Repository navigation
feat(cli,runtime)!: 18.x step 6: open the upgrade ceremony for v17 and 18.0 databases (and the deferred flips) #24582
Description
Filing gate ③: a task the maintainer directed. It is a step of the 18.x line, under ruling records 6266750393 and 6267391172 on #15194. It is filed from step 0's measured plan: os-dev-report 6268559156 on #24522, step_plan.steps[5], plus its line_facts F1–F6 and flags.
- Reader who acts: the epic seat (
epic:#15194,session_01Y5583bs2RDd53MH6kM1ca3). - Dedupe: none.
Part of #15212 (C8) and #24489 · Step 6: opening the ceremony · ⛔ Not an 18.0 gate.
The line's rule (binding)
Once merged, main stays releasable:
- R1. A fresh install boots.
- R2. test(qa): the 18.x line's upgrade harness (an 18.0 database boots on every later main with its data) and the measured step plan #24522's 18.0→HEAD harness is green, RESTATED by this step: an 18.0 database now takes the ceremony.
- R3. A v17 database is refused until step 6.
- R4. A walled posture is refused at boot until step 4.
Ordering: after step 5 (5a–5d) has merged, and after the maintainer rules on how an 18.0 database is recognised (Q3 in 6268559156).
Scope (from the measured plan; re-measure before building)
- chore(cli)!: 18.x restore of the 18.0 guards — re-open the upgrade ceremony and walled boots #24489, items 1, 4 and 6. Delete the refusing
MigrateOrganizationOwnershipsubclass and restore the default export toOrganizationOwnershipCeremony. Delete the release-refusal test. Put dogfood boot-refusal-order step 2 back on the binary. The 19 import sites are optional. - The deferred flips (PR 2b from step 2).
sys_secretandsys_flow_credentialgo totenant:false, landing together with the open ceremony (F2). Their inventory rows become column-drop. - The guard's verdict on an 18.0 database (F4), and the step-set check (F5). A verified marker from a shorter ceremony must not certify the database.
- The decision: (a) a birth marker written by the guard on a datastore created from empty, or (b) shape probes added to
findV17ShapeTables. - It amends the
migration.zod.ts:181-185prohibition if (a). The maintainer rules it.
- The decision: (a) a birth marker written by the guard on a datastore created from empty, or (b) shape probes added to
- The boot-guard refusal text. Stop telling an 18.0 database to "keep on 17.x" (out-of-scope finding 1).
- Close the
tenancy: { enabled: false }gap in the guard (boot-guard.ts:205checks onlysystemFields.tenant). - R2 and R3 are restated in the harness, by name.
Not dispatched yet. The seat claims it when its ordering is met.
Activity
objectstack-fleet commentedon Oct 19, 2026
Epic seat (
epic:#15194,session_01Y5583bs2RDd53MH6kM1ca3) · 2026-10-19T14:31Z. Ordering of the 18.x line (ruling 6266750393), recorded so the unlock scan can read it:Blocked-by: #24581
It also waits on the maintainer's ruling on Q3 of 6268559156 (how an 18.0 database is recognised).
objectstack-fleet commentedon Oct 19, 2026
Epic seat (
epic:#15194,session_01Y5583bs2RDd53MH6kM1ca3) · 2026-10-19T14:43Z. The decision this card waited on is ruled, in record 6269955919 on #15194.The maintainer chose ① A, a birth marker, and on the field design replied 「同意」 and then 「同意shapeGeneration」. The guard writes the marker exactly once, on a datastore created from empty. It carries
{ shapeGeneration, platformVersion, commit, createdAt }, and the guard decides onshapeGenerationalone; it never compares versions. The ceremony's verified marker carriesshapeGenerationtoo, andmarker.shapeGeneration < current→ refuse. That also closes F5.Remaining ordering:
Blocked-by: #24581
objectstack-fleet commentedon Oct 19, 2026
Epic seat (
epic:#15194,session_01Y5583bs2RDd53MH6kM1ca3) · 2026-10-19T14:48Z. Steps 5 and 6 now land together, as ONE merge. This follows the ruling that only complete features merge intomain(#15194, posted just now, quoting 「…都不是开发了一半的，都是某个完整的功能」).One branch carries both: #24581's ceremony steps (5a–5d) and #24582's opening of the ceremony. They are reviewed part by part and merged once, when
os migrate organization-ownershipreally upgrades v17 and 18.0 databases. That merge is likely Tier H by size, so the maintainer approves it. The step-5 card and the step-6 card close on that one landing.objectstack-fleet commentedon Oct 19, 2026
Claim: epic seat round · 2026-10-19T20:37Z
Session:
session_01Y5583bs2RDd53MH6kM1ca3Account:
os-steve(the card's assignee)Branch:
claude/issue-24581-ceremony-open(the same branch as #24581: one branch and one landing for steps 5 and 6, per ruling 6270035914; the full claim, with the file surface, is on #24581).Worktree: the cloud session's own checkout (
mode:cloud)Domain:
domain:engineSeat:
epic:#15194(the epic lane)Base, and an early start. Steps 2 and 3 have merged (#24590
b12e16a56, #24587fbafb8533). Step 1, PR #24588, is green and clean, and waits only on the maintainer's approval. The maintainer's standing order is 「你正常开发就行，只要确保你合并进main的代码都不是开发了一半的」. So this branch starts fromorigin/main, merged withorigin/claude/issue-24529-8b0g-webhooks-registry(#24588's head), because 5a needs the declared-webhook reader. ⛔ It lands only after #24588 and step 4 (#24580) have merged and this branch has mergedmainagain.The rulings that unblock it:
{shapeGeneration, platformVersion, commit, createdAt}is written on a datastore created from empty. The guard decides onshapeGenerationalone. The ceremony's verified marker carriesshapeGenerationtoo, andmarker.shapeGeneration < currentis refused (F5). Amend themigration.zod.tsprohibition accordingly.organization_idnullability. The schema differ does not flag it as drift, and no metadata changes.File surface, read at or after
14ccb1da9. The dev measures first; a breach stops the work and is explained in the report.declared:NAME; customized mirrors settled (an active-only edit becomes an activation row; any other edit becomes a clone under a new name, its deliveries re-sourced to the clone's id); orphaned mirrorsys_secretciphers reported or deleted; the mirror predicate aligned.scope; identity mail, after draining or rewriting{ rowId }send jobs and no-objectreclaim jobs, withsys_activityrows re-pointed or deleted, and the magic-link selector gap defined first.sys_secret/sys_flow_credentialtenant:falseflips with their column-drops, and the settings writer stops stampingsys_secret; the boot guard's 18.0 verdict via the birth marker, plus the step-set check; the refusal text; thetenancy: { enabled: false }gap in the guard. R2 and R3 are restated in the harness, by name.docs/adr/**: the seat batches the ADR-0131 D7 notes into a Tier H ADR PR. ⛔ Notcontent/docs/releases/.engine.tswalled lift,walledPostureRefusal).sys_emailexposure measured on measure(plugin-email): who can list sys_email rows that carry identity mail (reset and verification links) — sys_email declares no requiredPermissions #24625. It is not a fix for it either.Container & model:
L,mode:cloud,model: TIER_DEFAULTClause-②: yes (the dev re-measures). Opening the ceremony widens what boots, and the flips narrow two tables.
Responsibility: n/a. A ruled step of the line (6266750393, 6267391172, 6269955919, 6270035914 on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194).
Thread-read: 6271949316
Serial constraints cleared:
serve.ts; whichever lands second mergesmain.Merge gate: the PR opens as a draft and is likely Tier H, so the maintainer approves it. It lands after feat(plugin-webhooks,runtime)!: declared webhooks are read from the registry, the seeder retires, and the activation ledger switches them (18.x step 1, 8b-0g′) #24588 and feat(objectql,cli)!: 18.x step 4: the walled lift (8b walled half plus the walled part of #24489) #24580, with the harness green on the merged tree and R2 and R3 restated.
objectstack-fleet commentedon Oct 19, 2026
os-dev-report pointer: steps 5 and 6 land as one PR, #24681 (ruling 6270035914). This card's items are covered by it: #24489 items 1, 4 and 6; the sys_secret and sys_flow_credential flips with their column-drops; the guard's birth marker and shapeGeneration verdict, plus the step-set check (F5); the refusal text; and the tenancy:{enabled:false} gap. R2 and R3 are restated by name in upgrade-18x-harness.dogfood.test.ts, 8/8 green. The full report is on #24581.
Generated by Claude Code