feat(cli,runtime)!: 18.x step 6: open the upgrade ceremony for v17 and 18.0 databases (and the deferred flips) #24582

Activity

1. objectstack-fleet

   added

   priority:p1High: required for production / M2High: required for production / M2

   pm:blocked

   pm:epic

   domain:engineRetired 2026-10-22, alias of domain:server (engine surface); in-flight cards keep it until they landRetired 2026-10-22, alias of domain:server (engine surface); in-flight cards keep it until they land

   on Oct 19, 2026
2. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Epic seat (epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3) · 2026-10-19T14:31Z. Ordering of the 18.x line (ruling 6266750393), recorded so the unlock scan can read it:

   Blocked-by: #24581

   It also waits on the maintainer's ruling on Q3 of 6268559156 (how an 18.0 database is recognised).
3. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Epic seat (epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3) · 2026-10-19T14:43Z. The decision this card waited on is ruled, in record 6269955919 on #15194.

   The maintainer chose ① A, a birth marker, and on the field design replied 「同意」 and then 「同意shapeGeneration」. The guard writes the marker exactly once, on a datastore created from empty. It carries { shapeGeneration, platformVersion, commit, createdAt }, and the guard decides on shapeGeneration alone; it never compares versions. The ceremony's verified marker carries shapeGeneration too, and marker.shapeGeneration < current → refuse. That also closes F5.

   Remaining ordering:

   Blocked-by: #24581
4. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Epic seat (epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3) · 2026-10-19T14:48Z. Steps 5 and 6 now land together, as ONE merge. This follows the ruling that only complete features merge into main (#15194, posted just now, quoting 「…都不是开发了一半的，都是某个完整的功能」).

   One branch carries both: #24581's ceremony steps (5a–5d) and #24582's opening of the ceremony. They are reviewed part by part and merged once, when os migrate organization-ownership really upgrades v17 and 18.0 databases. That merge is likely Tier H by size, so the maintainer approves it. The step-5 card and the step-6 card close on that one landing.
5. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Claim: epic seat round · 2026-10-19T20:37Z
   Session: session_01Y5583bs2RDd53MH6kM1ca3
   Account: os-steve (the card's assignee)
   Branch: claude/issue-24581-ceremony-open (the same branch as #24581: one branch and one landing for steps 5 and 6, per ruling 6270035914; the full claim, with the file surface, is on #24581).
   Worktree: the cloud session's own checkout (mode:cloud)
   Domain: domain:engine
   Seat: epic:#15194 (the epic lane)
   Base, and an early start. Steps 2 and 3 have merged (#24590 b12e16a56, #24587 fbafb8533). Step 1, PR #24588, is green and clean, and waits only on the maintainer's approval. The maintainer's standing order is 「你正常开发就行，只要确保你合并进main的代码都不是开发了一半的」. So this branch starts from origin/main, merged with origin/claude/issue-24529-8b0g-webhooks-registry (#24588's head), because 5a needs the declared-webhook reader. ⛔ It lands only after #24588 and step 4 (#24580) have merged and this branch has merged main again.
   The rulings that unblock it:

   • Q3 (an 18.0 database is recognised by a birth marker): ruling 6269955919 ①A and its amendment. A birth marker {shapeGeneration, platformVersion, commit, createdAt} is written on a datastore created from empty. The guard decides on shapeGeneration alone. The ceremony's verified marker carries shapeGeneration too, and marker.shapeGeneration < current is refused (F5). Amend the migration.zod.ts prohibition accordingly.
   • Q4, 8e (5d): ruling 6269955919 ②A. The ceremony owns organization_id nullability. The schema differ does not flag it as drift, and no metadata changes.
     File surface, read at or after 14ccb1da9. The dev measures first; a breach stops the work and is explained in the report.
   • feat(cli): 18.x step 5: the upgrade ceremony steps behind the refusal (webhook re-source, sibling moves, 9c, 8e NOT NULL) #24581, 5a–5d, plus seat note 6271949316 in full:
     • 5a, webhooks: pristine-mirror deletion with deliveries re-sourced to declared:NAME; customized mirrors settled (an active-only edit becomes an activation row; any other edit becomes a clone under a new name, its deliveries re-sourced to the clone's id); orphaned mirror sys_secret ciphers reported or deleted; the mirror predicate aligned.
     • 5b, sibling moves: global audit rows by scope; identity mail, after draining or rewriting { rowId } send jobs and no-object reclaim jobs, with sys_activity rows re-pointed or deleted, and the magic-link selector gap defined first.
     • 5c: 9c (plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421).
     • 5d: 8e NOT NULL after the moves, per ②A.
     • Select by shape, never by NULL (F3).
   • feat(cli,runtime)!: 18.x step 6: open the upgrade ceremony for v17 and 18.0 databases (and the deferred flips) #24582: chore(cli)!: 18.x restore of the 18.0 guards — re-open the upgrade ceremony and walled boots #24489 items 1, 4 and 6; the sys_secret / sys_flow_credential tenant:false flips with their column-drops, and the settings writer stops stamping sys_secret; the boot guard's 18.0 verdict via the birth marker, plus the step-set check; the refusal text; the tenancy: { enabled: false } gap in the guard. R2 and R3 are restated in the harness, by name.
   • ⛔ Not docs/adr/**: the seat batches the ADR-0131 D7 notes into a Tier H ADR PR. ⛔ Not content/docs/releases/.
   • ⛔ Not step 4's surface (engine.ts walled lift, walledPostureRefusal).
   • ⛔ The identity-mail move must not widen the sys_email exposure measured on measure(plugin-email): who can list sys_email rows that carry identity mail (reset and verification links) — sys_email declares no requiredPermissions #24625. It is not a fix for it either.
     Container & model: L, mode:cloud, model: TIER_DEFAULT
     Clause-②: yes (the dev re-measures). Opening the ceremony widens what boots, and the flips narrow two tables.
     Responsibility: n/a. A ruled step of the line (6266750393, 6267391172, 6269955919, 6270035914 on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194).
     Thread-read: 6271949316
     Serial constraints cleared:
   • Step 4 (feat(objectql,cli)!: 18.x step 4: the walled lift (8b walled half plus the walled part of #24489) #24580) runs in parallel on its own branch. The two meet on serve.ts; whichever lands second merges main.
     Merge gate: the PR opens as a draft and is likely Tier H, so the maintainer approves it. It lands after feat(plugin-webhooks,runtime)!: declared webhooks are read from the registry, the seeder retires, and the activation ledger switches them (18.x step 1, 8b-0g′) #24588 and feat(objectql,cli)!: 18.x step 4: the walled lift (8b walled half plus the walled part of #24489) #24580, with the harness green on the merged tree and R2 and R3 restated.
6. objectstack-fleet

   added

   pm:dispatched

   and removed

   pm:blocked

   on Oct 19, 2026
7. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   os-dev-report pointer: steps 5 and 6 land as one PR, #24681 (ruling 6270035914). This card's items are covered by it: #24489 items 1, 4 and 6; the sys_secret and sys_flow_credential flips with their column-drops; the guard's birth marker and shapeGeneration verdict, plus the step-set check (F5); the refusal text; and the tenancy:{enabled:false} gap. R2 and R3 are restated by name in upgrade-18x-harness.dogfood.test.ts, 8/8 green. The full report is on #24581.

   ---

   Generated by Claude Code
8. os-zhuang

   closed this as completedin #24681on Oct 20, 2026
9. objectstack-fleet commented on Oct 20, 2026

   

   objectstack-fleetBot

   on Oct 20, 2026

   ContributorAuthor

   More actions

   Landed · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-20T07:43Z. PR #24681 (steps 5+6, one landing for #24581 and #24582) has merged as 12d14765c.

   reading	value
   contract review	CONTRACT_REVIEW_TIER. FAIL 6279650792 at 02321084f (B1: Turso remote birth marker; B2: closed-ceremony text), then PASS 6284464125 at b5010d9c0
   last head	c6f775cbd, text, pins and changesets only; in-seat check PASS, addendum 6285186426
   tier	H and governed (.github/workflows/lint.yml, 5,078 changed lines). APPROVED by the maintainer at 07:04Z, who also marked it ready and enabled auto-merge
   Check Changeset	red by design (#17712, DELIBERATE CORRECTION) on ten pending notes. The maintainer confirmed them with the approval; the list is in 6285186426
   R1–R4	dev re-runs on the head: harness and refusal-order 12/12, the #24688 matrix 25/25, walled e2e 7/7, check:generated 14/14

   Delivered.

   • The upgrade ceremony is open. os migrate organization-ownership --out PLAN, then --apply --plan-file PLAN --backup-taken, upgrades a database that 17.x or an 18.0 pre-release created. Its steps:
     • webhook re-source;
     • the settings-audit and identity-mail sibling moves;
     • 9c's sharing-rule copies;
     • attribution;
     • 8e's NOT NULL, under ② A.
   • The boot guard.
     • It writes a birth marker on a datastore created from empty, on the local, embedded and Turso remote faces.
     • It serves only a database it created or one the ceremony certified. It decides on shapeGeneration alone (① A).
     • It refuses everything else and names the two ceremony steps.
   • sys_secret and sys_flow_credential declare systemFields: { tenant: false }. Step 4's bridge is deleted.
   • No shipped text says the ceremony is closed. A new gate, check:closed-ceremony-text, holds that.

   Carried.

   • Step 7 (refactor(drivers,objectql,plugin-security)!: 18.x step 7: retire the organization-less readers (8c), COALESCE and __global__ (8d), and steps 1–3's dual reads #24583) is in flight in six parts: 7a-1, 7a-2, 7a-3, 7b-0, 7b-3 and 7c. 7b-1+7b-2 follow 7b-0. Each part merges main now.
   • The ADR notes PR (Tier H):
     • ADR-0131's release-scope note (817-830);
     • D9 against the engine's no-organization-object exit;
     • the D7 dated notes.
   • The harness fixture. fixture-18.0 stays as the pre-ceremony shape. A fixture from the 18.0.0 tag is added once that tag exists.
   • Release timing: 18.0.0 publishes after step 7 (6282882793).

   Both cards close completed. The dev session is archived.
10. objectstack-fleet

    removed

    pm:dispatched

    on Oct 20, 2026