diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 184a2134d4..d749ec82f6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,13 +33,14 @@ jobs:
       code: ${{ steps.filter.outputs.code }}
       desktop: ${{ steps.filter.outputs.desktop }}
       sdk: ${{ steps.filter.outputs.sdk }}
+      scripts: ${{ steps.filter.outputs.scripts }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - id: filter
         run: |
-          code=true; desktop=true; sdk=true
+          code=true; desktop=true; sdk=true; scripts=true
           base=""
           if [ "${{ github.event_name }}" = "pull_request" ]; then
             base="${{ github.event.pull_request.base.sha }}"
@@ -49,7 +50,7 @@ jobs:
           if [ -n "$base" ] && git cat-file -e "$base^{commit}" 2>/dev/null; then
             files=$(git diff --name-only "$base" HEAD)
             if [ -n "$files" ]; then
-              code=false; desktop=false; sdk=false
+              code=false; desktop=false; sdk=false; scripts=false
               # Root-module CI: desktop/ is a separate module, so only the
               # clearly unrelated paths below can skip it.
               if echo "$files" | grep -qvE '^(docs/|release-notes/|desktop/|workers/|[^/]+\.md$)'; then code=true; fi
@@ -60,9 +61,26 @@ jobs:
               # its DTOs are generated from internal/ext/extension/protocol, so
               # both paths must trigger the sdk job.
               if echo "$files" | grep -qE '^(sdk/|internal/ext/extension/)'; then sdk=true; fi
+              # The release-note tests render every committed Studio note.
+              if echo "$files" | grep -qE '^(scripts/|release-notes/studio/)'; then scripts=true; fi
             fi
           fi
-          { echo "code=$code"; echo "desktop=$desktop"; echo "sdk=$sdk"; } >> "$GITHUB_OUTPUT"
+          { echo "code=$code"; echo "desktop=$desktop"; echo "sdk=$sdk"; echo "scripts=$scripts"; } >> "$GITHUB_OUTPUT"
+
+  release-notes-scripts:
+    needs: changes
+    if: always() && (github.event_name != 'pull_request' || needs.changes.outputs.scripts != 'false')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: "22"
+      - run: node --test scripts/release-credits.test.mjs scripts/markdown-refs.test.mjs scripts/studio-release-notes.test.mjs
 
   # The ruleset requires the per-OS check names (test (ubuntu-latest) etc.).
   # A matrix job skipped at job level reports no per-leg checks at all, so
diff --git a/.github/workflows/release-studio.yml b/.github/workflows/release-studio.yml
index 5488a78d52..845cc93e24 100644
--- a/.github/workflows/release-studio.yml
+++ b/.github/workflows/release-studio.yml
@@ -545,11 +545,25 @@ jobs:
     environment: studio-release
     permissions:
       contents: write
+      issues: read # release-notes credits read PR and issue authors
+      pull-requests: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ needs.resolve.outputs.sha }}
 
+      # Before signing, so a credit lookup GitHub cannot answer stops the
+      # release while nothing has been published.
+      - name: Render version notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.resolve.outputs.version }}
+        run: |
+          version_notes="release-notes/studio/${VERSION#v}.md"
+          if [ -f "$version_notes" ]; then
+            node scripts/studio-release-notes.mjs "$version_notes" "$RUNNER_TEMP/version-notes.md"
+          fi
+
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: desktop/go.mod
@@ -650,13 +664,14 @@ jobs:
           SIGNED_WINDOWS: ${{ secrets.SIGNPATH_API_TOKEN != '' && vars.STUDIO_SIGNING_ENABLED == 'true' }}
         run: |
           # A version's own notes live in release-notes/studio/<semver>.md, named
-          # without the v the tag carries. The release still publishes without
-          # one, carrying only the standing text.
+          # without the v the tag carries, and were rendered with their authors
+          # above. The release still publishes without one, carrying only the
+          # standing text.
           version_notes="release-notes/studio/${VERSION#v}.md"
           notes="$RUNNER_TEMP/release-notes.md"
           : > "$notes"
           if [ -f "$version_notes" ]; then
-            cat "$version_notes" >> "$notes"
+            cat "$RUNNER_TEMP/version-notes.md" >> "$notes"
             printf '\n' >> "$notes"
           else
             echo "::warning::no $version_notes; publishing the standing text only"
diff --git a/docs/STUDIO_RELEASE.md b/docs/STUDIO_RELEASE.md
index 23f8f3d13e..ed57926625 100644
--- a/docs/STUDIO_RELEASE.md
+++ b/docs/STUDIO_RELEASE.md
@@ -55,7 +55,7 @@ Jobs in the run:
 | `signing-contract` | Validates `.signpath/` locally and prints its fingerprint. | does not call SignPath |
 | `build` | Builds windows/amd64, darwin/amd64, darwin/arm64, linux/amd64; signs macOS and, if enabled, Windows. | Apple secrets are required |
 | `cli` | Builds `reasonix` archives for six OS/arch targets plus `SHA256SUMS`. | fails on a missing archive |
-| `publish` | Minisigns, writes `latest.json`, creates the GitHub prerelease, mirrors to R2. | environment `studio-release` |
+| `publish` | Renders the notes with their authors, minisigns, writes `latest.json`, creates the GitHub prerelease, mirrors to R2. | environment `studio-release`; an unresolved `#N` stops it before signing |
 
 The `studio-release` environment allows the `studio-v*` tag and the `studio` branch. It has no required reviewer.
 
@@ -92,6 +92,19 @@ File: `release-notes/studio/X.Y.Z.md`, without the tag's `v`. Language: Chinese.
 | R4 | Every item names its issue (`#123`), pull request or commit. |
 | R5 | Describe what the user observes. The explanation belongs in the linked commit. |
 
+The published body is rendered, not copied:
+
+| Reference | Rendered as |
+| --- | --- |
+| `#N`, a pull request | `#N by @author` |
+| `#N`, an issue closed by merged pull requests | `#N fixed in #M by @author` |
+| `#N`, an issue fixed by a direct push; a commit; a bot author | as written |
+| `#N`, a discussion or no such number | as written, with a warning |
+
+A `## 贡献者` list of the credited authors closes the notes. A `#N` counts only at a line start or after whitespace, `(`, `（`, `、`, `，` or `,`, and never in code, an HTML comment or a link target. Write colours such as `#333` in a code span.
+
+A lookup GitHub refuses, or cannot answer after retries, fails `publish` with a `release_credits.*` code. Preview with `node scripts/studio-release-notes.mjs release-notes/studio/X.Y.Z.md /tmp/notes.md`; it reads `GH_TOKEN`, else `gh auth token`.
+
 ```markdown
 本版修复读图模型误报看不到图，并让被 ACL 残留阻塞的 Windows 安装恢复启动。
 
diff --git a/scripts/markdown-refs.mjs b/scripts/markdown-refs.mjs
new file mode 100644
index 0000000000..e1bad4371a
--- /dev/null
+++ b/scripts/markdown-refs.mjs
@@ -0,0 +1,89 @@
+// Finds the #N references in Markdown prose. A number counts only where a
+// reference is written: at the start of a line, or after whitespace, "(", "（"
+// or a list separator ("、", "，", ","). Fenced and indented code, code spans,
+// HTML comments, link targets ("](#N") and escaped "\#N" are never references.
+
+const refPattern = /(?<=^|[\s（、，,]|(?<!\])\()#(\d+)(?![\w-])/g;
+const codeSpanPattern = /(`+)[\s\S]*?\1/g;
+const listItemPattern = /^ {0,3}(?:[-*+]|\d+[.)])(?:\s|$)/;
+const masked = "\u0001";
+
+function mask(text, start, end) {
+  return text.slice(0, start) + masked.repeat(end - start) + text.slice(end);
+}
+
+// Returns, per line, the text with every non-prose span replaced by a
+// same-length run of a non-space placeholder, so match offsets still index the
+// original line and a placeholder never reads as the whitespace a ref needs.
+function proseLines(markdown) {
+  const lines = markdown.split("\n");
+  let fence = null;
+  let comment = false;
+  let previousBlank = true;
+  let previousCode = false;
+  let inList = false;
+  return lines.map((line) => {
+    const blank = line.trim() === "";
+    const opening = /^ {0,3}(`{3,}|~{3,})/.exec(line);
+    if (fence) {
+      const closing = /^ {0,3}(`{3,}|~{3,})\s*$/.exec(line);
+      if (closing && closing[1][0] === fence[0] && closing[1].length >= fence.length) fence = null;
+      previousBlank = false;
+      return masked.repeat(line.length);
+    }
+    if (opening && !comment) {
+      fence = opening[1];
+      previousBlank = false;
+      return masked.repeat(line.length);
+    }
+    const indented = /^( {4}|\t)/.test(line);
+    if (!comment && indented && !inList && (previousBlank || previousCode)) {
+      previousCode = true;
+      previousBlank = false;
+      return masked.repeat(line.length);
+    }
+    previousCode = false;
+    if (listItemPattern.test(line)) inList = true;
+    else if (!blank && !indented) inList = false;
+    previousBlank = blank;
+
+    let text = line;
+    for (const match of text.matchAll(codeSpanPattern)) {
+      if (!comment) text = mask(text, match.index, match.index + match[0].length);
+    }
+    let from = 0;
+    while (from <= text.length) {
+      if (comment) {
+        const end = text.indexOf("-->", from);
+        if (end === -1) return mask(text, from, text.length);
+        text = mask(text, from, end + 3);
+        from = end + 3;
+        comment = false;
+      }
+      const start = text.indexOf("<!--", from);
+      if (start === -1) break;
+      comment = true;
+      from = start;
+    }
+    return text;
+  });
+}
+
+export function markdownRefs(markdown) {
+  return proseLines(markdown).flatMap((prose) => [...prose.matchAll(refPattern)].map((match) => Number(match[1])));
+}
+
+// Appends suffixFor(N) after each reference; everything else is left byte for byte.
+export function annotateMarkdown(markdown, suffixFor) {
+  const source = markdown.split("\n");
+  return proseLines(markdown)
+    .map((prose, index) => {
+      let line = source[index];
+      for (const match of [...prose.matchAll(refPattern)].reverse()) {
+        const end = match.index + match[0].length;
+        line = line.slice(0, end) + suffixFor(Number(match[1])) + line.slice(end);
+      }
+      return line;
+    })
+    .join("\n");
+}
diff --git a/scripts/markdown-refs.test.mjs b/scripts/markdown-refs.test.mjs
new file mode 100644
index 0000000000..7ae5b2c12d
--- /dev/null
+++ b/scripts/markdown-refs.test.mjs
@@ -0,0 +1,66 @@
+import assert from "node:assert/strict";
+import { readdir, readFile } from "node:fs/promises";
+import { test } from "node:test";
+import { annotateMarkdown, markdownRefs } from "./markdown-refs.mjs";
+
+const tag = (ref) => `<${ref}>`;
+
+test("a reference is written at line start or after whitespace, a parenthesis or a list separator", () => {
+  const source = ["#1 修复", "- 见 #2", "- 修复（#3、#4）与 (#5, #6)，#7", "- 列表(#8,#9)"].join("\n");
+  assert.deepEqual(markdownRefs(source), [1, 2, 3, 4, 5, 6, 7, 8, 9]);
+  assert.equal(
+    annotateMarkdown(source, tag),
+    ["#1<1> 修复", "- 见 #2<2>", "- 修复（#3<3>、#4<4>）与 (#5<5>, #6<6>)，#7<7>", "- 列表(#8<8>,#9<9>)"].join("\n"),
+  );
+});
+
+test("colours, entities, paths, anchors and escapes are not references", () => {
+  const source = [
+    "- 颜色#333 与 color:#123456 与 #333abc 与 #12-a",
+    "- &#10; 与 a/#11 与 \\#12 与 [段落](#13) 与 [见](https://x/#14)",
+  ].join("\n");
+  assert.deepEqual(markdownRefs(source), []);
+  assert.equal(annotateMarkdown(source, tag), source);
+});
+
+test("code spans, fences of either kind and indented code are skipped", () => {
+  const source = [
+    "- `#1` 与 ``a `#2` b`` 之外 #3",
+    "```",
+    "#4",
+    "~~~",
+    "#5",
+    "```",
+    "#6",
+    "~~~~",
+    "#7",
+    "```",
+    "#8",
+    "~~~~~",
+    "#9",
+    "",
+    "    #10 indented code",
+    "    #11 still code",
+    "#12",
+  ].join("\n");
+  assert.deepEqual(markdownRefs(source), [3, 6, 9, 12]);
+});
+
+test("indentation inside a list item is a continuation, not code", () => {
+  const source = ["- 第一项", "", "    续行提到 #1", "", "段落", "", "    #2 is code"].join("\n");
+  assert.deepEqual(markdownRefs(source), [1]);
+});
+
+test("HTML comments hide references on one line or across several", () => {
+  const source = ["- 可见 #1 <!-- 隐藏 #2 --> 可见 #3", "<!--", "#4", "隐藏 #5 -->", "#6 <!-- #7"].join("\n");
+  assert.deepEqual(markdownRefs(source), [1, 3, 6]);
+});
+
+test("annotating leaves every other byte in place", async () => {
+  const dir = new URL("../release-notes/studio/", import.meta.url);
+  for (const name of await readdir(dir)) {
+    const source = await readFile(new URL(name, dir), "utf8");
+    assert.equal(annotateMarkdown(source, () => ""), source, name);
+    assert.equal(annotateMarkdown(source, tag).replace(/<\d+>/g, ""), source, name);
+  }
+});
diff --git a/scripts/release-credits.mjs b/scripts/release-credits.mjs
new file mode 100644
index 0000000000..49063e5173
--- /dev/null
+++ b/scripts/release-credits.mjs
@@ -0,0 +1,241 @@
+// Resolves the #N references in release notes to the people they credit: a
+// pull request's author, or for an issue the authors of the merged pull
+// requests that closed it. A number that names a discussion or nothing stays
+// plain with a warning; a lookup GitHub could not answer fails by code.
+
+import { execFileSync } from "node:child_process";
+
+export const defaultRepository = "esengine/DeepSeek-Reasonix";
+
+export const CreditErrorCode = Object.freeze({
+  noToken: "release_credits.no_token",
+  unreachable: "release_credits.api_unreachable",
+  status: "release_credits.api_status",
+  notFound: "release_credits.ref_not_found",
+  discussion: "release_credits.ref_is_discussion",
+  unresolved: "release_credits.unresolved",
+});
+
+export class CreditError extends Error {
+  constructor(code, message, { ref, failures } = {}) {
+    super(message);
+    this.name = "CreditError";
+    this.code = code;
+    if (ref !== undefined) this.ref = ref;
+    if (failures !== undefined) this.failures = failures;
+  }
+}
+
+const botLogins = new Set(["github-actions", "dependabot", "dependabot-preview"]);
+
+export function isBotAccount(login, type) {
+  if (type === "Bot") return true;
+  const name = String(login).toLowerCase();
+  return name.endsWith("[bot]") || botLogins.has(name);
+}
+
+export function tokenFromEnvironment(env = process.env, runGh = defaultRunGh) {
+  const token = env.GH_TOKEN || env.GITHUB_TOKEN;
+  if (token) return token;
+  try {
+    const fromGh = runGh().trim();
+    if (fromGh) return fromGh;
+  } catch {
+    // gh missing or signed out; reported below as no_token.
+  }
+  throw new CreditError(
+    CreditErrorCode.noToken,
+    "no GitHub token: set GH_TOKEN (in CI: ${{ github.token }}), or sign in with `gh auth login`",
+  );
+}
+
+function defaultRunGh() {
+  return execFileSync("gh", ["auth", "token"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+}
+
+const refQuery = `query($owner: String!, $name: String!, $number: Int!) {
+  repository(owner: $owner, name: $name) {
+    discussion(number: $number) { number }
+    issueOrPullRequest(number: $number) {
+      __typename
+      ... on PullRequest { author { login __typename } }
+      ... on Issue {
+        closedByPullRequestsReferences(first: 20, includeClosedPrs: true) {
+          nodes { number merged author { login __typename } }
+        }
+        timelineItems(itemTypes: [CLOSED_EVENT], last: 1) {
+          nodes { ... on ClosedEvent { closer { __typename ... on PullRequest { number merged author { login __typename } } } } }
+        }
+      }
+    }
+  }
+}`;
+
+function person(author) {
+  if (!author) return { login: null, bot: true };
+  return { login: author.login, bot: isBotAccount(author.login, author.__typename) };
+}
+
+// An issue's fixers are the merged pull requests GitHub links to it as closing
+// it: the one that closed it, and any linked by a closing keyword or by hand.
+// A mere mention is not a fix, so cross-references are not read.
+function issueFixes(issue) {
+  const closer = issue.timelineItems?.nodes?.[0]?.closer;
+  const candidates = [...(issue.closedByPullRequestsReferences?.nodes || [])];
+  if (closer?.__typename === "PullRequest") candidates.push(closer);
+  const fixes = new Map();
+  for (const pull of candidates) {
+    if (pull?.merged && !fixes.has(pull.number)) fixes.set(pull.number, { number: pull.number, ...person(pull.author) });
+  }
+  return [...fixes.values()].sort((a, b) => a.number - b.number);
+}
+
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// A 5xx, a 429, a 403 that carries rate-limit headers, a GraphQL RATE_LIMITED
+// error or a dropped connection is transient; anything else is final.
+function retryDelay(response, payload, attempt) {
+  const backoff = 1000 * 2 ** attempt;
+  if (!response) return backoff;
+  const header = (name) => response.headers?.get?.(name) ?? null;
+  const after = header("retry-after") === null ? null : Number(header("retry-after"));
+  const limited =
+    response.status === 429 ||
+    (response.status === 403 && (after !== null || header("x-ratelimit-remaining") === "0")) ||
+    payload?.errors?.some((error) => error.type === "RATE_LIMITED");
+  if (!limited && response.status < 500) return null;
+  return after > 0 ? Math.min(after * 1000, 60_000) : backoff;
+}
+
+// Returns an async lookup: number -> { kind: "pull", login, bot } |
+// { kind: "issue", fixes: [{ number, login, bot }] } | { kind: "discussion" } |
+// { kind: "missing" }.
+export function githubRefLookup({
+  repository = defaultRepository,
+  token,
+  fetchImpl = fetch,
+  sleep = defaultSleep,
+  attempts = 4,
+} = {}) {
+  const [owner, name] = repository.split("/");
+  const headers = { "Content-Type": "application/json", "User-Agent": "reasonix-release-credits" };
+  if (token) headers.Authorization = `Bearer ${token}`;
+  const body = (ref) => JSON.stringify({ query: refQuery, variables: { owner, name, number: ref } });
+
+  async function query(ref) {
+    for (let attempt = 0; ; attempt += 1) {
+      let response = null;
+      let payload = null;
+      let failure;
+      try {
+        response = await fetchImpl("https://api.github.com/graphql", { method: "POST", headers, body: body(ref) });
+        if (response.ok) payload = await response.json();
+        if (response.ok && !payload.errors?.some((error) => error.type === "RATE_LIMITED")) return payload;
+        const why = response.ok ? "GraphQL RATE_LIMITED" : `status ${response.status}`;
+        failure = new CreditError(CreditErrorCode.status, `#${ref}: GitHub API answered ${why}`, { ref });
+      } catch (error) {
+        if (error instanceof CreditError) throw error;
+        response = null;
+        failure = new CreditError(CreditErrorCode.unreachable, `#${ref}: GitHub API unreachable (${error.message})`, { ref });
+      }
+      const delay = retryDelay(response, payload, attempt);
+      if (delay === null || attempt + 1 >= attempts) throw failure;
+      await sleep(delay);
+    }
+  }
+
+  return async (ref) => {
+    const payload = await query(ref);
+    const repositoryNode = payload.data?.repository;
+    const node = repositoryNode?.issueOrPullRequest;
+    if (node?.__typename === "PullRequest") return { kind: "pull", ...person(node.author) };
+    if (node?.__typename === "Issue") return { kind: "issue", fixes: issueFixes(node) };
+    const errors = payload.errors || [];
+    if (repositoryNode && errors.every((error) => error.type === "NOT_FOUND")) {
+      return { kind: repositoryNode.discussion ? "discussion" : "missing" };
+    }
+    const types = errors.map((error) => error.type || "unknown").join(", ") || "empty response";
+    throw new CreditError(CreditErrorCode.status, `#${ref}: GitHub GraphQL returned no node (${types})`, { ref });
+  };
+}
+
+// Looks each distinct ref up once. Failures are collected, not thrown, so the
+// caller can still render every ref it has and then fail with all of them. A
+// discussion or a number that names nothing is a warning, not a failure.
+export async function resolveCredits(refs, lookup, { concurrency = 6 } = {}) {
+  const distinct = [...new Set(refs)];
+  const outcomes = new Array(distinct.length);
+  let next = 0;
+  async function worker() {
+    while (next < distinct.length) {
+      const index = next++;
+      try {
+        outcomes[index] = { credit: await lookup(distinct[index]) };
+      } catch (error) {
+        if (!(error instanceof CreditError)) throw error;
+        outcomes[index] = { failure: { ref: distinct[index], code: error.code, message: error.message } };
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, distinct.length) }, worker));
+  const credits = new Map();
+  const failures = [];
+  const warnings = [];
+  distinct.forEach((ref, index) => {
+    const { credit, failure } = outcomes[index];
+    if (failure) return failures.push(failure);
+    credits.set(ref, credit);
+    if (credit.kind === "discussion") {
+      warnings.push({ ref, code: CreditErrorCode.discussion, message: `#${ref} is a discussion; left uncredited` });
+    } else if (credit.kind === "missing") {
+      warnings.push({ ref, code: CreditErrorCode.notFound, message: `#${ref} names no issue, pull request or discussion; left uncredited` });
+    }
+  });
+  return { credits, failures, warnings };
+}
+
+export function reportWarnings(warnings, { env = process.env, write = (line) => console.error(line) } = {}) {
+  const prefix = env.GITHUB_ACTIONS === "true" ? "::warning::" : "warning: ";
+  for (const warning of warnings) write(`${prefix}${warning.code} ${warning.message}`);
+}
+
+export function unresolvedError(failures) {
+  const lines = failures.map((failure) => `  ${failure.code} ${failure.message}`);
+  return new CreditError(
+    CreditErrorCode.unresolved,
+    `${failures.length} reference(s) could not be credited:\n${lines.join("\n")}`,
+    { failures },
+  );
+}
+
+function humanLogin(person) {
+  return person.login && !person.bot ? person.login : null;
+}
+
+export function creditedLogins(credit) {
+  if (credit?.kind === "pull") return [humanLogin(credit)].filter(Boolean);
+  if (credit?.kind === "issue") return credit.fixes.map(humanLogin).filter(Boolean);
+  return [];
+}
+
+// " by @a" for a pull request, " fixed in #2 by @a and #3" for an issue.
+export function creditSuffix(credit) {
+  const by = (person) => (humanLogin(person) ? ` by @${person.login}` : "");
+  if (credit?.kind === "pull") return by(credit);
+  if (credit?.kind !== "issue" || !credit.fixes.length) return "";
+  return ` fixed in ${credit.fixes.map((fix) => `#${fix.number}${by(fix)}`).join(" and ")}`;
+}
+
+// Unique human logins in the order their refs first appear.
+export function contributorLogins(refs, credits) {
+  const logins = [];
+  const seen = new Set();
+  for (const ref of refs) {
+    for (const login of creditedLogins(credits.get(ref))) {
+      if (isBotAccount(login) || seen.has(login.toLowerCase())) continue;
+      seen.add(login.toLowerCase());
+      logins.push(login);
+    }
+  }
+  return logins;
+}
diff --git a/scripts/release-credits.test.mjs b/scripts/release-credits.test.mjs
new file mode 100644
index 0000000000..0b90fda693
--- /dev/null
+++ b/scripts/release-credits.test.mjs
@@ -0,0 +1,218 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  contributorLogins,
+  CreditError,
+  CreditErrorCode,
+  creditSuffix,
+  githubRefLookup,
+  isBotAccount,
+  reportWarnings,
+  resolveCredits,
+  tokenFromEnvironment,
+  unresolvedError,
+} from "./release-credits.mjs";
+
+function jsonResponse(status, body, headers = {}) {
+  return {
+    status,
+    ok: status >= 200 && status < 300,
+    headers: { get: (name) => headers[name] ?? null },
+    json: async () => body,
+  };
+}
+
+// routes: number -> node | "discussion" | Error | [status, body, headers] |
+// an array of those, answered in turn; a missing number is NOT_FOUND.
+function fakeGitHub(routes) {
+  const calls = [];
+  const fetchImpl = async (url, init) => {
+    const { variables } = JSON.parse(init.body);
+    calls.push({ url, init, variables });
+    let route = routes[variables.number];
+    if (route?.sequence) route = route.sequence.shift();
+    if (route instanceof Error) throw route;
+    if (Array.isArray(route)) return jsonResponse(...route);
+    if (route && route !== "discussion") {
+      return jsonResponse(200, { data: { repository: { discussion: null, issueOrPullRequest: route } } });
+    }
+    const errors = [{ type: "NOT_FOUND", message: "Could not resolve" }];
+    if (!route) errors.push({ type: "NOT_FOUND", message: "Could not resolve" });
+    return jsonResponse(200, {
+      data: { repository: { discussion: route ? { number: variables.number } : null, issueOrPullRequest: null } },
+      errors,
+    });
+  };
+  return { calls, fetchImpl };
+}
+
+const noSleep = { sleep: async () => {} };
+
+const user = (login, type = "User") => ({ login, __typename: type });
+const pull = (login, type) => ({ __typename: "PullRequest", author: user(login, type) });
+const linked = (number, login, merged = true, type) => ({ number, merged, author: user(login, type) });
+const issue = (references = [], closer = null) => ({
+  __typename: "Issue",
+  closedByPullRequestsReferences: { nodes: references },
+  timelineItems: { nodes: closer ? [{ closer }] : [] },
+});
+
+test("a pull request credits its author", async () => {
+  const { calls, fetchImpl } = fakeGitHub({ 1: pull("alice") });
+  const lookup = githubRefLookup({ repository: "o/r", token: "t", fetchImpl });
+  assert.deepEqual(await lookup(1), { kind: "pull", login: "alice", bot: false });
+  assert.equal(calls[0].url, "https://api.github.com/graphql");
+  assert.equal(calls[0].init.headers.Authorization, "Bearer t");
+  assert.deepEqual(calls[0].variables, { owner: "o", name: "r", number: 1 });
+});
+
+test("an issue credits the merged pull requests that closed it, and nothing else", async () => {
+  const { fetchImpl } = fakeGitHub({
+    2: issue([linked(12, "bob"), linked(11, "carol", false)], { __typename: "PullRequest", ...linked(10, "alice") }),
+    3: issue([], { __typename: "Commit" }),
+    4: issue([linked(14, "bob"), linked(14, "bob")], { __typename: "PullRequest", ...linked(14, "bob") }),
+  });
+  const lookup = githubRefLookup({ repository: "o/r", fetchImpl });
+  assert.deepEqual(await lookup(2), {
+    kind: "issue",
+    fixes: [
+      { number: 10, login: "alice", bot: false },
+      { number: 12, login: "bob", bot: false },
+    ],
+  });
+  assert.deepEqual(await lookup(3), { kind: "issue", fixes: [] });
+  assert.deepEqual(await lookup(4), { kind: "issue", fixes: [{ number: 14, login: "bob", bot: false }] });
+});
+
+test("bot and deleted authors are never credited", async () => {
+  const { fetchImpl } = fakeGitHub({
+    1: pull("github-actions", "Bot"),
+    2: pull("dependabot"),
+    3: pull("renovate[bot]"),
+    4: { __typename: "PullRequest", author: null },
+    5: issue([linked(15, "dependabot[bot]")]),
+  });
+  const lookup = githubRefLookup({ repository: "o/r", fetchImpl });
+  for (const ref of [1, 2, 3, 4]) assert.equal((await lookup(ref)).bot, true);
+  const fixed = await lookup(5);
+  assert.equal(fixed.fixes[0].bot, true);
+  assert.equal(creditSuffix(fixed), " fixed in #15");
+  assert.equal(isBotAccount("github-actions"), true);
+  assert.equal(isBotAccount("esengine"), false);
+});
+
+test("a discussion or a number naming nothing resolves, and warns instead of failing", async () => {
+  const { fetchImpl } = fakeGitHub({ 8: "discussion", 1: pull("alice") });
+  const lookup = githubRefLookup({ repository: "o/r", fetchImpl });
+  assert.deepEqual(await lookup(8), { kind: "discussion" });
+  assert.deepEqual(await lookup(9), { kind: "missing" });
+  const { credits, failures, warnings } = await resolveCredits([8, 1, 9], lookup);
+  assert.deepEqual(failures, []);
+  assert.equal(creditSuffix(credits.get(8)), "");
+  assert.deepEqual(
+    warnings.map((warning) => [warning.ref, warning.code]),
+    [
+      [8, CreditErrorCode.discussion],
+      [9, CreditErrorCode.notFound],
+    ],
+  );
+  const lines = [];
+  reportWarnings(warnings, { env: { GITHUB_ACTIONS: "true" }, write: (line) => lines.push(line) });
+  assert.ok(lines.every((line) => line.startsWith("::warning::release_credits.")));
+});
+
+test("transient failures are retried with backoff; the last one is reported by code", async () => {
+  const slept = [];
+  const sleep = async (ms) => slept.push(ms);
+  const { calls, fetchImpl } = fakeGitHub({
+    1: { sequence: [[502, {}], new TypeError("socket hang up"), [429, {}, { "retry-after": "7" }], pull("alice")] },
+    2: [503, {}],
+    3: new TypeError("fetch failed"),
+    4: { sequence: [[200, { data: null, errors: [{ type: "RATE_LIMITED" }] }], pull("bob")] },
+    5: [403, {}, { "x-ratelimit-remaining": "0" }],
+  });
+  const lookup = githubRefLookup({ repository: "o/r", fetchImpl, sleep });
+  assert.equal((await lookup(1)).login, "alice");
+  assert.deepEqual(slept, [1000, 2000, 7000]);
+  await assert.rejects(lookup(2), { code: CreditErrorCode.status, ref: 2 });
+  await assert.rejects(lookup(3), { code: CreditErrorCode.unreachable, ref: 3 });
+  assert.equal((await lookup(4)).login, "bob");
+  await assert.rejects(lookup(5), { code: CreditErrorCode.status, ref: 5 });
+  const tries = (ref) => calls.filter((call) => call.variables.number === ref).length;
+  assert.deepEqual([1, 2, 3, 4, 5].map(tries), [4, 4, 4, 2, 4]);
+});
+
+test("an authorisation failure is final and never retried", async () => {
+  const { calls, fetchImpl } = fakeGitHub({ 1: [401, {}], 2: [403, {}], 3: [200, { data: null, errors: [{ type: "FORBIDDEN" }] }] });
+  const lookup = githubRefLookup({ repository: "o/r", fetchImpl, ...noSleep });
+  await assert.rejects(lookup(1), { code: CreditErrorCode.status });
+  await assert.rejects(lookup(2), { code: CreditErrorCode.status });
+  await assert.rejects(lookup(3), { code: CreditErrorCode.status });
+  assert.equal(calls.length, 3);
+});
+
+test("suffixes use one wording for pull requests and fixed issues", () => {
+  assert.equal(creditSuffix({ kind: "pull", login: "alice", bot: false }), " by @alice");
+  assert.equal(creditSuffix({ kind: "pull", login: "x[bot]", bot: true }), "");
+  assert.equal(creditSuffix({ kind: "issue", fixes: [] }), "");
+  assert.equal(
+    creditSuffix({
+      kind: "issue",
+      fixes: [
+        { number: 2, login: "alice", bot: false },
+        { number: 3, login: "bob", bot: false },
+      ],
+    }),
+    " fixed in #2 by @alice and #3 by @bob",
+  );
+});
+
+test("each distinct ref is looked up once and failures are collected in ref order", async () => {
+  const seen = [];
+  const lookup = async (ref) => {
+    seen.push(ref);
+    if (ref === 3 || ref === 1) throw new CreditError(CreditErrorCode.notFound, `#${ref}`, { ref });
+    return { kind: "pull", login: `u${ref}`, bot: false };
+  };
+  const { credits, failures } = await resolveCredits([3, 2, 3, 1, 2], lookup, { concurrency: 2 });
+  assert.deepEqual(seen.sort(), [1, 2, 3]);
+  assert.deepEqual([...credits.keys()], [2]);
+  assert.deepEqual(failures.map((failure) => failure.ref), [3, 1]);
+  const error = unresolvedError(failures);
+  assert.equal(error.code, CreditErrorCode.unresolved);
+  assert.deepEqual(error.failures.map((failure) => failure.code), [CreditErrorCode.notFound, CreditErrorCode.notFound]);
+});
+
+test("an unexpected lookup error is not swallowed", async () => {
+  await assert.rejects(
+    resolveCredits([1], async () => {
+      throw new RangeError("bug");
+    }),
+    RangeError,
+  );
+});
+
+test("contributors are unique humans in first-appearance order, fixers included", () => {
+  const credits = new Map([
+    [1, { kind: "pull", login: "bob", bot: false }],
+    [2, { kind: "pull", login: "alice", bot: false }],
+    [3, { kind: "issue", fixes: [{ number: 30, login: "carol", bot: false }] }],
+    [4, { kind: "pull", login: "github-actions[bot]", bot: true }],
+    [5, { kind: "pull", login: "Bob", bot: false }],
+    [6, { kind: "issue", fixes: [] }],
+  ]);
+  assert.deepEqual(contributorLogins([3, 1, 4, 2, 1, 5, 6, 9], credits), ["carol", "bob", "alice"]);
+});
+
+test("the token comes from the environment, then gh, else a coded error", () => {
+  assert.equal(tokenFromEnvironment({ GH_TOKEN: "a", GITHUB_TOKEN: "b" }, () => "c"), "a");
+  assert.equal(tokenFromEnvironment({ GITHUB_TOKEN: "b" }, () => "c"), "b");
+  assert.equal(tokenFromEnvironment({}, () => "c\n"), "c");
+  assert.throws(
+    () =>
+      tokenFromEnvironment({}, () => {
+        throw new Error("gh: not logged in");
+      }),
+    { code: CreditErrorCode.noToken },
+  );
+});
diff --git a/scripts/studio-release-notes.mjs b/scripts/studio-release-notes.mjs
new file mode 100644
index 0000000000..3c20f7685f
--- /dev/null
+++ b/scripts/studio-release-notes.mjs
@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+// Renders release-notes/studio/<semver>.md for publication: each #N gains its
+// pull request author, or for an issue the pull requests that closed it, and a
+// 贡献者 list closes the notes. The source file is never rewritten.
+
+import { readFile, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { annotateMarkdown, markdownRefs } from "./markdown-refs.mjs";
+import {
+  contributorLogins,
+  creditSuffix,
+  githubRefLookup,
+  reportWarnings,
+  resolveCredits,
+  tokenFromEnvironment,
+  unresolvedError,
+} from "./release-credits.mjs";
+
+export function renderStudioNotes(markdown, credits) {
+  const body = annotateMarkdown(markdown, (ref) => creditSuffix(credits.get(ref))).trimEnd();
+  const contributors = contributorLogins(markdownRefs(markdown), credits);
+  if (!contributors.length) return `${body}\n`;
+  return `${body}\n\n## 贡献者\n\n感谢本版本的贡献者：${contributors.map((login) => `@${login}`).join("、")}\n`;
+}
+
+async function main() {
+  const [input, output] = process.argv.slice(2);
+  if (!input || !output) throw new Error("usage: studio-release-notes.mjs <notes.md> <output.md>");
+  const markdown = await readFile(input, "utf8");
+  const refs = markdownRefs(markdown);
+  let credits = new Map();
+  let failures = [];
+  if (refs.length) {
+    const lookup = githubRefLookup({ token: tokenFromEnvironment() });
+    let warnings;
+    ({ credits, failures, warnings } = await resolveCredits(refs, lookup));
+    reportWarnings(warnings);
+  }
+  await writeFile(output, renderStudioNotes(markdown, credits));
+  if (failures.length) throw unresolvedError(failures);
+  console.log(`Rendered ${input} to ${output}: ${new Set(refs).size} reference(s), ${credits.size} resolved`);
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch((error) => {
+    console.error(error.code ? `${error.code}: ${error.message}` : error.message);
+    process.exitCode = 1;
+  });
+}
diff --git a/scripts/studio-release-notes.test.mjs b/scripts/studio-release-notes.test.mjs
new file mode 100644
index 0000000000..4d4362b2cc
--- /dev/null
+++ b/scripts/studio-release-notes.test.mjs
@@ -0,0 +1,82 @@
+import assert from "node:assert/strict";
+import { readdir, readFile } from "node:fs/promises";
+import { test } from "node:test";
+import { markdownRefs } from "./markdown-refs.mjs";
+import { CreditError, CreditErrorCode, resolveCredits } from "./release-credits.mjs";
+import { renderStudioNotes } from "./studio-release-notes.mjs";
+
+const notes = `本版修复两件事。
+
+## 修复
+
+- 读图模型不再声称看不到图片（#20）(44150b0aa)
+- Windows 窗口可以打开 #21
+- 依赖升级 #22，并补上 #20 的回归测试
+- 会话不再丢失（#23）
+`;
+
+const authors = {
+  20: { kind: "pull", login: "alice", bot: false },
+  21: { kind: "issue", fixes: [] },
+  22: { kind: "pull", login: "dependabot[bot]", bot: true },
+  23: { kind: "issue", fixes: [{ number: 30, login: "bob", bot: false }] },
+};
+
+test("pull requests credit their authors, fixed issues their fixers, the rest stay plain", async () => {
+  const calls = [];
+  const { credits, failures } = await resolveCredits(markdownRefs(notes), async (ref) => {
+    calls.push(ref);
+    return authors[ref];
+  });
+  assert.deepEqual(failures, []);
+  assert.deepEqual(calls.sort(), [20, 21, 22, 23]);
+  assert.equal(
+    renderStudioNotes(notes, credits),
+    `本版修复两件事。
+
+## 修复
+
+- 读图模型不再声称看不到图片（#20 by @alice）(44150b0aa)
+- Windows 窗口可以打开 #21
+- 依赖升级 #22，并补上 #20 by @alice 的回归测试
+- 会话不再丢失（#23 fixed in #30 by @bob）
+
+## 贡献者
+
+感谢本版本的贡献者：@alice、@bob
+`,
+  );
+});
+
+test("an unresolved ref stays plain and is reported by code", async () => {
+  const { credits, failures } = await resolveCredits(markdownRefs(notes), async (ref) => {
+    if (ref === 20) throw new CreditError(CreditErrorCode.unreachable, "#20: down", { ref });
+    return authors[ref];
+  });
+  assert.deepEqual(failures.map((failure) => [failure.ref, failure.code]), [[20, CreditErrorCode.unreachable]]);
+  const rendered = renderStudioNotes(notes, credits);
+  assert.doesNotMatch(rendered, /#20 by/);
+  assert.match(rendered, /#23 fixed in #30 by @bob/);
+  assert.match(rendered, /感谢本版本的贡献者：@bob\n$/);
+});
+
+test("committed notes render unchanged when nothing is credited", async () => {
+  const dir = new URL("../release-notes/studio/", import.meta.url);
+  for (const name of await readdir(dir)) {
+    const source = await readFile(new URL(name, dir), "utf8");
+    assert.equal(renderStudioNotes(source, new Map()), `${source.trimEnd()}\n`, name);
+  }
+});
+
+test("a number naming a discussion or nothing stays plain and only warns", async () => {
+  const source = "- 讨论见 #40，颜色改为 #123456\n";
+  const { credits, failures, warnings } = await resolveCredits(markdownRefs(source), async (ref) =>
+    ref === 40 ? { kind: "discussion" } : { kind: "missing" },
+  );
+  assert.deepEqual(failures, []);
+  assert.deepEqual(
+    warnings.map((warning) => warning.code),
+    [CreditErrorCode.discussion, CreditErrorCode.notFound],
+  );
+  assert.equal(renderStudioNotes(source, credits), source);
+});