QA run · smoke:npm-18.2.0 (25/25) · 27f38ada · 2026-10-27 · 22 PASS / 0 PARTIAL / 3 FAIL / 0 BLOCKED / 0 NOT-RUN #26629

Post-release smoke of the PUBLISHED 18.2.0 (npm), real user paths. Ordered by the maintainer, verbatim: 「开云卡跑 18.2.0 已发布包冒烟」, under release-aftercare.md B. Shape copied from the 18.0.0 record #24908. Wave anchor: #25807.

ENVIRONMENT

• Subject: @objectstack/*@18.2.0, create-objectstack@18.2.0 and @objectstack/console@18.2.0 from npm (dist-tag latest = 18.2.0, from release commit 27f38ad, Version Packages PR chore: version packages #25640). Every package under test was installed from the registry into /tmp/smoke, outside the repo. No workspace build, no link:.
• Source checkout used only to read code and docs. Docs were read at the release commit 27f38ad (git show 27f38ad:PATH), and checked against main 7c34e5d where noted.
• 18.2.0 is the first release whose Console is built from the in-repo ui/ tree. The console served by every boot below is the scaffold's own node_modules/@objectstack/console@18.2.0.
• Node v22.22.0, npm 10.9.4, pnpm 10.28.0 (the scaffolder's pick). PostgreSQL 16.15, a local cluster on port 55433. SQLite via better-sqlite3 13.0.3. Chromium through Playwright (/opt/pw-browsers).
• Ports 3511, 3521, 3531-3533, 3541-3544, 3551-3553, 3561, 3571-3572. One file DB per cell under /tmp/smoke (PG: databases smoke182 and smoke182b). Servers were started with setsid and stopped by process group, and the port was confirmed free each time.
• Run executed sequentially by one agent (no sub-agents), 2026-10-27 10:36-10:58 UTC. Environment prep (registry installs for 7 scaffolds, the 18.1.0 and 17.7.0 bumps, pnpm add pg, initdb, the skills add) took about 6 minutes; testing took about 16 minutes.

SCOPE

• Selector smoke:npm-18.2.0 is a dispatched smoke, not a checklist selector: 25 cells across A-F as the dispatch lists them. Two cells (E1, E2) are checklist items, judged at the revisions the resolver reported: cli.scaffold-first-run revision 6 and cli.scaffold-console-first-paint revision 6, both on the PUBLISHED path. No planned items.
• Out of scope by the dispatch, not probed: the mention-notification area fixed after this release by fix(plugin-audit): a mention notification reaches a mentioned user only when they may read the comment it previews #26497.

A. NEW USER ONBOARDING (docs at 27f38ad: getting-started/index.mdx, your-first-project.mdx, quick-start.mdx; deployment/cli.mdx for the npx spelling)
A1 PASS. npm create objectstack@18.2.0 my-app: exit 0, 29 s, "Create ObjectStack v18.2.0", installed with pnpm. package.json pins every @objectstack dependency to exactly 18.2.0; cli, spec and runtime resolve 18.2.0; @objectstack/console@18.2.0 is in the tree. Skills installed for claude-code from @objectstack/skills@18.2.0 (11 skills).
A2 PASS. npx -y create-objectstack my-app --skip-skills (the docs' spelling, which resolves latest): exit 0, v18.2.0, installed with pnpm.
A3 PASS. The same with pnpm and corepack absent from PATH (npm 10.9.4 only): npx -y create-objectstack@18.2.0 exit 0, installed with npm; npx os validate exit 0. The index.mdx warning that npm 10 cannot install the CLI (edgesOut) was not reproduced for the scaffold. Observation (not filed): the npm-installed scaffold still writes pnpm-workspace.yaml and engines.pnpm >=10.15.
A4 PASS. npx os validate: exit 0, "Validation passed", 1 object, 2 fields.
A5 PASS. npx os dev --ui -p 3511: "Server is ready", dev admin admin@objectos.ai / admin123 seeded, 42 plugins including ConsoleUI. GET /api/v1/discovery 200.
A6 PASS. GET /_console/ 200 text/html, 19150 bytes, root div present. Entry chunk GET /_console/assets/index-BJwcizUn.js 200 application/javascript, 388132 bytes, byte-identical (cmp) to node_modules/@objectstack/console/dist/assets/index-BJwcizUn.js of the published 18.2.0 package. CSS index-DasIZtqD.css 200 text/css.
A7 PASS. Real browser (Playwright chromium, fresh context): /_console/ goes to /_console/login (1.97 s to network idle) with one email field and one password field. The form was filled with the seeded dev admin and "Sign In" was clicked: POST /api/v1/auth/sign-in/email 200, then the page landed on /_console/home with "Good morning, Dev Admin.", Your apps 0, My work, Recently Accessed and Activity feed. After the click: 0 console errors, 0 failed requests, 0 responses with status 400 or higher. Before the click: one 401 GET /api/v1/auth/get-session (the anonymous session probe on the login page), which the browser logs as "Failed to load resource". Observation, not filed.
A8 PASS. The docs' CRUD verbatim (your-first-project.mdx section 4): sign-in 200; POST /api/v1/data/my_app_note 201; GET ?select=title&sort=-created_at&top=10 200 (total 1). Then GET by id 200; PATCH 200 (updated_at moved); DELETE 200 success true; GET 404 RECORD_NOT_FOUND. POST /api/v1/auth/sign-up/email 403 SELF_REGISTRATION_CLOSED (invite_only).
A9 PASS. Record created through the Console UI. At /_console/apps/com.objectstack.setup/my_app_note, the "New" button opens a form with title and body fields. Filled and saved: POST /api/v1/data/my_app_note 201, toast 'Note "Created in Console UI" created', the record panel opens. Read back over REST: GET /api/v1/data/my_app_note/RjLI0f7kLEApEjFL 200, title "Created in Console UI", body "via browser". The record page logs two console errors: see F5.

B. PRODUCTION DEPLOY PATH (A1's scaffold, OS_AUTH_SECRET and OS_SECRET_KEY set, fresh SQLite file)
B1 PASS (#24908 B1 / #24827 no longer reproduces). os build exit 0 (dist/objectstack.json 2.5 KB). OS_DATABASE_URL=file:FRESH os migrate apply --yes: exit 0. os start --artifact ./dist/objectstack.json --port 3521: "Server is ready", health 200, no ownership-marker refusal.
B2 PASS. First-admin sign-up admitted, the second refused: the first POST /api/v1/auth/sign-up/email returned a session token, and the second answered 403 SELF_REGISTRATION_CLOSED. No dev admin exists in production: signing in as admin@objectos.ai / admin123 answers 401 INVALID_EMAIL_OR_PASSWORD.
B3 PASS. CRUD as the first admin: create 201, list 200, PATCH 200, DELETE 200, GET 404; /_console/ 200.

C. UPGRADE PATHS WITH REAL DATA (published packages)
C1 PASS. 18.1.0 to 18.2.0. App created with create-objectstack@18.1.0 (exact 18.1.0 pins), os dev on a file DB. Written over HTTP: an admin-created user (POST /api/v1/auth/admin/create-user, then that user signs in 200), an app181_note record, and branding.workspace_name = "Smoke v18.1" (PUT /api/settings/branding, source tenant). Then the upgrading.mdx steps: every @objectstack pin edited to 18.2.0 (9 pins), pnpm install exit 0 (no peer warnings), specVersion ^18.0.0 and engines.protocol ^18 left alone (same major), validate and build pass. Skills step 4 not applicable: the scaffold was made with --skip-skills. os dev on the same file: ready. admin 200; the created user with its original password 200; the record reads back with its body and organization_id; the setting reads "Smoke v18.1" (tenant). os start --artifact on a copy of the file, in production: ready, and the created user signs in 200.
C2 PASS. 17.7.0 to 18.2.0 through the ownership ceremony, following upgrading.mdx "Upgrading to 18.0" steps 1-8. App from create-objectstack@17.7.0; written over HTTP: an admin-created user, an app177_note record, branding.workspace_name = "Smoke v17.7". Bumped every @objectstack dependency to exactly 18.2.0, engines.protocol ^18, specVersion ^18.0.0; pnpm install, validate and build pass. Step 1: os migrate security-catalog-overlays exit 0 (nothing listed). Step 2: os start exit 1 with the refusal naming the ceremony. Step 4: plan exit 0 (81 tables planned). Step 6: apply exit 0 ("The ceremony is complete; recorded as adr-0131-organization-ownership"). Step 7: os start ready. admin 200; the created user with its original password 200; the record readable with organization_id stamped; the setting reads "Smoke v17.7" (tenant). Step 8: comment-reactions --apply --yes exit 0. os migrate plan then lists exactly the three destructive entries the doc names (sys_comment.reactions, sys_sso_provider.created_by, sys_sso_provider.updated_by). os migrate apply --allow-destructive --yes applied 3. The next os start was ready with 0 schema-drift lines, and the user signs in 200. Observation (not filed, as in #24908): the step 2 refusal is printed twice with a full stack trace (11 frames) before the one-line summary.
C3 FAIL (docs, new card). upgrading.mdx "Per-release specifics" has no v18.2.0 row. Its newest row is v18.1.0, both at the release commit 27f38ad and on main 7c34e5d. At the release commit, content/docs/releases/v18/ also had no 18-2.mdx; that page landed after the release (#26494, from #26429), and the upgrade guide still does not link it.

D. POSTGRESQL (16.15 local, port 55433)
D1 PASS (#24908 D1 fixed). A2's scaffold, before pg is installed: os dev -d postgres://... exits 1 with "The database client package pg is not installed ... Install it next to the server that opens this datasource — npm install pg (pnpm add pg / yarn add pg) — then start again." The remedy is now the right one.
D2 PASS. After pnpm add pg: "Driver: SqlDriver(pg)", ready; /_console/ 200; sign-in 200; the docs CRUD sequence 201/200/200/200/200/404; PUT /api/settings/branding 200.
D3 FAIL (new card). Every PostgreSQL boot logs two [sql-driver] DATABASE_ERROR lines (2BP01): "cannot drop index uniq_sys_setting_organization_id_namespace_key_scope_user_id because constraint uniq_sys_setting_organization_id_namespace_key_scope_user_id on table sys_setting requires it", and the same for uniq_sys_notification_preference_a22d7d27. Measured on 3 boots: the first boot of smoke182, a restart over it, and a fresh database smoke182b. The NULL-safe row-identity index never lands on PostgreSQL. pg_indexes shows sys_setting's unique index over plain (organization_id, namespace, key, scope, user_id), while SQLite carries COALESCE(user_id, ''). The same holds for sys_notification_preference. Effect: on PG, inserting a second tenant-scope sys_setting row with the same (organization_id, namespace, key, scope) and user_id NULL is accepted (done in a transaction and rolled back). The same insert on SQLite (an 18.2.0 database) is refused: UNIQUE constraint failed. No [metadata-protocol] degradation line is printed. The only trace is the two raw driver errors.

E. CHECKLIST ITEMS ON THE PUBLISHED PATH (the registry now holds 18.2.0)
E1 PASS. cli.scaffold-first-run revision 6, published path. Clause 0 pass: npx -y create-objectstack@latest qa-first-run -t blank --skip-skills exit 0 (v18.2.0), npm run validate exit 0, npm run build exit 0. os start --artifact on port 3561 (a scratch HOME): health 200 after 12 s, and GET /api/v1/ready returns {"status":"ready","state":"running"}. Clause 1 pass: blank is the only template, and it validates and builds. Clause 2 pass: the protocol handshake accepts the coherent scaffold, and server.log has no error. Clause 3 pass: a scaffold made without --skip-skills (A1) holds 11 skills in .claude/skills. Their names equal node_modules/@objectstack/skills/dist/skills, the trees match by diff -rq (only the catalog README is not copied), and there is no internal skill. GitHub-path probe: npx -y skills@1.7.2 add RELEASE-COMMIT/skills --all --copy -y gives the same 11 names as skills/ at 27f38ad. Repo-root discovery (skills add RELEASE-COMMIT-TREE --list) reports "Found 11 skills", the same 11 names, with no dogfood-verification, checklist-*, pm-dispatch, spec-property-retirement, objectui-contributor, verify or plugin-dashboard. Clause 4 pass (negative): the server became healthy inside the budget.
E2 PASS. cli.scaffold-console-first-paint revision 6, published path (knownGaps[2]: the published @objectstack/console@18.2.0 is the subject). Clause 0 pass: npx -y create-objectstack@latest qa-console-first-paint (no -t) exit 0, then npx os validate exit 0. Clause 1 pass: the console paints under the scaffold's own dev script. The screenshot showed the ObjectOS "Welcome back" sign-in card (email, password, Sign In, "Sign in as dev admin", "Local development instance"), and after sign-in the home page. Clause 2 pass: npm run dev -- -p 3571 and npx os dev --ui -p 3572 both serve /_console/ 200, 19150 bytes, with the same entry chunk index-BJwcizUn.js. Clause 3 pass: signed in as the seeded dev admin (banner prints it), created a record through the console form (POST 201), and read it back over REST (200, the title matches). The action and nav half has nothing to act on in a blank scaffold, a stated limit of the item, not scored.

F. OFF-LIST PROBES (RUNNER rule 8), about 6 minutes, on the A boot and the A1 scaffold
F1 PASS. os doctor exit 0: all green, one warning, "Object my_app_note is defined but not referenced by any view, flow, app, or lookup field".
F2 PASS. Bare npx os prints the help, exit 0, @objectstack/cli/18.2.0. The TOPICS mislabels #24908 E2 noted are unchanged (data "Create a new record", meta "Delete a metadata item", db "Reclaim SQLite free space ..."). Not filed.
F3 PASS. Package contents vs what /_console/ serves. @objectstack/console@18.2.0 ships dist (51 MB, 2404 files under assets; repository.directory packages/console). The entry chunk served is byte-identical to the package's (A6). The served index.html is the package's dist/index.html plus the server-injected description and og meta tags.
F4 PASS. The scaffolded .claude/skills set equals @objectstack/skills@18.2.0 dist/skills (11 skills, identical content; skills-lock.json records source @objectstack/skills, version 18.2.0, for every skill), and the same 11 names as skills/ at 27f38ad.
F5 FAIL (new card). On a scaffold, which composes no approvals service, opening any record in the Console logs two console errors: "Failed to load resource: ... 501 (Not Implemented)" and "HTTP request failed: GET /api/v1/approvals/records/my_app_note/ID/lock -> 501 [NOT_IMPLEMENTED]". Reproduced on 3 fresh loads of the same record page, and on a second scaffold (E2). The two approvals doors disagree: GET /api/v1/approvals/requests?object=...&recordId=... answers 200 {"data":[]}, while the lock read answers 501 "Approvals service is not configured on this deployment". useRecordApprovals.ts at 27f38ad documents 501 as the expected answer for a composition without the service ("there the record is not locked by this signal"), yet the read is still logged at error level.

FAIL REPRODUCTION RULES

• C3: read content/docs/upgrading.mdx "Per-release specifics" at 27f38ad (and on main 7c34e5d). Expected: a v18.2.0 row linking the 18.2.0 upgrade checklist. Actual: the newest row is v18.1.0.
• D3: scaffold with npm create objectstack@18.2.0 my-app; cd my-app; pnpm add pg; on an empty PostgreSQL 16 database run npx os dev --no-watch -p PORT -d postgres://postgres@127.0.0.1:PORT/DB. Expected: no driver error, and sys_setting's unique index NULL-safe on user_id, as on SQLite. Actual: two "[sql-driver] DATABASE_ERROR ... (2BP01) cannot drop index ... because constraint ... requires it" lines on every boot. Then psql: select indexdef from pg_indexes where indexname = 'uniq_sys_setting_organization_id_namespace_key_scope_user_id' shows plain user_id. A second row copying the tenant-scope workspace_name row under a new id inserts (INSERT 0 1; the count becomes 2).
• F5: scaffold as above (SQLite), npx os dev -p PORT, sign in to /_console/ as the dev admin, create a note at /_console/apps/com.objectstack.setup/my_app_note, or open any note's record panel (?recordId=ID). Expected: no console error for a designed 501. Actual: the two console errors above on every open.

DISPOSITION OF FAILS

• C3: product docs defect, new card.
• D3: product defect, new card.
• F5: product defect (console), new card.

Fixture gaps: none. Not-run handover: none. No authentication or authorization finding.