QA run · smoke:npm-18.4.0 (22/22) · 181ad7d4 · 2026-11-13 · 21 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #33105

qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W

Post-release smoke record for the published 18.4.0 (qa#3 · 18.4.0 round 2 aftercare, wave anchor #32908).

Post-release smoke of the PUBLISHED 18.4.0 (npm), real user paths, under release-aftercare.md B and checklist-test §6. Asked by the maintainer, 2026-11-13 12:35Z, verbatim: 「18.4 已发布」. Shape copied from the 18.3.0 record #30022 (cells A–F, versions bumped). Wave anchor #32908.

ENVIRONMENT

• Subject: @objectstack/*@18.4.0 and create-objectstack@18.4.0 from npm (dist-tag latest = 18.4.0, published 2026-11-13T12:30:15.590Z per npm view @objectstack/spec time; next = 18.2.0). Release commit 181ad7d (tag @objectstack/spec@18.4.0), Version Packages PR chore: version packages #29963. Everything under test was installed from the registry into /tmp/smoke184, outside the repo. No workspace build, no link:.
• Source checkout used only to read docs, at the release commit (git show 181ad7d:PATH); main read at 5430b4a for the re-judge.
• Node v22.23.4, npm 10.9.9, pnpm 10.28.0 in the scaffolds (the scaffolder's pick). PostgreSQL 16.15 local cluster, port 55434. Chromium through Playwright.
• Ports 3711 (dev), 3721 (production start), 3731 (PG), 3741/3742/3743 (upgrade), 3751 (probe scaffold). One file DB per cell.
• Run 2026-11-13 12:36–12:56 UTC, one agent, sequential.

A. NEW USER ONBOARDING (docs at 181ad7d: getting-started/your-first-project.mdx)
A1 PASS. npm create objectstack@18.4.0 my-app -- --skip-skills: exit 0, 14 s, installed with pnpm. All 9 @objectstack pins are exactly 18.4.0; cli, spec, runtime and console resolve 18.4.0 (59 @objectstack entries in pnpm-lock.yaml, all 18.4.0).
A2 PASS. npx -y create-objectstack@18.4.0 skillapp (skills on): 11 skills in .claude/skills, names and content identical (diff -rq) to node_modules/@objectstack/skills@18.4.0 dist/skills (only the catalog README is not copied).
A3 PASS. npx os validate: exit 0, 65 author-time rules, 1 object, 2 fields, 1 app, 1 view.
A4 PASS. npx os dev --ui -p 3711: "Server is ready" in about 11 s, 43 plugins including ConsoleUI, dev admin admin@objectos.ai / admin123 seeded. GET /api/v1/discovery 200.
A5 PASS. GET /_console/ 200 text/html, 24141 bytes. Entry chunk assets/index-Bk3byiZx.js 200 application/javascript, 475017 bytes, byte-identical (cmp) to the published @objectstack/console@18.4.0 dist. (The served index.html differs from dist/index.html only by the server-injected description/og meta tags and the nonce'd capabilities script.)
A6 PASS. Real browser: /_console/ goes to /_console/login (1.2–1.3 s to network idle); sign in as the dev admin lands on /_console/home ("Get your system ready" checklist, then "Good afternoon, Dev Admin."; app tile Main). After sign-in: 0 console errors, 0 responses >= 400. Before: the anonymous GET /api/v1/auth/get-session 401 only (same as 18.3.0, observation).
A7 PASS. The docs' CRUD (your-first-project.mdx section 4): sign-in 200; POST /api/v1/data/my_app_note 201; GET ?select=title&sort=-created_at&top=10 200 (total 1); GET by id 200; PATCH 200; DELETE 200 success true (recycleBinEntryId returned); GET 404 RECORD_NOT_FOUND. Anonymous GET 401. POST /api/v1/auth/sign-up/email 403 SELF_REGISTRATION_CLOSED.
A8 PASS. Record created through the Console UI at /_console/apps/com.example.my-app/my_app_note (the starter app Main, its Notes entry): New opens the "Create Note" dialog, fill Title, Create gives POST 201, toast 'Note "Created in Console UI 18.4" created', the record panel opens with Activity 1. 0 console errors, 0 responses >= 400. The 18.3.0 "Set the default currency" prompt over the page no longer appears (the currency item now sits in the Home checklist).

B. STUDIO (same dev boot)
B1 PASS. /_console/studio loads the App Builder (1.5 s to network idle): writable packages section (empty), Organization flows, Environment catalog, and the scaffold's My App as read-only ("0 customized, 0 switched off"). Opening My App shows the Note object (2 fields +8 system) and the record created in A8. 0 console errors, 0 responses >= 400.
B2 PASS. Authoring loop: New package "Smoke Tracker" (POST /api/v1/packages 201) → New object "Ticket" (identifier filled as ticket, "Save as draft": PUT /api/v1/meta/object/smoke_tracker_ticket?mode=draft&package=com.default.smoke-tracker 200, "Draft · 1 unpublished") → Publish → "Pending changes" dialog (1 object, New) → Publish all (POST /api/v1/packages/com.default.smoke-tracker/publish-drafts 200), toast "Published 1 item in this package" → reload shows "No drafts pending publish" and the Records grid live. REST on the new object: POST /api/v1/data/smoke_tracker_ticket 201 (twice), list 200 total 2. 0 console errors and 0 responses >= 400 across the loop.

C. PRODUCTION DEPLOY PATH (A1's scaffold, OS_AUTH_SECRET and OS_SECRET_KEY set, fresh SQLite file)
C1 PASS. os build exit 0 (dist/objectstack.json 3.3 KB); OS_DATABASE_URL=file:FRESH os migrate apply --yes exit 0; os start --artifact ./dist/objectstack.json --port 3721 ready in about 7 s, 0 WARN/ERROR lines on the start; /api/v1/health 200 version 18.4.0.
C2 PASS. First sign-up admitted (200, session token), the second 403 SELF_REGISTRATION_CLOSED; no dev admin in production (401 INVALID_EMAIL_OR_PASSWORD).
C3 PASS. CRUD as the first admin 201/200/200/200/200/404; /_console/ 200 text/html.

D. UPGRADE 18.3.0 → 18.4.0 WITH REAL DATA
D1 PASS. App from create-objectstack@18.3.0 (app183) on its default file DB, os dev on 18.3.0 (health 18.3.0). Written over HTTP on 18.3.0: an admin-created user (POST /api/v1/auth/admin/create-user 200, then signs in 200), an app183_note record, branding.workspace_name = "Smoke v18.3" (tenant, PUT /api/settings/branding 200). Server stopped (DB free). Bumped all 9 @objectstack pins to 18.4.0; pnpm install exit 0 (no peer warnings; 132 @objectstack lock entries, all 18.4.0); os validate exit 0 and os build exit 0. upgrading.mdx at 181ad7d names no 18.4.0 step (see D2), so its generic loop and every 18.4-relevant migrate command were run: os migrate meta --from 18 exit 0 (no step for 18 → 18, as printed); os migrate plan exit 0 (12 tables to create, 9 columns to add, 6 safe); os migrate stored-references exit 0, and with --dev exit 0 ("nothing to review"); os migrate stored-expressions exit 0 (nothing to backfill); os migrate activity-changed-fields exit 0 (0 rows); os migrate audit-key-material exit 0. os dev 18.4.0 on the same file: ready, 0 DATABASE_ERROR lines, health 18.4.0; admin 200; the created user with its original password 200; the record reads back with title and body; the setting reads "Smoke v18.3" (tenant). Afterwards os migrate apply --yes exit 0 (8 tables + 1 safe change, see observation O3), and a second plan shows 0 changes.
D2 FAIL (docs, NEW card draft card-smoke-1.md). upgrading.mdx "Per-release specifics" at the release commit 181ad7d has no v18.4.0 row (newest row v18.3.0), and content/docs/releases/v18/ holds 18-0, 18-1, 18-2, 18-3 and index only: no 18-4.mdx. Same on main 5430b4a at run time. releases/index.mdx at 181ad7d already says "current series: 18.4.0, released 2026-11-13", so the index names a release whose page does not exist. Third release in a row with this shape (#26631 for 18.2.0, #29933 for 18.3.0). No existing card found (searched open and closed issues created since 2026-11-10 for 18-4 / 18.4.0 release page / upgrading row).

E. POSTGRESQL (16.15 local, port 55434; a copy of A1's scaffold)
E1 PASS. Before pg is installed: os dev -d postgres://... exits 1 with the remedy "The database client package pg is not installed, so no connection was attempted ... npm install pg (pnpm add pg / yarn add pg) — then start again." Observation (not filed, unchanged from 18.3.0): the remedy is preceded by knex's raw "Cannot find module 'pg'" and a 6-line require stack.
E2 PASS. After pnpm add pg (8.23.1): "Driver: SqlDriver(pg)", ready in about 13 s; sign-in 200; docs CRUD 201/200/200/200/200/404; /_console/ 200, and the real-browser sign-in lands on /_console/home with 0 console errors and 0 responses >= 400 after sign-in.
E3 PASS (#26630 re-judged again). 0 [sql-driver] DATABASE_ERROR / 2BP01 lines on the first boot and on a restart; a record and the session survive the restart. pg_indexes: uniq_sys_setting_organization_id_namespace_key_scope_user_id is over (organization_id, namespace, key, scope, COALESCE(user_id, '')), and uniq_sys_notification_preference_a22d7d27 over (organization_id, COALESCE(user_id, ''), topic, channel).

F. RE-JUDGE AND PROBES
F1 PASS (#26632 re-judged). The record page /_console/apps/com.example.my-app/my_app_note?recordId=ID, 3 loads on a scaffold without the approvals service: 0 console errors, 0 responses >= 400, the record renders.
F2 PASS. os doctor: exit 0, "Environment is healthy and ready for development!", no warning (the 18.3.0 "defined but not referenced" warning is gone: the starter now ships an app and a view). Bare npx os prints the help (@objectstack/cli/18.4.0).
F3 PASS (#32955 headline, fix #32998 8004529 is in 181ad7d). A second 18.4.0 scaffold (probeapp) with requires + 'approvals', one position probeapp_reviewer (distributing a permission set with CRUD on probeapp_note) and one record-after-insert approval flow routed to that position. A member invited (invite-member, sign-up with invitationId) and bound to the position creates a note: a request opens with the member in pending_approvers. As the member: GET /api/v1/meta/object/sys_approval_request 200 and sys_approval_action 200 (data door GET /api/v1/data/sys_approval_request still 403); GET /api/v1/approvals/requests/ID 200. Real browser, member signed in through the form: cold-loading /_console/apps/com.objectstack.account/component/approvals/inbox?request=ID and /_console/system/approvals?request=ID both open the request page (no "Object Not Found"), with Approve, Reject, Reassign, Send back, Request info; Approve → Confirm moves the request to approved. 0 console errors, 0 responses >= 400. (Before the member held any request, their meta read was 404, as for any non-participant.)
F4 PASS (#32754 headline, fix fd63747 #32932). On probeapp (probeapp_note declares enable.files: true), the member attaches a file to their own note: POST /api/v1/storage/upload/presigned (scope attachments) 200 → PUT 200 → POST /api/v1/storage/upload/complete with attachTo {parentObject, parentId} 200 with an attachmentId, and the member's GET /api/v1/data/sys_attachment lists it. The same member on the admin's private note: 403 ATTACHMENT_PARENT_ACCESS ("does not exist or you cannot edit it"), as the changeset says. Tested on the REST door, not on the MCP create_upload_link door the card was measured on.

OBSERVATIONS (not filed)

• O1. An object without enable.files now refuses an attachment for everyone (upgrade-day change named in the Attachments: a member cannot attach a file to their own record (create_upload_link attachments:true answers 403 "cannot create sys_attachment"), though they can edit the record #32754 changeset): on the scaffold's own starter object my_app_note, the dev admin gets 403 FILES_DISABLED ("requires enable.files: true"). Correct per the changeset; it belongs on the missing 18.4.0 upgrade checklist (card-smoke-1).
• O2. os migrate plan on the not-yet-booted 18.3.0 file prints one [sql-driver] DATABASE_ERROR ... no such column: permission_set_package line before the plan, then reports the index as "could not be read; apply builds it if it is missing". The plan is right; the line reads like a failure.
• O3. On an 18.3.0 file DB, the first 18.4.0 os dev boot auto-reconciles only sys_user_permission_set's unique index; the sys_metadata_activation unique index on (metadata_type, name) stays until a second boot (measured on a restored copy: boot 2 logs "auto-reconciled replace_unique_index on sys_metadata_activation.package_id") or os migrate apply. Data reads were unaffected.
• O4. os migrate stored-references without --dev on a dev project (no OS_AUTH_SECRET) reads no sys_user_permission_set, sys_audience_binding_suggestion or sys_approval_request and still exits 0; with --dev only sys_approval_request is unread. The command says so, but the 18.4.0 checklist should say to run it with the deployment's composition.
• O5. os migrate apply on a fresh production file (C1) warns once that sys_metadata_activation "could not be read" during its schema boot and that sys_invitation:copy_invitation_link has no handler; the production start that follows has no WARN line.

FAIL REPRODUCTION RULES

• D2: git show 181ad7d:content/docs/upgrading.mdx, section "Per-release specifics". Expected: a v18.4.0 row linking the 18.4.0 upgrade checklist. Actual: newest row v18.3.0; git ls-tree 181ad7d content/docs/releases/v18/ has no 18-4.mdx (same at main 5430b4a), while releases/index.mdx line 22 names 18.4.0 as the current series.

DISPOSITION OF FAILS

• D2: product docs gap, no existing card: card draft out/card-smoke-1.md (p1 on the 18.3 precedent docs(releases): write content/docs/releases/v18/18-3.mdx for the 18.3.0 cut (and the upgrading table row) — the version PR merged at 14:44Z and the page does not exist #29933). Recurrence of docs(upgrading): the Per-release specifics table has no v18.2.0 row — 18.2.0 is published and its upgrade checklist (releases/v18/18-2) is not linked from the upgrade guide #26631 → docs(releases): write content/docs/releases/v18/18-3.mdx for the 18.3.0 cut (and the upgrading table row) — the version PR merged at 14:44Z and the page does not exist #29933 for the third release.

Re-checked prior 18.3.0 smoke failures (#30022): D2 → #29933 recurred in the same shape for 18.4.0 (card-smoke-1); #26630 (E3) and #26632 (F1) still do not reproduce.

Fixture gaps: none (probeapp's approval flow, position and permission set were authored for F3/F4; source kept in /tmp/smoke184/probeapp). Not-run handover: none. No authentication or authorization finding.