Repository navigation
os dev refuses an old dev database (ADR-0131 boot guard), promises an in-place upgrade, and exits with 「The upgrade did not run to a report」 and no cause #26615
Description
Source
Read on 2026-10-27 starting HotCRM 1f3f8880 (platform 18.2.0) on a dev database last used on 2026-10-16: the organization-ownership boot guard refused (sys_flow_credential, sys_secret still carry a physical organization_id column), os dev printed 「⟳ … os dev upgrades it in place, keeping a copy first…」 and then 「✗ The upgrade did not run to a report. The database as it was before the upgrade is copied to …/backups/organization-ownership-2026-10-27T10-08-08-349Z … Run os migrate organization-ownership --dev (review its plan), then the same command with --apply --plan-file FILE --backup-taken」. Exit code 1, no reason why the in-place upgrade stopped. A developer who last ran the app eleven days ago cannot start it without learning the ceremony.
Target
- The in-place upgrade either completes (and prints the report path) or prints the first refusal it hit, in the same words the ceremony's own
--out PLANwould; 「did not run to a report」 without a cause is not an exit. - The two columns it names here (
sys_flow_credential.organization_id,sys_secret.organization_id: objects that no longer declare the column) are a case the ceremony handles in dev mode, dropping or renaming them as the plan says, so the common 「I pulled main after a week」 path needs no manual command. - A test: a dev database with a stale
organization_idcolumn on an object that retired it starts underos devafter the automatic upgrade.
File surface
packages/cli/src/commands/dev.ts (the auto-upgrade branch), packages/runtime (the boot guard), the ceremony in packages/cli/src/commands/migrate/organization-ownership*, tests beside.
Acceptance
- The test; the log of
os devon the backed-up HotCRM database (.objectstack/data/backups/organization-ownership-2026-10-27T10-08-08-349Z) shows the upgrade completing or the cause.
Filed by the epic PM session session_cdb7a717-def7-4e71-9988-f089fbaa18ff from the 2026-10-27 fifth review: objectstack main f9867020c6 (Object UI now under ui/), HotCRM 1f3f8880 on platform 18.2.0 (the published console at /_console, a fresh dev database), the maintainer's browser pane at 955 × 452 (zh-CN), plus cloud staging (the control-plane home and the test1016 tenant's build chat). The maintainer asked for every finding to be filed by where the fix lands, verbatim: 「全部立卡，按落点分仓；#25943 让车道正常派发。」
Activity
objectstack-fleet commentedon Oct 27, 2026
Triage: first grade —
bug·priority:p1(from p2) ·domain:server(lane merge:domain:cli→domain:server) ·area:devpath·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-27T11:01Z⛔ Not a claim, ⛔ not a dispatch.
os devrefuses a pre-ADR-0131 dev database, promises an in-place upgrade, and then exits with 「The upgrade did not run to a report」 and no next step that works. Every developer who upgrades an old dev DB hits this on the release that just shipped. The backup is taken, so there is no data loss, but the upgrade path is dead. Find why the ceremony stops before its report (sys_flow_credentialandsys_secretstill carry a physicalorganization_id), and make it finish or name the exact command that does.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Claim: PM loop round 4 · card thread · 18.2.0 wave-2 split with server seat 1
Session:
session_0186vfjHHMsRXC9EUT9hTFMo(the seat); the card thread issession_01FEkQ5pVM4YkXVkL6VgUUhPAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-4e32d7(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#2Ruling-ref: triage
6440254086(find why the ceremony stops before its report and make it finish or name the exact command that does); the card's three targets are the acceptance; dev mode only, ⛔ production ceremony unchangedFile surface:
packages/cli/src/commands/dev.ts(the in-place upgrade branch),packages/cli/src/commands/migrate/organization-ownership*(the ceremony's dev-mode handling of a retiredorganization_idcolumn), thepackages/runtimeboot guard if the cause is there, their tests, and a changeset per package. ⛔ No change to the--applyproduction path, ⛔ no drop of a column whose data the plan does not account for, ⛔ the pre-upgrade backup staysContainer & model:
M,mode:thread, default model and effort (set at thread open)Clause-②: no (a dev-mode boot path; no metadata value moves; the dev re-measures)
Metadata-protocol: none
Responsibility:
os devin-place upgrade vs the ADR-0131 organization-ownership ceremonyThread-read: 6440254086
Premise: holds (read 2026-10-27T14:29Z at
origin/main5cc31c7885: card open, unassigned,pm:queuewith its triage line; the split with server seat 1 gives this card to seat 2); the dev re-measures it first, and a refutation is apremise_still_valid: falsehand-backResume-from: none — fresh from
origin/mainSerial constraints cleared: yes — the dev re-measures open PRs on the file surface before the first edit and before
pr_createState:
pm:queue→pm:dispatched, assigned toos-project-manager, in this act.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
os-dev-report
{
"issue": 26615,
"status": "needs_decision",
"branch": "claude/project-thread-4e32d7",
"pr": "#26785",
"session": "session_01FEkQ5pVM4YkXVkL6VgUUhP",
"premise_still_valid": true,
"summary": "Target 1 is done. os dev's in-place upgrade (packages/cli/src/utils/dev-organization-ownership-upgrade.ts) swallowed the cause in three places on origin/main 5cc31c7: (a) refusalLines kept only lines starting with the glyph, so a FORCE_COLOR terminal's coloured refusal (measured: ESC[31m before the glyph in the log file) matched nothing; (b) the apply's exit was ignored, so an uncaught error, a crash or a signal printed no cause; (c) a report file still holding the apply's reservation text was parsed as a report and printed 'stopped at a blocker (above)' with nothing above, and an unparseable one threw out of os dev. Now the upgrade prints the ceremony's own refusal (colour stripped, glyph not doubled), or how the run ended plus the end of its own part of the log, and ends on the exact command: os migrate organization-ownership --dev --database-url URL --apply --plan-file PLAN --backup-taken. Targets 2 and 3: sys_flow_credential and sys_secret already carry inventory fate column-drop, and the dev-mode ceremony drops both columns and their index. A new real os dev integration test pins that the stale-column database starts after the automatic upgrade and that the copy keeps both columns. The reporter's exact stop did NOT reproduce in 5 shapes, including an authentic HotCRM 4f82b81 (2026-10-16, 18.0.0-next.2) database started by HotCRM on the published 18.2.0. The reporter's backup is not in this container, so the fixture stands in for it, and with this change os dev prints whatever cause that backup hits. Production ceremony and runtime boot guard untouched. One ruling line is left open (open_questions).",
"tests": "Unit: pnpm --filter @objectstack/cli exec vitest run src/utils/dev-organization-ownership-upgrade.test.ts src/commands/dev-organization-ownership-recover.test.ts -> Test Files 2 passed, Tests 16 passed. Red first (base util 5cc31c7 restored from HEAD after, git diff HEAD empty, via a test copy whose fake answers the base seam's number): Tests 8 failed | 4 passed (12): the 6 new causes (coloured refusal, uncaught error, signal, reservation text, unparseable report, blocked report with no blocker) plus the un-doubled glyph and the exact command. Integration (built CLI, bin/run.js): vitest run --project integration test/dev-organization-ownership-stale-column.integration.test.ts -> 4 passed (refused, then 'Upgraded the development database', then 'server started on the upgraded database'; both columns gone; marker verified; rows kept; copy keeps both columns). It is green on base too: it pins target 3, which origin/main already meets. cli unit tier at debcc2c: Test Files 339 passed (339), Tests 4929 passed (4929), lock VERDICT command-exit 0. cli typecheck: exit 0 (check:test-typecheck OK). Repro probes (scratch, not committed): minimal fixture on main, both columns, no marker: upgraded; same with a gen-0 birth marker: upgraded; HotCRM afdf9a0 on main with columns, indexes and stamped rows: upgraded; HotCRM on published 18.2.0, same staging: upgraded; authentic HotCRM 4f82b81 / 18.0.0-next.2 database then HotCRM on published 18.2.0: upgraded, plan column-drop tables carrying the column = exactly sys_flow_credential and sys_secret, column-drops done dropped 2. FORCE_COLOR=1 os migrate organization-ownership --dev --apply (no --plan-file) writes ESC[31m before the refusal glyph into a file: measured.",
"gates": "Derived list (dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, 80 families) run at debcc2c, each exit captured before any pipe: 78 exit 0; pnpm check:dual-build-cjs-loads exit 3 (PREREQUISITE NOT MET: needs a full pnpm build) and pnpm check:i18n-coverage exit 3 (@objectstack/connector-slack has no build output in this worktree), both NOT MEASURED, CI runs them. --ran reconciliation: '80 derived famil(ies) accounted for, 78 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)', 0 UNRUN. Hand gates, all exit 0: node scripts/check-nul-bytes.mjs; node scripts/check-commit-card-trailers.mjs --range origin/main..HEAD; scoped eslint --no-inline-config on the 3 touched cli files and scripts/check-cli-test-child-env.mjs; node scripts/check-cli-test-child-env.mjs (census now eighteen files); node scripts/check-cli-test-child-env.mjs --self-test. PR check-runs: in_progress at hand-back (not waited on, per the contract).",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "0 — no MCP GitHub calls; reads went through gh api REST (card, triage, claim, open-PR file lists)",
"api_writes": "3 — git push of claude/project-thread-4e32d7 (not a REST write); relay pr_create (fw-20261027T154112Z-7e70f8, run 40533441432, read-back identical, assignee os-project-manager) = POST /repos/objectstack-ai/objectstack/pulls + its POST /issues/26785/assignees leg; this os-dev-report comment via post-stamped.mjs = POST /repos//issues/26615/comments",
"open_questions": [
{
"question": "Order ruling: the dev path 'never drops a column holding data the plan does not account for; if the stale column holds non-null values that the plan would discard, print that as the refusal and name the command'. As measured, the dev path drops a stale column only as the reviewed plan's fate says: the plan counts the stamps a drop discards (fateCounts.rowsLosingTheirStamp), the ceremony blocks a drop whose category still holds rows, and the copy is kept. This PR adds no new refusal. Should the dev path also refuse before the apply when a column-drop table's stale column holds non-null stamps?",
"status": "needs_decision",
"options": [
"A — As this PR: the dev path follows the plan's column-drop fate; the discarded stamps are counted in plan.json beside the kept copy. No new code.",
"B — Refuse before the apply when any column-drop table has rowsLosingTheirStamp > 0, naming each table and count and the exact plan and apply commands. Measured cost: sys_audit_log and the sys_metadata family are column-drop tables and always stamped on a 17.x database, so every 17.x dev database would need the manual ceremony again, which is the cost the ADR-0131 D10 development exception removed. On the authentic 18.0-era HotCRM database both stale columns held 0 rows, so B would not fire there.",
"C — Proceed, but print one line per dropped column-drop table that discarded non-null stamps (table, count, 'the copy keeps them') before the verdict, so the drop is never silent. About 15 lines plus a unit case, in this PR."
],
"recommendation": "C, by the four axes. Real business need, measured: the reported case (18.0-era HotCRM) has 0 stamped rows on both tables, and a 17.x database has stamps on sys_audit_log and sys_metadata that B would refuse. Long-term soundness: the plan's fate is the contract for what a drop discards, and C reports it while B adds a second dev-only rule on top of the plan. Preventing AI mistakes: C makes the discard visible in the output an agent reads, and B refuses loudly but stops every 17.x dev boot. Startup focus: C adds no gate. A is acceptable if the seat reads 'accounted for' as 'the plan's fate counts it'."
}
],
"out_of_scope_findings": [
"Not filed, noted: the reporter's own backup (.objectstack/data/backups/organization-ownership-2026-10-27T10-08-08-349Z/ceremony.log on the reporter's machine) names the actual stop. Re-running os dev on it with this change prints that stop; that run is the card's acceptance 1 log and needs the reporter's machine. carrier: Leehom (maintainer), noted, not filed",
"Not filed, noted: open PR #26772 (os migrate key-material ledger, card #26687) touches packages/cli/src/commands/migrate/** but none of this PR's files. No overlap. carrier: none"
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Seat ruling on the open question (report
6446452770)2026-10-27T15:45Z ·
domain:serverseat 2 ·os-project-manager·session_0186vfjHHMsRXC9EUT9hTFMoOption C. The dev path proceeds on a column-drop table whose stale
organization_idholds non-null values, and prints, per table, how many stamped values the drop discards, before the upgrade runs.sys_audit_logandsys_metadataare column-drop tables). That would makeos devunusable on exactly the path this card exists to fix.--applywithout--dev) keeps its review-the-plan ceremony unchanged.The dev adds C to #26785 (about 15 lines with a pin) and hands back.
Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
os-dev-report
{
"issue": 26615,
"status": "ready_for_review",
"branch": "claude/project-thread-4e32d7",
"pr": "#26785",
"session": "session_01FEkQ5pVM4YkXVkL6VgUUhP",
"premise_still_valid": true,
"summary": "Round 2, seat ruling C (comment 6446501014) added to PR #26785 at head 74e75e3. Before the apply runs, os dev now reads the reviewed plan and prints one warning line per column-drop table whose retired organization_id column held non-null stamps: the table, the count the drop discards, and that the copy in the backup directory keeps them. The upgrade then completes as before; no new refusal, no new gate, production os migrate without --dev untouched. Round 1 stands: the ceremony stop is printed in its own words (colour stripped), or how the run ended plus the end of its own part of the log, a reservation or unparseable report file is read as no report, and every failed upgrade ends on the exact resume command. Branch merged with origin/main (6c43855) before the gates.",
"tests": "Unit: vitest run src/utils/dev-organization-ownership-upgrade.test.ts src/commands/dev-organization-ownership-recover.test.ts -> 17 passed (13 + 4). New C pin: a plan whose sys_secret column-drop discards 3 stamps announces exactly one line naming sys_secret, 3 and the copy, before the apply starts; a column-drop with rowsLosingTheirStamp 0 is not announced; the upgrade is ok. Ablation: the rows > 0 filter replaced (ablation-replace.mjs) -> Tests 1 failed | 12 passed (13), the C pin red; restored, git diff HEAD empty. Round-1 red first unchanged (8 failed | 4 passed on base 5cc31c7). Integration (built CLI, bin/run.js) test/dev-organization-ownership-stale-column.integration.test.ts -> 5 passed: the sys_secret row is now stamped with a real sys_organization id, os dev prints the stamped-count line for sys_secret before Upgraded the development database, does not name the unstamped sys_flow_credential, the server starts, both columns are gone, the marker is verified, rows kept, the copy keeps both columns. cli unit tier at 74e75e3: Test Files 339 passed (339), Tests 4932 passed (4932).",
"gates": "Derived list (dispatch-gates.mjs --commands, 80 families) re-run at 74e75e3 after a full pnpm build, each exit captured before any pipe. --ran reconciliation: 80 derived famil(ies) accounted for, 80 run, 0 NOT-MEASURED, 0 UNRUN. pnpm check:dual-build-cjs-loads exit 0 and pnpm check:i18n-coverage exit 0 (both NOT MEASURED in round 1, now measured). Hand gates, all exit 0: check-nul-bytes, check-commit-card-trailers --range origin/main..HEAD, scoped eslint --no-inline-config on the touched cli files and scripts/check-cli-test-child-env.mjs, check-cli-test-child-env (eighteen files) and its --self-test. PR check-runs not waited on, per the contract.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "0 — no MCP GitHub calls in either round; reads through gh api REST",
"api_writes": "Round 2: 2 so far: git push debcc2c..74e75e3 (not a REST write) and this os-dev-report comment via post-stamped.mjs (POST /issues/26615/comments). Round 1: 3 (push, relay pr_create of #26785 + assignee leg, report comment 6446452770). The PR body is the round-1 body and does not yet name C; amendment left to the seat (no PATCH by the dev).",
"open_questions": [],
"out_of_scope_findings": [
"Not filed, noted: the reporter's own backup (.objectstack/data/backups/organization-ownership-2026-10-27T10-08-08-349Z/ceremony.log on the reporter's machine) names the actual stop. Re-running os dev on it with this change prints that stop; that run is the card's acceptance 1 log and needs the reporter's machine. carrier: Leehom (maintainer), noted, not filed",
"Not filed, noted: open PR #26772 (os migrate key-material ledger, card #26687) touches packages/cli/src/commands/migrate/** but none of this PR's files. No overlap. carrier: none"
],
"head": "74e75e381c",
"round": 2,
"pr_body_amendment_for_seat": "Add a What changes bullet: No silent drop (seat ruling C, 6446501014): before the apply, os dev prints one line per column-drop table whose stale organization_id held non-null stamps, with the count and the copy that keeps them; the upgrade completes. Tests: unit 13/13 with the C pin; integration 5/5 with the stamped sys_secret line. Verification: unit 4932 tests; gates 80 run, 0 NOT-MEASURED (dual-build-cjs-loads and i18n-coverage exit 0 after a full build). Drop the ruling-data-line open question from Acceptance notes."
}
Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Landed
2026-10-27T17:20Z ·
domain:serverseat 2 ·os-project-manager· sessionsession_0186vfjHHMsRXC9EUT9hTFMoPR #26785 merged at 2026-10-27T17:20:37Z. The merge queue landed it as
b198f919b8onmain(Fixes #26615; ACCEPT6448191440;Clause-②: no, so no contract review was owed).git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-26785-*'git merge-base --is-ancestor b198f919b8 origin/mainorigin/mainby contentdev-organization-ownership-upgrade.tsonorigin/maindiscardedStamps(ruling C)Landed:
os dev's in-place organization-ownership upgrade now names the cause when it stops:It ends on the exact command that carries on. Before the apply, it says per table how many stamped values each column drop discards, and names the copy that keeps them (seat ruling C,
6446501014). The production ceremony is unchanged.Acceptance 1 (the reporter's own stop): this did not reproduce on five measured shapes. The next
os devon the reporter's backup prints that stop, and theceremony.logbeside the backup already holds it. That run needs the reporter's machine.State: GitHub closed the card on merge.
Generated by Claude Code