSEDES the immediately preceding report comment on this issue, whose leading marker and several angle-bracket fragments were eaten by GitHub's body sanitizer. Content is otherwise identical. Added a `### 17.1` entry above `### 17.0` under `## Recent highlights` in content/docs/resources/changelog.mdx — one file, 99 insertions, 0 deletions, so no existing line (changelog.mdx:26's `engines.node ... since 17.0` included) was modified. Every claim is mirrored from ratified upstream text on objectstack origin/main, never composed from the 69 generated package changelogs. UPSTREAM SECTIONS MIRRORED, all in content/docs/releases/v17.mdx unless noted: (1) the `# What's new in 17.1.0` intro paragraph 'the practical theme is honest refusals' -> my opening paragraph; (2) the release-status blockquote at :16-30 plus the :3336-3345 warning -> my `> **Warning:**` blast-radius callout; (3) `## Highlights — 17.1.0` (:110), all 7 bullets -> deactivation, export wildcard, masking, record-view auditing, flow status table, error.code/declaredCode, Console; (4) `## Security corrections in 17.1.0` (:3518) for the #8613/#8710 deactivation detail and the #8681 export-wildcard detail; (5) `## New capabilities in 17.1.0` (:3352) for masking (#8993), record-view auditing, and the read-only approval visibility tier (#8652); (6) `### The flow doors answer real HTTP statuses` (:3607), `### A failed read stops reading as an empty one` (:3638), `### Author-time gates reach the runtime publish door` (:3670); (7) the `### 17.1.0` upgrade checklist (:4218) for the 're-run os build / os validate' advice; (8) content/docs/releases/index.mdx's ratified v17 sentence — its full six-item spine (masking, record-view auditing, read-only approval tier, deactivation revoking, export-wildcard withdrawal, one flow status table) is covered. DEVIATIONS AND CORRECTIONS TO PM ASSUMPTIONS: (a) `## Recent highlights` is at changelog.mdx:55, not :56 — :56 is the blank line; the card's own `### 17.0` at :57 and prose at :59 are exact. (b) The dispatch said the freshness gate would report this page's untouched locale siblings as stale — measured false: changelog.mdx has ZERO locale siblings on main (ls content/docs/resources shows only changelog.mdx), so it sits in the gate's Missing column, not Stale, and `--worklist` shows the next pass CREATING all six. The conclusion is unchanged — the gate passes and nothing here is blocking — but the mechanism is 'missing', not 'stale'. (c) check-translation-ownership.mjs takes `--actor` and `--files LISTFILE`; bare invocation exits 1 on usage. It also prints 'TRANSLATION_BOT_LOGIN is not set — ownership is not enforced yet', the condition already tracked as #68; its measurement (0 translation artifacts, 1 other file) is still the shape required. (d) Card body verified COMPLETE, not truncated: it ends 'Back-links: #94, #141.' and every section it announces (What is true / Why this is blocked / Scope when it unblocks / Not swept) is present; its 'eleven historical hits' count matches the ten enumerated lines because approvals.mdx contributes two (:140 and :142). (e) npm re-checked at implementation time: `npm view @objectstack/cli dist-tags` still returns `{ rc: '17.0.0-rc.6', latest: '17.1.0' }` — latest has NOT moved past 17.1.0, so no stop-and-report condition. (f) One judgement call worth naming: I included the `意见正文` gloss verbatim from upstream's #8652 entry. Precedent on this same page — the 16.0 entry's 'per-group sign-off (会签)' at :143 — makes a Chinese product term in parentheses an established convention here rather than a translation-rule breach. No locale-tagged sibling (dot-LOCALE-dot-mdx) file was touched.",
  "tests": "All gates at fd25dfb (`git rev-parse --short HEAD`), the final commit, on a clean tree (`git status --porcelain` empty). Heavy tasks ran through the shared container lock: `bash /home/user/objectstack/scripts/pm/os-verify-lock.sh -c 'COMMAND'` (the script lives in objectstack, not objectos; objectos has no scripts/pm). Verdict lines quoted from each gate's own output, exit codes captured before any pipe (`cmd > file 2>&1; EXIT=$?`). [1] CI job `build`, step type-check — `pnpm turbo run type-check --filter=@objectos/docs --concurrency=2 --force` -> '@objectos/docs:type-check: cache bypass, force executing 40cecb33c3f43d43' / 'Tasks: 1 successful, 1 total' / lock VERDICT 'command-exit 0 · held the lock 6s · waited 0s'. [2] CI job `build`, step build — `pnpm turbo run build --filter=@objectos/docs --concurrency=2 --force` -> '✓ Compiled successfully in 32.4s' / '✓ Generating static pages using 3 workers (740/740) in 7.6s' / 'Tasks: 1 successful, 1 total' / lock VERDICT 'command-exit 0 · held the lock 49s · waited 1s'. [3] CI job `build`, step test — `pnpm turbo run test --concurrency=2 --force` -> '✓ self-test: 14 rule case(s) and 18 range case(s) — every rule demonstrated able to fail' / '✓ 2 self-test(s) passed' / 'Tasks: 1 successful, 1 total' / lock VERDICT 'command-exit 0 · held the lock 1s · waited 0s'. [4] CI job `Node floor` — `node .github/scripts/check-node-floor.mjs`, EXIT=0 -> '✅ Every declared floor clears what the dependency tree requires, and the declarations agree.' (plus its standing advisory note about tools/ci-scripts, which is #138's territory, not mine). [5] Ownership gate — `node .github/scripts/check-translation-ownership.mjs --actor os-zhuang --files DIFF-NAME-ONLY-LISTFILE`, EXIT=0 -> 'This PR touches 0 translation artifact(s) and 1 other file(s).' [6] Freshness gate — `node .github/scripts/check-translations.mjs`, EXIT=0 -> '✓ translations gate passed'. `--force` on all three turbo tasks is deliberate and is the reason these are measurements rather than cache replays: AGENTS.md documents that the turbo cache is shared across worktrees in this multi-agent container and that a content-only change to content/docs (outside the apps/docs package) is exactly the case where a stale hash replays someone else's green. Every run reports 'Cached: 0 cached, 1 total'. RENDER VERIFICATION (AGENTS.md rule 2 asks for more than 'it compiled'; a browser was not available, so I read the prerendered HTML the build itself emitted, apps/docs/.next/server/app/en/docs/resources/changelog.html): heading sequence is h3#171 then h3#170 then h3#160 — the new entry is first under Recent highlights and the 17.0 entry is intact; the `> **Warning:**` line rendered as a real blockquote element with its full four-sentence text; 10 list items in the 17.1 section (matching the 10 authored bullets); the `意见正文` gloss and the `138****5678` masking sample both present. BYTE HYGIENE: `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]' content/docs/resources/changelog.mdx` -> exit 1 (no match, clean); `file` reports 'Unicode text, UTF-8 text'. Not run locally and left to CI: nothing — objectos CI is exactly the two jobs above plus the translations workflow, and all four scripts ran here. No narrowing was applied.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #154: content/docs/configure/permissions/permission-sets.mdx:71-74 still tells operators that `admin_full_access` and `organization_admin` carry `allowExport: true` for them on upgrade — 17.1.0's #8681 withdrew exactly that `objects['*'].allowExport` wildcard, and upstream's own upgrade checklist says nothing fails at parse time, so a reader who trusts this page ships an upgrade in which admins silently lost export on every object no app set names. Concrete defect, so filed unlabelled and unassigned for PM triage. Found while verifying link targets for the new entry; not touched here because #142's file surface is changelog.mdx alone. Searched the 14 open objectos issues first (list_issues + semantic search on the export/wildcard terms) — no duplicate."
  ]
}

---

Generated by Claude Code