docs(releases): the curated 17.7.0 release page and upgrade checklist

[objectstack-fleet]

Fixes #21989
Clause-②: no

What this is

This PR adds the curated release page for 17.7.0, content/docs/releases/v17/17-7.mdx (1,402 lines). It was written after the publish: npm latest moved on 2026-10-06, and @objectstack/spec@17.7.0 went out at 12:22:14Z. It also wires the page in:

• content/docs/releases/v17/meta.json: 17-7 comes ahead of 17-6.
• content/docs/releases/v17/index.mdx: the status blockquote, the minors warning, the per-release list and the checklist links now name 17.7.0 as current. This is the same shape docs(releases): finalize the 17.6.0 notes after publish #21362 used for 17.6.0.
• scripts/docs-audit/handwritten-docs.json: the page joins the docs-accuracy audit scope.
• content/docs/releases/v17/17-6.mdx: one dated correction (2026-10-06) on the anonymous-endpoints known issue. security(core, plugin-security): an unauthenticated principal never resolves the permission sets bound to the guest anchor; ADR-0090 D9 is declared and seeded but not enforced #21158 was closed as not planned on 2026-10-04.

The page follows the 17.6 page's structure:

1. Highlights.
2. What's new: the counts, and the runtime changes that happen silently.
3. Breaking changes and migration, triaged by door and subject. It includes a coverage table that names the section carrying the migration for every ADR-0087 entry added since 17.6.0 (8 conversions, 41 D3 entries).
4. New capabilities.
5. Notable fixes. Security fixes are described only as classes and doors.
6. New in Console: each objectui declared-breaking change, with this repo's answer.
7. The code that shipped but is not listed.
8. The upgrade checklist. Every line is marked Not exercised.

Sources and counts

• The version commit 4e4e881427 (chore: version packages #21352) consumed 323 changesets. 322 are new. One, 748b240 (feat(types,automation): a host's per-kernel scheduled-work OFF reports its own reason #21270), shipped in 17.6.0 and is listed again; the page explains this in its own section.

• 69 CHANGELOGs carry a 17.7.0 section, and 48 of them have entries. Their 444 entries (194 minor, 250 patch) de-duplicate to the 323 changesets.

• Two commits landed on main after the Version Packages PR's last refresh and before it merged:

  • 8a399b2b15 (fix(service-datasource): the admin door reads a datasource's origin from provenance, and a metadata-door write reaches it in the same boot #21977, for finding(service-datasource): a datasource created through the metadata door is missing from the admin door until restart, then reads as code-defined because the admin read defaults a missing origin to code #21923)
  • 04e776b39a (docs(spec, docs): App.defaultAgent and actions-as-tools name the agent route as the one chat door #21976, for docs(spec, docs): App.defaultAgent's docblock and actions-as-tools.mdx name POST /api/v1/ai/assistant/chat, a route cloud retired (cloud#2621) #21968)

  Both are ancestors of the version commit (exit 0 for each), so the 17.7.0 packages carry their code. But the version commit did not consume their changesets, so no 17.7.0 CHANGELOG line names them. The release-integrity audit named both in a warning.

• objectui: the pin moved five times and ends at 0abd4f9f8769:

  • 89cad75d5570 (chore(objectui): bump the console pin to 89cad75d5570 (carries objectui 0858267e, 8001068b, 3ae91930 and d0fba91aa) #21380)
  • ab1879721595 (chore(objectui): bump the console pin to ab1879721595 (carries objectui f624f278, b0bf413c and ab187972) #21625)
  • 2e818d0b51ec (chore(objectui): bump the console pin to 2e818d0b51ec (carries objectui#11466, #11574, #11578, #11581 and #11583) #21710)
  • 9dfaca654311 (chore(objectui): bump the console pin to 9dfaca654311 (carries objectui#11611, #11614 and #11619) #21800)
  • 0abd4f9f8769 (chore(objectui): bump the console pin to 0abd4f9f8769 (carries objectui#11636, #11637, #11635, #11624 and #11640) #21827)

  Across 173 commits, 254 changesets were added and 229 of them release something. 65 are declared breaking, plus one commit marked !. The Console table answers each.

• PROTOCOL_VERSION is still 17.0.0.

Premise corrections

• The dispatch named two pin moves ending at 9dfaca654311. The tree has five, ending at 0abd4f9f8769 (8832655, chore(objectui): bump the console pin to 0abd4f9f8769 (carries objectui#11636, #11637, #11635, #11624 and #11640) #21827). The page covers all five.
• One new D3 id contains a word that check:role-word refuses on docs pages, and release pages are not in its baseline. The coverage table therefore names that entry by its subject and points at os migrate meta --from 17.

Fact-check

A second pass checked every cited SHA, PR number, key name and behavioural claim against the commits, changesets and registry entries. It corrected 31 claims (commit e4a6280b46).

Two more corrections came earlier, while drafting:

• release: a Version Packages PR that merges behind main ships every changeset landed since its last refresh without a CHANGELOG entry (17.5.0: 8 changesets, 17.6.0: 1) #21361 is closed; it is not tracking the issue.
• There are seventeen ui-object-* members, not eighteen.

Mechanical checks on the final page:

• All 276 cited SHAs resolve, in objectstack or in an objectui clone carrying the final pin's history.
• Each of the 216 distinct sha–PR pairs matches its commit subject.
• Every printable new D3 id (40) and all 8 conversions appear on the page.
• The MDX for 17-7, 17-6 and index compiles with @mdx-js/mdx 3.1.1 and remark-gfm 4.0.1.

After the fact-check, main gained 1abfc58 (#21985), which lands the read half of #21922. It is not an ancestor of the version commit: the test returned exit 1, and the control commit 753e7a1 returned exit 0. So in 17.7.0, the metadata door's reads still serve a stored row under a code-defined datasource name. Commit 8347e0d172 says so in the datasource migration bullet.

Independent fact-check and fix round

An independent, read-only fact-check of head 8347e0d172 returned FAIL with 13 findings (record: #21989 comment 6018402030): 2 wrong facts (a flow's get_record node still reads the stored-metadata tables, in projected form), 1 security line that named the filter shapes and depth threshold evading 17.6.0's refusal, 1 breaking change missing from the Breaking section (0fc8087, #21626), 1 link whose label did not match its target, 4 overstatements, 1 missing security fix (49524f6, #21420), 1 missing rollback caveat on os secret rewrap --apply, and 2 minor wording issues.

All 13 were re-verified against their sources and applied in a53c972fa7; none was refuted. A scan for any other line naming a bypass shape of a fixed issue reduced two more lines to their class (0728cbf, fb69825).

Measured on a53c972fa7

• Derived gates: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derives 57 commands; all 57 exited 0 (--ran: "57 run, 0 NOT-MEASURED (a DERIVED zero)"). The verdicts include:
  • check-doc-anchors: 458 links resolve.
  • check-issue-citations: 305 resolve as a PR, 9 resolve, 15 are cross-repo; every citation this change adds resolves.
  • check:role-word, check:release-notes and check:release-page-status: OK.
  • check-release-section-coverage: OK, both plain and with --strict (10 minors).
  • The docs-audit scope check and check:nul-bytes: OK.
• Docs production build: TURBO_FORCE=true pnpm turbo run build --filter=@objectstack/docs, run under the verify lock, reports Tasks: 2 successful, 2 total and Cached: 0 cached. The built releases/v17/17-7.html carries the corrected text and none of the removed text.
• Mechanical checks: 231 distinct sha–PR pairs, 0 unresolved, 0 subject mismatches; the MDX of 17-7, 17-6 and index compiles.
• Not measured locally: the repo-wide lint and the CI-only families. CI owns them.

Not in this PR

• No changeset. The PR touches only docs and a docs-audit list, nothing a package ships (skip-changeset).
• Nobody has walked the 17.6.0 → 17.7.0 upgrade. The checklist says so on each line.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 6befe19c6e391ae655e1cc8a1c0589ba926d4592 → packageMentionDocs.