chore(spec): the changeset, and the checklist ratchet entry governing this type forces

Two files the ledger's own gates demand, neither of them optional:

- `.changeset/18582-sharing-rule-liveness-ledger.md` — `packages/spec`'s `files[]`
  includes `liveness`, so a new ledger IS published; this is a `patch`, not a
  `skip-changeset` diff.
- `docs/qa/platform-checklist/coverage.json` — the capability ratchet DERIVES its
  universe from `packages/spec/liveness/*.json`, so seeding a ledger is what makes
  the kind UNCLASSIFIED there. Mapped to the three items that already exercise the
  surface (`sharing-rules-widen`, `sharing-rule-authoring-ui`,
  `record-share-grant-revoke`) rather than waived — no item is authored here, and a
  waiver would have been false.

Claude-Session: https://claude.ai/code/session_01JbZnqu8bt6YqfJsr9vaFb3
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/18582-sharing-rule-liveness-ledger.md

@@ -0,0 +1,14 @@
+---
+"@objectstack/spec": patch
+---
+
+`liveness/sharing_rule.json` — the sharing-rule authoring surface is now a governed liveness type: every authorable key of `SharingRuleSchema` carries a status, the evidence that settles it and the producer that populates it (part of #18582).
+
+The ledgers ship inside this package (`files[]` includes `liveness`), so this is a new file in the tarball and two changed ones — `liveness/README.md`'s index row and the generated `liveness/state-counts.md`. Nothing else moves: no schema accepts or refuses anything it did not before, no export changes, and no CLI author warning is added (no entry is marked `authorWarn`).
+
+- **Why it was ungoverned.** `sharing_rule` is bound in `UNREGISTERED_KIND_SCHEMAS`, which `listMetadataTypeSchemaTypes()` deliberately does not enumerate, so it sat in **neither** `GOVERNED` **nor** `PENDING_GOVERNANCE` and produced no row in any of the gate's lists while the report read complete. Widening the governance denominator to the authorable set made it visible as a declared debt; this pays that debt. `connector` and `analytics_cube` are still owed.
+- **Every row cites a producer, because the authoring shape is not the enforced shape.** ADR-0057 D6 makes the `sys_sharing_rule` row canonical — `object_name` + `criteria_json` + `recipient_type`/`recipient_id` + `access_level` — and `bootstrapDeclaredSharingRules` translates each authored key into it at boot. Nothing re-parses `SharingRuleSchema` at enforcement time, so a consumer pointer alone would prove only that a column is read, never that the authored value reaches it.
+- **Nine keys are `live`; one is `planned`.** `type` is the `SharingRuleType` discriminator: one member, `criteria`, whose only reader in this repo is a defensive `=== 'owner'` comparison that is unreachable for every value the schema admits. It is deliberately **not** `dead` and therefore not an enforce-or-remove candidate — the key is required, so removing it would break every authored rule to delete nothing, and the schema keeps it as the discriminant for a future enforced rule type.
+- **`sharedWith` is drilled**, so the two recipient keys carry their own verdicts and the change adds no row to the undrilled-container baseline.
+
+For an author, the practical read: `name`, `object`, `active`, `accessLevel`, `condition` and both `sharedWith` keys change what the runtime grants; `label` and `description` are display-shaped and are shown in Setup; `type` has exactly one legal value and, today, no dispatch behind it.

docs/qa/platform-checklist/coverage.json

@@ -256,6 +256,13 @@
         "platform-core.seed-mode-matrix"
       ]
     },
+    "sharing_rule": {
+      "items": [
+        "access-security.sharing-rules-widen",
+        "access-security.sharing-rule-authoring-ui",
+        "access-security.record-share-grant-revoke"
+      ]
+    },
     "skill": {
       "items": [
         "ai.agent-tool-skill-metadata-roundtrip",