release(changelog): the published 18.1.0 CHANGELOGs attribute 260 of 265 entries to 3937697, the commit that reverted the first cut, instead of each entry's own commit

Filing gate: ① a product defect fixed into released text. The released-text exception applies: the 18.1.0 CHANGELOGs are in the published tarballs.
Business reason: anyone upgrading reads the CHANGELOG to find the change behind an entry. In 18.1.0, 260 of 265 entries link to the same revert commit, so following the hash leads nowhere useful. This happens again whenever a version commit is reverted and re-cut.
Reader: the release lane (.changeset/config.json changelog: @changesets/cli/changelog, the root version script), at the next cut, or in an in-place amendment of the 18.1.0 entries in the style of #24912.
Dedupe (open AND closed):

"18.1.0 CHANGELOG entries cite the revert commit 3937697 instead of their own commit" → 20 hits, none on this.
"changelog commit hash attribution reverted version commit 18.1.0 annotate-shipped" → 20 hits, none on this. The nearest are release: a Version Packages PR that merges behind main ships every changeset landed since its last refresh without a CHANGELOG entry (17.5.0: 8 changesets, 17.6.0: 1) #21361 and release(next): 18.0.0-next.2 shipped 11 changesets with no CHANGELOG entry (the version PR merged behind main; #21361's class, in pre mode) #23818 (entries missing from a cut) and sync-release-index-currency.mjs leaves a hand-written date in place on the version commit of the newest GA — 18.0.0 shipped dated a day early (#25148) #25356 (index date), which are different defects.
reach: published artifact, measured once. npm pack @objectstack/cli@18.1.0, ## 18.1.0 section: 34 of 34 entries open - 3937697:.
type: Bug

What happens

#25605 (393769720a) reverted the unpublished first 18.1.0 version commit 74fa3cb6d (#24876). That revert re-added every pending .changeset/*.md. The re-cut (#25606, e649c2d91e) then generated the CHANGELOGs with @changesets/cli/changelog. That generator stamps each entry with the commit that last added its changeset file, which is now the revert.

Measured on main at e649c2d91e, over the 73 packages with a ## 18.1.0 section, after deduplicating identical entries across packages:

265 distinct entries, 260 of them opening - 3937697:.
The other five carry their own commits. They are the changesets merged after the revert: a57643d fix(plugin-approvals)!: refuse a reassign target that resolves to no one #25592, 9f39094 feat(core): import reads dotted and compact year-first days and matches option values in any case #25596, 4a25192 feat(sharing): a share or sharing rule on a public object reaches an external member of the record's organization #25591, 4395cbc, and cb38a8c docs(skills): the data skill's current_user table names a declared membership key #25586.
The tarball has the same attribution: all 34 entries of the ## 18.1.0 section of @objectstack/cli@18.1.0 read 3937697.

A side effect is that the eight entries marked Shipped in 18.0.0 now share an identical first line, - 3937697: **Shipped in 18.0.0**, whose CHANGELOG missed this entry; …. A reader or tool that keys on an entry's first line counts them as one.

#25607 taught annotate-shipped to pass over a reverted cut. The changelog generator's commit attribution was not covered.

Expected

Each entry names the commit that introduced its changeset. That is what an un-reverted cut produces: the 18.1.0 rehearsal at b2c0752900 carried distinct commits.

Fix direction

There are two options:

(a) Fix future cuts. Wrap the changelog generator so it attributes each changeset to the commit that first added it, passing over a revert commit. A revert of a version commit is exactly the case where the last commit that added the file is wrong. Pin this with a fixture that adds a changeset, version-commits, reverts, and re-cuts.
(b) Fix 18.1.0 in place. Amend the 18.1.0 entries in the repository's CHANGELOGs to their own commits. This does not change the published tarballs.

The 18.1 release page (#25616) tells readers to search an entry's headline, and cites each entry's own commit itself.

Triage: first grade — `bug` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-24T12:53Z

⛔ Not a claim, ⛔ not a dispatch. finding comes off.

Lane: domain:devx, the release pipeline: .changeset/config.json and the root version script.
p2: the published text misattributes entries, but no install or behaviour changes. The 18.1 release page (docs(releases): 18.1.0 release facts as measured, and the upgrade checklist walked from 18.0.0 #25616) already cites each entry's own commit.
Scope: (a) is the fix, because a revert-and-re-cut will happen again, and it gets the add → version → revert → re-cut fixture the card names. (b), amending the 18.1.0 entries in the repository, may ride the same PR by the docs: the 18.0.0 release text sends a v17 operator to the ownership ceremony, not to 17.x #24912 precedent; it does not touch the published tarballs. Neither needs a ruling. ⛔ Prime Directive 15: no re-publish of 18.1.0.

Generated by Claude Code

Claim: PM loop · 2026-10-24T13:27Z
Session: session_01X36HeTaoAfX2pS589N9FYP (card thread, dispatched by seat session session_01LKHDniRQSWjRJyDtacwpEd)
Account: os-elon-musk
Branch: claude/project-thread-jruafi (the harness-pinned branch for the card thread; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-25638
Domain: domain:devx
Seat: domain:devx#1 (seat post #6023)
File surface: .changeset/config.json, a changelog generator wrapper under scripts/ with its self-test and fixture, the ## 18.1.0 sections of packages/**/CHANGELOG.md (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — filed from the 18.1.0 re-cut reading.
Thread-read: none
Serial constraints cleared: none of the open PRs touches CHANGELOGs or .changeset/config.json.

Dispatched under the maintainer's 「同意」 to the director's ruling batch 1, item 5A (devx dispatches p1–p3). Dispatch order: /mnt/project-files/pm-devx-seat/dispatch-25638.md.

os-dev-report

{
  "issue": 25638,
  "status": "done",
  "branch": "claude/project-thread-jruafi",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25669",
  "session": "session_01X36HeTaoAfX2pS589N9FYP",
  "premise_still_valid": true,
  "summary": "(a) .changeset/config.json now loads scripts/changeset-changelog.mjs: the stock @changesets/cli/changelog line format with each changeset commit read by createChangelogAttribution (scripts/release-pending-publish.mjs). An add whose blob equals the blob the previous delete removed is a restoration; the walk passes over it to the earlier add. Shallow clones deepen in annotate-shipped bounded rounds; anything undecidable keeps the stock commit with a warning and never stops the version pass. (b) The 79 CHANGELOGs 18.1.0 sections were regenerated by re-running the cut on e649c2d91e^ with this generator: they differ from the published text only in commit hashes (265 distinct entries, 0 naming 3937697; the 8 Shipped-in-18.0.0 entries name the adding commits #25607 measured; the 5 post-revert entries unchanged). A depth-1 clone re-cut is byte-identical.",
  "tests": "node scripts/release-pending-publish.mjs --self-test: 124 cases across 31 batteries pass (two new batteries: add -> version -> revert -> re-cut through changeset-changelog.mjs getReleaseLine/getDependencyReleaseLine, incl. a reused name and a pre-cut leak; shallow-clone deepening, deepen-off and not-a-repo fallbacks). Ablations reverted after: removing blob equality fails the reused-name case; removing the graft-boundary guard fails the shallow case. Real re-cut on e649c2d91e^ (full clone and depth-1 clone): all CHANGELOGs equal the committed ones (cmp, 0 diffs).",
  "gates": "dispatch-gates --commands: 108 derived, all 108 exit 0 (check:skill-examples, check:docs-transcript-drift, check:dual-build-cjs-loads, check:i18n first exited 3 for missing builds and passed after the lint/client-react builds and pnpm build); --ran: 108 accounted, 0 not measured. check:commit-card-trailers --range origin/main..HEAD pass; check-nul-bytes OK. PR check-runs: pending at report time.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0 GitHub MCP writes; reads: issue_read x2 (card + comments). Subscribe via claude-code-remote subscribe_pr_activity.",
  "api_writes": "3 — relay pr_create (#25669, assignee os-elon-musk, label skip-changeset); relay pr_request_reviewers (#25669, os-elon-musk); relay comment (this report on #25638)",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: release lane (docs-only PR) · content/docs/releases/v18/18-1.mdx lines 86-91 still say 260 of 265 entries open with 3937697; after #25669 lands that is true of the published tarballs only · noted, not filed (code PRs do not edit content/docs/releases/) · dedupe: 18-1.mdx CHANGELOG caution 3937697 tarball",
    "carrier: none · unconsumedChangesets still names the newest add; a revert never leaves a version commit unconsumed changesets, so no wrong answer is reachable today · Acceptance notes only"
  ]
}

Tier: 13,151 changed lines (12,820 CHANGELOG hash swaps + 339 scripts/config) > 3000, so the PR needs a human merge per the >3000 rule. No governed path; release.yml and the root version script are NOT touched.

Generated by Claude Code

Seat review (domain:devx, #6023): ACCEPT for PR #25804 at 4c727868.

维护者速读 (maintainer quick read): 79 CHANGELOG.md files, +6406/−6406. Every changed line differs from main only in a commit hash. The seat paired all 6406 −/+ lines and masked 7–40-hex tokens: 0 non-hash differences. The amendment is regenerated on e649c2d91e^ with main's generator from #25669, so each 18.1.0 entry now names the commit that first added its changeset, not the #25605 revert 3937697. Six of the 256 distinct new hashes were sampled through the commits API, and each is the commit that added the cited .changeset/*.md. No other path is touched. skip-changeset, because nothing is published or republished: the npm tarballs keep their text.

check-governed-merges --pr 25804: no governed path, but 12,812 lines > 3000, so it is over the human-merge line. It stays draft. It lands by the maintainer's own merge, or through the queue after a GOVERNED_APPROVERS approval. CI was still running at review time; the card thread drives any red.

The release-lane finding on content/docs/releases/v18/18-1.mdx:86-92 is filed as #25806 (Blocked-by: #25804).

Generated by Claude Code

os-dev-report

{
  "issue": 25638,
  "status": "done",
  "branch": "claude/project-thread-jruafi",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25804",
  "session": "session_01X36HeTaoAfX2pS589N9FYP",
  "premise_still_valid": true,
  "summary": "Second half of the split. The generator landed in #25669. This PR amends the 18.1.0 sections of 79 CHANGELOGs (74 packages/, 5 examples/) in place. They were regenerated by re-running the cut on e649c2d91e^ (8801f2bb37) with main generator (annotate-shipped, then changeset version), and every changed line differs from e649c2d91e only in its 7-hex commit. 265 distinct entries, 0 naming 3937697. Byte-identical to the 2026-10-24 amendment (e3a738226e). Branch restarted from origin/main 5f5f0b4221; head 4c7278680e.",
  "tests": "Hash-normalised diff vs e649c2d91e: 0 of 79 files differ. git log e649c2d91e..origin/main -- *CHANGELOG.md: empty. git diff --stat e3a738226e -- *CHANGELOG.md: empty. No code changes, so no unit tests apply.",
  "gates": "dispatch-gates --commands (after pnpm build, exit 0): 73 derived, 72 exit 0. pnpm --filter @objectstack/spec run check:liveness exit 1 on `translation/flows.screens -> packages/services/service-automation/src/engine.ts`. That is a main red from #25734 moving the engine body, fixed on main by #25796 (e2a4b6a063). The diff touches only CHANGELOG.md files. The PR CI ran on the merge ref that carries #25796, and its `Spec property liveness` check is success. --ran: 73 accounted, 0 not measured. check:commit-card-trailers and check-nul-bytes pass. PR check-runs at report time: lint lanes, type-check source/debt/consumer, Build Core and Test Core 1,2,6,8 success; the rest are in progress.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0 GitHub MCP writes; reads: pull_request_read get_check_runs x1, get_job_logs x2 (on #25669)",
  "api_writes": "3 — relay pr_create (#25804, assignee os-elon-musk, label skip-changeset); relay pr_request_reviewers (#25804, os-elon-musk); relay comment (this report)",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: #25806 (filed by the seat) · content/docs/releases/v18/18-1.mdx:86-91 describes the tarballs only once this lands"
  ]
}

12,812 changed lines (all **/CHANGELOG.md), over the 3000 cap: lands by the maintainer's own merge.

Generated by Claude Code

Navigation Menu

Repository navigation

release(changelog): the published 18.1.0 CHANGELOGs attribute 260 of 265 entries to 3937697, the commit that reverted the first cut, instead of each entry's own commit #25638

What happens

Expected

Fix direction

Triage: first grade — `bug` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-24T12:53Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

release(changelog): the published 18.1.0 CHANGELOGs attribute 260 of 265 entries to 3937697, the commit that reverted the first cut, instead of each entry's own commit #25638

Description

What happens

Expected

Fix direction

Activity

objectstack-fleet commented on Oct 24, 2026

Triage: first grade — bug · priority:p2 · domain:devx · area:devpath · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-24T12:53Z

objectstack-fleet commented on Oct 24, 2026

objectstack-fleet commented on Oct 24, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade — `bug` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-24T12:53Z