[zhuangjianguo]

Requested by Steedos · project thread

What changes

• @objectstack/spec, runtime, plugin-hono-server and cli move from 18.1.0 to 18.2.0 (exact pins, as the 18.1 upgrade Upgrade the @objectstack/* dependencies from 17.7.0 to 18.1.0, walking the official upgrade checklists of 18.0 and 18.1 #110 set them), with the eight CLI overrides in pnpm-workspace.yaml moved together. The lockfile resolves every @objectstack/* package to 18.2.0 (no 18.1.0 left).
• 18.2 makes a position's and a permission set's label / description translatable, and objectstack lint / the i18n gate now count them (24 missing zh-CN keys after the bump). New src/translations/{en,zh-CN}/security.ts carries the 7 positions and 5 permission sets; the zh-CN position names follow DESIGN.md §04 (法务经办, 法务负责人, 财务负责人, 分管领导, 总经理, 档案与记录管理员, CLM 管理员).

No metadata is reshaped: none of the 18.2 breaking changes (action copy templates, allowDelete:false beside modifyAllRecords, escalateTo addresses, locale tags, node visibleOn…) hits hotclm's sources.

Gates (on this branch)

pnpm validate        ✓ Validation passed
pnpm lint            exit 0
pnpm typecheck       exit 0
pnpm lint:i18n-gate  ✓ COVERAGE: 0 missing keys across 2 locale(s)

New 18.2 lint warning, not fixed here

18.2's lint adds one warning that 18.1 did not have: security-controlled-by-parent-owner-policy-without-opt-in on clm_requester's obligation_requester_own policy (clm_obligation is controlled_by_parent, so the owner-scoped update never admits a requester who cannot edit the contract). That is the existing card #64, and 18.2's sharing.controlledByParent.ownerMayEdit is the capability #64 waits on. It is a security-posture change, so it stays on #64 rather than in the version bump.

Browser verification of the main flows: see the comment below — every main flow passes.

---

Generated by Claude Code

[objectstack-fleet]

Browser verification on 18.2.0 (fresh pnpm demo:zh, zh-CN, 11 README-made personas)

Main flows pass for every persona:

• Launch wizard: NDA with an existing counterparty, upload, submit now → in_review, assigned to Legal Counsel 1; requester creating a new counterparty → launched (The launch wizard offers every business requester a "new counterparty" step that always fails — create_party is refused for clm_requester #133's fix holds).
• Approval ladder: 250k order → rung 1 (manager, the Executive) approve → finance_only approve → approved; reject path → rejected, comment carried into the notification.
• 18.2 lets the pending rung-1 manager read the contract (objectstack#26180 shipped as b7b04e5): the request page renders the whole contract, and the data API answers 200 on the contract and its versions while the step is pending. This unblocks An approver cannot open the contract they are asked to approve — the request page says "无法打开此记录" for the rung-1 manager and for the finance rung #134.
• NDA lifecycle: send-for-approval refused without an approved review (422) → clean v2 → approved review → send → manager approves → records manager Start Signing → wet-ink round (completed_at stamped) → Activate → active.
• Renewal ×2: first creates a draft, second is refused.
• Setup → Positions / Permission Sets: the app's 7 positions and 5 sets render in Chinese from this PR's new bundle.
• Discussion reactions (The contract's Discussion tab answers 403 on sys_comment_reaction for requesters and lawyers — the grant PR #88 added stops one object short #135): 200.
• executed_upload: still 403, as expected; 18.2 ships flow-level requiredPermissions (f1ddace), which unblocks [Decision] §06 F16 说补录动作「档案岗**或**法务可用」，但实现只能给档案岗——权限是 AND，没有两边都持有的能力 #43.
• The six daily flows, with cron temporarily set to every minute (not committed): all completed on every run, none failed, notifications sent (18.2 changed notify semantics, so this was checked on purpose).

New cards from this pass: #156 #157 #158 #159, objectstack#26562 #26563. Still reproducing, already carded: #139, #140.

18.2 also ships what nine pm:blocked cards wait on: #134, #43, #64, #127, #99, #41, #31, #28, #19 (only #134 measured; the rest matched against the 18.2 CHANGELOG).

Full report and screenshots: project files hotclm-objectstack-18-2-upgrade/.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 — ACCEPT · head 0b2622f · 2026-10-27T08:36Z

check	reading
shape	draft → main, on top of main 3b7364f; assignee zhuangjianguo; mergeable clean. The maintainer asked for it in the project thread: 「hotclm 升级到 objectstack 18.2」
CI on the head	both Validate check-runs success on 0b2622f = PR head.sha
pins	package.json 4 exact pins and the 8 pnpm-workspace.yaml overrides go from 18.1.0 to 18.2.0. The lockfile has 0 @objectstack/*@18.1 entries, and every @objectstack/* resolves to 18.2.0
translations	src/translations/{en,zh-CN}/security.ts: 7 positions and 5 permission sets. The en strings are verbatim from src/sharing/positions.ts and src/profiles/*.profile.ts. The zh-CN position names match DESIGN.md §04 (法务经办 · 法务负责人 · 财务负责人 · 分管领导 · 总经理 · 档案与记录管理员). This closes 18.2's 24 new i18n-gate keys
scope	7 files, nothing governed (no DESIGN / AGENTS / CLAUDE / CHANGELOG / docs/design). No metadata reshaped
browser	the dev's pass with 11 README-made personas on a fresh demo:zh (comment 6437265614): every main flow passes
known, not here	one new 18.2 lint warning, security-controlled-by-parent-owner-policy-without-opt-in on obligation_requester_own. It belongs to #64, which waits on exactly the ownerMayEdit capability 18.2 ships. Unblocking #64 and the other cards 18.2 unlocks is the seat's next step after landing
observation	the finance position's description predates #153 (the routed read during approval). This is source-string drift, not a translation issue. It is noted for the #134 follow-up, no card

Landing: under the maintainer's merge authorization (project thread: 「你可以自己审核的就自己合并」).

---

Generated by Claude Code