@@ -0,0 +1,143 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// [#24522] The 18.x line's upgrade harness: a database an 18.0 install created
+// upgrades to THIS commit, boots, and keeps its data (R2), and a v17-shaped one
+// is still refused (R3). Ruling record 6266750393 on the v18 epic makes R2 a
+// check every PR on the line passes before it merges.
+//
+// The fixture (`upgrade-harness/fixture-18.0/`) is a showcase install of the
+// 18.0 code after real use — sign-ups, an invitation, settings with a secret, a
+// flow credential, the declared webhook customized and delivering, a runtime
+// sharing rule, a share link, record activity — dumped to SQL text, with a
+// manifest of every row of the tables steps 1–7 reshape. Regenerate it with
+// `node scripts/gen-upgrade-harness-fixture.mjs --ref <ref>`; the manifest
+// records the ref and commit it came from.
+//
+// What is asserted, on a fresh copy of the fixture:
+//
+//   1. HEAD boots over it, composed the way `os serve` composes it — the
+//      ownership boot guard included — and nothing refuses it.
+//   2. It serves the fixture's data: the fixture's people sign in with their
+//      18.0 passwords and read the fixture's own task.
+//   3. Once HEAD has stopped, every reshaped table still holds every row the
+//      fixture gave it, with the same key columns (`organization_id` among
+//      them): a step that moved, deleted or re-stamped 18.0 rows outside the
+//      upgrade ceremony goes red here, naming the table and the row.
+//   4. The same fixture with one v17 trait added — a physical `organization_id`
+//      on `sys_metadata`, an object that declares none — is refused at boot
+//      with the guard's code. Until step 6 opens the ceremony that is the
+//      answer a v17 database gets; step 6 rewrites this case, by name.
+//
+// ⛔ Additive change passes: a row HEAD's boot ADDS (an activity shard, a
+// seeder's row) is not a failure, so counts are compared as "at least", and
+// every fixture row is looked up by id.
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { isOrganizationOwnershipBootRefusal } from '@objectstack/runtime';
+import type { VerifyStack } from '@objectstack/verify';
+import { columnsOf, keyRowsOf, type FixtureManifest } from './upgrade-harness/fixture-manifest.js';
+import { FIXTURE_NAMES, FIXTURE_PEOPLE, bootFixture } from './upgrade-harness/populate-fixture.js';
+import { loadSqlIntoSqlite } from './upgrade-harness/sqlite-text-dump.js';
+
+const FIXTURE = new URL('./upgrade-harness/fixture-18.0/', import.meta.url);
+const manifest = JSON.parse(readFileSync(new URL('manifest.json', FIXTURE), 'utf8')) as FixtureManifest;
+const fixtureSql = readFileSync(new URL('database.sql', FIXTURE), 'utf8');
+
+/** The guard's refusal down a failed boot's `cause` chain (the kernel wraps a failed `start()`). */
+function refusalIn(error: unknown): unknown {
+  for (let e = error, depth = 0; !!e && typeof e === 'object' && depth < 8; e = (e as { cause?: unknown }).cause, depth++) {
+    if (isOrganizationOwnershipBootRefusal(e)) return e;
+  }
+  return undefined;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const rowsOf = (body: any): any[] => (Array.isArray(body) ? body : (body?.records ?? body?.data ?? []));
+
+describe(`[#24522] an 18.0 database (fixture from ${manifest.ref} @ ${manifest.sha.slice(0, 12)}) upgrades to HEAD and keeps its data`, () => {
+  const dir = mkdtempSync(join(tmpdir(), 'dogfood-upgrade-18x-'));
+  const file = join(dir, 'upgraded.db');
+  let stack: VerifyStack | undefined;
+  let bootError: unknown;
+
+  beforeAll(async () => {
+    loadSqlIntoSqlite(fixtureSql, file);
+    try {
+      stack = await bootFixture(file);
+    } catch (error) {
+      bootError = error;
+    }
+  }, 240_000);
+
+  afterAll(async () => {
+    await stack?.stop();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it('the fixture covers every reshaped table (a vacuous fixture is no harness)', () => {
+    for (const t of manifest.reshaped) expect(t.count, `${t.table} holds rows in the fixture`).toBeGreaterThan(0);
+  });
+
+  it('1. HEAD boots over the 18.0 database, and no ownership refusal stops it', () => {
+    const refusal = refusalIn(bootError);
+    expect(refusal, `the ownership boot guard refused the 18.0 database: ${String((refusal as Error | undefined)?.message)}`).toBeUndefined();
+    expect(bootError, `the boot failed: ${String((bootError as Error | undefined)?.stack ?? bootError)}`).toBeUndefined();
+  });
+
+  it('2. it serves the 18.0 data: the fixture\'s people sign in, and the fixture\'s task is there', async () => {
+    expect(stack).toBeDefined();
+    const adminTok = await stack!.signIn(FIXTURE_PEOPLE.admin.email, FIXTURE_PEOPLE.admin.password);
+    const memberTok = await stack!.signIn(FIXTURE_PEOPLE.memberA.email, FIXTURE_PEOPLE.memberA.password);
+    expect(memberTok).toBeTruthy();
+    const res = await stack!.apiAs(adminTok, 'GET', '/data/showcase_task');
+    expect(res.status).toBe(200);
+    const titles = rowsOf(await res.json()).map((r) => String(r?.title));
+    expect(titles).toContain(`${FIXTURE_NAMES.task} — edited`);
+  });
+
+  it('3. every reshaped table keeps every 18.0 row, with its key columns, once HEAD has stopped', async () => {
+    await stack?.stop();
+    stack = undefined;
+    const db = new DatabaseSync(file, { readOnly: true });
+    try {
+      for (const t of manifest.reshaped) {
+        for (const physical of t.physical) {
+          const cols = columnsOf(db, physical);
+          expect(cols.length, `${physical} still exists`).toBeGreaterThan(0);
+          for (const c of t.keyColumns) expect(cols, `${physical}.${c} still exists`).toContain(c);
+        }
+        const now = keyRowsOf(db, t.physical, t.keyColumns);
+        const byId = new Map(now.map((r) => [r.id, r]));
+        expect(now.length, `${t.table}: ${now.length} rows now, ${t.count} in the fixture`).toBeGreaterThanOrEqual(t.count);
+        for (const row of t.rows) expect(byId.get(row.id), `${t.table} row ${row.id}`).toEqual(row);
+      }
+    } finally {
+      db.close();
+    }
+  });
+
+  it('4. R3: the same database with a v17 trait is still refused at boot, with the guard\'s code', async () => {
+    const v17 = join(dir, 'v17-shaped.db');
+    loadSqlIntoSqlite(fixtureSql, v17);
+    const db = new DatabaseSync(v17);
+    try {
+      expect(columnsOf(db, 'sys_metadata'), 'the 18.0 fixture carries no organization column on sys_metadata').not.toContain('organization_id');
+      db.exec('ALTER TABLE sys_metadata ADD COLUMN organization_id TEXT');
+    } finally {
+      db.close();
+    }
+    let error: unknown;
+    try {
+      const refused = await bootFixture(v17);
+      await refused.stop();
+    } catch (e) {
+      error = e;
+    }
+    const refusal = refusalIn(error);
+    expect(refusal, 'the v17-shaped database was refused by the ownership boot guard').toBeDefined();
+    expect((refusal as { tables?: string[] }).tables).toContain('sys_metadata');
+  }, 240_000);
+});
@@ -0,0 +1,131 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// [#24522] What the upgrade harness holds the fixture to, in one place: the
+// tables steps 1–7 of the 18.x line reshape (ruling record 6266750393 on the v18
+// epic), the columns that identify a row of each, and the census both sides
+// take — the populator when it writes the fixture, the harness when HEAD has
+// booted over a copy of it.
+//
+// A table is named here because a step will move, delete, re-source or
+// constrain its rows, so it is where an upgrade loses data if one is going to.
+// The step numbers are the line's; the plan that cut them is the step-0 report
+// on #24522. ⛔ A row here is never an assertion that the step's code exists —
+// only that the 18.0 data it will reshape is in the fixture, and still there.
+import { DatabaseSync } from 'node:sqlite';
+
+export interface ReshapedTable {
+  /** The physical table, or the prefix of a date-sharded family (`sys_activity__r…`). */
+  table: string;
+  /** Matches every physical shard whose name starts with `table` + `__`. */
+  sharded?: boolean;
+  /** The 18.x steps that reshape it. */
+  steps: readonly number[];
+  /** Why the step touches it, in one line. */
+  why: string;
+  /**
+   * The columns whose values a row must keep across the upgrade. Only columns
+   * no boot rewrites: never `updated_at`, never a delivery's `status`.
+   */
+  keyColumns: readonly string[];
+}
+
+/**
+ * The reshaped tables. Every one must hold at least one row in the fixture —
+ * the populator refuses to write a fixture otherwise, so the harness can never
+ * go green over an empty table.
+ */
+export const RESHAPED_TABLES: readonly ReshapedTable[] = [
+  { table: 'sys_webhook', steps: [1, 5], why: 'the declared webhook mirror rows the registry read replaces; the ceremony deletes them (D10 fate 2)', keyColumns: ['id', 'name', 'organization_id', 'is_active'] },
+  { table: 'sys_http_delivery', steps: [1, 5], why: 'the mirror rows\' delivery tails, re-sourced by the ceremony', keyColumns: ['id', 'webhook_id', 'organization_id'] },
+  { table: 'sys_secret', steps: [2, 5], why: 'loses its organization column; ownership follows the referencing row', keyColumns: ['id', 'organization_id'] },
+  { table: 'sys_setting', steps: [2], why: 'the referencing row a secret\'s ownership follows', keyColumns: ['id', 'organization_id'] },
+  { table: 'sys_setting_audit', steps: [2, 5], why: 'its global rung moves to a deployment-level sibling', keyColumns: ['id', 'organization_id'] },
+  { table: 'sys_flow_credential', steps: [2, 5], why: 'becomes deployment-level (no organization column)', keyColumns: ['id', 'organization_id'] },
+  { table: 'sys_email', steps: [3, 5], why: 'identity mail moves to a deployment-level sibling', keyColumns: ['id', 'organization_id'] },
+  { table: 'sys_invitation', steps: [3], why: 'the invitation whose mail is identity mail', keyColumns: ['id', 'organization_id', 'email'] },
+  { table: 'sys_sharing_rule', steps: [5], why: '9c: the same-name guard and the sharing-rule copy migration', keyColumns: ['id', 'name', 'organization_id'] },
+  { table: 'sys_share_link', steps: [5], why: '8e: organization_id NOT NULL', keyColumns: ['id', 'organization_id'] },
+  { table: 'sys_activity', sharded: true, steps: [5, 7], why: '8e NOT NULL; 8c retires the organization-less read branch', keyColumns: ['id', 'organization_id'] },
+  { table: 'sys_user_permission_set', steps: [5, 7], why: 'grants: 8e NOT NULL, 8c retires the NULL grant readers', keyColumns: ['id', 'organization_id'] },
+  { table: 'sys_member', steps: [5], why: 'membership, the anchor attribution reads', keyColumns: ['id', 'organization_id', 'user_id'] },
+  { table: 'sys_user', steps: [3], why: 'the identity mail\'s anchor; the fixture\'s people sign in with it', keyColumns: ['id', 'email'] },
+];
+
+export interface ManifestTable {
+  table: string;
+  physical: string[];
+  steps: readonly number[];
+  keyColumns: string[];
+  count: number;
+  rows: Array<Record<string, string | null>>;
+}
+
+export interface FixtureManifest {
+  /** The git ref the generator was asked for, as given. */
+  ref: string;
+  /** The commit it resolved to. */
+  sha: string;
+  generatedAt: string;
+  /** Every table's row count, physical names. */
+  tables: Record<string, number>;
+  reshaped: ManifestTable[];
+}
+
+const ident = (name: string): string => `"${name.replace(/"/g, '""')}"`;
+const text = (v: unknown): string | null => (v === null || v === undefined ? null : String(v));
+
+/** The physical tables one reshaped entry names, in name order. */
+export function physicalTablesOf(db: DatabaseSync, entry: ReshapedTable): string[] {
+  const names = (db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name").all() as Array<{ name: string }>).map((r) => r.name);
+  return names.filter((n) => n === entry.table || (entry.sharded === true && n.startsWith(`${entry.table}__`)));
+}
+
+/** The physical columns of `table`. */
+export function columnsOf(db: DatabaseSync, table: string): string[] {
+  return (db.prepare('SELECT name FROM pragma_table_info(?)').all(table) as Array<{ name: string }>).map((r) => r.name);
+}
+
+/** Every row of a reshaped entry, projected onto its key columns, ordered by id. */
+export function keyRowsOf(db: DatabaseSync, physical: readonly string[], keyColumns: readonly string[]): Array<Record<string, string | null>> {
+  const rows: Array<Record<string, string | null>> = [];
+  for (const t of physical) {
+    for (const r of db.prepare(`SELECT ${keyColumns.map(ident).join(',')} FROM ${ident(t)} ORDER BY id`).all() as Array<Record<string, unknown>>) {
+      rows.push(Object.fromEntries(keyColumns.map((c) => [c, text(r[c])])));
+    }
+  }
+  return rows;
+}
+
+/**
+ * The census the populator writes into the manifest. Throws when a reshaped
+ * table is missing or empty, or names a key column the table does not carry.
+ */
+export function takeCensus(file: string, ref: string, sha: string): FixtureManifest {
+  const db = new DatabaseSync(file, { readOnly: true });
+  try {
+    const all = (db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name").all() as Array<{ name: string }>).map((r) => r.name);
+    const tables: Record<string, number> = {};
+    for (const t of all) tables[t] = Number((db.prepare(`SELECT COUNT(*) AS n FROM ${ident(t)}`).get() as { n: number }).n);
+    const problems: string[] = [];
+    const reshaped: ManifestTable[] = [];
+    for (const entry of RESHAPED_TABLES) {
+      const physical = physicalTablesOf(db, entry);
+      if (physical.length === 0) {
+        problems.push(`${entry.table}: no such table`);
+        continue;
+      }
+      const missing = entry.keyColumns.filter((c) => physical.some((t) => !columnsOf(db, t).includes(c)));
+      if (missing.length > 0) {
+        problems.push(`${entry.table}: no column ${missing.join(', ')}`);
+        continue;
+      }
+      const rows = keyRowsOf(db, physical, entry.keyColumns);
+      if (rows.length === 0) problems.push(`${entry.table}: empty — the populator did not reach it`);
+      reshaped.push({ table: entry.table, physical, steps: entry.steps, keyColumns: [...entry.keyColumns], count: rows.length, rows });
+    }
+    if (problems.length > 0) throw new Error(`the fixture does not cover what steps 1–7 reshape:\n  - ${problems.join('\n  - ')}`);
+    return { ref, sha, generatedAt: new Date().toISOString(), tables, reshaped };
+  } finally {
+    db.close();
+  }
+}