@@ -18,7 +18,7 @@ migration steps, then covers new capabilities and notable fixes.
 
 ## Versions
 
-- [v18](/docs/releases/v18) — The line that carries ADR-0131, total organization ownership with no NULL `organization_id`; its breaking changes land in stages, each with its own changeset and migration, and `latest` stays on 17.x until the line reaches GA (prerelease: `18.0.0-next.N` on npm's `next` tag, no GA date).
+- [v18](/docs/releases/v18) — The line that carries ADR-0131, total organization ownership with no NULL `organization_id`; its breaking changes landed in stages through the `18.0.0-next.N` prereleases on npm's `next` tag, each with its own changeset and migration, and its GA release, 18.0.0, publishes to npm's `latest` tag and moves it from 17.x to 18 (current series: 18.0.0, released 2026-10-19).
 - [v17.0.0](/docs/releases/v17) — Files become owned `sys_file` records with server-enforced `accept`/`maxSize` and a governed download path, bulk export becomes its own opt-in privilege, the SDK is reconciled against the routes the server actually mounts (21 dead methods out, 40+ real ones in), approval nodes route approvers dynamically via CEL expressions and decision outputs, a datasource that cannot connect fails the boot, and Node 22 becomes the supported floor; 17.1 adds partial field masking, record-view auditing on `sys_audit_log`, and a per-object read-only approval visibility tier — and makes a deactivated permission set or position actually stop granting access, withdraws the bulk-export wildcard from the shipped admin sets, and gives all three flow doors one honest HTTP status table; 17.2 tightens by-id `update`/`delete` against a silently-dropped `where` predicate or a mismatched id, retires `sys_position.permissions` and other dead ADR-0049 surfaces, and stops analytics from answering the wrong number on a cross-object filter (current series: 17.7.0, released 2026-10-06).
 - [v16.0.0](/docs/releases/v16) — One org identifier (`organizationId`) across hooks and actions, quorum + per-group sign-off (会签) approvals with metadata-declared decision actions, time-relative automations, filtered roll-ups, strict dashboard widgets, an identity-scoped MCP stdio transport, and a platform-wide enforce-or-remove sweep that makes dead metadata loud; 16.1 adds a `requires` capability-provider preflight, two more dashboard build gates, and `runAs:'user'` automations that run with the triggering user's real grants (final release: 16.1.0).
 - [v15.0.0](/docs/releases/v15) — Explain record access layer by layer, a docked AI workspace in the Console, project-ready Gantt charts, and phone sign-in; 15.1 adds permission-following attachments, no-code third-party connectors, dashboard-wide filters, pinyin search, and whole-record inline editing — with materially safer multi-tenant and write-path defaults (final release: 15.1.1).
@@ -55,10 +55,13 @@ shipped as a minor release.** It landed in a **minor** alongside a changeset
 entry marked `**BREAKING**`, and `scripts/check-changeset-no-major.mjs`
 failed a pull request that declared a major bump.
 
-**The v18 line is a major in prerelease.** Changesets is in pre mode with the
-tag `next`, and `check-changeset-no-major.mjs` stands aside in pre mode, so a
-pull request may declare a major bump. Every release cut from `main` is the
-next `18.0.0-next.N` on npm's `next` tag, while `latest` stays on 17.x. See
+**The v18 line is a major, and 18.0.0 is its GA release.** While Changesets
+was in pre mode with the tag `next`, `check-changeset-no-major.mjs` stood
+aside, so a pull request could declare a major bump, and every release cut
+from `main` was the next `18.0.0-next.N` on npm's `next` tag while `latest`
+stayed on 17.x. Changesets has left pre mode for the 18.0.0 cut, which
+publishes to npm's `latest` tag, and the guard again fails a pull request that
+declares a major bump. See
 [how a breaking stage lands on the v18 line](/docs/releases/v18#how-a-breaking-stage-lands-on-this-line).
 
 What that means when you read a version number:
 
@@ -1,32 +1,34 @@
 ---
 title: v18
-description: "The v18 line, in prerelease on npm's `next` tag. It carries ADR-0131 (organization ownership is total, with no NULL `organization_id`) and lands its breaking changes in stages, each with its own migration. `latest` stays on 17.x until the line reaches GA."
+description: "The v18 line and its GA release, 18.0.0, which closes the `18.0.0-next.N` prerelease train and publishes to npm's `latest` tag. It carries ADR-0131 (organization ownership is total, with no NULL `organization_id`) and landed its breaking changes in stages, each with its own migration."
 ---
 
-> **Release status: v18 has no GA release yet.** The line publishes as
-> `18.0.0-next.N` prereleases on npm's `next` dist-tag. The `latest` tag stays
-> on the 17.x line, so a plain install keeps resolving 17.x, and a `^17`
-> dependency range never moves to 18. You get a v18 prerelease only by asking
-> for one: `@next` on every `@objectstack/*` dependency together, or an exact
-> `18.0.0-next.N`. There is no GA date.
+> **Release status: 18.0.0 is GA — the release this page documents.** It
+> closes the v18 prerelease train, which published as `18.0.0-next.N` on npm's
+> `next` dist-tag. The 18.0.0 cut leaves Changesets pre mode, so the
+> `@objectstack/*` packages stop publishing as `18.0.0-next.N`, and 18.0.0
+> publishes to npm's `latest` dist-tag, which moves from 17.x to 18 with it. A
+> `^17` dependency range still never moves to 18 by itself: move every
+> `@objectstack/*` dependency to 18 together, and read
+> [Upgrading](/docs/upgrading) before you do.
 
 **The v18 line** exists for one decision whose changes do not fit in a 17.x
 minor: [ADR-0131](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0131-total-organization-ownership-no-null-organization-id.md),
 organization ownership is total — no NULL `organization_id`; declared metadata
 stays in code; a row exists only when an organization authored it. Its changes
 reshape stored data and narrow what the runtime accepts, so the ADR stages them
 in one major (its D14) instead of spreading them across 17.x minors. While the
-line is open, every other breaking change that lands on `main` ships on it too,
-under the same rules.
+line was open, every other breaking change that landed on `main` shipped on it
+too, under the same rules.
 
 ## How a breaking stage lands on this line
 
 - **Through `next` before `latest`.** Every major is published to the `next`
   dist-tag for at least one RC cycle before `latest`
   ([ADR-0087](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0087-metadata-protocol-upgrade-contract.md)
-  D6). Changesets is in pre mode with the tag `next`, so every release cut from
-  `main` is the next `18.0.0-next.N`, carrying everything merged since the cut
-  before it.
+  D6). While Changesets was in pre mode with the tag `next`, every release cut
+  from `main` was the next `18.0.0-next.N`, carrying everything merged since
+  the cut before it; 18.0.0 is the cut that takes the line to `latest`.
 - **One stage, one changeset, one migration.** ADR-0131 lands in stages, in the
   order the ADR records, and each stage that breaks something says so in its
   own changeset: what breaks, and how to move from the old shape to the new
@@ -59,6 +61,7 @@ under the same rules.
 
   `npx skills remove --all` replaces the first command when these are the only
   skills the project has.
-- **GA ends the prerelease.** Reaching GA exits pre mode and publishes the line
-  to `latest`. Curated notes for the line's releases are compiled at release
-  time and are not written yet; until then, the changesets are the record.
+- **18.0.0 ends the prerelease.** It is the GA cut: it leaves pre mode and
+  publishes the line to `latest`. Curated notes for the line's releases are
+  compiled at release time and are not written yet; until then, the changesets
+  are the record.