docs: keep a CHANGELOG.md, with one entry file per PR

Release notes were written by hand on GitHub at tag time, so the contents
of a stacked release had to be pieced together from every PR, and output
changes that scripts and agents rely on were easy to miss.

- CHANGELOG.md backfills every published release (0.2.0 to 0.4.0) from its
  GitHub notes, verbatim.
- A PR adds changes/unreleased/<branch-name>.md instead of editing
  CHANGELOG.md, so stacked PRs never conflict. changes/README.md gives the
  sections, including Output Changes for JSON, MCP and error-code changes.
- scripts/changelog.sh: `check` validates entries and CHANGELOG.md,
  `release X.Y.Z` folds the entries into a new section (ordered by PR), and
  `notes X.Y.Z` prints a section as GitHub release notes.
- The release workflow sets the GitHub notes from the tag's section.
- New flake check `changelog` runs scripts/changelog-test.sh; both scripts
  are shellchecked.
- Entries for 0.5.0: #73, #74, #75, #78, #79, #80, #81 and this PR.

Claude-Session: https://claude.ai/code/session_01RqPPVeVDrnLoP7NUZmLRxY

changes/README.md

@@ -0,0 +1,39 @@
+# Changelog entries
+
+Every pull request that changes what users or agents see adds one file here,
+`changes/unreleased/<branch-name>.md`; for example, `fix/mcp-warnings` adds
+`changes/unreleased/mcp-warnings.md`. Each PR has its own file, so stacked PRs
+never conflict over the changelog. Internal refactors, CI-only and test-only
+changes need no entry.
+
+An entry holds `### <section>` headings with one bullet per change. Write each
+bullet as one sentence for the user, saying what changed for them, and end it
+with the PR number:
+
+```markdown
+### Bug Fixes
+
+- `ownership import` reads IDX's register from October 2026 on, which adds a `CONTROLLER_OR_AFFILIATE` column. (#79)
+```
+
+The sections, in the order a release lists them:
+
+| Section | For |
+| --- | --- |
+| `Security` | vulnerabilities, with what an attacker could do |
+| `New Features` | new commands, tools, flags and providers |
+| `Bug Fixes` | wrong output, crashes, failures |
+| `Improvements` | speed, robustness, help text, distribution |
+| `Output Changes` | any change to JSON fields, MCP results, error codes or exit codes that scripts and agents read; start a breaking one with **Breaking:** |
+| `Docs` | user-facing documentation |
+| `Testing` | what was verified, when a release needs to say so |
+| `Notes` | dependencies, requirements, known limits |
+
+A release may add `changes/unreleased/summary.md`: a short paragraph with no
+headings that opens its notes, such as "**Upgrade from 0.3.2**: ...".
+
+`scripts/changelog.sh check` (part of `nix flake check`) validates the entries.
+At release time, `scripts/changelog.sh release X.Y.Z` folds them into a new
+section of [`CHANGELOG.md`](../CHANGELOG.md) and deletes them; edit the section
+if needed and commit it with the version bump. The release workflow publishes
+that section as the GitHub release notes.

changes/unreleased/changelog.md

@@ -0,0 +1,3 @@
+### Docs
+
+- `CHANGELOG.md` records every release since 0.2.0, and each release's GitHub notes come from it. (#82)

changes/unreleased/macos-15-runners.md

@@ -0,0 +1,3 @@
+### Improvements
+
+- CI and the release build macOS binaries on `macos-15` runners, since GitHub retired `macos-14`. (#75)

changes/unreleased/mcp-warnings.md

@@ -0,0 +1,7 @@
+### Output Changes
+
+- MCP answers and errors carry `warnings` when idx worked around something the CLI warns about on stderr: history that fell back to Yahoo, a stale cache entry and the failure behind it, or a shareholder movements query cut short. (#81)
+
+### Improvements
+
+- The stale-cache warning names the failure that caused it, for example `network failed (provider unavailable), serving stale cache for BBCA.JK`. (#81)

changes/unreleased/ownership-xlsx-controller-column.md

@@ -0,0 +1,3 @@
+### Bug Fixes
+
+- `ownership import` reads IDX's above-1% register from October 2026 on, which adds a `CONTROLLER_OR_AFFILIATE` column; 0.4.0 rejects these files with `PARSEERROR`. Any other unknown column is still rejected. (#79)

changes/unreleased/stockbit-corpaction.md

@@ -0,0 +1,5 @@
+### New Features
+
+- `idx stocks actions` and `get_corporate_actions` list one stock's corporate actions from your Stockbit session, newest first: cash and stock dividends, bonus shares, rights issues, warrants, splits and reverse splits, shareholders' meetings, public exposes and tender offers. `--kind` picks kinds, and `--kind ipo` adds the stock's IPO. (#78)
+- `idx stocks calendar` and `get_corporate_calendar` list the market's actions dated in a range, oldest first: by default today and the next 30 days, at most 366 days. (#78)
+- An action's `date` is its cum date where there is an entitlement (dividends, bonuses, rights, splits), else the event's first day. Where Stockbit gives only an ex date, the table marks it `(ex)`. Dividends paid in another currency carry `currency`. (#78)

changes/unreleased/stockbit-login.md

@@ -0,0 +1,11 @@
+### New Features
+
+- `idx stockbit login`, `status` and `logout` sign in with your own Stockbit account. On a desktop, idx opens a browser window on Stockbit's sign-in page; over SSH or with `--no-browser`, a page on 127.0.0.1 takes the session from your own browser. idx never sees your password, stores the session with mode 0600, and refreshes it under a lock so concurrent processes never spend it twice. (#74)
+- `idx stocks orderbook` and `get_orderbook` show a stock's order book: the depth ladder, OHLC, value, trades and foreign flow, and whether the book is live. (#74)
+- With a session, `--provider stockbit` quotes come from Stockbit's session API, and price history from 5 days to 1 year uses Stockbit's daily charts (`--history-provider stockbit`, or `auto` under the stockbit provider). If Stockbit refuses the session, `auto` falls back to Yahoo with a warning. (#74)
+- MCP: `stockbit_login` starts a sign-in and answers at once, and `stockbit_status` reports it: `sign_in.state` (waiting, signed_in or failed), plus `sign_in.warning` while it waits, for example when Stockbit refuses the session. (#74)
+
+### Notes
+
+- New dependency in idx-core: `base64` 0.22. (#74)
+- Google sign-in does not work in idx's browser window; sign in with your password there, or use the local page (`idx stockbit login --no-browser`). (#74)

changes/unreleased/stockbit-movements.md

@@ -0,0 +1,7 @@
+### New Features
+
+- `idx ownership movements` and `get_shareholder_movements` list reported changes in insiders' and major holders' stakes from your Stockbit session, newest first. `IDX` rows are insider disclosures with the trade price; `KSEI` rows are holders at 5% and above, with a price Stockbit estimates. Stockbit filters by date, holder, action and source, and `--pages` reads up to 10 pages of 50 rows. If a later page fails, you get the rows read before it, with `incomplete` saying why. (#80)
+
+### Improvements
+
+- The `ownership` commands honour `--offline` and `--no-cache`; only `movements` uses them. (#80)

changes/unreleased/stockbit.md

@@ -0,0 +1,14 @@
+### New Features
+
+- `idx stocks intraday` and the MCP tool `get_intraday` show today's session by the minute from Stockbit's public page, for stocks and the `IHSG` and `LQ45` indices: the quote, the best bid and offer while the market is open, and a sparkline. No login is needed. (#73)
+- `--provider stockbit` (or `IDX_PROVIDER=stockbit`, or `general.provider`) serves quotes from Stockbit, with bid, offer and market status. History stays on Yahoo, and the MSN-only commands answer `UNSUPPORTED`. (#73)
+
+### Output Changes
+
+- New error code `UPSTREAMBLOCKED` (exit 4): a site's CDN refused idx, so the request is not retried. (#73)
+- Under the stockbit provider, quotes carry `market_status` (`open` or `close`), `bid` and `offer` (while the market is open) and `session_note`. MSN and Yahoo output is unchanged. (#73, #74)
+- `stocks intraday` marks a chart from before the latest session with `behind_session`, as quotes do. (#73)
+
+### Notes
+
+- Stockbit's terms allow personal, non-commercial use, and its data is delayed at least 10 minutes. idx sends at most one request a second across all its processes. See the [Stockbit page](https://idx.rasyidanaf.com/cli/stockbit/). (#73)

changes/unreleased/summary.md

@@ -0,0 +1 @@
+Stockbit data: intraday and quotes without a login, and with your own Stockbit session the order book, daily history, corporate actions and shareholder movements. **Upgrade from 0.4.0** to import IDX's ownership register from October 2026 on.