docs(releases): write content/docs/releases/v18/18-4.mdx for the 18.4.0 cut and the upgrading table row: 18.4.0 is on npm latest and the page does not exist

qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W

QA-source: #33105 · smoke:npm-18.4.0 · D2

Suggested labels: documentation, priority:p1, domain:devx
Filing category: ① product defect (docs). Graded p1 on the 18.3 precedent #29933 (「发版本优先的都p1」).

维护者速读

18.4.0 已在 12:30Z 发到 npm latest（发版提交 181ad7d，Version Packages #29963）。但 content/docs/releases/v18/18-4.mdx 不存在，升级页的「Per-release specifics」表也没有 v18.4.0 行；而 releases/index.mdx 已写「current series: 18.4.0」。这是第三次同样的缺口（18.2 #26631、18.3 #29933）。升级用户现在拿不到 18.4.0 的升级清单，下面列出冒烟实测中这份清单必须写的几条。

Measured

git ls-tree 181ad7d4 content/docs/releases/v18/ → 18-0, 18-1, 18-2, 18-3, index, meta.json. No 18-4.mdx. Same at main 5430b4a (2026-11-13 ~12:53Z).
git show 181ad7d4:content/docs/upgrading.mdx "Per-release specifics": newest row v18.3.0.
git show 181ad7d4:content/docs/releases/index.mdx line 22: "(current series: 18.4.0, released 2026-11-13)", a link target with no page.
npm: @objectstack/spec latest = 18.4.0, published 2026-11-13T12:30:15.590Z.

Wanted

content/docs/releases/v18/18-4.mdx in 18-3.mdx's section skeleton (Highlights; Release facts, as measured; What's new by kind; New in Console (Studio); Upgrade checklist), added to meta.json pages ahead of 18-3.
The v18.4.0 row in upgrading.mdx "Per-release specifics", as docs(releases): 18.3.0 release notes and its upgrading row #29938 did for 18.3.0.
The upgrade checklist carries at least what an 18.3.0 → 18.4.0 upgrade measured in the smoke (record D1, O1–O4):
- the four migrate commands new in 18.4.0's CLI: os migrate stored-references (run with the deployment's composition: --dev or the deployment's --preset/OS_AUTH_SECRET, else it leaves sys_user_permission_set, sys_audience_binding_suggestion and sys_approval_request unread), os migrate stored-expressions, os migrate blank-multi-values, os migrate recompute-home-amounts, each with when to run it;
- os migrate plan / apply after the pin move: on an 18.3.0 file DB the first dev boot leaves sys_metadata_activation's unique index on (metadata_type, name) until a second boot or os migrate apply widens it to (metadata_type, package_id, name);
- the attachment changes from Attachments: a member cannot attach a file to their own record (create_upload_link attachments:true answers 403 "cannot create sys_attachment"), though they can edit the record #32754 / fix(service-storage, plugin-security): every member can attach files to the records they edit — storage contributes its own attachment set to the member baseline #32932: members can attach to records they edit, and an object without enable: { files: true } now refuses attachments for everyone with 403 FILES_DISABLED (the blank starter's note object is one);
- the 18.4 narrowings the CLI CHANGELOG marks BREAKING / Clause-② narrowing (e.g. the six address-literal namespaces refused by os validate/os build, the email-template 409 holders rule).
Facts cite the 18.4.0 sweep ([sweep] v18.4.0 release test sweep #32908) records and the smoke record.

⛔ No CHANGELOG.md is hand-edited (generated). ⛔ No tag, publish or release-workflow act.

Links: #29933 / #29938 (18.3 precedent), #26631, #29963, #32908, docs/releases-maintenance.md.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: first touch → `domain:devx` · p1 · `pm:queue` · 2026-11-13T13:45Z

⛔ Not a claim.

Row: 18.4.0 is on npm latest, but there is no release page and no upgrade-table row. An upgrader following the shipped docs does not learn about the four new os migrate commands, or that stored-references must run with the deployment's composition. If they are skipped, rows stay unread or wrong after the upgrade. That is silently wrong data on a real path, so it is p1 (pm-dispatch(grading) + NORTH-STAR: grade in a fixed order — impact, reach discount, one raise, release window — with decidable tests for security boundary, core task, workaround and "a real user can hit" #32997). The filer's 18.3 precedent docs(releases): write content/docs/releases/v18/18-3.mdx for the 18.3.0 cut (and the upgrading table row) — the version PR merged at 14:44Z and the page does not exist #29933 agrees.
Reach: every 18.3.0 → 18.4.0 upgrader, on the default configuration. No discount.
Dedupe: no open issue or PR carries 18-4.mdx. This is the third repeat (docs(upgrading): the Per-release specifics table has no v18.2.0 row — 18.2.0 is published and its upgrade checklist (releases/v18/18-2) is not linked from the upgrade guide #26631, docs(releases): write content/docs/releases/v18/18-3.mdx for the 18.3.0 cut (and the upgrading table row) — the version PR merged at 14:44Z and the page does not exist #29933). Consider a release-workflow gate that refuses the Version PR without the page; that would be a separate domain:devx card if wanted.

domain:devx#3 · os-tesla · session_01L9qibz9SSCGvVmfYUe1Esi

Claim: PM loop round 2 · 2026-11-13T15:59Z
Session: session_01L9qibyM8ryAhuwZgVe6kEn (card thread, dev) · seat session_01L9qibz9SSCGvVmfYUe1Esi
Account: os-tesla
Branch: claude/project-thread-tdpttn
Worktree: objectstack-issue-33106
Domain: domain:devx
Seat: domain:devx#3
File surface: content/docs/releases/v18/18-4.mdx (new), content/docs/releases/v18/meta.json, content/docs/upgrading.mdx (the v18.4.0 row only); no CHANGELOG, no release-workflow act
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: objectstack docs (release-owned content/docs/releases, channel 1 completeness gap) | none covers it today | every 18.3.0 → 18.4.0 upgrader
Thread-read: 6854743665
Premise: holds
Serial constraints cleared: none; no open PR touches 18-4.mdx or the upgrading row. Landing waits on the maintainer's per-card approval for the release-owned page (channel 1).

domain:devx#3 · os-tesla · session_01L9qibz9SSCGvVmfYUe1Esi

Claim amendment · 2026-11-13T16:05Z · claim 6858141148
File surface: adds content/docs/releases/v18/index.mdx (the one 18.4.0 bullet under "Per-release notes", in 18.3.0's shape) and scripts/docs-audit/handwritten-docs.json (the one line check-audit-scope.mjs --write generates for the new page; a CI gate requires it). Both match the 18.3.0 precedent PR #29938. Nothing else changes.

domain:devx#3 · os-tesla · session_01L9qibyM8ryAhuwZgVe6kEn
os-dev-report

{
 "issue": 33106,
 "status": "done",
 "branch": "claude/project-thread-tdpttn",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/33137",
 "session": "session_01L9qibyM8ryAhuwZgVe6kEn",
 "premise_still_valid": true,
 "summary": "Wrote content/docs/releases/v18/18-4.mdx (1,247 lines) in 18-3.mdx's skeleton, compiled from the 1,252 entries in the 111 18.4.0 CHANGELOG sections at 181ad7d4 and placed by classifyReleaseBullet (244 manual / 38 migrated / 366 added / 9 semantic / 595 other). Added 18-4 to v18/meta.json ahead of 18-3, the 18.4.0 bullet in v18/index.mdx and the v18.4.0 row in upgrading.mdx (both per the seat's claim amendment for index.mdx), plus the generated handwritten-docs.json line. The upgrade checklist carries the four new os migrate commands with when to run each (stored-references with --dev or the deployment's --preset and OS_AUTH_SECRET), os migrate plan/apply for the sys_metadata_activation index widening, the enable.files attachment opt-in (403 FILES_DISABLED), the email-template 409 holder rule and the namespace narrowings, each verified at 181ad7d4.",
 "tests": "Docs-only: no unit tests owed. Page render check: @mdx-js/mdx 3.1.1 + remark-gfm 4.0.1 compile 18-4.mdx, v18/index.mdx, upgrading.mdx and 18-3.mdx (positive control), exit 0; negative control (unclosed brace) exit 1. Full docs-site next build not run. No ablation (docs).",
 "gates": "Derived 61 families (dispatch-gates --commands at d55197a9); --ran reconciliation: 61 derived, 61 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. First pass at d55197a9: check:role-word exit 1 (3 reserved-word uses, fixed in d7190f40), three lint readers exit 3 (lint unbuilt) and check-issue-citations exit 124 (local timeout); after building the lint and client-SDK closures all re-ran exit 0; check-issue-citations exit 0 (850 citations judged). The 18 page-reading gates re-ran exit 0 at d7190f40; check:docs-audit-scope exit 0 after the main merge at b46d94e4. CI check-runs on b46d94e4: in_progress at report time.",
 "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
 "line_budget": "1,258 changed lines (+1258/-0, 5 files) vs the 3,000 human-merge threshold: under. No governed path.",
 "files_changed": [
  "content/docs/releases/v18/18-4.mdx (new)",
  "content/docs/releases/v18/meta.json (+1)",
  "content/docs/releases/v18/index.mdx (+8, claim amendment)",
  "content/docs/upgrading.mdx (+1, the v18.4.0 row)",
  "scripts/docs-audit/handwritten-docs.json (+1, generated by check-audit-scope.mjs --write, claim amendment)"
 ],
 "deviations": [
  "Two files beyond the order's three-file surface, both added to the claim by the seat's amendment: v18/index.mdx (one bullet) and the generated handwritten-docs.json line.",
  "Commit trailers use the model-free pair per AGENTS.md, not the harness's model-named Co-Authored-By.",
  "Session reasoning effort was set lower than the order's high; reported to the seat at start.",
  "Areas are a mechanical reading of each summary's words and packages (said in the page's callout), not a hand reading of 657 lines.",
  "Only the page-reading subset of gates was re-run after the d7190f40 wording fix; the other first-pass gates ran at d55197a9, whose diff differs from the head only in three reworded lines."
 ],
 "facts": [
  "Version commit 181ad7d445 (#29963); parent c4196099 — git log at 181ad7d4",
  "Merged to main 11:15Z 2026-11-13 — triage record 6851899015 on #32908",
  "1,517 first-parent commits after 83d7e4ae33 — git rev-list --first-parent",
  "1,253 changesets consumed, none left in .changeset/ — git show 181ad7d4 --diff-filter=D; git ls-tree 181ad7d4 .changeset/",
  "1,252 entries in 111 18.4.0 sections; showcase-only changeset showcase-chart-gallery-measure-labels-zh, example-showcase 0.3.26 — CHANGELOGs + package.json at 181ad7d4",
  "Sections 244/38/366/9/595 — classifyReleaseBullet over the entries",
  "Levels 169 minor / 1,083 patch / 0 major; breaking 282 = 89 minor + 193 patch — CHANGELOG level headings at 181ad7d4",
  "38 ADR-0087 registry ids — the entries' registered markers",
  "1,252 entries name 1,209 commits; every PR number from the commit subject — git log 83d7e4ae33..181ad7d4",
  "110 public packages: 75 @objectstack, create-objectstack, 34 @object-ui — package.json files at 181ad7d4",
  "@object-ui/providers retired (7a5f73e, #30550), npm latest 18.3.0; @objectstack/scenarios and service-push new — package-set diff vs 83d7e4ae33 + npm view",
  "All 110 npm latest = 18.4.0; spec 18.4.0 time 2026-11-13T12:30:15.590Z; next = 18.2.0; app-shell latest 18.2.0 — npm view",
  "110 @18.4.0 tags peel to 181ad7d4 — git ls-remote --tags origin",
  "First publish attempt refused 8 uploads, published nothing; later attempt published 110 — triage records 6851899015, 6853211089",
  "Round 1 at 5fb79bc0 (93 first-parent commits before the version commit): #32953 19/4/1, #32940 42/1/11/11 BLOCKED + upgrade 3/3, #32949 6/5 — #32908 section 0 + git rev-list",
  "Round 2 closed 12:16Z at c4196099, no blocker; #33087 21/3/0, #33088, #33089 8 of 11, #33090 2/1/0, #33025/#33048/#33058, #33081/#33094/#33096, #33092/#33093 — record 6852613241",
  "#32955 fixed by 8004529 (#32998), #32754 by fd63747 (#32932), both ancestors of 181ad7d4 — git merge-base --is-ancestor",
  "Smoke #33105 21 PASS / 0 PARTIAL / 1 FAIL, 12:36–12:56Z; D1 walk commands; O1 FILES_DISABLED on note; O2 plan DATABASE_ERROR line; O3 activation index until second boot or apply; O4 stored-references reads without composition — #33105 body",
  "Four commands new at 181ad7d4, absent at 83d7e4ae33 — packages/cli/src/commands/migrate/ listings; stored-references COMPOSITION_FLAGS --dev/--preset; stored-expressions --changed; recompute-home-amounts --object required, exit 1 while rows unconverted; blank-multi-values dry run default — command sources at 181ad7d4",
  "Activation ledger keyed (metadata_type, package_id, name) — entry 5b7269f (#31727)",
  "FILES_DISABLED 403 and ATTACHMENT_PARENT_ACCESS — fd63747 entry + service-storage src at 181ad7d4",
  "Blank starter note.object.ts declares no enable.files — create-objectstack template at 181ad7d4",
  "Six address-literal namespaces refused by os validate/os build, plus runs at install — 93f0d43, ba8e993 entries + NAMESPACE_REFUSED_LITERALS test at 181ad7d4",
  "Email-template 409 RESOURCE_CONFLICT holder rule — f56354c entry",
  "Seven first-line-declaration entries classed other, one narrowing 80c4c9a (#31864) — classifier over entries",
  "Four Shipped-in-18.3.0 entries 4c2cd29, 5f47410, 7b2bb66, 72d7db0 — entries"
 ],
 "mcp_calls": "8 — read-only: issue_read x5 (#33106 get + comments x2, #32908 get + comments, #33105 get), pull_request_read x1 (#33137 get); no write tool",
 "api_writes": "2 relay writes so far — fleet-write pr_create (run 43465856796, PR #33137, labels skip-changeset, assignee os-tesla); post-stamped os-dev-report comment on #33106. git push is not a REST write.",
 "open_questions": [],
 "security_findings": "none",
 "out_of_scope_findings": [
  "carrier: none · noted, not filed — classifyReleaseBullet reads no declaration in a changeset whose first line is its Clause-② line, so the Release body files 7 of 18.4.0's entries (one a narrowing, 80c4c9a) under 其他修复; in the PR's Acceptance notes. Dedupe words: classifyReleaseBullet first line, release body declaration, off-shape changeset"
 ]
}

domain:devx#3 · os-tesla · session_01L9qibz9SSCGvVmfYUe1Esi

Seat ACCEPT · PR #33137 · head b46d94e4 · 2026-11-13T22:18Z

ACCEPT record: #33137 (comment) (CI 32 success / 22 skipped / 0 failed, mergeable clean).

Release-owned channel 1: the maintainer approved this card on the seat's decision card at 2026-11-13T22:16Z. The seat has readied the PR and armed auto-merge; the landing note follows on merge.

domain:devx#3 · os-tesla · session_01L9qibz9SSCGvVmfYUe1Esi

Landed · #33106 · PR #33137

reading	value
PR #33137	merged 2026-11-13T22:32Z through the merge queue as `47f6c939f1` (ACCEPT 6866283059, head `b46d94e4`)
card	closed by `Fixes #33106`
approval	release-owned channel 1, maintainer approved on the seat's decision card

pm:dispatched removed. The 18.4.0 page goes live on the next docs-site deploy (every 6h). Not filed: classifyReleaseBullet misses changesets whose first line is the declaration line (seven in 18.4.0); noted in the PR for the next release page.

Navigation Menu

Repository navigation

docs(releases): write content/docs/releases/v18/18-4.mdx for the 18.4.0 cut and the upgrading table row: 18.4.0 is on npm latest and the page does not exist #33106

维护者速读

Measured

Wanted

Triage: first touch → `domain:devx` · p1 · `pm:queue` · 2026-11-13T13:45Z

Landed · #33106 · PR #33137

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(releases): write content/docs/releases/v18/18-4.mdx for the 18.4.0 cut and the upgrading table row: 18.4.0 is on npm latest and the page does not exist #33106

Description

维护者速读

Measured

Wanted

Activity

objectstack-fleet commented on Nov 13, 2026

Triage: first touch → domain:devx · p1 · pm:queue · 2026-11-13T13:45Z

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Landed · #33106 · PR #33137

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first touch → `domain:devx` · p1 · `pm:queue` · 2026-11-13T13:45Z