ci: an opt-in label lane runs the 18.x upgrade harness on a line PR's merge preview (step 0 wiring)

[objectstack-fleet]

Part of #24522
Clause-②: no — a CI workflow, an expected-skip roster row and a label declaration; nothing a package publishes changes

The second, governed half of step 0 of the 18.x line: the wiring that lets the line's PRs run the upgrade harness before they merge. The harness itself (test, fixture, generator) is the sibling draft PR on claude/issue-24522-18x-upgrade-harness, and this PR's job runs that file. Land it with or after that PR. Before then, a labelled run fails loudly on a missing file: the dogfood config's filter preflight refuses a named path that selects no test.

维护者速读（草稿）

• 改了什么： 新增一个按标签触发的 CI 任务。PR 打上 needs:upgrade-harness 标签后，CI 会在合并预览上用 18.0 的样本数据库启动当前代码，检查数据是否完好、v17 数据库是否仍被拒绝。没有标签的 PR 不运行，不花钱。另外两处是配套登记：预期跳过名单加一行，标签声明脚本加一行。
• 为什么改： 您定的 18.x 原则是每次合并后 main 都能随时发版，其中 R2 要求「18.0 装出来的数据库升级到这个提交后能启动、数据不丢」，并要求在合并前检查。dogfood 测试现在只在 main 上跑，PR 阶段跑不到，所以要加这个入口。
• 风险与代价（含回滚）： 每个打了标签的 PR 约多一个 CI 任务：构建 dogfood 依赖（有缓存时较快，冷构建约 10 分钟）加约 1 分钟的测试。它不是必需检查，不进合并队列，也不影响其他 PR。回滚方法是删掉这个 workflow 文件。
• 席位意见：
• 你要做的： 审阅并批准合并（.github/workflows/** 属 Tier H）。标签对象由席位用 scripts/pm/ensure-pm-labels.sh 创建；之后席位给 18.x 线上的每个 PR 打这个标签。

What it adds

• .github/workflows/upgrade-harness-optin.yml — job 18.x upgrade harness (opt-in).
  • It runs on pull_request (opened, synchronize, reopened, labeled), and only while the PR carries needs:upgrade-harness. A labeled event must name that label.
  • It checks out the merge preview, restores the dogfood job's turbo cache read-only, builds --filter=@objectstack/dogfood, and runs vitest run test/upgrade-18x-harness.dogfood.test.ts.
  • Concurrency is set at job level, so a skipped run never cancels a real one. There is no merge_group trigger, and the job is not a required context. This mirrors pack-smoke-optin.yml, whose header argues each choice.
• scripts/pm/check-expected-skips.mjs — the job's name enters EXPECTED_SKIPS as a label-gated skip, so the enqueue bar does not read its skip on every other PR as a filter miss.
• scripts/pm/ensure-pm-labels.sh — declares the label object (colour and description). ⛔ Never auto-applied.

Why this shape (measured)

wiring	cost per line PR	why not / why
run it on every PR	build closure plus ~54 s on every PR in the repo	taxes every PR for one release line
workflow_dispatch ci.yml on the PR branch	the full battery: 3 dogfood shards, Temporal Conformance and the console pin	no diff needed, but a manual act with no trigger a PR carries, and ~20× the runner time for one file
label lane (this PR)	the dogfood build closure (turbo cache restored) plus one file: 53.89 s locally, of which 42.8 s is import	runs only where the seat asks; the ruled shape for a pre-merge check most PRs do not need

Gates (on this branch, head as pushed)

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 52 commands. All 52 exit 0.
  • pnpm check:pm-dispatch-gates ran on its own: ✓ dispatch-gates self-test (fast tier): 1913 cases pass in 465.4 s.
  • pnpm check:pm-expected-skips and pnpm check:pm-label-desc-cap exit 0.
  • node scripts/pm/check-expected-skips.mjs --self-test gave ✓ … 154 cases pass; it reads the roster's truth against this checkout's workflows.
• node scripts/pm/check-governed-merges.mjs --branch claude/issue-24522-harness-lane reads GOVERNED, landing tier H, 136 changed lines.

---

Generated by Claude Code

[objectstack-fleet]

Seat review · TIER_DEFAULT · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-19T14:27Z

Head c7101e99, +136 lines: .github/workflows/upgrade-harness-optin.yml, plus the needs:upgrade-harness label in ensure-pm-labels.sh and in check-expected-skips.mjs. Governed (.github/workflows/**), Tier H: the maintainer merges. The seat neither approves nor merges it.

Verdict: ACCEPT.

• The lane is an opt-in label lane, the same shape as the existing pack-smoke opt-in. It runs test(dogfood): the 18.x upgrade harness — an 18.0 database boots on HEAD with its data (step 0) #24552's harness on a PR that carries needs:upgrade-harness, and only there.
• It is advisory, not a required context: the merge group carries no PR whose label it could read. The seat hangs the label on every 18.x-line PR and reads the check before it queues one (ruling 6266750393, item 3).
• CI: 32 success, 13 skipped, 0 failed. The dev measured 52 gate families, all exit 0.
• It does not gate anything until it merges. Until then, each line PR's dev runs the harness locally.