[objectstack-fleet]

Requested by 田騏 · project thread

Summary

Five more changesets reached main after #25562 was compiled at 03243fc637, still before the 18.1.0 cut. This PR folds them into the 18.1.0 notes. It is docs-only.

Three are breaking patches:

• fix(plugin-auth, driver-sql)!: fail closed on a missing auth secret outside development; compile window functions from closed tables #25563, auth secret: the temporary auth secret is now used on a development or test boot only. This goes under "Boot and deployment", and checklist step 2 now names the embedded-kernel case.
• fix(plugin-auth, driver-sql)!: fail closed on a missing auth secret outside development; compile window functions from closed tables #25563, window functions: findWithWindowFunctions() now serves a closed set of functions and directions. This goes under "Datasources and drivers".
• fix(rest)!: compare the credential's environment with the resolved environment in enforceAuth #25565: a REST credential is honoured only in the environment that validated it. This goes under "REST, MCP and API clients", and checklist step 4 covers multi-environment hosts.

The other two:

• docs(spec): the runAs description names a system run's refused identity-assignment writes, with its ADR-0087 D3 entry #25564 is semantic: it records the change of meaning that feat(plugin-security)!: a flow that runs as system writes no identity assignment #25483 made to runAs. It goes under "Semantic changes".
• fix(metadata-protocol): a widget probe refused by read admission names the caller's read access, not a dataset edit #25560 is a fix and is counted under other fixes.

The counts are now 258 entries, split 81 / 9 / 47 / 3 / 118. 90 changesets are declared breaking, 48 minor and 42 patch, and check-adr-0087-registration --list reports 90 of 90. The count is updated on the 18.1 page, the v18 index, the releases index and Backward Compatibility.

Checks

These pass locally: check:role-word, check:release-notes, check:release-page-status, check:release-index-currency-sync, check:doc-anchors, check:docs-audit-scope, check:docs-single-h1, and an MDX compile of the page.

Clause-②: no
Metadata-protocol: none

🤖 Generated with Claude Code

https://claude.ai/code/session_01At7xrR4rgknXtej5ZkMJHd