Repository navigation
driver-turso / os migrate organization-ownership: the v18 ceremony cannot run on a Turso remote database (deferred DDL, drift detection and migration entries are refused on the remote face), so every hosted tenant's v18 upgrade stops #23816
Description
Filing-gate category ① (a defect with a measured reach) and ③ (a maintainer direct order). Reach: the first v18 request to a hosted tenant on cloud's staging, measured 2026-10-16. The maintainer chose the route 「框架补 remote 支持」 and then directed 「相关任务都提到最高优先级」.
Reader: the cloud#2899 executor (the maintainer's local session) dispatches a developer on this card today. Cloud's follow-up is a pin bump that carries the fix, tracked on cloud#2868.
Dedupe (gh api search/issues, total_count, closed issues included):
"Schema drift detection is not supported by the Turso REMOTE": 1 (fix(driver-turso): refuse remote schema drift detection instead of answering "no drift" #19891, closed: the refusal itself).turso remote detectManagedDrift: 16, all closed (driver-turso remotedetectManagedDrift()diffs against the dummy:memory:Knex connection remote mode is given — drift is always empty, so the artifact boot migration gate reads a remote Turso database as never drifted #19845, fix(driver-turso): refuse remote schema drift detection instead of answering "no drift" #19891, docs(driver-turso): the README lists what remote mode refuses instead of transactions it does not run #20053, driver-turso remote: inheritedSqlDrivermethods the remote face does not override answer from the placeholder:memory:Knex database —introspectSchema()returns no tables,distinct()a 500,findWithWindowFunctions()a raw SQLite error #20055, driver-turso README: the remote-transport tree listsbeginTransaction, commit, rollbackas supported, but the remote face refuses all three with NOT_IMPLEMENTED / 501, and the README names none of the remote refusals #20016, fix(driver-turso): remote mode constructs without better-sqlite3 — its Knex base is built with no connection (#20054) #20073 …). They made the remote face refuse instead of answering wrongly; none gives the ceremony a remote path.organization-ownership turso remote: 20. The only open one is feat(spec,drivers,objectql,plugin-security):organization_idNOT NULL per cleared table; one predicate for Layer 0 and every driver; bothorWhereNullarms, the__global__sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212 (NOT NULL per cleared table), which is a different subject.turso remote ceremony is:open: 6, all seat posts except feat(spec,drivers,objectql,plugin-security):organization_idNOT NULL per cleared table; one predicate for Layer 0 and every driver; bothorWhereNullarms, the__global__sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212.- No open card asks for the v18 ceremony to run on a Turso remote database.
What happens
Cloud's tenant first-serve upgrade (cloud#2868) runs os migrate organization-ownership (plan, then --apply --backup-taken) against each environment's database. Hosted environments are Turso databases reached over the remote transport (libsql://). On staging, at pin 534ca13eb5, the first request to a v17 environment stops at the plan:
[tenant-v18-upgrade] environment 9930e6cf-… is NOT served: the v18 upgrade stopped at preflight {"blocking":["preflight: the ceremony's plan refused: Deferred schema DDL is not supported by the Turso REMOTE transport (this datasource's transport mode is `remote`) … answers NOT_IMPLEMENTED/501 …"]}
Every environment holding v17 data is unserved; evidence is in cloud#2899 comment 6208078528. Production's tenants are on the same transport, so production cannot take v18 until this is fixed.
Why, at 534ca13eb5 (read in source and measured on a remote face)
- Deferred DDL refused: the ceremony arms deferred schema DDL unconditionally (
deferSchemaDdl: truein the plan and the apply boots), and driver-turso's remote face refuses it (setDeferredDdl: 'refused', fix(driver-turso): refuse to arm deferred schema DDL on the remote face #19842 /e07843b5a6). - Drift detection and migration entries refused: the apply's column drops go through
detectManagedDrift+applyMigrationEntries(packages/cli/src/utils/organization-ownership-column-drops.ts), which the remote face also refuses (detectManagedDrift: 'refused',applyMigrationEntries: 'refused', fix(driver-turso): refuse remote schema drift detection instead of answering "no drift" #19891). Cloud's own overlay-index step usesdetectManagedDrifttoo, and it was measured refused on a remote face. - The embedded replica is not a way around it (measured, libsql 0.18.0 / sqld 0.24.32):
- The replica face's writes go through Knex into the local file, and
sync()only pulls. After an UPDATE, a DELETE, a ledger INSERT, aDROP COLUMNand aDROP TABLE, the primary was unchanged and the replica had diverged. - On a fresh file, the replica cannot connect at all:
Can not sync a database without a wal_index. - The CLI's turso datasource (
runtime/src/standalone-stack.ts) builds{ url, authToken }only, with nosyncUrlentry point.
- The replica face's writes go through Knex into the local file, and
- Never measured before: the ceremony and cloud's upgrade were rehearsed on
file:databases only.
Wanted
The ceremony, plan and apply, completes on a Turso remote database. The lane judges the design. One shape that fits the measurements:
- Plan and apply without deferral: on the remote face, the ceremony boots with schema sync skipped instead of arming deferral. The environment's own kernel has already run the additive sync, and the plan stays read-only.
- Remote drift detection: the remote face gains
detectManagedDriftandapplyMigrationEntriesfor the entry kinds the ceremony emits (drop_column,drop_index,recreate_index), through the libsql client.
Acceptance:
- Plan: on a remote face (a local
sqldreached aslibsql://127.0.0.1:<port>?tls=0;http://is refused by the CLI's URL check), with a v17-shaped database,os migrate organization-ownership --jsonexits 0. - Apply:
--apply --backup-takencompletes withblocking 0. The column drops land on the server's own database, read back through a second connection. Theadr-0131-organization-ownershipmarker is verified. - Ablation: the remote-face test turns red without the change.
The repro and probe scripts from the measurement are kept on the maintainer's machine and can be handed to the developer.
Related: cloud#2899 (operation card), cloud#2868 (tenant upgrade), cloud#2746 (the v18 move, merged), #19842, #19891.
Activity
hotlong commentedon Oct 16, 2026
Claim: PM loop round 1 (maintainer direct dispatch from the cloud#2899 executor session)
Session:
local_6eb9ec2e-0e3f-410b-9123-9dab7a337b9e(the maintainer's local desktop session)Account:
hotlong(the card's assignee)Branch:
claude/issue-23816-remote-ceremonyWorktree:
objectstack-issue-23816Domain:
domain:engineSeat:
domain:engine#9(not a registered seat: the maintainer's local executor acting as PM on the maintainer's order)File surface:
packages/drivers/driver-turso/src/**,packages/cli/src/commands/migrate/organization-ownership*.ts,packages/cli/src/utils/organization-ownership-*.ts, their tests, one.changeset/*.md(stop on breach; explain in the report)Container & model:
M,mode:subagent, top tierClause-②: yes (the remote face's refused drift and migration doors become accepted ones)
Responsibility: driver-turso's remote face and the ceremony's unconditional deferral are this repository's code | no platform path runs the ceremony on a Turso remote database today | every hosted tenant reaches it on its first v18 request (measured on cloud's staging)
Thread-read: none
Serial constraints cleared: none (no open PR or in-flight claim on driver-turso or the ceremony files)
Maintainer's orders (2026-10-16, local session, verbatim): 「框架补 remote 支持」 · 「相关任务都提到最高优先级」 · and, on who builds it, the option 「我在本机派 dev」.
hotlong commentedon Oct 16, 2026
Release: the claim above (
local_6eb9ec2e…, branchclaude/issue-23816-remote-ceremony) is withdrawn before any developer started. No branch was pushed and no code was written.Why: the maintainer moved this card to the fleet. Verbatim (2026-10-16, local session): 「cloud任务可以交给车队处理吗？」. This card goes back to
pm:queueatpriority:p0for thedomain:enginelane. The fix spansdriver-turso(engine) and the ceremony inpackages/cli(cli); triage may re-route it.For whoever claims it:
sqld, reached aslibsql://127.0.0.1:<port>?tls=0.http://is refused by the CLI's URL check.Deferred schema DDL is not supported by the Turso REMOTE transportrefusal.blocking 0with the drops landing on the server's database, then the marker verified, then an ablation.Blocked-by:this card) and verifies on staging. Production v18 waits on this.hotlong commentedon Oct 16, 2026
Claim: PM loop round 1 (re-claim; supersedes the release above, maintainer's order)
Session:
local_6eb9ec2e-0e3f-410b-9123-9dab7a337b9e(the maintainer's local session, as PM); the developer runs as a cloud Claude Code session, whose id follows in a pointer commentAccount:
hotlong(the card's assignee)Branch:
claude/issue-23816-remote-ceremonyWorktree:
objectstack-issue-23816(cloud session)Domain:
domain:engineSeat:
domain:engine#9(not a registered seat: the maintainer's local executor acting as PM on the maintainer's order)File surface:
packages/drivers/driver-turso/src/**,packages/cli/src/commands/migrate/organization-ownership*.ts,packages/cli/src/utils/organization-ownership-*.ts,packages/runtime/src/standalone-stack.ts(only if the boot needs it), their tests, one.changeset/*.md(stop on breach; explain in the report)Container & model:
M,mode:cloud, top tierClause-②: yes (the remote face's refused drift and migration doors become accepted ones)
Responsibility: driver-turso's remote face and the ceremony's unconditional deferral are this repository's code | no platform path runs the ceremony on a Turso remote database today | every hosted tenant reaches it on its first v18 request (measured on cloud's staging)
Thread-read: 6208418880
Serial constraints cleared: none (no open PR or in-flight claim on driver-turso or the ceremony files)
Maintainer's orders (2026-10-16, local session, verbatim): 「你已经派发的就让他继续处理」 · 「云端clause code更快」 · earlier 「框架补 remote 支持」, 「相关任务都提到最高优先级」. Cloud-repo follow-ups stay with the fleet (cloud#2868).
3 remaining items
objectstack-fleet commentedon Oct 16, 2026
First touch: p0 and
target:v18confirmed · lane:domain:enginetakes the whole PR on the cross-domain exception path, with thepackages/cliceremony files declared todomain:cli· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-16T05:00ZRead in this act: the body in full and the four comments (the claim, its release, the re-claim, and the final release
6208441417).domain:engineclaims the whole fix (SKILL.md 跨域例外路径). The fix spanspackages/drivers/driver-turso(engine) and the ceremony inpackages/cli/src/commands/migrate/organization-ownership*.ts/packages/cli/src/utils/organization-ownership-*.ts(cli). One remote path through both is one PR that does not split cleanly.domain:cliseat.pm:queue, unassigned since 2026-10-16T04:59Z. It is first in the engine lane's selection, being p0.6208441417:sqldreached aslibsql://127.0.0.1:<port>?tls=0;⛔ Not a claim.
hotlong commentedon Oct 16, 2026
Claim: PM loop round 1 (maintainer direct dispatch; the card sat unclaimed in the engine lane queue since 2026-10-16T05:00Z)
Session:
local_6eb9ec2e-0e3f-410b-9123-9dab7a337b9e(the maintainer's local session, as PM); the developer is a cloud Claude Code session titled "p0 #23816: v18 ceremony on Turso remote" (requested 2026-10-16T06:5xZ)Account:
hotlong(the card's assignee)Branch:
claude/issue-23816-remote-ceremonyWorktree:
objectstack-issue-23816(cloud session)Domain:
domain:engine(cross-domain exception path per triageFirst touch; thepackages/cliceremony files are declared todomain:cli)Seat:
domain:engine#9(not a registered seat: the maintainer's local executor acting as PM on the maintainer's order)File surface:
packages/drivers/driver-turso/src/**,packages/cli/src/commands/migrate/organization-ownership*.ts,packages/cli/src/utils/organization-ownership-*.ts,packages/runtime/src/standalone-stack.ts(only if the boot needs it), their tests, one.changeset/*.md(stop on breach; explain in the report)Container & model:
M,mode:cloud, top tierClause-②: yes (the remote face's refused drift and migration doors become accepted ones; triage: not the protocol-first class unless a spec key moves)
Responsibility: driver-turso's remote face and the ceremony's unconditional deferral are this repository's code | no platform path runs the ceremony on a Turso remote database today | every hosted tenant reaches it on its first v18 request (measured on cloud's staging)
Thread-read: 6208454728
Serial constraints cleared: none (no open PR or in-flight claim on driver-turso or the ceremony files; engine seat 1 reads "In flight: none", seat 2 vacant)
Maintainer's order (2026-10-16, local session): picked 「我开云端会话做」 for this card after it sat unclaimed; earlier 「框架补 remote 支持」, 「相关任务都提到最高优先级」.
objectstack-fleet commentedon Oct 16, 2026
Cross-lane declaration from
domain:cliseat 1 (seat post #6024) ·marchtian· sessionsession_01PFB9ZGRWYvjhTXsd8i6KBp· 2026-10-16T07:17Z. ⛔ Not a claim on this card, ⛔ no label change. A reply is owed only on an objection.6210181396) editspackages/runtime/src/standalone-stack.ts, which this card's claim6209712917also names. Its region is the two host-sidemkdirSyncarms increateStandaloneStack(about:803and:817onorigin/main43567a8fcb). This card's branch head15fdbc228edits theskipSchemaSyncschema field and itsObjectQLPluginpass-through, which are disjoint hunks. Whichever PR lands second mergesmain.--outfile, the ceremony executes every step and then refusesapply_refused/report-file-unwritable, which under--jsonreads as if nothing ran #23826 (p1target:v18, the ceremony's--applywith an existing--out) is held indomain:cli's queue until this card merges, because both edit the apply run ofpackages/cli/src/commands/migrate/organization-ownership.ts(note6210227966).Generated by Claude Code
objectstack-fleet commentedon Oct 16, 2026
os-dev-report
{
"issue": 23816,
"status": "done",
"branch": "claude/issue-23816-remote-ceremony",
"pr": "#23843",
"session": "session_01Lr3rg6qTp9r38exA5DHEEH",
"premise_still_valid": true,
"summary": "The v18 organization-ownership ceremony (plan and --apply --backup-taken) now completes on a Turso REMOTE database, measured on a real sqld 0.24.32 reached as libsql://127.0.0.1:PORT?tls=0: plan exit 0 and read-only (logical dump identical), apply exit 0 with complete true and blocking 0, both organization_id columns and their tenant indexes gone on the server and the adr-0131-organization-ownership marker applied and verified, all read back through a second connection. driver-turso's remote face now answers detectManagedDrift (the shared differ over remote catalog reads, against declarations every remote schema door and registerObjectMetadata record) and applyMigrationEntries for drop_index / create_index / recreate_index / replace_unique_index / drop_column (one libSQL write batch each, verified by read-back; rebuild-only column entries skipped and logged); its config also carries the url, so the ceremony's plan-database refusal tells remote databases apart. bootSchemaStack gains deferredDdlUnsupported: 'skip-schema-sync' (the primary on the Turso remote transport boots with skipSchemaSync instead of armed deferral; every other datasource stays armed), which only the ceremony declares; createStandaloneStack takes skipSchemaSync. Deviations: the file surface was extended to packages/cli/src/utils/schema-migrate.ts and schema-migration-plugins.ts (+ its test), stated in the PR's Acceptance notes; the harness-written co-author trailer with a model name was refused by the pre-push hook on the first, unpublished commit and reworded to the model-free pair before any push; objectstack-ai/cloud was attached read-only to check which cloud boots reach the OS_ARTIFACT_URL gate.",
"tests": "Positive control on unchanged main 1ecb08a against sqld: plan exit 1, {"error":"boot_failed","detail":"Deferred schema DDL is not supported by the Turso REMOTE transport ..."}. Fix at 39b9abd against sqld (scratch acceptance script): plan exit 0, dump c0790dff... before = after (341 objects / 12 rows), plan database libsql://127.0.0.1:38187; apply exit 0, complete true, blocking 0, column-drops dropped 2/2; second connection: sys_job and sys_metadata_activation have no organization_id, both idx__organization_id absent, marker applied 1 verified 1, sys_job rows 2. driver-turso: typecheck exit 0; vitest 90 files, 2410 passed / 33 skipped. cli: typecheck + test-typecheck exit 0; --project unit 297 files / 4435 passed; --project integration targeted (20 files: organization-ownership, schema-migrate*, unmanaged-tables, incl. the new OS_TEST_SQLD_BIN sqld e2e) 182 passed; the e2e reads 1 skipped without the variable. runtime: typecheck exit 0; vitest 402 files, 6787 passed / 19 skipped. eslint over changed .ts files exit 0. Ablation 1 (scripts/ablation-replace.mjs WRAP, remote drift arm removed, driver-turso rebuilt, ablation-dist-preflight marker hit in dist/index.js + dist/index.mjs): the two remote driver suites 18/18 red; sqld e2e red with apply_failed 'Unable to acquire a connection'; restore leg rebuilt, preflight --absent (0 of 6 built files, tree clean), 19/19 + 1/1 green. Ablation 2 (ceremony plan posture removed, src-resolved): sqld e2e red at the plan with boot_failed 'Deferred schema DDL is not supported by the Turso REMOTE transport'; restored blob == HEAD.",
"gates": "Local, at 39b9abd: node scripts/pm/dispatch-gates.mjs --ran reports 70 derived families, 69 run with exit 0, 1 NOT MEASURED: pnpm check:dual-build-cjs-loads exit 3 (PREREQUISITE NOT MET: needs a whole-repo pnpm build; only the closure was built). check-plugin-teardown-shape --self-test and check:i18n-coverage first read exit 3 (shallow clone lacked the pinned fixture commit; contention) and re-ran alone with exit 0. CI on 39b9abd at report time: completed success = The card this PR closes must claim this branch, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Check PR Size, Check Documentation Links, Auto Label, filter; in_progress = Lint (repo & tooling, CI release & engine, docs & code guards, ESLint, PM dispatch-gates, scoped x3), Type Check (workspace, consumer gates, source gates, debt ledger), Test Core 1-6/6, Build Core, Governed Surface Queue Guard, Check Changeset, Dogfood Regression Gate, Flag docs affected by code changes; skipped = Console Pin Gate, Dogfood Verify CLI, Temporal Conformance, Build Docs, Packed-tarball smoke.",
"mcp_calls": "4 GitHub MCP calls, all reads: issue_read get #23816, issue_read get_comments #23816, pull_request_read get #23843, pull_request_read get_check_runs #23843. Also claude-code-remote add_repo (objectstack-ai/cloud, read) and subscribe_pr_activity (#23843).",
"api_writes": "2 REST proxy writes, both POST /repos/objectstack-ai/objectstack/dispatches through scripts/pm/fleet-write/dispatch.mjs: pr_create (landed as #23843 by objectstack-fleet[bot], 10292 bytes sent = stored, assignee hotlong) and this os-dev-report comment. Labels: zero writes (the dispatch named none and skip-changeset does not apply; the labeler set documentation, size/xl, tests, tooling).",
"open_questions": [
{
"question": "The OS_ARTIFACT_URL boot migration gate of os serve now judges a Turso remote database (applies safe drift, refuses on destructive drift) where it used to warn that it could not check; its remedy, os migrate apply --allow-destructive, still refuses on that transport. Keep the new gate behaviour?",
"options": [
"A keep it, and card os migrate apply on the remote face (the same skip-schema-sync posture plus the new remote apply door) as a follow-up",
"B restore the warn-and-boot answer for a remote face in the gate until os migrate apply works there"
],
"recommendation": "A, because the gate's contract is to refuse a destructive change rather than skip it, the remote face can now answer truthfully, and the cloud boots read at cloud 837e24a do not pass through this gate; B would put back a known blind spot on purpose."
},
{
"question": "The sqld e2e (organization-ownership.remote-face.integration.test.ts) runs only when OS_TEST_SQLD_BIN names a sqld binary, so CI never runs it. Provision sqld in CI?",
"options": [
"A add the npm package that ships the binary (@sqld/linux-x64, published by vltpkg) as a devDependency and set the variable in the integration job",
"B keep it opt-in for the maintainer's machine; the driver suites over a real libSQL file: client stay in CI"
],
"recommendation": "B for this PR, because adding a third-party 45 MB binary dependency is the maintainer's decision; A is a small follow-up if remote-face regressions should be caught in CI."
}
],
"out_of_scope_findings": [
"carrier: none · noted in PR #23843 Acceptance notes, not filed (read from source, not measured on a server) · os migrate apply --allow-destructive, the remedy the OS_ARTIFACT_URL boot gate prints, refuses on a Turso remote database because it arms deferred DDL, so a remote deployment that gate refuses for non-ceremony destructive drift has no CLI remedy · dedupe words: os migrate apply turso remote, artifact boot migration gate remote, deferred DDL remote apply, destructive drift remote",
"carrier: cloud#2868 · noted, not filed · the shared differ leaves a physical index with an expression key part (for example COALESCE(package_id, '')) out of its proposals on both faces (isSyncReproducibleIndex), so a tenant overlay index still carrying such a 17.x key would read as declared to rebuildTenantOverlayIndex and not be rebuilt; measured on a remote face over a libSQL file: client, not against a cloud tenant · dedupe words: overlay index expression key drift, isSyncReproducibleIndex COALESCE, idx_sys_metadata_overlay_active recreate"
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 16, 2026
os-dev-report
{
"issue": 23816,
"status": "done",
"round": "contract-review patch round 2 (review of head 39b9abd, maintainer ruling: restore the warning and add tests)",
"branch": "claude/issue-23816-remote-ceremony",
"pr": "#23843",
"head": "26b6acef",
"session": "session_01Lr3rg6qTp9r38exA5DHEEH",
"premise_still_valid": true,
"summary": "Every item of the contract review is addressed in 4 commits on top of 39b9abd (ec063d8, 040fbcc, cc73b80, 26b6ace); the ceremony fix itself is unchanged and its sqld acceptance re-ran green. Blocking 1: on a Turso remote primary the OS_ARTIFACT_URL boot migration gate again answers cannot judge, warn and boot: it warns, applies nothing, refuses nothing and never calls detectManagedDrift. It decides that from a capability the driver declares, SqlDriverLike.driftReportCaveat (a string on the remote face naming the reason: the remote sync creates no declared NOT NULL, and os migrate apply refuses there; null on the local and embedded-replica faces), not from transportMode. The changeset says this plainly and names #23847 and #23848 as follow-ups this change does not close. Blocking 2: the embedded-replica control is back as a same-layer replacement in turso-remote-drift-detection.test.ts: a replica-mode TursoDriver over a drifted local file reports the destructive drop_column, for the no-argument and explicit-objects calls. Required 3: two unit-tier suites now guard the CLI half in every CI run, without OS_TEST_SQLD_BIN: organization-ownership.remote-posture.test.ts (both ceremony boots pass deferredDdlUnsupported skip-schema-sync; the apply reads the ledger from the catalog when the boot skipped schema sync) and schema-migrate.remote-posture.test.ts (transportRefusesDeferredDdl over 8 resolved databases; exemptPrimary leaves only the engine default driver un-armed, at init and on a later registerDriver, with the no-exemption and the other-refusing-driver controls). Required 4: the sqld e2e stays opt-in, and no CI dependency was added. Non-blocking notes, all done: (a) the citation now names turso-remote-drift-detection.test.ts; (b) remoteCatalogRead and the catalog batch throw a raw-statement fault on a non-array answer instead of folding it into no drift; (c) the applied read-back for create_index, recreate_index and replace_unique_index checks the live index's unique flag and column order, not only its name, and the doc says so; (d) the catalog is read in 3 round trips whatever the table count (sqlite_master, one read batch of table_info and index_list, one read batch of index_info for indexes whose DDL does not parse; chunks of 200 statements), pinned for 1 and 5 tables.",
"review_items": [
{
"item": "Blocking 1 (gate refuses healthy remote deployments)",
"fix": "ec063d8f gate branch on driver.driftReportCaveat plus REMOTE_DRIFT_REPORT_CAVEAT on the remote face; cc73b80 and 26b6ace changeset",
"pinned_by": "artifact-boot-migration.test.ts: the caveat case (warn with the reason, no detect, no apply, ok) and the null-caveat control (the same report refuses the boot); turso-remote-drift-detection.test.ts: remote declares a sentence containing NOT NULL, local and replica declare null"
},
{
"item": "Blocking 2 (embedded-replica control lost)",
"fix": "ec063d8f",
"pinned_by": "turso-remote-drift-detection.test.ts, describe the embedded-replica face still reports drift (its Knex detector), 2 cases; this is the named same-layer replacement for the replica case of the deleted turso-remote-drift-detection-refusal.test.ts"
},
{
"item": "Required 3 (unit pins for the CLI half)",
"fix": "040fbcc8 (exports DeferSchemaDdlPlugin and transportRefusesDeferredDdl for the pins)",
"pinned_by": "organization-ownership.remote-posture.test.ts (5 cases) and schema-migrate.remote-posture.test.ts (8 table cases plus 3 exemption cases), both unit tier"
},
{
"item": "Required 4 (sqld e2e stays opt-in)",
"fix": "no change",
"pinned_by": "the e2e reads 1 skipped without OS_TEST_SQLD_BIN"
},
{
"item": "Non-blocking a-d",
"fix": "ec063d8f",
"pinned_by": "turso-remote-drift-detection.test.ts round-trip case (3 client calls for 1 and for 5 tables); turso-remote-migration-entries.test.ts read-backs"
}
],
"tests": "driver-turso at 26b6ace (code-identical to cc73b80): typecheck exit 0; vitest 90 files, 2415 passed / 33 skipped. cli: typecheck plus test-typecheck exit 0; --project unit 299 files / 4453 passed; --project integration targeted, 20 files (every organization-ownership* and schema-migrate* integration suite, unmanaged-tables, and the sqld e2e with OS_TEST_SQLD_BIN set) 182 passed, 0 skipped. runtime: no change since 39b9abd, not re-run. eslint over the 15 changed .ts files exit 0. sqld acceptance re-run at cc73b80 against sqld 0.24.32 at libsql://127.0.0.1:38211?tls=0: plan exit 0, logical dump c0790dff before = after (341 objects / 12 rows), plan database libsql://127.0.0.1:38211; apply exit 0, complete true, blocking 0, advisory 0, every step done, column-drops dropped 2 of 2; second connection: sys_job and sys_metadata_activation have no organization_id, idx_sys_job_organization_id and idx_sys_metadata_activation_organization_id absent, marker adr-0131-organization-ownership applied 1 verified 1, sys_job rows 2.",
"ablations": "Round 2, each through scripts/ablation-replace.mjs WRAP mode with the mutation proven to land, the suite run while mutated, and the blob restored to HEAD with git diff HEAD empty. (1) the apply boot's deferredDdlUnsupported skip-schema-sync removed from organization-ownership.ts: organization-ownership.remote-posture.test.ts red, 1 failed (the apply boot case). (2) the exemption line in DeferSchemaDdlPlugin.arm removed: schema-migrate.remote-posture.test.ts red, 2 failed. (3) the gate's caveat branch disabled in artifact-boot-migration.ts: artifact-boot-migration.test.ts red, 1 failed. Process note: the first attempt at (1) used an empty replacement, which ablation-replace refuses (it counts the replacement's occurrences), so nothing ran; it was re-run with a marker comment as the replacement and went red as above.",
"gates": "Local, at 26b6ace: node scripts/pm/dispatch-gates.mjs --commands derives the same 70 families as round 1; all 70 ran sequentially with exit 0, recorded as cmd :: exit N; node scripts/pm/dispatch-gates.mjs --ran reports 70 derived, 70 run, 0 NOT-MEASURED, 0 UNRUN. pnpm check:dual-build-cjs-loads, NOT MEASURED in round 1, ran this time: 110 require entry points across 68 packages load, 722 CommonJS files parse. eslint over the 15 changed .ts files exit 0. CI on 26b6ace at report time: completed success = TypeScript Type Check (source gates, workspace, debt ledger, consumer gates), Lint and Repo Gates (ESLint, repo and tooling, docs and code guards, CI release and engine, PM dispatch-gates, scoped x3), Build Core, Test Core 1, 2, 3, 5, 6 of 6, Dogfood Regression Gate, Check Changeset, Check PR Size, Governed Surface Queue Guard, Check Documentation Links, Flag docs affected by code changes, Auto Label, filter, and the three claim checks plus Part-of; in progress = Test Core 4/6; skipped = Console Pin Gate, Dogfood Verify CLI, Temporal Conformance, Build Docs, Packed-tarball smoke. The TypeScript Type Check and Lint and Repo Gates failures reported on ec063d8 and 040fbcc are their aggregators reading lanes cancelled when the next push superseded the run (every non-success lane concluded cancelled, none failed); both aggregators are green on 26b6ace.",
"mcp_calls": "This round: 5 GitHub MCP calls, all reads: pull_request_read get_comments #23843 twice (the review, then the follow-up pointer), pull_request_read get_check_runs #23843 twice, and get_job_logs failed_only for run 38875413801 (the superseded 040fbcc run). No MCP writes; the PR subscription from round 1 stays on.",
"api_writes": "This round: 1 REST proxy write, POST /repos/objectstack-ai/objectstack/dispatches through scripts/pm/fleet-write/dispatch.mjs, op comment on #23816 (this report). Git pushes to claude/issue-23816-remote-ceremony: ec063d8, 040fbcc, cc73b80, 26b6ace. No label, assignee, PR-body or review writes.",
"pr_body_corrections_for_the_seat": [
"Acceptance notes, the bullet One behaviour change outside the ceremony: replace it. On a Turso remote primary the OS_ARTIFACT_URL boot migration gate keeps cannot judge, warn and boot (no apply, no refusal, no detectManagedDrift call), decided from the driver's declared driftReportCaveat; it judges remote databases again only after the follow-ups #23847 and #23848, which this PR does not close.",
"Summary, point 2: add that the remote face declares driftReportCaveat and that the catalog is read in 3 round trips per call (batched), and that an applied index entry is read back by unique flag and column order.",
"Tests: add organization-ownership.remote-posture.test.ts and schema-migrate.remote-posture.test.ts (unit tier, both run in CI), the caveat and null-caveat cases in artifact-boot-migration.test.ts, and in turso-remote-drift-detection.test.ts the embedded-replica control (named as the deleted refusal test's replica replacement), the driftReportCaveat case and the round-trip case. Counts: driver-turso 2415 passed / 33 skipped; cli unit 299 files / 4453 passed; integration subset 182 passed.",
"Ablation: add the three round-2 ablations listed in this report.",
"Head references: 39b9abd becomes 26b6ace for tests and gates; the sqld acceptance re-ran at cc73b80, which is code-identical to 26b6ace."
],
"open_questions": [],
"out_of_scope_findings": [
"carrier: #23847 and #23848 (filed by the PM) · the remote sync's missing NOT NULL and the missing remote os migrate apply remedy, reported in round 1, are now carried there",
"carrier: cloud#2868 · noted, not filed · unchanged from round 1: the shared differ leaves a physical index with an expression key part (for example COALESCE(package_id, '')) out of its proposals on both faces (isSyncReproducibleIndex), so a tenant overlay index still carrying such a 17.x key reads as declared to rebuildTenantOverlayIndex and is not rebuilt; measured on a remote face over a libSQL file: client, not against a cloud tenant · dedupe words: overlay index expression key drift, isSyncReproducibleIndex COALESCE, idx_sys_metadata_overlay_active recreate"
]
}
Generated by Claude Code
hotlong commentedon Oct 16, 2026
ACCEPT → PR #23843 at
26b6acef· PM of this card (local_6eb9ec2e…) · 2026-10-16T09:27Zneeds:contract-reviewis cleared on the PR and on this card. The PR is marked ready and auto-merge is armed (merge queue).hotlong commentedon Oct 16, 2026
Landed · PR #23843 merged through the merge queue as
ae4dfafa15e31334b5064708f61b99991c103718· 2026-10-16. The commit message carries no model identifier, and this card closed on the merge. Follow-ups #23847 and #23848 stay open. Downstream, cloud#2868's pin round 10 now bumps cloud's framework pin to amainthat containsae4dfafa15.