@@ -0,0 +1,10 @@
+---
+'@objectstack/core': patch
+---
+
+docs: the external org-wide-default floor's docblock no longer lists `controlled_by_parent` among the models it closes
+
+Clause-②: no
+Metadata-protocol: none
+
+`owdForAudience`'s module docblock said an external is floored on a `controlled_by_parent` detail. It is not: plugin-sharing exempts the detail, whose rows follow its master, and the master meets the floor (#25541). Comment only; no behaviour changes.
@@ -0,0 +1,9 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the objectstack-data skill's `current_user` placeholder table names a declared membership key
+
+Clause-②: no
+
+The security rules' table of the `current_user.*` placeholders the RLS compiler resolves listed only the kernel's keys. It now has a row for `current_user.KEY`, the set an object's `membershipKeys.KEY` declares (for `IN`), so an author reading the catalog alone learns that a declared key resolves.
@@ -33,14 +33,8 @@
   只读条款与输入集内建,⛔ 不删 ⛔ 行。
 - 隔离复核子代理暂存全写按所审 PR 命名的 `<scratchpad>/pr-<n>/`,⛔ 不读非本轮自写的暂存。
 - 独立性对:`Implemented-by:`/`Reviewed-by:` 取值同见 `--template`;子代理记采纳它的席位。
-- 项目席落地的 Tier S:`Reviewed-by:` 须属 PR 作者外的账户;同账户子代理只算复核。
-- 作者账户 = PR 正文 attribution 的 `github_login`;记录另带 `Reviewed-by-account:` 行写复核账户。
-- 只动散文面、不欠契约复核的 PR 同欠另一账户一条 `TIER_DEFAULT` 记录;⛔ 散文面无豁免。
 - 轮次报告设复审清单专节,与呈裁清单同为强制审计。
 - 落地前检两条,过则 Tier S 入队、Tier H 等人批:① 达档条款②复核 PASS 在案(同形记录)。
-- ① 在项目席另加:`Reviewed-by-account:` 的登录须异于 PR attribution 的登录,队列守卫同判。
-- 过渡:无另一账户在席时,① 的替代 = 维护者本人在执行线程的话:逐个点名 PR 编号,
-  或对该席位的 Tier S 长期授权(一句可撤)。
 - 例外:纯重生成或只动上列散文面的 head 后移原记录继续管;判据机读已提交树;
   PR 落 `Regen-provenance:` 行。
 - ② PR check 全绿,⛔ 非 required 子集;例外:merge-base 同签名的红不计、按设计而红见 SKILL.md。
 
@@ -19,7 +19,7 @@ ObjectStack follows strict backward compatibility guarantees to ensure predictab
 
 **The v18 line has exited prerelease mode.** While Changesets was in pre mode with the tag `next`, every release cut from `main` was the next `18.0.0-next.N` on npm's `next` tag, and `scripts/check-changeset-no-major.mjs` stood aside in pre mode, so a pull request could declare a major bump. Changesets has exited pre mode, so the line's GA version is `18.0.0`, which publishes to npm's `latest` tag, and the guard again fails a pull request that declares a `major` bump. See [how a breaking stage lands on the v18 line](/docs/releases/v18#how-a-breaking-stage-lands-on-this-line).
 
-**After 18.0.0, a breaking change ships in a MINOR or a PATCH release.** The maintainer's 2026-10-21 ruling ([#25105](https://github.com/objectstack-ai/objectstack/issues/25105)) keeps the no-major guard and grades each change by the metadata protocol: a key, value or metadata type added, narrowed or given a new meaning takes MINOR, and every other change takes PATCH, breaking or not. A non-protocol breaking change (a REST response, a boot refusal, a CLI exit status, a removed runtime export) keeps its `**BREAKING**` banner and ships as a PATCH. 18.1.0, the first release under the rule, is a MINOR that carries 87 changesets declared breaking.
+**After 18.0.0, a breaking change ships in a MINOR or a PATCH release.** The maintainer's 2026-10-21 ruling ([#25105](https://github.com/objectstack-ai/objectstack/issues/25105)) keeps the no-major guard and grades each change by the metadata protocol: a key, value or metadata type added, narrowed or given a new meaning takes MINOR, and every other change takes PATCH, breaking or not. A non-protocol breaking change (a REST response, a boot refusal, a CLI exit status, a removed runtime export) keeps its `**BREAKING**` banner and ships as a PATCH. 18.1.0, the first release under the rule, is a MINOR that carries 90 changesets declared breaking.
 </Callout>
 
 ObjectStack follows [Semantic Versioning 2.0.0](https://semver.org/) (`MAJOR.MINOR.PATCH`). The table below describes what each component means; which version a breaking change ships in depends on the line, as the callout above says.
 
@@ -72,7 +72,7 @@ meaning takes `minor`, and every other change takes `patch` — a REST door, a
 driver, a boot refusal, the CLI or the Console — breaking or not. A
 non-protocol breaking change keeps its `**BREAKING**` banner and its ADR-0087
 disposition. 18.1.0 is the first release cut under the rule: a minor carrying
-87 changesets declared breaking, 39 of them graded `patch`.
+90 changesets declared breaking, 42 of them graded `patch`.
 
 What that means when you read a version number:
 
 
@@ -5,22 +5,22 @@ description: "Release notes and upgrade checklist for 18.1.0, the first minor of
 
 <Callout type="warn">
 **How this page was compiled.** From the 18.1.0 changesets on `main` at
-`03243fc637` (2026-10-24), before the 18.1.0 cut: a rehearsed
+`ba9e0c3749` (2026-10-24), before the 18.1.0 cut: a rehearsed
 `pnpm run version` in a throwaway clone at `b2c0752900` (73 packages move to
-18.1.0, and their `## 18.1.0` sections held 227 distinct entries), and the 26
-changesets merged after it, graded the same way. That makes **253 distinct
+18.1.0, and their `## 18.1.0` sections held 227 distinct entries), and the 31
+changesets merged after it, graded the same way. That makes **258 distinct
 entries**. The five sections below use the grouping the GitHub Release body
-uses, and the counts are that grouping's: **78** need you to act, **9** are
-converted for you, **47** add capabilities, **2** declare a semantic change,
-and **117** are other fixes. Nothing here was
+uses, and the counts are that grouping's: **81** need you to act, **9** are
+converted for you, **47** add capabilities, **3** declare a semantic change,
+and **118** are other fixes. Nothing here was
 read off a published 18.1.0 package or walked on an upgrade yet: every refusal
 is described as its changeset describes it. Anything that lands on `main` before
 the cut is in the CHANGELOG and not on this page.
 </Callout>
 
 ## Highlights — 18.1.0
 
-- ⚠️ **A minor that breaks.** 18.1.0 is a minor version, and 87 of its
+- ⚠️ **A minor that breaks.** 18.1.0 is a minor version, and 90 of its
   changesets are declared breaking. Under the level rule the maintainer ruled
   on 2026-10-21 (#25105, "ruling A"), the v18 line takes no further major: a
   change to the metadata protocol takes `minor`, and every other change takes
@@ -88,7 +88,7 @@ else:
 | Everything else: REST, drivers, services, the CLI, the Console, `feat:` and `fix!:` alike | `patch` |
 
 So a **patch** release can break a REST client, a boot or a deployment
-script, and 18.1.0 carries 39 changesets graded `patch` that say **BREAKING**,
+script, and 18.1.0 carries 42 changesets graded `patch` that say **BREAKING**,
 beside 48 graded `minor` ones. Pin exact `@objectstack/*` versions, and read the
 release notes for every version you cross. Each entry in a CHANGELOG states its
 kind on its own `Metadata-protocol:` line, and the GitHub Release body groups the
@@ -102,7 +102,7 @@ you change them.
 
 ### Breaking changes you must act on
 
-The 78 entries that are breaking and have no ADR-0087 conversion, and one boot
+The 81 entries that are breaking and have no ADR-0087 conversion, and one boot
 refusal (`db1c7cc`) that its changeset declares as an addition. Each line names
 the one fix; the CHANGELOG entry carries the full FROM → TO.
 
@@ -116,6 +116,14 @@ the one fix; the CHANGELOG entry carries the full FROM → TO.
   is too. Fix: set `OS_AUTH_SECRET`, and enable auth on a stack that mounts
   none. A development boot (`os dev`, `--dev`) and an embedded kernel are not
   affected.
+- **A boot with no `OS_AUTH_SECRET` uses the temporary secret on a development
+  boot only** (`6abee03`, #25563). It used it whenever `NODE_ENV` was anything
+  but exactly `production` (unset, `staging`, a typo); now any boot other than
+  `NODE_ENV=development` or `test` throws `OS_AUTH_SECRET is required outside
+  development`. `os serve` and `os start` already default an unset `NODE_ENV`
+  to `production`, so CLI boots behave as before: an embedder that builds its
+  own kernel is the one that meets it. Fix: set `OS_AUTH_SECRET`, or
+  `NODE_ENV=development` for a local boot.
 - **A production `os serve` whose `@objectstack/plugin-auth` fails to load is
   refused, naming the load error** (`b2e964f`, #25231), `os start` included.
   18.0.0 booted it without auth, silently or with one
@@ -253,6 +261,14 @@ door (`422 INVALID_METADATA`), where 18.0.0 accepted it.
   starts empty, and a read-only boot no longer opens an empty in-memory database
   over a file it cannot open or create (`4d99158`, #25007). Fix: restore from a
   backup, or move the file aside yourself; an absent file is created empty.
+- **`SqlDriver.findWithWindowFunctions()` serves a closed set** (`6abee03`,
+  #25563), and so do `driver-sqlite-wasm` and `driver-turso`'s local and
+  replica transports: the function is one of `row_number`, `rank`,
+  `dense_rank`, `percent_rank` or `cume_dist`, the direction `asc` or `desc`,
+  and every `partitionBy` / `orderBy` field is quoted as a column. Anything
+  else answers `400 INVALID_QUERY`. Fix: use one of those; send a window that
+  takes an argument (`lag`, `lead`, `ntile`) through `execute()` with bound
+  parameters.
 - **On PostgreSQL, `introspectSchema` reads each table in its own schema**, and
   refuses a `search_path` that reaches one table name in two schemas (`74fcec1`,
   #24920). Fix: point the connection at one schema.
@@ -302,6 +318,16 @@ door (`422 INVALID_METADATA`), where 18.0.0 accepted it.
   naming the parameter (`17f3c65`, #25260), and the published list-query
   schemas declare it a non-negative integer (`5f30f00`, #25300). Fix: send a
   whole count of zero or more, or leave it out.
+- **A credential is honoured only in the environment whose auth service
+  validated it** (`1361a5a`, #25565), on every route behind the shared REST
+  auth gate: crud, actions, import and export, batch, sharing, approvals,
+  analytics, search and security, scoped and unscoped. Before, an environment
+  with no `auth` service of its own fell back to the default environment's.
+  A mismatch now answers the same `401` as an unauthenticated request. Only a
+  multi-environment host whose per-environment kernels carry no `auth`
+  service meets it; a single-kernel deployment is unchanged. Fix: give each
+  environment's kernel its own `auth` service, and sign in to the environment
+  you call.
 - **`GET {base}/docs`, the OpenAPI HTML viewer page, is retired**
   (`1b3b65e`, #25124). `GET {base}/openapi.json` stays: point your own viewer
   at it.
@@ -472,6 +498,12 @@ rows.
   `controlled_by_parent` detail follows its master. Nothing changes for a
   principal that does not hold the `external` grade, and no earlier release
   shipped it.
+- **`FlowSchema.runAs` now says what a `system` run may not write**
+  (`025f6de`, #25564): its description names the refused writes to the four
+  identity-assignment objects (above, under security), and ADR-0087 D3 records
+  the change of meaning as `flow-run-as-system-identity-assignment-write-refused`,
+  so `os migrate meta` lists it for a flow that wrote those rows. It carries no
+  conversion, and every flow parses as before.
 
 A change of meaning that also breaks is listed with the breaking changes above.
 
@@ -585,7 +617,8 @@ reinstall.
 #### 2. Before the first boot
 
 - Production `os serve` or `os start`: set `OS_AUTH_SECRET`, and do not rely on
-  `--no-server` or `OS_MIGRATE_AND_EXIT=1` to boot without it.
+  `--no-server` or `OS_MIGRATE_AND_EXIT=1` to boot without it. A kernel you
+  embed needs it too, unless it boots with `NODE_ENV=development` or `test`.
 - A stack that mounts no auth (`auth` tier off, `--preset minimal`) fails a
   production boot: enable auth.
 - CORS: list every cross-origin front-end in `OS_CORS_ORIGIN`, loopback origins
@@ -628,3 +661,5 @@ managed datasource.
   assignments, invitations or memberships, and move it to `runAs: 'user'` or
   the organization endpoints.
 - Read the boot's upgrade impact report beside the access upgrade report.
+- On a multi-environment host, give each environment's kernel its own `auth`
+  service before callers reach it, or they get `401`.
@@ -135,7 +135,7 @@ Each release below is a self-contained page: what it changed, what breaks, and
 its own upgrade checklist.
 
 - **[18.1.0](/docs/releases/v18/18-1)** — the first minor, and a minor that
-  breaks: 87 of its changesets are declared breaking (ruling A grades a
+  breaks: 90 of its changesets are declared breaking (ruling A grades a
   non-protocol breaking change `patch` and a protocol narrowing `minor`). Its
   [upgrade checklist](/docs/releases/v18/18-1#upgrade-checklist) moves an
   18.0.0 app to 18.1.0; it was compiled from the changesets before the cut and
 
@@ -11,6 +11,20 @@
 
 ---
 
+## Amendment: a `runAs:'system'` run writes no identity assignment (2026-10-24, #25251)
+
+M2's last bullet below says "`runAs:'system'` stays god-mode throughout". That no longer holds for one family of writes. Ruling 6354966423 (letter B) on #25251 carved identity assignment out of a flow's system elevation, the same way the 2026-10-03 ruling carved the stored-metadata tables out of app-authored work: a flow is app-authored automation, and `runAs` declares its authorization posture, not an identity (D2).
+
+**What is refused.** An insert, update, delete, transfer, restore or purge of a row of `sys_user_position`, `sys_user_permission_set`, `sys_invitation` or `sys_member`, from a context that carries `isSystem` **and** a `flowRunId`. That is the context a `runAs:'system'` run's data nodes write under (`resolveRunDataContext`). The security middleware refuses it ahead of its `isSystem` short-circuit with `PERMISSION_DENIED` (403), and nothing is written. The refusal holds at any depth of the flow's own write: a cascade leg or a hook's write under the same context is refused the same way. Landed in #25483 (plugin-security, the run-time arm) and #25564 (the `FlowSchema.runAs` description and the ADR-0087 D3 entry `flow-run-as-system-identity-assignment-write-refused`).
+
+**What is unchanged.** A system run's reads of the four objects, and its writes to every other object. A `runAs:'user'` run, which carries a `flowRunId` without `isSystem` and reaches the ADR-0090 D12 delegated-administration gate as the user it acts for. Every platform writer whose system context carries no flow run: the seeders, the publish materializer, better-auth and its reconciliation, invitation placement, and the organization-administrator grant.
+
+**The remedy the refusal names.** For position holdings and permission-set grants, `runAs:'user'`: the D12 gate then judges the acting user and records that user as `granted_by`. For invitations and memberships, the organization endpoints (`invite-member`, `cancel-invitation`, `update-member-role`, `remove-member`), which apply the invitation's placement and role-cap checks.
+
+So `system` stays full elevation everywhere else, and the M2 bullet is read with this one exception.
+
+---
+
 ## Amendment: user-less data ops are now REFUSED (2026-07-28, #3760)
 
 Two load-bearing claims below turned out to be wrong. Both were about *severity*, not about the model — D1–D5 stand unchanged, and D5 shipped in full.
@@ -21,7 +35,7 @@ Two load-bearing claims below turned out to be wrong. Both were about *severity*
 
 **Consequently `runAs:'user'` + no trigger user now REFUSES the data operation** (`UnscopedRunDataAccessError`, thrown from `resolveRunDataContext` — the single place every data node resolves its context). This implements D5's ruling ("user-less `runAs:'user'` is a configuration error") at the only layer that can see the record-change case, since whether a triggering write carries a user is not knowable at authoring time.
 
-Note what this deliberately is **not**: it does not re-badge these runs as `isSystem`. The security middleware's `isSystem` short-circuit precedes its package-managed-row / system-row / audience-anchor / delegated-admin gates, all of which a principal-less context still has to clear — so "unscoped" was never equivalent to "system", and elevating would have *widened* these runs (e.g. letting them write `sys_user_position`) rather than preserving the status quo.
+Note what this deliberately is **not**: it does not re-badge these runs as `isSystem`. The security middleware's `isSystem` short-circuit precedes its package-managed-row / system-row / audience-anchor / delegated-admin gates, all of which a principal-less context still has to clear — so "unscoped" was never equivalent to "system", and elevating would have *widened* these runs (e.g. letting them write `sys_user_position`) rather than preserving the status quo — a write that, since the 2026-10-24 Amendment above, a `runAs:'system'` run is itself refused.
 
 This is an **interim** posture, not a replacement for D2. Refusal is strictly safer than today and forward-compatible: when the `automation` principal lands, the refusal point becomes the place that resolves it, and these runs go from *refused* to *RLS-enforced* with no third state. Ordering is unchanged — D2 still waits for a real consumer.