docs(changelog): mirror the ratified 17.1.0 notes into Recent highlights

[os-zhuang]

Fixes #142

content/docs/resources/changelog.mdx tells readers that docs.objectstack.ai/docs/releases/v17 holds the authoritative release notes. That page now carries a full 17.1.0 treatment, so the mirror can follow. Adds a ### 17.1 entry above ### 17.0 under Recent highlights — "recent" is a claim about now, and it had been six days stale.

This is a mirror, not a composition. Every claim in the new entry is traceable to a ratified upstream section; nothing was summarized independently from the 69 generated @objectstack/* changelogs, which is what the card held this work back to avoid.

What was mirrored, and from where

All sources are objectstack origin/main:

New bullet	Upstream source
Opening paragraph (theme: the runtime's answers become loud)	releases/v17.mdx:3341-3346, the "practical theme is honest refusals" paragraph under # What's new in 17.1.0
The blast-radius Warning callout	releases/v17.mdx:27-30 (release-status blockquote) and :3336-3345 — upstream's own "minor by version number, not by blast radius" framing
Deactivating a permission set or a position	## Security corrections in 17.1.0 (#8613, #8710) + ## Highlights — 17.1.0 bullet 1
Shipped admin sets lose the * export wildcard	## Security corrections in 17.1.0 (#8681) + Highlights bullet 2
Partial field masking	## New capabilities in 17.1.0 (#8993) + Highlights bullet 3
sys_audit_log record-view auditing	## New capabilities in 17.1.0 + Highlights bullet 4
Read-only approval visibility, per object, default off	## New capabilities in 17.1.0 (#8652); named as one of the three 17.1 adds in releases/index.mdx
All three flow doors, one status table	### The flow doors answer real HTTP statuses + Highlights bullet 5
error.code closed vocabulary / declaredCode	## Highlights — 17.1.0 bullet 6 (#9106)
A failed read stops reading as an empty one	### A failed read stops reading as an empty one
Author-time gates reach the runtime publish door	### Author-time gates reach the runtime publish door + the ### 17.1.0 upgrade checklist
Console (Studio)	## Highlights — 17.1.0 bullet 7

The six-item spine of releases/index.mdx's ratified v17 sentence — masking, record-view auditing, the read-only approval tier, deactivation actually revoking, the export-wildcard withdrawal, one flow status table — is covered in full.

What was deliberately NOT touched

Eleven version-shaped claims across content/docs are facts about when a behaviour changed ("Since ObjectStack 17.0 …") and stay true forever. A bulk version bump would corrupt ten true sentences to fix one. That includes changelog.mdx:26 on this very file (engines.node … since 17.0) — read and left alone.

The diff proves it mechanically: 99 insertions, 0 deletions, 1 file. No existing line was modified.

No locale sibling was touched. changelog.mdx in fact has none yet — the translation worklist will create all six.

Verification — all at fd25dfb, the final commit, on a clean tree

Gate	Command	Verdict line
build / type-check	pnpm turbo run type-check --filter=@objectos/docs --force	Tasks: 1 successful, 1 total (cache bypass, force executing)
build / build	pnpm turbo run build --filter=@objectos/docs --force	✓ Compiled successfully in 32.4s · ✓ Generating static pages using 3 workers (740/740) · Tasks: 1 successful, 1 total
build / test	pnpm turbo run test --force	✓ 2 self-test(s) passed · Tasks: 1 successful, 1 total
Node floor	node .github/scripts/check-node-floor.mjs	✅ Every declared floor clears what the dependency tree requires, and the declarations agree.
Ownership	check-translation-ownership.mjs --actor os-zhuang --files (the diff list)	This PR touches 0 translation artifact(s) and 1 other file(s).
Freshness	node .github/scripts/check-translations.mjs	✓ translations gate passed

--force on the turbo tasks is deliberate: the turbo cache is shared across worktrees in this container, and this is a content-only change to a directory outside the package. Bypassing the cache removes the whole class of replayed-green false negatives that turbo.json's $TURBO_ROOT$/content/docs/** input exists to prevent.

Rendered-output check (not just "it compiled") — from the prerendered apps/docs/.next/server/app/en/docs/resources/changelog.html. Angle brackets are spelled out below because GitHub's body sanitizer eats short tag-shaped fragments, backticks included:

• heading order under Recent highlights is h3#171 → h3#170 → h3#160 — the new entry is first and the 17.0 entry survives intact;
• the Warning callout rendered as a real blockquote element carrying its full text;
• 10 list items in the 17.1 section;
• the 意见正文 gloss and the 138****5678 masking example both render (the CJK gloss follows the 会签 precedent already on this page in the 16.0 entry).

Out of scope, filed separately

• permission-sets.mdx:71-74 still promises the shipped admin sets carry allowExport — 17.1.0 withdrew that wildcard #154 — permission-sets.mdx:71-74 still promises admin_full_access and organization_admin carry allowExport: true for you. 17.1.0's #8681 withdrew exactly that wildcard, and nothing fails at parse time on upgrade. Found while checking link targets for this entry; out of scope for this PR: the card's file surface is this one file.

---

Generated by Claude Code