v18 upgrade ceremony refuses every cloud database: the inventory gives cloud-provided tables no fate on the premise that cloud stays on v17 — a host needs to declare fates for its own objects #23280

Blocked-by: #23034

Filed by the repo:cloud#1 seat (seat post #6026, session session_01WVbr5J6u8BHh8EyFtcWciH). Source: the cloud upgrade rehearsal objectstack-ai/cloud#2867 6147243232 (item I10), measured with the v18 CLI at 01a3421f42 on copies of a v17 cloud control database and tenant database. It blocks cloud's v18 upgrade (objectstack-ai/cloud#2709), so it is filed priority:p1, target:v18.

What happens

os migrate organization-ownership (the plan, read-only) refuses on both database kinds:

✗ Refused (ai_agent_memories): ai_agent_memories carries organization_id but the ADR-0131 D10 inventory gives it no fate. The plan refuses rather than guess one.

• The control database holds 23 tables with organization_id and no inventory row: sys_billing_* ×7, sys_quota_usage, sys_domain, sys_slug_reservation, sys_cloud_connection, sys_ai_credit_grant, sys_environment_usage, sys_environment_revision, and ai_* ×8.
• A tenant database holds 11: ai_* ×8, sys_env_artifact_cache, sys_seed_replay and sys_seed_replay_claim.
• The cloud-supplement rows that are listed carry fate 4, cloudCarried. packages/cli/src/utils/organization-ownership-inventory.ts:177-179 says why: "Cloud stays on v17 (ruling record 6094175435): no v18 ceremony runs against a cloud database, so the row is listed, never given a guessed fate; C10 assigns it when cloud moves."

Why that premise no longer holds

• The clear is withdrawn. The maintainer, 2026-10-13: 「我没有要求清库…以后不可能每次升级都清库」 (objectstack-ai/cloud#2843 6145481762).
• Ruling objectstack-ai/cloud#2866 A (6146394952): cloud's tenant databases are migrated by this ceremony.
• The control plane is cloud's own migration (objectstack-ai/cloud#2863 A).

So the ceremony must run on cloud's tenant databases, and it cannot while cloud's tables have no fate.

Ask

A way for the host to declare the fates of its own objects, read by the ceremony. Examples: fates on the host's object definitions, or a host supplement the CLI loads. Cloud then declares them, which is the C10 stage named in the inventory: cloud's tenant-database tables first, and the control-plane tables if the lane wants one mechanism for both.

• ⛔ No guessed fate inside objectstack for a cloud table. The inventory's own rule stands.
• It also gates the organization-layer view promotion. The rehearsal measured that views saved through the v17 /meta door sit in the retired organization layer and answer 404 at v18 (I8), and the ceremony's organization-presentational-promotion carries them only once it can run.

Related: #15211 · #23034 · objectstack-ai/cloud#2868 (cloud's orchestration) · #23269 · #23270 · #23271.

Generated by Claude Code