docs(releases): draft the 17.6.0 release notes and upgrade checklist (#21290)

## What this is

A pre-cut draft of the curated release page for **17.6.0**,
`content/docs/releases/v17/17-6.mdx`, plus its entry in
`content/docs/releases/v17/meta.json` and in
`scripts/docs-audit/handwritten-docs.json`. It also appends one dated
correction to `content/docs/releases/v17/17-5.mdx` (details below).

Docs-only. Everything is under `content/docs/releases/` (release-owned)
or the docs-audit list, so this is the dedicated docs-only PR
`AGENTS.md` sanctions for that tree. It publishes nothing from any
package, hence `skip-changeset`.

Clause-②: no

It follows the 17.5.0 page's structure:

1. Highlights
2. What's new, including the "read this before treating the version
number as a safety guarantee" list of silent runtime changes
3. Breaking changes & migration (triaged, not exhaustive)
4. New capabilities
5. Notable fixes
6. New in Console (Studio)
7. Shipped in 17.5.0, listed again in 17.6.0's CHANGELOG
8. Upgrade checklist (every line marked *not exercised*)

## How it was compiled

- **Source:** all 338 changesets pending on `main` at `748b2407`. Every
changeset was read and triaged into breaking, feature, fix or internal.
PR numbers and short SHAs are taken from the commit that added each
changeset.
- **Already shipped in 17.5.0:** 16 of the 338 changesets (from 15
commits) describe code that 17.5.0 already published. I checked each
commit with `git merge-base --is-ancestor` against the version commit
`8c87d26a` and the publish commit `0f6dcac5`.
- Eight follow the version commit in first-parent order. The 17.5.0 page
already covers them.
- Seven are ancestors of the version commit but were not in the version
PR when it merged. The 17.5.0 page does not mention them. Two of them
are breaking (`e73ee2d` #20567, `c876a74` #20504), and `7a1faf1`
(#20579) makes `os validate --strict` fail on a live conversion.
- The new section matches the list in
`.changeset/20622-release-aftercare-upgrade-and-unannounced-notes.md`.
- **Cross-check:** each of the nine ADR-0087 conversions added since
17.5.0 is covered by a migration entry on the page:
  - `action-block-endpoint-to-target`
  - `connector-sync-keys-removed`
  - `connector-triggers-removed`
  - `cube-refresh-key-removed`
  - `dataset-count-measure-empty-field-removed`
  - `form-field-public-picker-removed`
  - `form-view-subform-columns-canonicalized`
  - `page-header-breadcrumb-removed`
  - `time-default-utc-suffix-dropped`
- **Console section:** built from the three pin-bump changesets
(`dd3f7e1be356 → db11afd4967c → e420df310f5b → 31971ff1e28f`), which
carry 232 releasing objectui changesets, 23 of them declared breaking.
The range was also read with `scripts/objectui-range.mjs`.
- **Fact-check pass:** a second pass checked every cited SHA's changeset
against the page, in three slices. It found 31 claims that were wrong or
overstated, and the three follow-up commits correct them. Some examples:
- An RLS `contains` verdict that `d2bc644` (#21253) later reversed in
this same release.
- The `manage_platform_settings` scope: reads of both types, but writes
of `datasource` only.
  - The dataset door's status after `434c6c7` (#21240).
  - Filter positions that differ per change.
  - `7a1faf1`, which is not a breaking change.
- **Other corrections made while compiling:**
- The connector migration table does not claim that a `job` schedules a
`connectorSource` pull. `0efbdc3` says nothing schedules a pull until
the `job` stage lands, and none landed in this release.
- The public-form picker search-key change (`bafb8c9`, #21136) is noted
as moot, because the route it changed is retired later in the same
release (`3dc33b2`, #21222).

## Open items for the cut

These are recorded in the page's RELEASE-TIME TODO comment.

- **Anonymous endpoints.** Under the deny baseline (#21217), an
app-declared anonymous endpoint (`authRequired: false`) can no longer
read or write objects. #21158 is still open, and until it lands no
supported channel grants anonymous callers a permission set. The page
says so instead of prescribing a grant.
- **Console pin.** Three 17.6.0 server changes refuse a body that the
pinned Studio (`31971ff1e28f`) still sends. objectui fixed each one
after the pin:

| Studio action | Server change that refuses it | objectui fix (not in
the pin) |
|:--|:--|:--|
| A dataset count measure saved with the Field box blank (`field: ''`) |
#21240 | `0858267e` |
| An External / Validate-only datasource saved without a credential |
#21133 | `8001068b` |
| Republishing an html page that gained a plugin component | #20852 |
`3ae91930` |

The page lists these under "Known console issues". If the pin moves
before the cut, the lines it fixes come out. Otherwise the
accepted-for-GA waiver is recorded.

## The correction to 17.5.0

One dated correction line is appended in place to the "Also shipped in
17.5.0" paragraph of `17-5.mdx`, in the form #20985 used. It names the
seven commits that shipped in 17.5.0 with no CHANGELOG entry and links
to the 17.6.0 section. The original text is unchanged.

## Deliberately not in this PR

- `content/docs/releases/v17/index.mdx` is **untouched**. Its status
blockquote and per-release list may only claim 17.6.0 after the release
ships.
- An MDX comment at the top of `17-6.mdx` lists the release-time edits:
  1. the publish date;
  2. changesets landed after `748b2407`;
  3. the per-package CHANGELOG entry count;
  4. the console-pin outcome;
  5. #21158 if it lands first;
  6. the `v17/index.mdx` update.

## Verification

Run locally on the head commit, with the workspace installed. All of
these pass:

- `check-issue-citations --base origin/main`: every added citation
resolves.
- `check:doc-anchors`, `check:role-word`, `check:docs-audit-scope`,
`check:nul-bytes`, `check:doc-authoring`, `check:docs-single-h1`,
`check:docs-redirects`, `check:docs-locale-catch-all`
- `check:corpus-claim-drift`, `check:docs-spec-enumerations`,
`check:published-readme-links`
- `check:release-notes`, `check:release-page-status`,
`check:release-index-currency-sync`, `check:release-body`
- `check-release-section-coverage` (plain and `--strict`),
`check-doc-frontmatter`, `check-docs-nav-label`,
`check-docs-section-name`, `check-section-landing-index`,
`check-doc-route-spelling --advisory`

Both pages compile as MDX with `@mdx-js/mdx` 3 + `remark-gfm`, and the
three tables parse with no ragged rows.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_014VGCS11YUtYAiinRcdqQwL

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hotlong

content/docs/releases/v17/17-5.mdx

@@ -1606,6 +1606,15 @@ packages on npm also carry the eight commits below. The version commit did not
 consume their changesets, so no 17.5.0 `CHANGELOG.md` entry names them; they
 will be listed again in 17.6.0's `CHANGELOG.md`. The release-pipeline defect
 that let the publish run past its version commit is tracked in #20613.
+**Correction (2026-10-02):** seven more commits shipped in 17.5.0 with no
+17.5.0 `CHANGELOG.md` entry — they landed before the version commit but were
+not in the version PR when it merged. Two are breaking, `e73ee2d` (#20567,
+`RealtimeEventType`) and `c876a74` (#20504, a forced Turso replica with no
+`syncUrl`), and `7a1faf1` (#20579) makes `os validate --strict` fail on a
+live conversion. See
+[Shipped in
+17.5.0](/docs/releases/v17/17-6#shipped-in-1750--listed-again-in-1760s-changelog)
+on the 17.6.0 page.
 
 - `6e3aa75` (#20584) — a permission-set resolution with no active organization
   reads only the organization-less permission sets, the rule the grant