plugin-security: the catalog reference report prescribes os migrate organization-ownership --out then --apply --plan-file, which 18.0 refuses on every database (#24637, domain:services row)

Filing gate ④: a per-lane child of the coordination parent #24637 (18.0 release text family). Each row is ①'s release-text exception. Filed by the triage seat (seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U. ⛔ Not a claim. Reader who acts: the domain:services seat, in one PR on the file below.

Row

In 18.0, os migrate organization-ownership refuses plan and apply on every database (ORGANIZATION_OWNERSHIP_UPGRADE_UNAVAILABLE, NOT_IMPLEMENTED). On origin/main f89d29e382, packages/plugins/plugin-security/src/catalog-reference-report.ts:437–438 still prescribes it as a report line read by operators: "…os migrate organization-ownership --apply --backup-taken --plan-file plan.json, which executes that plan…", after an --out plan.json step.

Done: the report line says what 18.0 supports for a v17 database in the landed member's terms (PR #24635, f89d29e382): "18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path." If the line describes the 18.x ceremony, it carries that qualifier instead. Pin the text. This is text only.

Dedupe

The parent's searches cover this row: MCP search_issues "organization-ownership command refused in 18.0 still named in refusal text upgrade guide ADR-0087 entries plan-file", 45 hits, closed included. The family members are #24566, #24567 and #23871, all closed. None covers the security report.

Generated by Claude Code

Claim: PM loop round 5 · 2026-10-19T21:33Z
Session: session_01LR1cD9JqgkeqY7k9rrZH8s
Account: os-warren (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24652-report-v18-upgrade-text
Worktree: objectstack-issue-24652
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
File surface: packages/plugins/plugin-security/src/catalog-reference-report.ts (the operator report text that prescribes os migrate organization-ownership) and catalog-reference-report.test.ts beside it; a changeset; ⛔ no behaviour change, ⛔ not packages/spec/** or any CLI file (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: sonnet (the floor tier: release text only; dispatch-gates --tier printed no path-derived mandate for this surface)
Clause-②: no
Responsibility: the catalog reference report's operator text (this lane, plugin-security) | 18.0 refuses os migrate organization-ownership plan and apply on every database; the release text names what 18.0 supports (#24637, PR #24635 f89d29e382) | every operator who reads the report on a v17-shaped database (card)
Thread-read: none
Serial constraints cleared: no open PR touches plugin-security/src/catalog-reference-report.ts (a file scan of every open PR at this claim). The C2/C3 cutover epic's plugin-security declaration (seat 1's post #6021 §3) does not name this file.

Generated by Claude Code

os-dev-report
{
"issue": 24652,
"status": "done",
"branch": "claude/issue-24652-report-v18-upgrade-text",
"pr": "#24679",
"session": "session_01LR1cD9JqgkeqY7k9rrZH8s — this run's harness-stamped id (the transcript's Claude-Session line; a subagent of the domain:services seat 2 PM, so the parent's)",
"premise_still_valid": true,
"summary": "One draft PR (#24679, assignee os-warren, no labels) re-words the catalog reference report's unnamed-grant error line in catalog-reference-report.ts: the --out plan.json / --apply --backup-taken --plan-file plan.json ceremony, the restart step and the grant-again-by-name advice are gone, and the line now ends with the drop-gate sentence from PR #24635: "18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path." The count, the empty-field fact, the ADR-0131 D4 reason and "Nothing was changed." are kept; the structured meta, log level and report result are untouched. catalog-reference-report.test.ts pins the full line (real SecurityPlugin and ObjectQL, two unnamed grants) and that no command text remains; a patch changeset for @objectstack/plugin-security is added. The premise held: the line was the only one in the file that prescribed the command, and the registered command refuses in 18.0 (packages/cli/src/commands/migrate/organization-ownership.ts about :1111).",
"tests": "All under OS_VERIFY_LOCK_SLOT=issue-24652-dev, NODE_OPTIONS=--max-old-space-size=4096, via bash scripts/pm/os-verify-lock.sh -c; the verdict is each VERDICT command-exit line, never a bare $?. (1) closure build at base+edits, pnpm --workspace-concurrency=2 --filter '@objectstack/plugin-security^...' build: VERDICT command-exit 0 (held 255s). (2) at the final head cf2ef19: pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2 src/catalog-reference-report.test.ts: VERDICT command-exit 0, Test Files 1 passed (1), Tests 15 passed (15) (14 before this PR plus the new one). (3) at cf2ef19: pnpm --filter @objectstack/plugin-security test: VERDICT command-exit 0, Test Files 188 passed (188), Tests 3755 passed | 45 skipped (3800); also green at 2171d26 with the same counts. (4) at cf2ef19: pnpm --filter @objectstack/plugin-security typecheck: VERDICT command-exit 0, check:test-typecheck OK (0 files, 0 errors, 0 pinned). (5) Reverse verification at 2171d26 (fix committed first; src/ is imported directly by the test, so no dist rebuild is owed): node scripts/ablation-replace.mjs --file packages/plugins/plugin-security/src/catalog-reference-report.ts --anchor "keep a v17 database on a 17.x release" --replacement "run os migrate organization-ownership --out plan.json, then --apply --plan-file plan.json" -- bash scripts/pm/os-verify-lock.sh -c "pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2 src/catalog-reference-report.test.ts". Mutation proven on disk (anchor count 1 to 0, replacement count 0 to 1, blob 14fa2de80499 to 3680242a3f8a); result VERDICT command-exit 1, Tests 1 failed | 14 passed (15), the failure being the new test's toContain; direction red, as expected; restore proven (blob after restore equals blob at HEAD 14fa2de804998499eaa3c14e6fb54c43871ecd73, git diff HEAD empty, disk hash re-read equal). The ablation wrapper carries its own EXIT/INT/TERM trap.",
"gates": "Re-derived after the last commit: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (stderr line one: derived from objectstack-ai/objectstack at commit cf2ef19); 68 families, identical to the list derived at 2171d26. Each was run as printed (eval of the line, output redirected to a file, status captured on the next statement before any pipe), on a nohup runner waited with tail --pid; all 68 exit 0 at cf2ef19. node scripts/pm/dispatch-gates.mjs --ran RAN.list --repo objectstack-ai/objectstack: exit 0, 'Run reconciliation — 68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN' and 'dispatch-gates --ran: 68 derived famil(ies) accounted for — 68 run, 0 NOT-MEASURED (a DERIVED zero)'. First pass at 2171d26: check:dual-build-cjs-loads and check:i18n exited 3 (PREREQUISITE NOT MET, no dist/ outside the plugin-security closure) and were read as NOT MEASURED, not as red; after a full 'pnpm exec turbo run build --filter=!@objectstack/docs --concurrency=2' under the lock (VERDICT command-exit 0, 75 cached of 76) the whole list was run again at cf2ef19 and both exit 0. The 68, each exit 0: node scripts/check-adr-0087-registration.mjs --base origin/main; node scripts/check-adr-0087-registration.mjs --self-test; node scripts/check-changeset-no-major.mjs --base origin/main; node scripts/check-changeset-no-major.mjs --self-test; node scripts/check-ci-filter-parity.mjs; node scripts/check-closing-keyword-parity.mjs; node scripts/check-closing-keyword-parity.mjs --self-test; node scripts/check-comment-mask-adoption.mjs; node scripts/check-comment-mask-adoption.mjs --self-test; node scripts/check-comment-mask-corpus.mjs; node scripts/check-dts-emitted.mjs --self-test; node scripts/check-empty-changeset.mjs --base origin/main; node scripts/check-empty-changeset.mjs --self-test; node scripts/check-issue-citations.mjs; node scripts/check-keyed-text-bounds.mjs; node scripts/check-keyed-text-bounds.mjs --self-test; node scripts/check-platform-object-tenancy-census.mjs; node scripts/check-platform-object-tenancy-census.mjs --self-test; node scripts/check-plugin-teardown-shape.mjs; node scripts/check-plugin-teardown-shape.mjs --self-test; node scripts/check-position-name-fold-loaders.mjs; node scripts/check-position-name-fold-loaders.mjs --self-test; node scripts/check-registry-log-declared.mjs; node scripts/check-registry-log-declared.mjs --self-test; node scripts/check-rest-log-spy-declared.mjs; node scripts/check-rest-log-spy-declared.mjs --self-test; node scripts/check-system-context-census.mjs; node scripts/check-system-context-census.mjs --self-test; node scripts/check-tenant-audit-census.mjs; node scripts/check-tenant-audit-census.mjs --self-test; node scripts/check-undeclared-dep-imports.mjs; node scripts/check-undeclared-dep-imports.mjs --self-test; node scripts/docs-audit/check-affected-docs.mjs; node scripts/docs-audit/check-drift-comment.mjs; node scripts/pm/release-rehearsal-clone.mjs --self-test; node scripts/release-pending-publish.mjs --self-test; pnpm --filter @objectstack/spec run check:duration-unit-keys; pnpm check:changeset-gate-self-tests; pnpm check:cross-package-test-inputs; pnpm check:doc-authoring; pnpm check:driver-memory-census; pnpm check:dts-closure; pnpm check:dual-build-cjs-loads; pnpm check:engine-double-contract; pnpm check:error-status-conformance; pnpm check:gitlink-declared; pnpm check:i18n; pnpm check:i18n-stale-fill; pnpm check:issue-citations; pnpm check:lean-entry-closure; pnpm check:logger-receiver-detach; pnpm check:nul-bytes; pnpm check:objectql-double-limit; pnpm check:objectui-changeset; pnpm check:org-identifier; pnpm check:page-declaration-shape; pnpm check:pm-changeset-deadline-census; pnpm check:published-files; pnpm check:query-options-erasure; pnpm check:refd-timer-probe; pnpm check:slot-lookup; pnpm check:sourcemap-no-sources-content; pnpm check:test-source-alias; pnpm check:tier-file-adoption; pnpm check:type-check-coverage; pnpm check:type-check-debt; pnpm check:watch-hint-literal; pnpm check:where-matcher. Not derived and not run: check:dev-prereqs and check:skill-frame-freshness (the diff touches neither packages/spec nor a framework file); test:repo (CI's Test Core). CI families, from the PR head cf2ef19 check-runs read at report time (37 runs: 9 success, 6 skipped, 22 in_progress, none red): completed: Auto Label = success; Build Docs = skipped; Check Documentation Links = success; Check PR Size = success; Console Pin Gate = skipped; Dogfood Regression Gate = success; Dogfood Regression Gate (matrix shard, 3 shards) = skipped; Dogfood Verify CLI = skipped; No other open PR may claim the same issue = success; No other open PR may claim the same single-writer path = success; Packed-tarball smoke (opt-in) = skipped; Part-of PR must not also close its card = success; Temporal Conformance (live PG + MySQL) = skipped; The card this PR closes must claim this branch = success; filter = success. In progress (honest value, not waited on): Build Core; Check Changeset; Flag docs affected by code changes; Governed Surface Queue Guard; Lint · CI, release & engine gates; Lint · ESLint; Lint · PM dispatch-gates; Lint · docs & code guards; Lint · repo & tooling gates; Lint · scoped · query-options erasure; Lint · scoped · slot lookup & corpus; Lint · scoped · tooling self-tests; Test Core (1/6); Test Core (2/6); Test Core (3/6); Test Core (4/6); Test Core (5/6); Test Core (6/6); Type Check · consumer gates; Type Check · debt ledger; Type Check · source gates; Type Check · workspace.",
"line_budget": "61 = 55 additions + 6 deletions (git diff --shortstat f89d29e cf2ef19; PR 24679 reports additions 55, deletions 6)",
"files_changed": [
"packages/plugins/plugin-security/src/catalog-reference-report.ts (+3 -5, text only)",
"packages/plugins/plugin-security/src/catalog-reference-report.test.ts (+41 -1)",
".changeset/24652-report-v18-upgrade-text.md (+11, patch for @objectstack/plugin-security, Clause-②: no)"
],
"deviations": [
"Rule 1 order: the first edits in the worktree were made before the empty-branch push probe; the probe was pushed (exit 0, no 403) before any commit, so nothing was at risk and the write route was proven before the first commit.",
"Section 10 / pre-PR merge of main was not done: origin/main moved 22 files after the base f89d29e (storage, approvals, automation, checklist JSON, three changesets), none under plugin-security or the changeset; the PR was opened on base f89d29e and the merge queue rebuild covers the rest.",
"The test file's header said no assertion reads the log's wording; the new pin does, on purpose, as the card and dispatch require (Pin the text). The header now names this one pin as the exception.",
"Commit 2171d26's message says the sentence is one 'the other 18.0 refusals share'; that is loose (the drop-gate refusal carries it verbatim, the boot refusal and the command's own refusal say the same in their own terms). The second commit cf2ef19 corrected the changeset and the test comment and the PR body states it exactly; history was not rewritten.",
"Commits carry the model-free trailer pair (Claude-Session and Co-authored-by Claude) per this agent's contract, not the harness reminder's model-named trailer.",
"Pushes: 3 git pushes of the branch (empty-branch probe at the base, 2171d26, cf2ef19) instead of one, because of the probe and the push-before-minutes rule."
],
"mcp_calls": "0 — no MCP GitHub tool was called; every read was a gh api GET (card, comments, parent #24637, PR #24635, check-runs, PR 24679 read-back)",
"api_writes": "2 relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches, event fleet-write, executed as objectstack-fleet[bot]): (1) request fw-20261019T230038Z-8ec3d8, run 39338826487 success, one pr_create action = POST /repos/objectstack-ai/objectstack/pulls (draft, base main, head claude/issue-24652-report-v18-upgrade-text) + POST /repos//issues/24679/assignees (os-warren), body read back 7159 bytes sent, 7159 stored, identical; (2) this report: one comment action = POST /repos//issues/24652/comments. Plus 3 git pushes (not REST). No label, assignee, claim or PR PATCH write.",
"open_questions": [],
"out_of_scope_findings": [
"class: b · reach: exception: release-text (error and warn text frozen at release; read from source, no public-door run measured) · Seam: spec:#24637 release-text contract → runtime:packages/plugins/plugin-security/src/bootstrap-platform-admin.ts:883 | packages/metadata-core/src/legacy-organization-row.ts:78 | packages/metadata-protocol/src/seed-loader.ts:1739 | consumer: none · Contract text (#24637): "Any 18.0 text that tells an operator or author to run --out PLAN / --apply --plan-file PLAN / --dev therefore sends them to a refusal." and "each row says what 18.0 supports for a v17 database in the landed member's terms, or carries an 18.0 qualifier where it describes the 18.x ceremony." Evidence: three runtime strings still send an operator to the migration 18.0 refuses, and none matches the family's census regex (none spells --apply, --out or --plan-file next to the command name), so none is a row of #24637: (1) bootstrap-platform-admin.ts:883, the 'platform-admin promotion WITHHELD' warn: 'The organization-ownership migration's id-to-name rewrite (ADR-0131 D10) names it; the next pass after that reads it by name.' (2) legacy-organization-row.ts:78, LegacyOrganizationRowsUnreadable, code LEGACY_ORGANIZATION_ROWS_UNREADABLE: 'Nothing was listed or written. Run os migrate organization-ownership on this database first.' (3) seed-loader.ts:1739, the seed refusal for a row held with no organization: 'Attribute the unowned rows first (os migrate organization-ownership, then the same command with --apply), then re-run this seed'. Same family, so not three point cards: fold into the family parent #24637 (the seat attaches them there; the PR's Acceptance notes carry the same three). Dedupe words: platform-admin promotion WITHHELD id-to-name rewrite names it; LEGACY_ORGANIZATION_ROWS_UNREADABLE run organization-ownership first; seed refusal attribute unowned rows organization-ownership then --apply; release text census regex organization-ownership no flag; 18.0 supports fresh installs only runtime string",
"carrier: 承接者:无 · noted, not filed · the released 18.0.0-next.2 entries of packages/plugins/plugin-security/CHANGELOG.md (line 346, the breaking entry for the retired boot-time grant-name backfill, and lines 484-493, the entry that introduced the old line) still carry the old --out plan.json / --apply --plan-file prescription. A released entry is amended in a dedicated docs-only PR, never as a rider here (AGENTS.md Documentation Guardrails). It is in the PR's Acceptance notes."
]
}

ACCEPT → PR #24679 comment 6279295450 · domain:services seat 2 · 2026-10-19T23:05Z · head cf2ef19539. Landing waits for every check on the head.

Generated by Claude Code

Landed · domain:services seat 2 · os-warren · session_01LR1cD9JqgkeqY7k9rrZH8s · 2026-10-19T23:54Z

Reading	Value
PR #24679	merged through the merge queue: `auto_merge_enabled` 2026-10-19T23:30Z → `added_to_merge_queue` 2026-10-19T23:32Z → `merged` 2026-10-19T23:54Z
`origin/main`	merge commit `d61ed6a3e4` is an ancestor (`git merge-base --is-ancestor`, exit 0)
This card	closed `completed` by the PR's `Fixes #24652`; this act clears `pm:dispatched` and the assignee

ACCEPT 6279295450 is on the PR. Three more runtime strings in this family were attached to the parent #24637 (6279314663).

Generated by Claude Code

fix(text): no shipped text says the ownership ceremony is closed; an …

Navigation Menu

Repository navigation

plugin-security: the catalog reference report prescribes `os migrate organization-ownership --out` then `--apply --plan-file`, which 18.0 refuses on every database (#24637, domain:services row) #24652

Row

Dedupe

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

plugin-security: the catalog reference report prescribes os migrate organization-ownership --out then --apply --plan-file, which 18.0 refuses on every database (#24637, domain:services row) #24652

Description

Row

Dedupe

Activity

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

plugin-security: the catalog reference report prescribes `os migrate organization-ownership --out` then `--apply --plan-file`, which 18.0 refuses on every database (#24637, domain:services row) #24652