feat(cli,runtime)!: 18.x step 6: open the upgrade ceremony for v17 and 18.0 databases (and the deferred flips)

Filing gate ③: a task the maintainer directed. It is a step of the 18.x line, under ruling records 6266750393 and 6267391172 on #15194. It is filed from step 0's measured plan: os-dev-report 6268559156 on #24522, step_plan.steps[5], plus its line_facts F1–F6 and flags.

Reader who acts: the epic seat (epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3).
Dedupe: none.

Part of #15212 (C8) and #24489 · Step 6: opening the ceremony · ⛔ Not an 18.0 gate.

The line's rule (binding)

Once merged, main stays releasable:

R1. A fresh install boots.
R2. test(qa): the 18.x line's upgrade harness (an 18.0 database boots on every later main with its data) and the measured step plan #24522's 18.0→HEAD harness is green, RESTATED by this step: an 18.0 database now takes the ceremony.
R3. A v17 database is refused until step 6.
R4. A walled posture is refused at boot until step 4.

Ordering: after step 5 (5a–5d) has merged, and after the maintainer rules on how an 18.0 database is recognised (Q3 in 6268559156).

Scope (from the measured plan; re-measure before building)

chore(cli)!: 18.x restore of the 18.0 guards — re-open the upgrade ceremony and walled boots #24489, items 1, 4 and 6. Delete the refusing MigrateOrganizationOwnership subclass and restore the default export to OrganizationOwnershipCeremony. Delete the release-refusal test. Put dogfood boot-refusal-order step 2 back on the binary. The 19 import sites are optional.
The deferred flips (PR 2b from step 2). sys_secret and sys_flow_credential go to tenant:false, landing together with the open ceremony (F2). Their inventory rows become column-drop.
The guard's verdict on an 18.0 database (F4), and the step-set check (F5). A verified marker from a shorter ceremony must not certify the database.
- The decision: (a) a birth marker written by the guard on a datastore created from empty, or (b) shape probes added to findV17ShapeTables.
- It amends the migration.zod.ts:181-185 prohibition if (a). The maintainer rules it.
The boot-guard refusal text. Stop telling an 18.0 database to "keep on 17.x" (out-of-scope finding 1).
Close the tenancy: { enabled: false } gap in the guard (boot-guard.ts:205 checks only systemFields.tenant).
R2 and R3 are restated in the harness, by name.

Not dispatched yet. The seat claims it when its ordering is met.

Epic seat (epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3) · 2026-10-19T14:31Z. Ordering of the 18.x line (ruling 6266750393), recorded so the unlock scan can read it:

Blocked-by: #24581

It also waits on the maintainer's ruling on Q3 of 6268559156 (how an 18.0 database is recognised).

Epic seat (epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3) · 2026-10-19T14:43Z. The decision this card waited on is ruled, in record 6269955919 on #15194.

The maintainer chose ① A, a birth marker, and on the field design replied 「同意」 and then 「同意shapeGeneration」. The guard writes the marker exactly once, on a datastore created from empty. It carries { shapeGeneration, platformVersion, commit, createdAt }, and the guard decides on shapeGeneration alone; it never compares versions. The ceremony's verified marker carries shapeGeneration too, and marker.shapeGeneration < current → refuse. That also closes F5.

Remaining ordering:

Blocked-by: #24581

Epic seat (epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3) · 2026-10-19T14:48Z. Steps 5 and 6 now land together, as ONE merge. This follows the ruling that only complete features merge into main (#15194, posted just now, quoting 「…都不是开发了一半的，都是某个完整的功能」).

One branch carries both: #24581's ceremony steps (5a–5d) and #24582's opening of the ceremony. They are reviewed part by part and merged once, when os migrate organization-ownership really upgrades v17 and 18.0 databases. That merge is likely Tier H by size, so the maintainer approves it. The step-5 card and the step-6 card close on that one landing.

Claim: epic seat round · 2026-10-19T20:37Z
Session: session_01Y5583bs2RDd53MH6kM1ca3
Account: os-steve (the card's assignee)
Branch: claude/issue-24581-ceremony-open (the same branch as #24581: one branch and one landing for steps 5 and 6, per ruling 6270035914; the full claim, with the file surface, is on #24581).
Worktree: the cloud session's own checkout (mode:cloud)
Domain: domain:engine
Seat: epic:#15194 (the epic lane)
Base, and an early start. Steps 2 and 3 have merged (#24590 b12e16a56, #24587 fbafb8533). Step 1, PR #24588, is green and clean, and waits only on the maintainer's approval. The maintainer's standing order is 「你正常开发就行，只要确保你合并进main的代码都不是开发了一半的」. So this branch starts from origin/main, merged with origin/claude/issue-24529-8b0g-webhooks-registry (#24588's head), because 5a needs the declared-webhook reader. ⛔ It lands only after #24588 and step 4 (#24580) have merged and this branch has merged main again.
The rulings that unblock it:

Q3 (an 18.0 database is recognised by a birth marker): ruling 6269955919 ①A and its amendment. A birth marker {shapeGeneration, platformVersion, commit, createdAt} is written on a datastore created from empty. The guard decides on shapeGeneration alone. The ceremony's verified marker carries shapeGeneration too, and marker.shapeGeneration < current is refused (F5). Amend the migration.zod.ts prohibition accordingly.
Q4, 8e (5d): ruling 6269955919 ②A. The ceremony owns organization_id nullability. The schema differ does not flag it as drift, and no metadata changes.
File surface, read at or after 14ccb1da9. The dev measures first; a breach stops the work and is explained in the report.
feat(cli): 18.x step 5: the upgrade ceremony steps behind the refusal (webhook re-source, sibling moves, 9c, 8e NOT NULL) #24581, 5a–5d, plus seat note 6271949316 in full:
- 5a, webhooks: pristine-mirror deletion with deliveries re-sourced to declared:NAME; customized mirrors settled (an active-only edit becomes an activation row; any other edit becomes a clone under a new name, its deliveries re-sourced to the clone's id); orphaned mirror sys_secret ciphers reported or deleted; the mirror predicate aligned.
- 5b, sibling moves: global audit rows by scope; identity mail, after draining or rewriting { rowId } send jobs and no-object reclaim jobs, with sys_activity rows re-pointed or deleted, and the magic-link selector gap defined first.
- 5c: 9c (plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421).
- 5d: 8e NOT NULL after the moves, per ②A.
- Select by shape, never by NULL (F3).
feat(cli,runtime)!: 18.x step 6: open the upgrade ceremony for v17 and 18.0 databases (and the deferred flips) #24582: chore(cli)!: 18.x restore of the 18.0 guards — re-open the upgrade ceremony and walled boots #24489 items 1, 4 and 6; the sys_secret / sys_flow_credential tenant:false flips with their column-drops, and the settings writer stops stamping sys_secret; the boot guard's 18.0 verdict via the birth marker, plus the step-set check; the refusal text; the tenancy: { enabled: false } gap in the guard. R2 and R3 are restated in the harness, by name.
⛔ Not docs/adr/**: the seat batches the ADR-0131 D7 notes into a Tier H ADR PR. ⛔ Not content/docs/releases/.
⛔ Not step 4's surface (engine.ts walled lift, walledPostureRefusal).
⛔ The identity-mail move must not widen the sys_email exposure measured on measure(plugin-email): who can list sys_email rows that carry identity mail (reset and verification links) — sys_email declares no requiredPermissions #24625. It is not a fix for it either.
Container & model: L, mode:cloud, model: TIER_DEFAULT
Clause-②: yes (the dev re-measures). Opening the ceremony widens what boots, and the flips narrow two tables.
Responsibility: n/a. A ruled step of the line (6266750393, 6267391172, 6269955919, 6270035914 on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194).
Thread-read: 6271949316
Serial constraints cleared:
Step 4 (feat(objectql,cli)!: 18.x step 4: the walled lift (8b walled half plus the walled part of #24489) #24580) runs in parallel on its own branch. The two meet on serve.ts; whichever lands second merges main.
Merge gate: the PR opens as a draft and is likely Tier H, so the maintainer approves it. It lands after feat(plugin-webhooks,runtime)!: declared webhooks are read from the registry, the seeder retires, and the activation ledger switches them (18.x step 1, 8b-0g′) #24588 and feat(objectql,cli)!: 18.x step 4: the walled lift (8b walled half plus the walled part of #24489) #24580, with the harness green on the merged tree and R2 and R3 restated.

os-dev-report pointer: steps 5 and 6 land as one PR, #24681 (ruling 6270035914). This card's items are covered by it: #24489 items 1, 4 and 6; the sys_secret and sys_flow_credential flips with their column-drops; the guard's birth marker and shapeGeneration verdict, plus the step-set check (F5); the refusal text; and the tenancy:{enabled:false} gap. R2 and R3 are restated by name in upgrade-18x-harness.dogfood.test.ts, 8/8 green. The full report is on #24581.

Generated by Claude Code

Landed · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-20T07:43Z. PR #24681 (steps 5+6, one landing for #24581 and #24582) has merged as 12d14765c.

reading	value
contract review	`CONTRACT_REVIEW_TIER`. FAIL 6279650792 at `02321084f` (B1: Turso remote birth marker; B2: closed-ceremony text), then PASS 6284464125 at `b5010d9c0`
last head	`c6f775cbd`, text, pins and changesets only; in-seat check PASS, addendum 6285186426
tier	H and governed (`.github/workflows/lint.yml`, 5,078 changed lines). APPROVED by the maintainer at 07:04Z, who also marked it ready and enabled auto-merge
Check Changeset	red by design (#17712, DELIBERATE CORRECTION) on ten pending notes. The maintainer confirmed them with the approval; the list is in 6285186426
R1–R4	dev re-runs on the head: harness and refusal-order 12/12, the #24688 matrix 25/25, walled e2e 7/7, `check:generated` 14/14

Delivered.

The upgrade ceremony is open. os migrate organization-ownership --out PLAN, then --apply --plan-file PLAN --backup-taken, upgrades a database that 17.x or an 18.0 pre-release created. Its steps:
- webhook re-source;
- the settings-audit and identity-mail sibling moves;
- 9c's sharing-rule copies;
- attribution;
- 8e's NOT NULL, under ② A.
The boot guard.
- It writes a birth marker on a datastore created from empty, on the local, embedded and Turso remote faces.
- It serves only a database it created or one the ceremony certified. It decides on shapeGeneration alone (① A).
- It refuses everything else and names the two ceremony steps.
sys_secret and sys_flow_credential declare systemFields: { tenant: false }. Step 4's bridge is deleted.
No shipped text says the ceremony is closed. A new gate, check:closed-ceremony-text, holds that.

Carried.

Step 7 (refactor(drivers,objectql,plugin-security)!: 18.x step 7: retire the organization-less readers (8c), COALESCE and __global__ (8d), and steps 1–3's dual reads #24583) is in flight in six parts: 7a-1, 7a-2, 7a-3, 7b-0, 7b-3 and 7c. 7b-1+7b-2 follow 7b-0. Each part merges main now.
The ADR notes PR (Tier H):
- ADR-0131's release-scope note (817-830);
- D9 against the engine's no-organization-object exit;
- the D7 dated notes.
The harness fixture. fixture-18.0 stays as the pre-ceremony shape. A fixture from the 18.0.0 tag is added once that tag exists.
Release timing: 18.0.0 publishes after step 7 (6282882793).

Both cards close completed. The dev session is archived.

Navigation Menu

Repository navigation

feat(cli,runtime)!: 18.x step 6: open the upgrade ceremony for v17 and 18.0 databases (and the deferred flips) #24582

The line's rule (binding)

Scope (from the measured plan; re-measure before building)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

feat(cli,runtime)!: 18.x step 6: open the upgrade ceremony for v17 and 18.0 databases (and the deferred flips) #24582

Description

The line's rule (binding)

Scope (from the measured plan; re-measure before building)

Activity

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions