docs(releases): v17 页补齐 rc.0 → rc.1 窗口(元数据/协议变更 + 平台功能） (#4418)

* docs(releases): v17 page carries the rc.0 → rc.1 window — backend half

The v17 release page stopped at the rc.0 cut. 334 changesets have landed on
main since (40 major-class), plus five objectui pin moves, and none of it was
in the layer-3 curated page the releases-maintenance playbook makes mandatory
for a major.

Adds a "Landed since 17.0.0-rc.0" section written for the two audiences the
release actually strands:

1. **Metadata-app developers** — what changed in the metadata they author and
   the protocol they call: the actions route's HTTP contract, list queries
   that apply-or-fail, the one alias fold across every engine method,
   `query.having` becoming real, flow-node config enforcement and the ADR-0087
   alias graduations, blank hook targets, stored-metadata conversion replay,
   Studio forms that saved nothing, view-filter operator parity, the temporal
   storage/bounds campaign, and ADR-0111 sharing authority.

2. **System administrators** — what changes about operating the platform:
   honest 501s naming the package to install (the fabricated-session auth mock
   and the RLS-free analytics shim are deleted), `HonoServerPlugin` reduced to
   a transport adapter, memory-driver persistence back to opt-in, `os migrate`
   writing nothing before confirmation and refusing a busy database, boot-log
   visibility, platform-objects infrastructure, cron jobs that finally fire,
   and the four fail-opens closed this window.

The largest post-rc.0 landings (ADR-0110/0104-D2/0113/0114, the #4001
strictness clicks, the seven protocol-17 retirements, the #4212 family, the
#3896 sweep) are already documented in place in the sections above — this
section names them and points there rather than duplicating, then covers the
rest of the window.

Also extends the upgrade checklist with the new consumer-facing actions and
the References list with this window's ADRs and PRs.

Console (objectui) half follows in the next commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MevuZ96T3E9yivS8QvghcR

* docs(releases): v17 page carries the rc.0 → rc.1 window — Console half

The five objectui pin moves since rc.0 (`4a4829d0ef39 → 7d9734d5e321`, 79
commits, released as objectui 17.1.0) had no entry on the curated page. Sourced
from the five `console-*` changesets `scripts/bump-objectui.sh` writes on every
bump.

Leads with the release-critical one: the rc.0 pin predates the ADR-0110 D1
client fix, so the Console it builds still posts `action.target` to the actions
route — against a v17 server, which resolves the declaration by `name` and
refuses an unresolvable one, every target-bound script action would 404 from
the shipped Console. Then the rest grouped by what a user of the Console
actually feels: action feedback that stops lying, filters/sorting/export
agreeing with the server, safer edits (If-Match + 409 surfacing), per-record
bulk actions, approvals and notification surfaces, the Studio designers, types
that stop forking the spec, and the resilience fixes.

Also scopes the existing Console section to the rc.0 window it documents, so
`4a4829d0ef39` no longer reads as the shipping pin.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MevuZ96T3E9yivS8QvghcR

* docs(releases): fold the four post-merge changesets into the rc.1 window

main advanced while this branch was being written. Three of the four new
changesets are consumer-facing and belong on the page:

- #4363's second half — the background walks seek instead of counting. The
  page already carried the single-read half; the walk half is the one with
  teeth, because `rebuildApproverIndex` deleted index rows for requests its
  offset-paged scan skipped, and `scanValueShapes` could open the value-shape
  migration gate on evidence it never fully read. Both land beside the paged-
  read entry they complete.
- `SqlDriver.findOne(object, id)` removal + `bypassTenantAudit` becoming a
  declared `DriverOptions` member, with the limit the declaration states.
- react page props joining the reference-integrity suite, so `os lint` /
  `os compile` stop passing metadata `os validate` rejects — noted where the
  authoring lints are described, with the CI consequence called out.

The fourth (`driver-conformance-gate`) is a CI gate that releases nothing
consumer-visible and is deliberately left off.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MevuZ96T3E9yivS8QvghcR

* docs(releases): declare the changeset, and backfill the 27 objectui fixes the bump missed

Two things the `Check Changeset` gate and a verification pass turned up.

**This PR declares itself.** An empty-frontmatter changeset — the sanctioned
"releases nothing" declaration the gate documents — for the docs-only v17 page
work.

**The Console window was under-enumerated, and the page would have inherited
that.** Cross-checking the five `console-*` changesets against objectui's own
history found `console-bebaebd39ace.md` covers only the tail of its range: 94
first-parent commits, 40 enumerated, oldest entry #3026. The other four ranges
reconcile exactly. Everything that merged earlier inside that one range is in
neither the release history nor the curated page — the same failure
`console-c6cfdf1288b6-backfill.md` records, now for the second time.

Adds the backfill (patch; all 27 are `fix`, none `feat`, so the bump script's
own typing rule applies) declaring no SHA move. Several are data-loss fixes an
upgrading Console user feels on contact: a tabbed modal or split form silently
dropping the values of every pane but the active one, a `defaultValues` change
discarding what the user was typing, no unload guard on a dirty modal, and a
flow or action that failed under HTTP 200 still reporting success.

Also fixes the `check:role-word` failure this branch introduced — the ADR-0090
D3 vocabulary is permission sets and positions, so the upgrade-checklist entry
now says which permission sets carry `manage_sharing` rather than "roles".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MevuZ96T3E9yivS8QvghcR

* docs(releases): fold the backfilled Console fixes into the v17 page

The backfill changeset records the 27 unenumerated objectui fixes in
`@objectstack/console`'s changelog (the detail layer). The curated page is the
layer that has to tell an upgrading user what they will feel, so the
user-visible half lands here too rather than being left to a changelog nobody
reads before upgrading.

Two additions: a "forms stop losing what you typed" group — the tabbed-modal
and split-form value loss, `defaultValues` discarding in-progress input, the
missing unload guard, the stale record after a `recordId` swap — and a
"spec values render instead of failing three different ways" group covering
the three spec-parity tiers, the FilterBuilder operator table, the chart
series/category fixes, the empty-KPI analytics case, legacy string row
actions, and the HTTP-200 failure reporting as success.

The section header now states the real window size (143 commits) and names the
backfill, so the 79-PR enumeration is not mistaken for the whole of it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MevuZ96T3E9yivS8QvghcR

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.changeset/console-bebaebd39ace-backfill.md

@@ -0,0 +1,56 @@
+---
+"@objectstack/console": patch
+---
+
+Console (objectui) backfill for `96ee72e85439...bebaebd39ace` — the 27 fix
+commits that refresh's changeset did not enumerate.
+
+`scripts/bump-objectui.sh` emits a `@objectstack/console` changeset on every
+bump precisely so a SHA move leaves a trace (see `docs/releases-maintenance.md`),
+and the `console-bebaebd39ace.md` entry it wrote covers only the tail of its own
+range: the range holds **94** first-parent commits, the enumeration lists 40,
+and its oldest entry is #3026. Everything that merged earlier inside the same
+range went unrecorded — in the release history and in the curated v17 page.
+This is the second instance of the failure `console-c6cfdf1288b6-backfill.md`
+records; it declares no SHA move (`.objectui-sha` already points at
+`7d9734d5e321`, past this range).
+
+The 27 are all `fix`, hence `patch`. Several are data-loss fixes an upgrading
+Console user feels immediately:
+
+- fix(form): a tabbed/sectioned modal keeps every tab's values (#2959, #2153) (#2987)
+- fix(form): a split form keeps BOTH panels' values (#2153) (#3012)
+- fix(form): a defaultValues change no longer discards the field being filled (#2982) (#2991)
+- fix(components): apply new form defaultValues in the commit that renders them (#3001)
+- fix(plugin-form): block page unload while a modal/drawer form has unsaved input (#2998)
+- fix(plugin-form): swapping recordId no longer leaves the previous record on screen (#3005)
+- fix(plugin-form): a wizard that ends on a field-less review step can finish (#2986)
+- fix(form): a tabbed/split form honours the form view's own `columns` (#3018)
+- fix(console): a flow or action that failed under HTTP 200 stops reporting success (#2958) (#2995)
+- fix(grid): a legacy string row action runs instead of green-toasting a no-op (#2960) (#2996)
+- fix(spec-parity): render the six Tier-1 spec values right instead of silently wrong (#2941) (#2993)
+- fix(spec-parity): the Tier-2 spec values render instead of validating into nothing (#2942) (#3008)
+- fix(spec-parity): the Tier-3 spec values render instead of red-boxing (#2943) (#3011)
+- fix(view,components): the spec→FilterBuilder operator table covers the whole view vocabulary (#2945) (#2989)
+- fix(view): the spec→FilterBuilder map follows the four operators #2942 added (#3022)
+- fix(charts): a spec `series[].type` draws, and a spec-shape `series` plots at all (#2945) (#3004)
+- fix(charts): say so when rows carry no category key, instead of drawing an empty axis (#3007)
+- fix(analytics): a missing analytics capability no longer renders as an empty KPI (objectstack#3891) (#2981)
+- fix(chatbot): read the agent catalog in the declared envelope too (objectstack#4053) (#2992)
+- fix(sdui): a react page keeps its state; a source that exports nothing fails loudly (#2984)
+- fix(sdui): a kind:'html' page can use lazily-registered blocks, and recovers when one registers late (#2988)
+- fix(sdui): stop the react page's "no adapter yet" fallback churning its provider context (#3000)
+- fix(sdui): the curated contract lists record:line_items, the tag that actually resolves (#3006)
+- fix(record): register the record:* blocks under one key, prefixed once (#3023)
+- fix(plugin-list,plugin-grid): drop undeliverable formats from the export menu (#2999)
+- fix(components): a stacked resizable group gets a divider, not a 1px sliver (#3024)
+- fix(components,app-shell): the last two `direction` props follow v4's rename to `orientation` (#3025)
+
+Also in the range and deliberately not listed here: the refactor/chore/test/
+build/ci PRs the bump script's fix/feat filter excludes by design — including
+three breaking-flagged refactors already reflected in the spec-side work
+(#2990 the `execute` alias deleted from the action runner, objectstack#3856;
+#3003 action sub-vocabularies derived from spec, and #3020 authoring types
+become input types, both objectstack#4074).
+
+objectui range: `96ee72e85439...bebaebd39ace`

.changeset/v17-page-rc1-window.md

@@ -0,0 +1,31 @@
+---
+---
+
+Docs-only: carry the v17 release page across the `rc.0 → rc.1` window. Releases
+nothing.
+
+The page stopped at the rc.0 cut while 334 changesets (40 `major`-class) and
+five objectui pin moves landed on `main` — the layer-3 curated page
+`docs/releases-maintenance.md` makes mandatory for a major, left a release
+behind the train it documents.
+
+Adds a **Landed since 17.0.0-rc.0** section organised by who has to act on it:
+the metadata and protocol changes an upgrading application developer must read
+(the `/actions` HTTP contract, list queries that apply-or-fail, the one alias
+fold across every engine method, `query.having` becoming real, flow-node config
+enforcement, stored-metadata conversion replay, the temporal campaign,
+ADR-0111 sharing authority), then the platform capabilities an administrator
+gains (honest 501s naming the package to install, `os migrate` writing nothing
+before confirmation, boot-log visibility, platform-objects infrastructure,
+cron jobs that finally fire), then a security-corrections subsection for the
+four fail-opens closed in this window, then the Console delta.
+
+The largest post-rc.0 landings (ADR-0110, ADR-0104 D2, ADR-0113, ADR-0114, the
+#4001 strictness clicks, the seven protocol-17 retirements, the #4212 family,
+the #3896 sweep) were already written into the sections above as they landed;
+the new section names them and points there rather than restating them, so the
+page cannot grow two accounts of one change that drift apart.
+
+Also extends the upgrade checklist with this window's consumer-facing actions
+and the References list with its ADRs and PRs, and scopes the existing Console
+section to the rc.0 window it actually documents.