Add changelog page

[dawn-ducky]

Dependencies

• None; this can merge on its own.

Status

READY

Description

Adds /changelog/, a searchable, filterable feed of what shipped to Code Push, the CLI, the Console, and the API. It's a StarlightPage next to roadmap.astro, linked from the sidebar right below it.

Entries sit on a timeline. Each has a type badge (New/Fixed/Changed/Deprecated), an area tag, its date, and the CLI release that shipped it, when there is one. It expands in place to show detail bullets, an optional command, a link to the relevant doc page, a link to the release notes, and a copyable permalink (/changelog/#entry-id). Opening the page with a matching #entry-id expands and scrolls to that entry. Search and the area chips filter the list client-side. The month headings appear under "On this page".

Seeded with 51 real changes from August 28 to October 11, 2026: CLI 1.6.120 to 1.6.128, checked against RELEASE_NOTES.md and the CLI source, plus Console and API changes from the private monorepo. Write future CLI entries from RELEASE_NOTES.md, not the GitHub release bodies, which are auto-generated and leave things out. Also skim the release's commits: the 1.6.128 notes don't mention its flag renames (shorebird#4045). For the same reason, each entry's "Release notes" link opens RELEASE_NOTES.md at that release's tag. Console, API, and server-side entries have no version, and are dated by the first production deploy that included the change (the "Deploy All to Prod" run), which can be days after it merged. All dates, CLI releases included, are in US Pacific time, and a change that took effect on an announced date, like the October 1 legacy token cutoff, uses that date.

Adding an entry: copy src/content/changelog/_template.md to a new file in that folder. The file name becomes the permalink. Fill in the frontmatter, then write a summary paragraph, a bullet list, and an optional sh code block. The template explains each field. The build checks every entry and fails with a message naming the entry if something is wrong, including a docLink to a page or heading that doesn't exist. Problems in the body also give the line, as file:line. version is required for CLI and Flutter entries and optional otherwise, since Console, API, and server-side changes don't ship in a CLI release.

Also served as:

• /changelog.md, the Markdown version for agents, also listed under Optional in llms.txt. Accept: text/markdown on /changelog/ negotiates to it.
• /changelog.xml, an RSS 2.0 feed, linked from the page and advertised in its <head>.
• Appended to llms-full.txt by a build hook in astro.config.mjs, since starlight-llms-txt leaves standalone pages out.
• Advertised to agents in public/.well-known/: a changelog link in agent.json, an entry in ai-catalog.json, and item 4 in agent-instructions.txt, which tells agents to compare an entry's CLI release with shorebird --version.
• public/_headers serves /changelog.xml as application/rss+xml.

Also updates the docs pages that changelog entries link to, so they match what shipped:

• src/content/docs/account/api-keys.mdx: full access keys can't delete the account, change billing limits, or manage sessions and API keys. The second level is now "Release and patch only", available on paid plans. shorebird login:ci was replaced by API keys, and its tokens stopped working on October 1, 2026.
• src/content/docs/code-push/ci/_authentication.mdx, the CI authentication snippet shared by the CI guides, which changelog entries reach through /account/api-keys/. It said shorebird login:ci was deprecated and its tokens would work until September 2026. It now matches /account/api-keys/.
• src/content/docs/account/cli.mdx: the Login section describes the browser login, the printed URL, the code login when no browser can open, and --device. The whoami example matches CLI 1.6.128.
• src/content/docs/code-push/preview.mdx: adds the --flavor option.

Design source: https://claude.ai/design/p/8d6abb36-5f0f-4da2-86d9-636e825acb58 ("Docs Changelog.dc.html", option 3a).

Test plan

• npm run build (astro check && astro build) passes: 0 errors, 0 warnings, all internal links valid
• cspell, Prettier, and Vale pass on the changed files; changelog.xml validates with xmllint
• Local preview, light and dark: expand/collapse, title click, text selection, find-in-page into a collapsed entry, search, area chips, empty state, permalink hash, "On this page" month links, RSS link

[easymac]

I think this looks great. I made a couple tiny adjustments:

• Vertically centered the filter chips
• Vertically centered the + icon for expanding an entry, and made it a little bigger
• Made it so you can click anywhere in the title to expand the summary

The last change isn't precious, just an idea :)

[AbhishekDoshi26]

Reviewed this. The page structure, the filtering, and the sidebar wiring all look good, and the build is clean (0 errors, 0 warnings). I found a few small issues and pushed the fixes as a55b990:

1. The copy-link fallback never worked. The .cl-copy handler called ev.preventDefault() before writing to the clipboard. So when the clipboard write failed (permissions, insecure context), nothing happened, even though the comment says "the link itself still works as a fallback". The click also gave no sign that it had copied anything. Now the link navigates normally, so the permalink always ends up in the address bar, and a successful copy briefly shows ✓ with the aria-label "Link copied".
2. Permalinks only opened on first load. The auto-expand ran once, in init(). Following a #entry-id link from the page itself (or pasting one into the same tab) only fires hashchange, so the entry stayed collapsed. The same logic now runs on hashchange too.
3. Search skipped most of an entry. data-search held only the title, summary, area, and type. Searching a version number or a flag that appears only in the details returned nothing. It now also covers the version, the bullets, and the command.
4. The command had a stray leading space. <pre> preserves whitespace, so the template's indentation before <code> rendered as a leading space ahead of $. They're on one line now.

How I checked: ran npm run build and cspell. In a local preview I confirmed that a hash change expands the entry, that version and bullet searches match, that the empty state still appears, and that a real click on copy writes the full URL, shows ✓, and reverts after 1.5s.

[AbhishekDoshi26]

One more fix, pushed as 3cf311f: the changelog wasn't reachable as Markdown for agents.

Head.astro gives every page a <link rel="alternate" type="text/markdown" href="<path>.md">, but [...slug].md.ts only builds .md files for content collection pages. changelog.astro is a standalone page, so the page advertised /changelog.md, which would 404, and a request for /changelog/ with Accept: text/markdown quietly got HTML instead.

• Moved ENTRIES, AREAS, the entry type, and the month grouping into src/data/changelog.ts, so the page and the Markdown route read the same list. You still add entries in one place, just in that file now.
• Added src/pages/changelog.md.ts, which renders /changelog.md: frontmatter, month headings, and for each entry the type, area, version, date, permalink, bullets, command, and doc link. The existing middleware now negotiates /changelog/ to it with no changes.
• Listed /changelog.md under Optional in llms.txt.

How I checked: npm run build is clean (0 errors, 0 warnings), and Prettier and cspell pass on the changed files. Using wrangler pages dev with the real middleware:

• Accept: text/markdown on /changelog/ returns 200 text/markdown with Vary: Accept and CORS.
• A browser Accept header still gets HTML.
• text/markdown;q=0.5, text/html still gets HTML.
• /changelog.md returns 200.

[AbhishekDoshi26]

Pushed 3d897b3 to fix the type badge colors.

New looked like the area badge. It used --sl-color-accent, and the Nova theme's accent is gray, so the NEW pill had almost the same gray text and fill as the CODE PUSH pill next to it. Each type now has its own color: New is green, and Fixed moves from green to blue so the two don't clash. That matches the usual changelog convention.

Light-mode contrast. These are about 11px bold labels, so they need 4.5:1. Measured against the tinted pill on a white page:

Type	Before	After
New	gray, same as the area badge	#166534, 6.2:1
Fixed	#16a34a, 2.9:1	#1d4ed8, 5.6:1
Changed	#9333ea, 4.4:1	#7e22ce, 5.7:1
Deprecated	#d97706, 2.8:1	#92400e, 6.3:1

Dark mode already passed. New uses #4ade80 (8.4:1) and Fixed uses #93c5fd (8.7:1); Changed and Deprecated keep their existing shades.

How I checked: npm run build is clean (0 errors, 0 warnings). In a local preview I added the other three badge types to the page and confirmed the computed colors and the look in both light and dark themes.

[AbhishekDoshi26]

Second pass on this, covering the code and the design in a local preview (dark and light).

One blocker before merge: the seeded entry describes a feature that doesn't exist. See the inline comment on src/data/changelog.ts. That one needs you, since it's about what we actually shipped.

Everything else is small. I'm pushing a commit right after this review that fixes the comments marked (fixing):

• Accessible name of the entry toggle
• Title and summary text can't be selected
• Result count not announced
• Find-in-page can't reach collapsed details
• Month grouping depends on array order
• Double border on the command block
• Detail panel has no fill in light mode
• Commands and flags render as plain prose
• type="search" and white-space on the command

The comments marked (suggestion) are design ideas I left for you to decide on. Also, the PR description still says to add entries in src/pages/changelog.astro. Since 3cf311f they live in src/data/changelog.ts.

[AbhishekDoshi26]

Pushed 10ce731. It addresses the rest of my review:

• Blocker: replaced the example entry with six real changes from CLI 1.6.120 to 1.6.123: --flutter-version=fvm/system, the patch-load fix, Flutter 3.47.4 support, the shorebird apps and shorebird channels commands, and shorebird patches rollback/rollforward. I checked each one against the release notes and the CLI source, and each links to an existing doc page.
• On this page: the month headings now have ids and are passed as headings, so they show up there.
• Date and version: each entry shows its date, and the version is labeled CLI 1.6.x, with a release-notes link in the expanded footer.
• RSS: added /changelog.xml, linked from the page intro and from <head>, with a Content-Type rule in public/_headers.
• PR description: updated to point at src/data/changelog.ts.

Build is clean (0 errors, 0 warnings, all links valid), and cspell and xmllint pass.

[AbhishekDoshi26]

Pushed d73ec70, which redesigns the list as a timeline:

• Layout: each entry's date and CLI version sit in a left column, joined by a line with a dot in the change type's color. The title and summary use the full width. At phone width it becomes one column, with the date above the badges.
• Chips: they show live counts that follow the search, and a chip with no matches dims. Areas with no entries (Console and API, for now) are hidden until an entry uses them. The active chip has a solid fill and aria-pressed.
• Footer: the doc link, a shorter "Release notes ↗" link, and a "Copy link" button that says "Copied" on success. It replaces the mono permalink text and the ⧉ glyph.
• Chip row on phones: the chips stay on one row that scrolls sideways instead of wrapping.

How I checked: npm run build is clean (0 errors, 0 warnings, all links valid) and cspell passes. In a local preview I checked desktop in light and dark, and phone width through a 390px frame. I measured no gaps in the timeline line, the date, dot, and badge row aligned within 1px, and no horizontal scroll at 390px. I also confirmed that the chip counts update while searching and that the live region stays quiet on load.

[AbhishekDoshi26]

Pushed 6748c86, which moves each entry into its own Markdown file in src/content/changelog/. To add one, copy _template.md and fill it in. Authors write plain Markdown instead of TypeScript strings with escaped quotes.

The build now fails, with a message naming the file and line, when:

• a field is malformed: the date isn't YYYY-MM-DD, the version has a "v", or the area or type is unknown
• a CLI or Flutter entry has no version (it's optional for Console, API, and server-side Code Push changes, which don't ship in a CLI release)
• docLink points at a page that doesn't exist, or at a heading that isn't on that page
• the body has anything besides a summary paragraph, a bullet list, and one optional sh block

How I checked:

• npm run build is clean, and cspell and Prettier pass.
• /changelog.md, /changelog.xml, and the page's rendered text and attributes are byte-identical to the previous commit.
• I built 14 test entries: a copy of the template and a Console entry with no version both build, and every broken case fails with the right message and line number.

[AbhishekDoshi26]

Pushed b44cb67, which makes the changelog discoverable to agents. Before this, agents could only reach it through llms.txt, the .md alternate link, and Accept: text/markdown:

• llms-full.txt: it now ends with the changelog. starlight-llms-txt only covers docs collection pages, so a build hook appends /changelog.md in the plugin's page format. The hook runs after the unlisted-page strip, which counts pages from the end of the file.
• .well-known: ai-catalog.json has a changelog entry with representative queries, agent.json lists it under endpoints, and agent-instructions.txt tells agents to compare an entry's CLI release with shorebird --version before suggesting a recently added flag, and to suggest shorebird upgrade if the user is behind.
• /changelog.md: it opens with the same version hint, and no longer repeats the description from its frontmatter, matching the other Markdown twins.

How I checked: the build is clean (0 errors, 0 warnings, all links valid). The build log shows the strip hook running before the append. llms-full.txt has 66 pages, with the changelog last. Both JSON files parse, and changelog.xml still validates.

[AbhishekDoshi26]

Fresh-eyes pass over the whole PR. The structure holds up. I also confirmed that astro dev picks up entry edits, and recovers from a broken entry once it's fixed, without a restart, so the getEntries() cache isn't a problem.

I found five small issues, all about things an author can write that pass the build but render wrong, plus two edge cases. I'm pushing fixes for all five right after this review.

[AbhishekDoshi26]

Pushed 1911814 and fc0f02e, which bring the changelog up to date through October 6. It now has 22 entries, up from 10.

New entries

• CLI 1.6.124: Flutter 3.47.6 support, with the fix for a hang in production Windows apps. Also, shorebird patch android now lists the Android libraries whose versions changed when a patch has DEX changes.
• CLI 1.6.121: shorebird account whoami shows your plan level. 1.6.122's patch entry also gets a bullet for the fix about patches that are still booting.
• Console:
  • the Plan page under Account, including the split into "Owned by you" and "Member of" organizations
  • size analysis is free on every plan
  • Change Track on a superseded patch
  • apps in the sidebar, and filtering, sorting and paging on the app list
  • a role picker in the invite dialog
  • sign-ins last until they go 30 days unused
• API:
  • the built-in stable, beta, and staging channels can't be deleted
  • legacy login tokens stopped working on October 1
  • responses now carry RateLimit headers

Console and API entries are dated by the day the change merged to main.

Other fixes

• Release notes links now open RELEASE_NOTES.md at the release's tag. The GitHub release pages are generated from merged PRs and leave out Flutter updates; the 1.6.123 page lists only one PR.
• Doc links: docs: document apps, channels, and patch rollback CLI commands #698 and docs: explain Dart symbols for obfuscated builds #702 have merged, so the rollback, apps, channels, and dSYM entries now link to the sections those PRs added.
• account/api-keys still said login:ci tokens work "until September 2026". It now says they stopped working on October 1, 2026, which matches the server's error message.
• Merged main.

Left out

• Signing in from your identity provider's dashboard (for example the Okta tile) works since September 2, but enterprise/saml.mdx still says it isn't supported. That page needs fixing before this gets an entry.
• CLI work on main after 1.6.124, since it isn't released yet.

How I checked

• I checked each entry against RELEASE_NOTES.md at its tag, the CLI source, and the Console, auth, and server source.
• An independent second pass found six entries that overstated or misdescribed a change. For example, app search already existed, and the 30-day idle limit was already in place before (the change removed the fixed 90-day limit). All six are fixed in fc0f02e.
• The build is clean (0 errors, 0 warnings, all internal links valid), Prettier and cspell pass, and changelog.xml validates with xmllint.

[AbhishekDoshi26]

Brought this up to date with main and added what shipped since the entries were seeded (0780a7f).

New CLI entries, written from RELEASE_NOTES.md at each tag and checked against the CLI source at that tag:

• 1.6.125: release and patch --json, OAuth with PKCE plus logout revocation, the app extension version warning, obfuscated Android patches on Flutter older than 3.41.2, and errors that name the next step.
• 1.6.126: Flutter 3.47.7, browser and device-code login, cache pruning with cache clean --unused, and iOS preview logs. The login entry notes the 1.6.126 crash that 1.6.127 fixed.
• 1.6.127: Linux patch checks and build arguments, plus the login, doctor, and set-track crash fixes.
• 1.6.128: the macOS re-signed app fix, --public-key-cmd for patches, unknown flavors, clearing the build output, precondition_failed, set-track on the same track, preview --flavor, refusing to delete built-in tracks, hiding patches promote, and one entry for the remaining fixes.

The macOS fix needed both the CLI diff change in 1.6.126 (#3965) and the engine change in 1.6.128's Flutter pin (flutter#172). It only works on 1.6.128, so it has one entry there and none in 1.6.126. Nothing from shorebird#4055 is included, since no release has it yet.

API entries from _shorebird:

• Personal access tokens can no longer delete the account, change billing limits, or manage sessions and keys (#3361, #3364, #3383).
• GET /api/v1/apps no longer lists an app twice (#3332).

api-keys.mdx:

• The Full access bullet said the key "has the same permissions as your account". That stopped being true with the token limits, so it now lists the exceptions, using the Console's wording.
• The login:ci section now says the command was replaced, since 1.6.125 only prints a pointer to API keys.

npm run build reports 0 errors and valid links. cspell, Vale, and Prettier are clean on the changed files.

[AbhishekDoshi26]

Second pass over the new entries from the rendered /changelog.md (97ec40d, wording only):

• Built-in tracks: the server has refused deleting them since September 1, so "which always refused them" is now "which already refuses them".
• changed in JSON: rollback and rollforward already reported changed before 1.6.128. The bullet now says set-track gained it.
• Token limits: only deleting the account or changing billing limits returns personal_access_token_forbidden. Session and key management are checked by the auth service, so the bullet no longer claims that code for them. The title now names the two limits.
• 1.6.128 fixes: split the credentials bullet. The change is that rate limits and other auth refusals no longer count as logged out. Also noted that the flavored macOS fix applies when --release-version isn't passed.
• Other clarifications: the Linux patch, --public-key-cmd (it also runs once per release now), cache clean --unused, and the promote title.

Build, cspell, Vale, and Prettier are clean.

[AbhishekDoshi26]

Third pass: checked every 1.6.125 to 1.6.128 release-note bullet against the entries, and checked the older entries against what changed since.

• debbb15: added an entry for the 1.6.128 flag renames from shorebird#4045. set-track now takes --release-version and --patch-number, init takes --org-id, and blank names are rejected. The old names still work as hidden aliases. This isn't in the 1.6.128 section of RELEASE_NOTES.md, so I found it in the source. The PR description now says to skim each release's commits too, and gives the new seed range (46 entries, through October 11).
• c47fb3a: the 1.6.127 patch number fix also covers patches promote, as the release notes say.

The older apps, channels, and rollback entries still match the CLI.

Separately, and not part of this PR: tracks.mdx and initialize.mdx still show the old set-track and init flag names. Those still work, but the pages should move to the new names in a follow-up.

[AbhishekDoshi26]

Fix round pushed in 19623c4. Each change was checked against the CLI tags, RELEASE_NOTES.md, or _shorebird.

Corrections:

• cli-errors-name-next-step: the --json hint only applies to the patch --force advice (the unknown-option path in the runner). Other errors in 1.6.125 go through ProcessExit, which writes no hint.
• personal-access-token-limits: dropped "manage your sessions and API keys". The auth service only ever accepted session tokens for those endpoints, so keys never had that ability. Also capitalized "Console".
• console-plan-page: moved the "Owned by you / Member of" bullet out. It shipped on 2026-09-17 (_shorebird #3101) and now has its own entry, console-whose-plan.
• apps-listed-once: added shorebird account apps, which shorebird apps list extends.
• linux-patches-match-releases: Linux has no doctor validators, so this now lists the real checks (logged in, project initialized, Linux host), the same ones shorebird release linux runs.
• consistent-flag-names: the blank-name check now names the commands that actually got it (init, channels create, and --track on patch and patches set-track). apps rename already rejected blank names in 1.6.127, so it's mentioned as prior behavior, not as new.
• json-precondition-failed: the hint is optional, so the text now says "when there's a known fix". Removed the docLink because the scripting page on main contradicts this entry until #714 lands.
• patches-promote-hidden: the docLink now goes to /code-push/patch/#set-patch-track instead of the tracks page, which starts with the deprecated promote.
• agent-instructions.txt: changelog line no longer says every entry has a CLI release. Console and API entries don't.

Additions:

• preview.mdx: added a --flavor row to the options table, using the help text from app_scoped_command.dart at v1.6.128.
• apple-layered-icons-asset-changes (1.6.120, #3899). AppleArchiveDiffer covers iOS, iOS framework, and macOS patches.
• android-missing-libapp (1.6.121, #3826): release and patch android now explain a bundle with no libapp.so, and a patch that skips some of the release's architectures warns about it.
• cli-fixes-1-6-128: added the INTERNET permission check fix (#4035).
• No entry for the 1.6.121 --shorebird-trace item. It's an internal flag the CLI passes to flutter build for build-trace telemetry, so users don't see it.

Cleanup: removed the em-dashes in api-keys.mdx.

Checks: astro check 0 errors, build passes link validation, and cspell, vale, and prettier are clean on the changed files.

[AbhishekDoshi26]

Fix round pushed in c5dc9e1. Each change was checked against the CLI tags, _shorebird, and the upstream Flutter and Dart changelogs.

• release-patch-json: removed the docLink to /code-push/ci/scripting/#json-output, which contradicts this entry until docs#714 lands (same call as json-precondition-failed).
• account/cli.mdx: the whoami example now matches v1.6.128 whoami_command.dart (adds Subscription:, Plan: pro), with the sentence after it updated. The Login section now describes the browser login, the printed fallback URL, the automatic code login over SSH, in CI, or on Linux without a display, and --device.
• personal-access-token-limits: retitled "API keys hold exactly their permission level". Keys were already refused account deletion (#1859) and overage changes (#2506), so only the error code is new (#3361). Full access keys gained audit logs and invitations (#3363). The summary also names sessions and API keys, which no key can manage, to match the Console and api-keys.mdx. The date stays 2026-10-10: the release-and-patch restriction (#3364) reached prod in the Deploy All run on that day, and the template dates API entries by the day they went live.
• flutter-3-47-4: the Device Support Symbols bullet now describes the Xcode 27 white-screen hang (flutter#189284). The Windows bullet now says blocked binaries give an actionable error instead of a crash (flutter#191899).
• flutter-3-47-2: hot reload ignored edits made within the same second (flutter#191198).
• flutter-3-47-3: the Dart 3.13.3 fix covers Windows-to-Linux cross-compilation with build hooks, and the PowerVR fix is Android only (flutter#181315).
• consistent-flag-names: init, channels create, and set-track already rejected empty names, so only whitespace-only rejection is new for them. patch --track had no check before, so it now also rejects an empty, whitespace-only, or over-128-character name (shorebird#4045).
• android-obfuscated-patches-older-flutter: the release check is iOS only (patchesLinkAgainstRelease), so the bullet now names release ios and release ios-framework.
• New cli-fixes-1-6-121: asset catalog toolchain versions (#3915), the legacy flutter.jar hint (#3820), the pubspec comment on init (#3911), signing-flag errors (#3923), and iOS patcher errors (#3926). The signing bullet says the errors now name the flag. They already exited with a usage error, and the both-flags case already named both flags, so the examples are the cases that changed.
• api-keys.mdx: the label is now "Release and patch only", as in the Console, and the plan line says "Available on paid plans" (apiKeyPermissions is on Pro, Business, and Enterprise).
• apps-listed-once: not changed. The MCP server's list_apps also calls GET /api/v1/apps, but the MCP server is documented only on the unlisted Zap page, so naming it here would surface it publicly.
• The PR description now says 50 entries and that server-side entries are dated by the day they went live.

Build: 0 errors, all internal links valid. cspell, vale, and prettier pass on the changed files.

[AbhishekDoshi26]

Fix round in 095a5a1, each item checked against source:

1. failed-patch-checks-for-replacement.md: retitled and reworded as suggested. The 1.6.121 engine (ee0ddce, flutter_release/3.47.3) already started the update thread in ConfigureShorebird, before any patch loaded. #164 (65e9873c5) and #166 (caee19377) both land between ee0ddce and 72bc686 (the 1.6.122 pin, head of flutter_release/3.47.4), so no CLI release shipped the suppression. 3.47.5 to 3.47.7 still start the thread from MaybeStartUpdateThread. The auto_update: false sentence holds because the start is still gated on ShouldAutoUpdate(). File name and docLink are unchanged.

2. login-oauth-pkce.md: dropped the login:ci bullet. login_ci_command.dart is unchanged between v1.6.124 and v1.6.125 and has pointed to API keys since #3775 (first in v1.6.100). api-keys.mdx doesn't tie that change to 1.6.125, so I left it alone.

3. cli-crash-fixes-1-6-127.md: "Four commands". #3982 touched both set_track_command.dart and promote_command.dart.

4. Dates now follow the first successful "Deploy All to Prod" run that contains the commit, as a US Pacific day. CLI entries already use Pacific: 1.6.125 was published 10-09T01:55Z and is dated 10-08. Changes:

   • console-plan-page 09-10 (2305b62d3; the whole billing stack, from c08d43716 to 76fde9db5, first shipped there)
   • console-change-track-superseded-patch 09-23 (8031a1b49)
   • console-app-list and console-invite-role 09-24 (468d0fa2a)
   • apps-listed-once 10-06 to 10-09. 75c9e96db merged on 10-06, but the next prod deploy after ac2e74c7e was 8d6e3d82e on 10-09.

   These already matched: default channels 09-01 (deployed 09-01 22:49 PDT), size analysis 09-02, whose plan 09-17, rate limits 10-04 (19:04 PDT), sessions 10-05 (auth deployed 19:49 PDT), and token limits 10-10 (#3364). legacy-login-tokens-retired stays 10-01: the cutoff is DateTime.utc(2026, 10) and that is the announced date. The template now states this rule, and the PR description is updated to match.

5. console-change-track-superseded-patch.md: the suggested wording was still a bit off. The old canEditPatch was also true for a rolled-back patch newer than the served one. Changed it to "hidden on any patch with a newer patch on its track that wasn't rolled back", which is exactly when canEditPatch returned false.

6. cli-fixes-1-6-128.md: applied as suggested. #4034 only changed ios_deploy.dart, and preview falls back to ios-deploy only for devices that devicectl doesn't handle (iOS 16 and earlier).

7. _template.md: the comment now says to delete all three docLink lines. A scratch entry with a bare docLink: failed the content schema. A copy of the template with all three lines deleted built and published. The scratch entry is removed. The template also now states the US Pacific dating rule.

Build: 0 errors, 0 warnings, all internal links valid. cspell and prettier are clean on the changed files.

[AbhishekDoshi26]

Fix round in 2d1f3aa (merged origin/main first, including #716). Each change was checked against the CLI tags, the private monorepo, and the Flutter fork.

• login-oauth-pkce.md: logout has revoked the server session since CLI 1.6.90 (shorebird#3653). 1.6.125 moved it to the standard revocation endpoint and added a warning when the server can't confirm the revocation. The summary now says that, and the title is now "More secure CLI sign-in".
• api-rate-limits.md: only code_push_server has the rate limit guard. Prod routes /api/v1/patches/* to code_push_updater_server, which has none. Changed "Every API response" to "API responses" and added "Patch checks from your app aren't rate limited."
• android-missing-libapp.md: in 1.6.120 only the release error pointed at ABI filters. The patch error didn't. The bullet now says so.
• macos-patches-resigned-apps.md: the fix is only in the engine pinned by 1.6.128 (flutter#172, shorebird/dev only), and the patcher falls back to whole-binary diffs without it. The caveat now mentions an older --flutter-version.
• ci/_authentication.mdx: login:ci was replaced by API keys in 1.6.100 (shorebird#3775), and its tokens stopped working on October 1, 2026 (server returns legacy_auth_retired). The tip now says this, matching /account/api-keys/. Also replaced the two em-dashes in that file.
• cli-fixes-1-6-121.md: added the resumable Flutter install fix (shorebird#3901, first in v1.6.121).
• cli-fixes-1-6-128.md: added the patch ios-framework release prompt (shorebird#4033, first in v1.6.128). It used to hard-error without --release-version, and now prompts through the same shared path as the other platforms.
• PR description: now mentions the _authentication.mdx change.

Build passes with 0 errors and all internal links valid. cspell, Prettier, and Vale are clean on the changed files.

[AbhishekDoshi26]

Fifth fresh review at 2d1f3aa found two small issues. Both are fixed in the latest commit:

• Missing entry: the Console's "Copy invitation link" button (_shorebird #3104) shipped with no entry. Added console-copy-invitation-link.md, dated 2026-09-21: that's the first prod deploy containing it (e33e669a4), counted as a US Pacific day like the other Console entries. The text matches copy-invitation-link-button.tsx: only the invited address can accept the link, after signing in with it.
• PR description: it named only one of the four docs pages this PR edits. It now lists api-keys.mdx, _authentication.mdx, cli.mdx and preview.mdx, and the entry count is 51.

Build: 0 errors in astro check, all internal links valid, and the new entry renders on /changelog/, /changelog.md and /changelog.xml.

[AbhishekDoshi26]

Round 6 fresh review at 484ce84 found no problems in the page, entries, template, agent files or docs edits. Its two findings were in the PR description: the build error format was overstated, and the agent-discovery changes weren't listed. Both are fixed. All 51 entries are checked against the CLI source and RELEASE_NOTES.md at each tag, the engine pins, _shorebird and its prod deploys, and the upstream Flutter and Dart changelogs. Every docLink exists and doesn't contradict its entry. Build: 0 errors in astro check, all internal links valid, and /changelog.md and the RSS feed each have 51 items (feed passes xmllint). CI is green.