docs(releases): curate the v16 release page — backend + Console coverage for 16.0.0

[os-zhuang]

Summary

content/docs/releases/v16.mdx was missing while @objectstack/spec is already published at 16.0.0-rc.0 — the check:release-notes drift guard demands a curated page per released major. This adds the full v16 release page (backend and Console), wires it into meta.json, and updates the index (v15 marked final at 15.1.1).

Sourcing

Per docs/releases-maintenance.md:

• Backend — the deduplicated 16.0.0-rc.0 changeset entries across all package CHANGELOG.mds (85 unique changesets: 2 major, ~30 minor, ~50 patch), plus the changeset-less approvals commits (feat(approvals): quorum + per-group sign-off (会签) + decision attachments (#3266) #3268 / feat(approvals): server-computed decision progress + notification deep links (#3266 / objectui#2678 P1.5) #3274 / feat(approvals): declare decision actions on sys_approval_request (objectui#2678 P2-4) #3282 / feat(approvals): declare full decision/continuity action set + wire revise/resubmit routes #3300) and capability-vocabulary work (feat(spec,cli): one platform capability vocabulary — canonical kebab tokens, deprecated aliases, warn-first validation (#3265) #3281 / feat(spec): reject unknown requires capability tokens at authoring (#3265) #3302) recovered from commit messages.
• Console — the bundled objectui delta 077e45b..94d4876 (the objectui 15.0.0 → 16.0.0 major, objectui fix(runtime): carry spec-validation issues + 422 through metadata save/publish errors #2589–[cli/plugin-security] dev 元数据物化不一致:默认权限集 insert-if-not-exists 不重物化(声明集走 upsert) #2705), from the three @objectstack/console bump changesets plus objectui commit bodies.

Page structure (mirrors v15)

• Highlights, outcome-oriented.
• Breaking changes & migration:organizationId convergence (Unify the developer-facing org identifier: hooks expose session.tenantId while RLS/seed/columns use organizationId (add organizationId as the blessed name) #3280/Remove the deprecated hook/action ctx.session.tenantId alias in the next major (converge on organizationId) #3290), DashboardWidgetSchema.strict() ([P2] Finish the dashboard analytics migration: Studio → dataset shape, then enable DashboardWidgetSchema strict validation #3251, protocol step16), MCP stdio API-key principal + own switch (ADR-0101/decision: default wiring for the serve-side MCP server (@objectstack/mcp) in dev — identity admission first #3167), feed-surface retirement (Retire vestigial feed contracts + protocol surface (ADR-0052 §5 follow-up) #1959/Retire residual feed discovery/dispatcher surface (ADR-0052 §5, follow-up to #1959) #3180), the [11.0][A2] Remove dead author-facing metadata properties (ADR-0049 enforce-or-remove) #2377 enforce-or-remove sweep (dead field/object/agent props, 18→8 hook events, dead validation/webhook triggers, js dialect), engine-owned system objects (ADR-0103/The managedBy: 'system' bucket is overloaded (engine-only vs. admin-writable) — split the taxonomy; don't guard it wholesale #3220), ADR-0099 P1 posture narrowing with its upgrade check, and role → org_membership_level (ApproverType.role is the last surface projecting the reserved word — the ADR-0090 D3 exception it relies on has a false premise #3133).
• Behavior changes: import passwordPolicy: 'auto' default, readonly INSERT strip, bulk-update validation enforcement, transactional-batch API gates, dateField == today() fix, sandbox CPU-time budgets, better-auth system-context writes, platform-global tenancy fix.
• New capabilities: approvals quorum + per-group sign-off (会签) + declared decision actions, time-relative trigger ([P2] Provide a declarative time-relative trigger (avoid fragile date-equality on record-change) #1874), filtered roll-ups ([P0] Add native cross-object rollup/summary capability (parent aggregates of child rows) #1868), state_machine.initialStates, flow-trigger observability, analytics drill ranges (Report drill-down: date-granularity dimensions need a range filter, not equality #1752), Server-Timing spans (feat(observability): per-request performance timing → Server-Timing (perf-tuning mode) #2408), MCP validate_expression, capability vocabulary (Unify optional-plugin loading: framework serve.ts and cloud objectos-runtime are parallel implementations with divergent capability tokens (ai-studio vs aiStudio) #3265), typed batchTransaction, sandbox/bulk-write/seed/CLI hardening.
• Console (Studio) — bundled objectui 16.0, grouped by area: metadata-driven approvals inbox (perf/reliability: seed + data-import bypass the engine's bulk-insert path → N round-trips, N summary recomputes, no transient retry #2678 line), ADR-0059 action-param widgets, dataset-only dashboard authoring, flow-designer nested regions (记录页头审批决策按钮（Approve/Reject）被 app 动作挤进溢出菜单；建议审批动作可优先渲染 + Action 增加显式排序 #2670), Gantt, Access pillar (docs(spec,skills,adr): correct related-list docs for relatedList 'primary' (#2579 follow-up) #2600 B1–B5), lists/master-detail/detail, auth/login, platform fixes.
• Upgrade checklist and References.

Verification

• node scripts/check-release-notes.mjs → OK (every released major has a curated, navigable page).
• Every claim traced to a changeset entry, commit message, or objectui commit body in the bundled range; the RC status is called out explicitly on the page.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AHVoqyH9VAjmbyMN1Ri2jf

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 19, 2026 7:00pm