runtime: the organization-ownership boot refusals prescribe --out PLAN / --apply --plan-file PLAN, which 18.0 refuses on every database (#24637, domain:cli row)

Filing gate ④: a per-lane child of the coordination parent #24637 (18.0 release text family). Each row is ①'s release-text exception. Filed by the triage seat (seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U. ⛔ Not a claim. Reader who acts: the domain:cli seat, in one PR on the file below.

Row

In 18.0, os migrate organization-ownership refuses plan and apply on every database (ORGANIZATION_OWNERSHIP_UPGRADE_UNAVAILABLE, NOT_IMPLEMENTED). The runtime's boot refusals still send the operator there. On origin/main f89d29e382, packages/runtime/src/organization-ownership-boot-guard.ts says:

:242: "…then run '${ceremony} --out PLAN' again, review it, run '${ceremony} --apply --plan-file PLAN …";
:256–257: "Run '${ceremony} --out PLAN' to write and review its plan, take a backup, then run '${ceremony} --apply --plan-file PLAN --backup-taken', and start again.";
:342–343: "…or run the ceremony ('${ceremony} --out PLAN', then '${ceremony} --apply --plan-file PLAN --backup-taken'), then start again."

Done: each branch says what 18.0 supports for a v17 database in the landed member's terms (PR #24635, f89d29e382): "18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path." Pin the message text. This is text only: the refusal codes and the boot outcome do not move.

Dedupe

The parent's searches cover this row: MCP search_issues "organization-ownership command refused in 18.0 still named in refusal text upgrade guide ADR-0087 entries plan-file", 45 hits, closed included. The family members are #24566, #24567 and #23871, all closed. #23871 is the earlier boot-refusal wording, and it predates 18.0's refusal. None covers these branches.

Generated by Claude Code

Claim: PM loop round 6 · domain:cli seat 1 · p1 + target:v18 (the domain:cli child of #24637) · 2026-10-19T22:24Z
Session: session_01SYEJqDL3NXxrJRBVqaMu9T
Account: zhuangjianguo (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24651-boot-refusal-18-0-text
Worktree: objectstack-issue-24651
Domain: domain:cli
Seat: domain:cli#1 (seat post #6024)
File surface (read on origin/main bfc1539fe; line numbers move; stop on a breach and explain it in the report):

packages/runtime/src/organization-ownership-boot-guard.ts: the three branches the card names (about :242, :256–:257, :342–:343), which prescribe '${ceremony} --out PLAN' / --apply --plan-file PLAN …. Each says what 18.0 supports for a v17 database in the landed member's terms (PR fix(cli): the organization-ownership drop refusal says what 18.0 supports for a v17 database #24635): "18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path."
The tests that pin these strings, plus one pin per branch, with an ablation. A patch changeset on @objectstack/runtime.
⛔ Hold-offs: refusal codes and the boot outcome; the v17-shape refusal's wording for a database 18.0 created, which is [Decision] An 18.0-created database whose object newly declares systemFields: { tenant: false } has no way on in 18.0 — the drift report prescribes --allow-destructive, the drop gate refuses it, and the ceremony is refused #24638's open decision and is not pre-empted here; packages/spec/**; packages/cli (PR fix(cli): the organization-ownership drop refusal says what 18.0 supports for a v17 database #24635 landed it).
Container & model: S, mode:subagent, model: default tier (no path-derived mandate)
Clause-②: no
Basis for the Clause-② line: refusal text only. No code, outcome or shape moves.
Responsibility: this lane's own runtime text (packages/runtime). No platform path covers it. It reaches every operator whose 18.0 boot is refused on a v17-shaped database. It is the release-text exception, from 18.0 release text still sends operators to os migrate organization-ownership --out / --apply --plan-file, which 18.0 refuses on every database (family close-out: spec upgrade-guide entries, runtime boot refusals, plugin-security report, docs) #24637's census.
Thread-read: none
Serial constraints cleared:
No open PR touches organization-ownership-boot-guard.ts, and no pm:dispatched claim names it (read in this act).
platform-objects sys_organization: change_slug targets a cloud-only route, so on an open-source multi-organization composition the record page offers Change Slug and the click answers 404 #24318's declared packages/runtime/src/action-execution-destructive.test.ts is another file in the same package.
The other dispatches in this act, hourly full run: red on main (CI) #24645 (packages/qa) and runtime: two hand-built 400 refusals put off-catalog codes on details.fields[].code (unrecognized_keys, invalid_string), which ADR-0114's closed FieldErrorCode catalog forbids #24597 (packages/runtime/src/domains/automation.ts, permission-set-clone.ts), and rest: every GET /api/v1/data/OBJECT still runs a full zod safeParse of the object's definition (the API-exposure gate's by-name read is decorated with diagnostics) — 11.8% of a HotCRM read's CPU #24535 (PR perf(rest): GET /data/OBJECT no longer computes metadata diagnostics; the exposure gate reads getMetaItemForExecution #24666) are disjoint.

Generated by Claude Code

os-dev-report
{
"issue": 24651,
"status": "done",
"branch": "claude/issue-24651-boot-refusal-18-0-text",
"pr": "#24682",
"session": "session_01SYEJqDL3NXxrJRBVqaMu9T",
"premise_still_valid": true,
"summary": "All three boot-refusal branches in packages/runtime/src/organization-ownership-boot-guard.ts now end on the landed member's sentence, '18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path, and upgrade it there.' None names os migrate organization-ownership or any of its steps. The branches are: A, the v17 shape; B1/B2, no v17 table with the marker unverified/unreadable; C, the column read failed. B2 and C keep or add 'Fix the read, then start again.', and a dev boot says 'a v17 development database' (the landed os dev wording). ceremonyCommand() is gone. The refusal code, the refused tables and every boot outcome are unchanged. The unit, kernel and dogfood pins that named the command are updated, with one pin per branch. Changeset .changeset/24651-boot-refusal-fresh-installs-only.md is a patch on @objectstack/runtime and carries Clause-②: no. The census, the branch map and the quoted before/after text are in the PR body. Premise verified at bfc1539 by rendering the guard's messages from the base file: all three branches named --out PLAN / --apply --plan-file PLAN --backup-taken.",
"tests": "All at head 7ac4f50, under scripts/pm/os-verify-lock.sh. (1) pnpm --filter @objectstack/runtime test (project local): 'Test Files 425 passed (425) / Tests 6676 passed | 19 skipped (6695)'. test:repo (project repo): 'Test Files 3 passed (3) / Tests 808 passed (808)'. typecheck: exit 0, tsc --noEmit plus check:test-typecheck OK; tsc -p tsconfig.test.json --listFilesOnly lists both edited test files. (2) cli readers of the boot refusal, against runtime's rebuilt dist (dist carries the new sentence, 0 hits of '--apply --plan-file PLAN'): vitest run apply.organization-ownership-refusal.test.ts, organization-ownership.no-organization.integration.test.ts and organization-ownership.declared-rule-mirrors.integration.test.ts gave 'Test Files 3 passed (3) / Tests 8 passed (8)'. (3) dogfood, once at the final head: closure build exit 0 (66 tasks), then test/organization-ownership-boot-refusal-order.dogfood.test.ts gave 'Test Files 1 passed (1) / Tests 5 passed (5)'. (4) Ablation on committed HEAD 7ac4f50 via node scripts/ablation-replace.mjs (WRAP mode, trap-restored). It put branch C's old 'Fix the read, or run the ceremony (...--out PLAN..., then ...--apply --plan-file PLAN --backup-taken), then start again.' back. On disk: anchor x1 to x0, replacement x0 to x1, blob 65f1c9e2 to dad453f6. Unit file: 'Tests 2 failed | 20 passed (22)'. The red pins were 'a column read that failed: fix the read first' and 'a development boot says the same ... in every branch'. Direction: red, as predicted. Restore: blob after restore 65f1c9e2 == HEAD blob, git diff HEAD empty. The unit test imports the guard by relative path (src), so no build/dist leg applies and ablation-dist-preflight is n/a. Two lock waits hit queue-timeout (exit 99, NOT MEASURED) behind other agents and were re-queued under the same slot names; the readings above are from the runs that acquired.",
"gates": "Local, head 7ac4f50, each exit captured before any pipe. (a) node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack named 68 commands; 67 exited 0 on the first pass. pnpm check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET, not every package had dist). After pnpm turbo run build --filter=!@objectstack/docs (76 tasks, 75 cached) it was re-run and exited 0 ('111 published require entry point(s) across 69 package(s) load'). --ran reconciliation exited 0: 'Run reconciliation — 68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN.' (b) The 11 declared-wide families all exited 0: check:init-service-contract, check:live-db-isolation, check:meta-type-normalized, check:optional-error-sink, check:resume-authority-declared, check:route-envelope, check:runner-env-posture, check:settings-bind-window, check:startup-registry-verdict, check:verify-stand-in, check:wildcard-fallthrough. pnpm lint (eslint . --no-inline-config) exited 0. (c) node scripts/check-platform-checklist.mjs --changed-from origin/main exited 0 (3 anchors judged, 0 lost). (d) The changeset's Clause-② line read by scripts/pm/clause2-line.mjs readClause2Line: declared, value no, arm null. CI on PR #24682, read once at head 7ac4f50 and not polled: 'No other open PR may claim the same issue' success; 'Packed-tarball smoke (opt-in)' skipped; 22 runs in_progress, including Check Changeset, Governed Surface Queue Guard, Lint · ESLint, Lint · CI, release & engine gates, Lint · repo & tooling gates, Lint · docs & code guards, Lint · PM dispatch-gates, Type Check · workspace, Type Check · source gates, Type Check · consumer gates, Type Check · debt ledger and Spec property liveness. Test Core and Build Core had not appeared yet: in_progress.",
"mcp_calls": "0 — no MCP GitHub tool was called",
"api_writes": "3 — through the fleet-write relay (scripts/pm/fleet-write/dispatch.mjs, as objectstack-fleet[bot]), in two strokes: (1) pr_create: POST /repos/objectstack-ai/objectstack/pulls (draft forced) and POST /repos//issues/24682/assignees [zhuangjianguo]; read back: 15077 bytes sent and 15077 stored, identical. (2) this report: POST /repos//issues/24651/comments. git push is not counted. All other GitHub calls were GET reads.",
"deviations": [
"packages/qa/dogfood/test/organization-ownership-boot-refusal-order.dogfood.test.ts was edited: step 1 pinned 'os migrate organization-ownership' in the v17-shape refusal. It is outside packages/runtime but is one of the claim's 'tests that pin these strings'. #24645's claim holds only expression-conformance.test.ts, and #24318's holds org-record-admin-reach.dogfood.test.ts. Dogfood is not on PR CI, so the file was run locally at the final head (5/5).",
"Beyond deleting the steps: B2 (marker unreadable) gains 'Fix the read, then start again.' because it also reaches a fresh 18.0 database whose ledger read failed. A's 'To keep 17.x semantics, run a 17.x runtime.' was dropped, because the 17.x sentence now carries it.",
"The pins assert the refusal code plus the closing 18.0 sentence (not the first sentence) and the absence of the command's steps. The card and the dispatch require pinning that sentence. os-dev.md's text-pin rule names the first sentence; the code is asserted alongside in every pin.",
"pnpm lint and test:repo were run locally because the dispatch asked for them. os-dev.md says both belong to CI; this is noted as additive, not a conflict.",
"The commit uses AGENTS.md's model-free trailer pair (Claude-Session plus 'Co-authored-by: Claude'), not the harness reminder's model-named Co-Authored-By line. The pre-push hook refuses a model identifier."
],
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: exception: release-text (a runtime string that ships in 18.0) · Two strings outside packages/runtime still send the operator to the command 18.0 refuses on every database (ORGANIZATION_OWNERSHIP_UPGRADE_UNAVAILABLE, packages/cli/src/commands/migrate/organization-ownership.ts about :1110). (1) packages/metadata-protocol/src/seed-loader.ts:1739, the unowned-holder seed refusal: 'Attribute the unowned rows first (os migrate organization-ownership, then the same command with --apply), then re-run this seed'. Its bare --apply was refused even before 18.0, without --plan-file. (2) packages/metadata-core/src/legacy-organization-row.ts:78, LegacyOrganizationRowsUnreadable: 'Run os migrate organization-ownership on this database first.' #24637's census regex misses both, because a backtick follows the command name. Same family, so the seat should fold them into #24637 as two rows (no single-point card). Whoever fixes (1) must also update the cross-package pin packages/runtime/src/seed-loader-null-organization-holder-real-driver.integration.test.ts:215, which asserts toContain('os migrate organization-ownership'). · dedupe words: seed-loader unowned holder refusal names organization-ownership command; LegacyOrganizationRowsUnreadable run os migrate organization-ownership; 18.0 withdrawn command in metadata-protocol refusal text",
"class: a · reach: named producer — the checklist-test runner reading docs/qa/platform-checklist/areas/platform-core.json item platform-core.v18-boot-refusals acceptance[1] (QA runs #24556/#24557 ran this item) · This PR makes that clause stale. The item's title ('naming the tables and the command'), acceptance[1].clause ('names the tables and os migrate organization-ownership') and acceptance[1].verify expect the boot refusal to name the command. Against PR #24682's head, a run records FAIL on a correct product. Proposed revision 4: say it 'names the tables and says that 18.0 supports fresh installs only, naming no step of os migrate organization-ownership', with a history row citing PR #24682. Not edited here: the file is outside the claim's surface, and the item had two revisions on 2026-10-19, so a claim on it could not be ruled out without scanning. Conditions ①②④ of the in-place exemption hold. If ③ holds, the seat can send it back as a patch round on this claim. · dedupe words: platform-core.v18-boot-refusals names the command; checklist boot refusal os migrate organization-ownership stale; v18 boot refusal checklist clause 18.0 fresh installs",
"carrier: #24638 (open maintainer decision) · noted, not filed. Branch A still reaches an 18.0-created database whose object newly declares systemFields: { tenant: false }. It still calls that database 'still in the v17 organization-ownership shape', and the 17.x sentence is false for it. This PR adds no sentence for that case, which leaves #24638's decision open."
]
}

Generated by Claude Code

os-dev-report
{
"issue": 24651,
"status": "done",
"branch": "claude/issue-24651-boot-refusal-18-0-text",
"pr": "#24682",
"session": "session_01SYEJqDL3NXxrJRBVqaMu9T",
"premise_still_valid": true,
"summary": "Patch round 1, commit 21f7e90 on the same branch, PR #24682. The checklist item platform-core.v18-boot-refusals in docs/qa/platform-checklist/areas/platform-core.json goes from revision 3 to 4. The title now says the refusal names the tables and says that 18.0 supports fresh installs only. acceptance[1].clause and .verify now assert three things: the printed refusal names each table still carrying organization_id; it ends with '18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path, and upgrade it there.'; and the excerpt has 0 hits for --out PLAN, --plan-file and os migrate organization-ownership. The code-literal note is kept. The history row (revision 4, 2026-10-19, ref #24682) cites card #24651. Round 0, unchanged at 7ac4f50: all three boot-refusal branches in packages/runtime/src/organization-ownership-boot-guard.ts now end on the landed 18.0 sentence and name no step of the withdrawn command; the unit, kernel and dogfood pins were updated; and the changeset is a patch on @objectstack/runtime with Clause-②: no. origin/main was not merged in: platform-core.json is unchanged on main since bfc1539. The PR body is not patched; body_edits carries 7 exact-anchor edits for the seat.",
"tests": "Round 1, at 21f7e90: the dogfood file test/organization-ownership-boot-refusal-order.dogfood.test.ts was re-run once at the final head (closure 66/66 cached, exit 0): 'Test Files 1 passed (1) / Tests 5 passed (5)'. @objectstack/plugin-auth src/checklist-refusal-envelope-consistency.test.ts reads every checklist area file and was run at the new head: 'Test Files 1 passed (1) / Tests 5 passed (5)'. Round 0, at 7ac4f50, code unchanged since: runtime local 'Test Files 425 passed (425) / Tests 6676 passed | 19 skipped (6695)'; runtime repo 'Test Files 3 passed (3) / Tests 808 passed (808)'; runtime typecheck exit 0 with both edited tests in the tsconfig.test.json program; the three cli boot-refusal readers 'Test Files 3 passed (3) / Tests 8 passed (8)'. Ablation (round 0) via scripts/ablation-replace.mjs put branch C's old '--out PLAN ... --apply --plan-file PLAN --backup-taken' alternative back. On disk: anchor x1 to x0, blob 65f1c9e2 to dad453f6. Result: 'Tests 2 failed | 20 passed (22)', red as predicted. Restore: blob == HEAD 65f1c9e2, git diff HEAD empty. The round-1 change is a QA checklist JSON, not code, so it owes no ablation.",
"gates": "Round 1, at 21f7e90, each exit captured before any pipe. (a) node scripts/check-platform-checklist.mjs --changed-from origin/main exited 0: 'OK — 1 anchored file(s) in the change set, 3 anchor(s) judged, 0 lost. 6 changed file(s) since merge base bfc1539.' (b) node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack named 70 commands. The new path adds pnpm check:platform-checklist and pnpm --filter @objectstack/lint run check:doc-formula-expressions. All 70 exited 0, after pnpm turbo run build --filter=!@objectstack/docs restored dist (76/76 cached). That includes check:platform-checklist ('OK — 16 areas, 327 items (322 active, 1 planned)'), check:doc-formula-expressions, and check:dual-build-cjs-loads. --ran exited 0: 'Run reconciliation — 70 derived, 70 run, 0 NOT-MEASURED, 0 UNRUN.' (c) The 11 declared-wide families and pnpm lint, re-run at 21f7e90: all 12 exited 0. CI on PR #24682 at 21f7e90, read once: 41 check-runs completed, 35 success and 6 skipped (Build Docs, Console Pin Gate, the two Dogfood shard and verify jobs, which are full-battery-only, Temporal Conformance, and the opt-in tarball smoke). The required contexts all succeeded: Lint & Repo Gates, TypeScript Type Check, Test Core (and 1/6 to 6/6), Build Core, Governed Surface Queue Guard; Check Changeset succeeded too. At 7ac4f50 the Test Core shards were cancelled, superseded by the round-1 push. Round 0 (7ac4f50): 68/68 derived and 0 NOT-MEASURED; 11 wide families and lint exited 0.",
"mcp_calls": "0 — no MCP GitHub tool was called",
"api_writes": "4 across both rounds, all through the fleet-write relay as objectstack-fleet[bot]. Round 0: POST /repos/objectstack-ai/objectstack/pulls (draft) plus POST /repos//issues/24682/assignees, then POST /repos//issues/24651/comments (comment 6279485022). Round 1: POST /repos//issues/24651/comments (this report). No PATCH to the PR body. git push is not counted. Everything else was a GET.",
"deviations": [
"Claim surface addition, as the seat recorded: docs/qa/platform-checklist/areas/platform-core.json (item platform-core.v18-boot-refusals only). docs/qa/platform-checklist/areas/cli.json:1880 names this item only as where to get a v17 DB copy. It is PR #24681's file and was not touched.",
"acceptance[1] asserts that the refusal names neither the command nor any step of it, slightly more than the round's ask ('no step'). The product and the runtime pins (WITHDRAWN_COMMAND) already hold that.",
"packages/qa/dogfood/test/organization-ownership-boot-refusal-order.dogfood.test.ts was edited: step 1 pinned 'os migrate organization-ownership' in the v17-shape refusal. It is outside packages/runtime but is one of the claim's 'tests that pin these strings'. #24645's claim holds only expression-conformance.test.ts, and #24318's holds org-record-admin-reach.dogfood.test.ts. Dogfood is not on PR CI, so the file was run locally at the final head (5/5).",
"Beyond deleting the steps: B2 (marker unreadable) gains 'Fix the read, then start again.' because it also reaches a fresh 18.0 database whose ledger read failed. A's 'To keep 17.x semantics, run a 17.x runtime.' was dropped, because the 17.x sentence now carries it.",
"The pins assert the refusal code plus the closing 18.0 sentence (not the first sentence) and the absence of the command's steps. The card and the dispatch require pinning that sentence. os-dev.md's text-pin rule names the first sentence; the code is asserted alongside in every pin.",
"pnpm lint and test:repo were run locally because the dispatch asked for them. os-dev.md says both belong to CI; this is noted as additive, not a conflict.",
"The commit uses AGENTS.md's model-free trailer pair (Claude-Session plus 'Co-authored-by: Claude'), not the harness reminder's model-named Co-Authored-By line. The pre-push hook refuses a model identifier."
],
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: exception: release-text (a runtime string that ships in 18.0) · Two strings outside packages/runtime still send the operator to the command 18.0 refuses on every database (ORGANIZATION_OWNERSHIP_UPGRADE_UNAVAILABLE, packages/cli/src/commands/migrate/organization-ownership.ts about :1110). (1) packages/metadata-protocol/src/seed-loader.ts:1739, the unowned-holder seed refusal: 'Attribute the unowned rows first (os migrate organization-ownership, then the same command with --apply), then re-run this seed'. Its bare --apply was refused even before 18.0, without --plan-file. (2) packages/metadata-core/src/legacy-organization-row.ts:78, LegacyOrganizationRowsUnreadable: 'Run os migrate organization-ownership on this database first.' #24637's census regex misses both, because a backtick follows the command name. Same family, so the seat should fold them into #24637 as two rows (no single-point card). Whoever fixes (1) must also update the cross-package pin packages/runtime/src/seed-loader-null-organization-holder-real-driver.integration.test.ts:215, which asserts toContain('os migrate organization-ownership'). · dedupe words: seed-loader unowned holder refusal names organization-ownership command; LegacyOrganizationRowsUnreadable run os migrate organization-ownership; 18.0 withdrawn command in metadata-protocol refusal text",
"carrier: #24638 (open maintainer decision) · noted, not filed. Branch A still reaches an 18.0-created database whose object newly declares systemFields: { tenant: false }. It still calls that database 'still in the v17 organization-ownership shape', and the 17.x sentence is false for it. This PR adds no sentence for that case, which leaves #24638's decision open."
],
"body_edits": [
{
"old_str": "- Ablation, on the committed head 7ac4f50e9:",
"new_str": "- docs/qa/platform-checklist/areas/platform-core.json, item platform-core.v18-boot-refusals, revision 3 to 4 (patch round 1, commit 21f7e90f4): the title and acceptance[1] (clause, verify) asserted that the refusal names os migrate organization-ownership. They now assert the named tables, the closing 18.0 sentence, and 0 hits for --out PLAN, --plan-file and the command. The ⛔ on the code literal is kept, and a history row cites #24682.\n- Ablation, on the committed head 7ac4f50e9:"
},
{
"old_str": "| everything else (action-execution.ts, domain-handler-registry.ts, flow-clone.ts, sandbox/quickjs-runner.ts, security/security-catalog.testkit.ts) | the word "ceremony" in unrelated comments | not this family |",
"new_str": "| everything else (action-execution.ts, domain-handler-registry.ts, flow-clone.ts, sandbox/quickjs-runner.ts, security/security-catalog.testkit.ts) | the word "ceremony" in unrelated comments | not this family |\n| docs/qa/platform-checklist/areas/platform-core.json, item platform-core.v18-boot-refusals (outside packages/runtime) | a QA checklist item whose title and acceptance[1] expected the refusal to name the command | changed in patch round 1 (revision 4, 21f7e90f4) |"
},
{
"old_str": "## Tests and gates (all at head 7ac4f50e9, the final commit)",
"new_str": "## Tests and gates (code at 7ac4f50e9; the union, wide families, lint and dogfood re-run at 21f7e90f4, the final commit)"
},
{
"old_str": "--ran reconciliation: "68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN".",
"new_str": "--ran reconciliation: "68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN". At 21f7e90f4 the new path adds pnpm check:platform-checklist and pnpm --filter @objectstack/lint run check:doc-formula-expressions. The derivation named 70 commands, and all 70 exited 0 after the whole-repo build was restored from cache. --ran: "70 derived, 70 run, 0 NOT-MEASURED, 0 UNRUN"."
},
{
"old_str": "pnpm lint (eslint . --no-inline-config) exited 0.",
"new_str": "pnpm lint (eslint . --no-inline-config) exited 0. At 21f7e90f4 all 11 and pnpm lint were re-run and exited 0."
},
{
"old_str": "- node scripts/check-platform-checklist.mjs --changed-from origin/main exited 0: 3 anchors judged, 0 lost.",
"new_str": "- node scripts/check-platform-checklist.mjs --changed-from origin/main exited 0 at both heads: 3 anchors judged, 0 lost. At 21f7e90f4, pnpm check:platform-checklist exited 0 ("16 areas, 327 items"). @objectstack/plugin-auth's checklist-refusal-envelope-consistency.test.ts, which reads every area file, passed 1 file and 5 tests. The dogfood file re-run at 21f7e90f4 passed 1 file and 5 tests."
},
{
"old_str": "- A QA checklist clause this PR makes stale. docs/qa/platform-checklist/areas/platform-core.json, item platform-core.v18-boot-refusals. Its title ("naming the tables and the command"), acceptance[1].clause ("names the tables and os migrate organization-ownership") and acceptance[1].verify expect the refusal to name the command. After this PR, a run of that item would record FAIL against a correct product. The fix is a revision 4 that reads "names the tables and says that 18.0 supports fresh installs only, naming no step of os migrate organization-ownership". The file is outside this claim's file surface and had two revisions today, so it is reported to the seat, not edited here.",
"new_str": "- The QA checklist clause this PR made stale is fixed here. Patch round 1 used the seat's in-place exemption: conditions ① to ④ hold, and the seat measured ③. See Pins."
}
]
}

Generated by Claude Code

ACCEPT → PR #24682 comment 6279986603 · domain:cli seat 1 · session session_01SYEJqDL3NXxrJRBVqaMu9T · 2026-10-19T23:58Z · head 21f7e90f4 (after patch round 1: the checklist item). Ready and auto-merge are set; it is in the queue.

Generated by Claude Code

Landed: PR #24682 → `9e2722a92` · `domain:cli` seat 1 · `zhuangjianguo` · session `session_01SYEJqDL3NXxrJRBVqaMu9T` · 2026-10-20T00:24Z

Reading	Result
PR #24682 object	`merged: true`, merge commit `9e2722a92`, merged 2026-10-20T00:23Z through the merge queue
`origin/main`	`9e2722a92` is an ancestor of `origin/main`, with a single parent (squash). The 6 files and +174 / −59 match what was reviewed at `21f7e90f4`
queue branch	no `gh-readonly-queue/main/pr-24682` head remains

Review chain: claim 6278703183 → report 6279485022 → patch round 1 (the checklist item, in place) → report 6279958070 → the seat's 7 body edits → ACCEPT 6279986603 → ready and auto-merge.
What landed: every branch of the runtime's organization-ownership boot refusal ends on "18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path, and upgrade it there." No branch names --out PLAN / --apply --plan-file PLAN --backup-taken any more. The checklist item platform-core.v18-boot-refusals is at revision 4.
Serial note: the epic lane's PR feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681 (feat(cli): 18.x step 5: the upgrade ceremony steps behind the refusal (webhook re-source, sibling moves, 9c, 8e NOT NULL) #24581) rewrites the same file and merges main after this landing. The order and the expected resolution are recorded on feat(cli): 18.x step 5: the upgrade ceremony steps behind the refusal (webhook re-source, sibling moves, 9c, 8e NOT NULL) #24581.
Family: this is 18.0 release text still sends operators to os migrate organization-ownership --out / --apply --plan-file, which 18.0 refuses on every database (family close-out: spec upgrade-guide entries, runtime boot refusals, plugin-security report, docs) #24637's domain:cli row.
State: the card closed completed on the merge. pm:dispatched is removed in the stroke after this comment.

Generated by Claude Code

Navigation Menu

Repository navigation

runtime: the organization-ownership boot refusals prescribe `--out PLAN` / `--apply --plan-file PLAN`, which 18.0 refuses on every database (#24637, domain:cli row) #24651

Row

Dedupe

Landed: PR #24682 → `9e2722a92` · `domain:cli` seat 1 · `zhuangjianguo` · session `session_01SYEJqDL3NXxrJRBVqaMu9T` · 2026-10-20T00:24Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

runtime: the organization-ownership boot refusals prescribe --out PLAN / --apply --plan-file PLAN, which 18.0 refuses on every database (#24637, domain:cli row) #24651

Description

Row

Dedupe

Activity

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 20, 2026

Landed: PR #24682 → 9e2722a92 · domain:cli seat 1 · zhuangjianguo · session session_01SYEJqDL3NXxrJRBVqaMu9T · 2026-10-20T00:24Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

runtime: the organization-ownership boot refusals prescribe `--out PLAN` / `--apply --plan-file PLAN`, which 18.0 refuses on every database (#24637, domain:cli row) #24651

Landed: PR #24682 → `9e2722a92` · `domain:cli` seat 1 · `zhuangjianguo` · session `session_01SYEJqDL3NXxrJRBVqaMu9T` · 2026-10-20T00:24Z