Add September 4 changelog entry

[eclairen]

Summary

Adds the September 4 changelog entry, covering the window since the August 28 entry (August 27 – September 3).

Each bullet was checked against merged PRs and against what is actually live: production API commit, production MCP server deployment, the browser image pinned in prod, and published npm versions.

Corrections made to the draft

Five claims in the drafted entry did not survive verification and were changed or dropped:

• Dropped "request errors are self-describing" from the WebMCP bullet. The change is merged (kernel-images auth: dedicated page for health checks and re-auth #365, Sep 3 17:10 UTC) but is not in the deployed browser image — production runs kernel-cu-v64 / chromium-headless-v60 built from the Sep 2 release commit, and the change has not synced into the release branch. Worth re-adding once a new image ships.
• Dropped "field hints and masked MFA destinations" from the managed auth bullet. masked_destination and field hints shipped on August 12, three weeks outside this window. Only the docs for them landed here, which the documentation section already covers.
• Reworded the managed auth login clause. The draft credited the hosted account picker; the change is in the login agent (0.5.19/0.5.20), which now requires every visible field and auth choice on the auth surface — including controls in descendant frames — to be described before it pauses for input. The hosted UI only took a React version bump.
• Repointed the managed auth docs link to /auth/connection-lifecycle. /auth/overview has not changed since August 7; the refresh landed in connection-lifecycle, programmatic, credentials, and faq.
• Rewrote the MCP authentication bullet. Nothing was added to /reference/mcp-server/authentication. What shipped is an API-key path for clients whose strict RFC 9207 issuer verification rejects the OAuth flow, documented in troubleshooting.
• Removed the browser pool guides bullet. browsers/pools.mdx has not changed since August 12; no docs change in this window touched pools. The same claim already appears in the August 7 entry.

Still needs an author check

"verification returns authoritative tri-state outcomes" is left as drafted, but I could not tie it to a change in this window. Health-check status is two-state (AUTHENTICATED / NEEDS_AUTH), and the typed-outcome work is a canonical error-code set rather than a tri-state. If a specific behavior was meant here, it should be named; otherwise consider dropping the clause.

Not included

Verified-but-missing items are deliberately left out of this PR, per the request to fix only the identified problems. The notable one is that production browsers moved to Chromium 152.0.7977.64.

---

Note

Low Risk
Documentation-only changelog addition with no runtime or API behavior changes in this diff.

Overview
Adds a September 4 changelog block at the top of changelog.mdx, covering the release window since August 28.

Product bullets summarize shipped capabilities: broader WebMCP (browser discovery/invoke, MCP tools, session recovery), managed auth UX and login-agent coverage (typed errors, risk-aware reauth, nested frames), multi-host app deployments, captcha/challenge telemetry (captcha_solve_started, challenge_id), org-scoped OTLP destinations with dashboard controls, regional browser locale data, and MCP session lookup by name.

Documentation bullets link new or updated guides: Playwright + computer-use fallback cookbook, live view allowlist domains, captcha telemetry categories, refreshed managed auth (/auth/connection-lifecycle), and MCP API-key connection troubleshooting for strict OAuth clients.

^{Reviewed by Cursor Bugbot for commit ea40b57. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Sep 3, 2026, 11:52 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 3f8fd14. Configure here.}

[cursor]

Risk assessment: Very Low

Decision: Existing approval stands. Risk did not increase on this update, so approval is not revoked and is not re-issued.

Re-evaluated after the synchronize to ea40b57. The PR still touches only changelog.mdx (20 insertions, 0 deletions): one new <Update label="September 4"> block matching the existing changelog pattern.

• Codepaths: User-facing Mintlify changelog copy only. No application logic, APIs, auth, billing, config, prompts, or infrastructure.
• Blast radius: Isolated to the changelog page. No shared libraries or production runtime.
• Incremental change vs prior approval: One wording edit in the managed-auth bullet — dropped the “verification returns authoritative tri-state outcomes” clause. Scope stayed documentation-only; risk did not increase.
• CODEOWNERS: No CODEOWNERS file in this repo; no required owner review.
• Prior approval: This automation already approved 3f8fd14. Per policy, do not re-approve.

  

_{Sent by Cursor Automation: Assign PR reviewers}