docs(releases): the v18 landing page — the page check:release-notes needs before 18.0.0-next.0, behind the URL the CLI's @next pointer names

content/docs/releases/index.mdx

@@ -18,6 +18,7 @@ migration steps, then covers new capabilities and notable fixes.
 
 ## Versions
 
+- [v18](/docs/releases/v18) — The line that carries ADR-0131, total organization ownership with no NULL `organization_id`; its breaking changes land in stages, each with its own changeset and migration, and `latest` stays on 17.x until the line reaches GA (prerelease: `18.0.0-next.N` on npm's `next` tag, no GA date).
 - [v17.0.0](/docs/releases/v17) — Files become owned `sys_file` records with server-enforced `accept`/`maxSize` and a governed download path, bulk export becomes its own opt-in privilege, the SDK is reconciled against the routes the server actually mounts (21 dead methods out, 40+ real ones in), approval nodes route approvers dynamically via CEL expressions and decision outputs, a datasource that cannot connect fails the boot, and Node 22 becomes the supported floor; 17.1 adds partial field masking, record-view auditing on `sys_audit_log`, and a per-object read-only approval visibility tier — and makes a deactivated permission set or position actually stop granting access, withdraws the bulk-export wildcard from the shipped admin sets, and gives all three flow doors one honest HTTP status table; 17.2 tightens by-id `update`/`delete` against a silently-dropped `where` predicate or a mismatched id, retires `sys_position.permissions` and other dead ADR-0049 surfaces, and stops analytics from answering the wrong number on a cross-object filter (current series: 17.7.0, released 2026-10-06).
 - [v16.0.0](/docs/releases/v16) — One org identifier (`organizationId`) across hooks and actions, quorum + per-group sign-off (会签) approvals with metadata-declared decision actions, time-relative automations, filtered roll-ups, strict dashboard widgets, an identity-scoped MCP stdio transport, and a platform-wide enforce-or-remove sweep that makes dead metadata loud; 16.1 adds a `requires` capability-provider preflight, two more dashboard build gates, and `runAs:'user'` automations that run with the triggering user's real grants (final release: 16.1.0).
 - [v15.0.0](/docs/releases/v15) — Explain record access layer by layer, a docked AI workspace in the Console, project-ready Gantt charts, and phone sign-in; 15.1 adds permission-following attachments, no-code third-party connectors, dashboard-wide filters, pinyin search, and whole-record inline editing — with materially safer multi-tenant and write-path defaults (final release: 15.1.1).

content/docs/releases/meta.json

@@ -1,6 +1,7 @@
 {
   "title": "Releases",
   "pages": [
+    "v18",
     "v17",
     "v16",
     "v15",

content/docs/releases/v18/index.mdx

@@ -0,0 +1,42 @@
+---
+title: v18
+description: "The v18 line, in prerelease on npm's `next` tag. It carries ADR-0131 (organization ownership is total, with no NULL `organization_id`) and lands its breaking changes in stages, each with its own migration. `latest` stays on 17.x until the line reaches GA."
+---
+
+> **Release status: v18 has no GA release yet.** The line publishes as
+> `18.0.0-next.N` prereleases on npm's `next` dist-tag. The `latest` tag stays
+> on the 17.x line, so a plain install keeps resolving 17.x, and a `^17`
+> dependency range never moves to 18. You get a v18 prerelease only by asking
+> for one: `@next` on every `@objectstack/*` dependency together, or an exact
+> `18.0.0-next.N`. There is no GA date.
+
+**The v18 line** exists for one decision whose changes do not fit in a 17.x
+minor: [ADR-0131](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0131-total-organization-ownership-no-null-organization-id.md),
+organization ownership is total — no NULL `organization_id`; declared metadata
+stays in code; a row exists only when an organization authored it. Its changes
+reshape stored data and narrow what the runtime accepts, so the ADR stages them
+in one major (its D14) instead of spreading them across 17.x minors. While the
+line is open, every other breaking change that lands on `main` ships on it too,
+under the same rules.
+
+## How a breaking stage lands on this line
+
+- **Through `next` before `latest`.** Every major is published to the `next`
+  dist-tag for at least one RC cycle before `latest`
+  ([ADR-0087](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0087-metadata-protocol-upgrade-contract.md)
+  D6). Changesets is in pre mode with the tag `next`, so every release cut from
+  `main` is the next `18.0.0-next.N`, carrying everything merged since the cut
+  before it.
+- **One stage, one changeset, one migration.** ADR-0131 lands in stages, in the
+  order the ADR records, and each stage that breaks something says so in its
+  own changeset: what breaks, and how to move from the old shape to the new
+  one. Those changesets become the `CHANGELOG.md` entries shipped inside each
+  `18.0.0-next.N` package, so read the CHANGELOG of every prerelease you move
+  to — moving from one `18.0.0-next.N` to the next can break you.
+- **Protocol 18 comes with it.** `PROTOCOL_VERSION` is `18.0.0` on `main`, so a
+  v18 prerelease's handshake admits `engines.protocol: '^18'` and refuses
+  `'^17'`. Read [Upgrading](/docs/upgrading) before you move an app's declared
+  range.
+- **GA ends the prerelease.** Reaching GA exits pre mode and publishes the line
+  to `latest`. Curated notes for the line's releases are compiled at release
+  time and are not written yet; until then, the changesets are the record.

content/docs/releases/v18/meta.json

@@ -0,0 +1,6 @@
+{
+  "title": "v18",
+  "pages": [
+    "index"
+  ]
+}

scripts/docs-audit/handwritten-docs.json

@@ -203,6 +203,7 @@
     "content/docs/releases/v17/17-6.mdx",
     "content/docs/releases/v17/17-7.mdx",
     "content/docs/releases/v17/index.mdx",
+    "content/docs/releases/v18/index.mdx",
     "content/docs/releases/v9.mdx",
     "content/docs/ui/actions.mdx",
     "content/docs/ui/apps.mdx",