feat(spec,auth)!: one declared audience posture for self-registration — invite_only|email_domain|open, default invite_only

[os-zhuang]

Fixes #11739
Part of #11723

One declared audience posture answers "who may become a user of an environment's apps": a closed vocabulary invite_only | email_domain | open, default invite_only when undeclared (maintainer ruling on the epic, 2026-08-24 — no legacy/undeclared limbo), one decision owner on the creation path, and every invariant enforced where it is declared. Ships as a minor changeset per the launch-window rule (check:changeset-no-major), with the ADR-0087 semantic migration audience-posture-default-invite-only registered (the rest-requireauth-default-flip class: a secure-default flip no transform can decide).

Contract published for the blocked cloud consumer (objectstack-ai/cloud#1649)

• Field shape and name — authorable key audience on AuthConfig (packages/spec/src/system/auth-config.zod.ts, exported from @objectstack/spec/system as AudienceConfigSchema / AudienceConfig):
  • audience.posture — enum, default invite_only.
  • audience.allowedEmailDomains — string array; required non-empty for email_domain, refused under any other posture (ADR-0078 inert-declaration refusal). Bare hostnames only, at least one dot, no wildcard.
  • audience.selfRegistrationPermissionSet — sys_permission_set name; required whenever the posture permits self-registration (email_domain / open), refused under invite_only, and admin_full_access is always refused.
  • Authorable-surface manifests carry system/AuthConfig:audience and the system/AudienceConfig:* keys, with the invite_only default recorded in authorable-defaults.
• Vocabulary values — invite_only, email_domain, open; runtime value list AUDIENCE_POSTURES plus guards isAudiencePosture() and audiencePermitsSelfRegistration() (all exported from @objectstack/spec/system).
• Error codes (ADR-0112 ledger, @objectstack/plugin-auth entry) — all surfaced as HTTP 403 with the code in the body; browser OAuth flows redirect to the error URL carrying the same code:
  • SELF_REGISTRATION_CLOSED — a valid posture closed self-registration (no pending invitation for the address).
  • EMAIL_DOMAIN_NOT_ALLOWED — posture email_domain, address's domain off the allowlist.
  • AUTH_CONFIG_ERROR (pre-registered) — the audience configuration itself is unusable at admission time (off-vocabulary posture smuggled past entry, or the declared permission set cannot be resolved). Deliberately distinct from "policy said no" (the finding(auth): reconcileMembership 与 backfillMemberships 对「词表外的 policy」判断相反 —— 一个 fail-open，一个 fail-safe #5205 lesson).
• Accessor cloud should read/write — AuthManager.getAudience() is the ONE live read (the getMembershipPolicy() pattern: the enforcement gate, the forced-verification wiring and the public config all read it). Cloud writes the posture by passing audience in the AuthPlugin/AuthManager config at kernel construction (AuthManagerOptions extends Partial of AuthConfig, so the key already flows), and may switch it live via AuthManager.applyConfigPatch({ audience: ... }) — the patch replaces the whole audience object and is validated as a merged result (an invalid patch throws and the standing config keeps ruling). Effective posture is observable per env on GET /api/v1/auth/config as features.audiencePosture (registered beside tenancyPosture in PUBLIC_AUTH_CONFIG_NON_FLAG_KEYS).
• Backfill note — since undeclared already IS invite_only, backfilling existing envs is semantically a no-op at the framework layer; writing an explicit audience: { posture: 'invite_only' } per env is still worthwhile for auditability, and the switch surface should write the full object (posture + domains + permission set) in one stroke.

What enforcement looks like

• One decision owner: decideAudienceAdmission() in packages/plugins/plugin-auth/src/audience-posture.ts (pure — the test matrix drives it as a table). Wired at better-auth 1.7.1's own admission seam, user.validateUserInfo, which internalAdapter.createUser invokes for every creation path with a method-discriminated source (measured against the installed dist: email-password, oauth, sso-oidc/sso-saml, magic-link, email-otp, phone-number, anonymous, admin, scim), failing closed by vendor construction.
• Creation classes (the SSO JIT determination the dispatch asked for, stated explicitly): admin and scim are operator class — never posture-gated; sso-oidc / sso-saml and oauth whose providerId is a configured oidcProviders entry (enterprise SSO, incl. the cloud platform IdP whose OP side already enforces app-assignment per D5.1) are provider class — never posture-gated, because registering an IdP is a platform-admin-only operator act (finding: the direct /sso/register endpoint's ADR-0024 before-hook admits org owners/admins — wider than the platform-admin posture #9653 landed on the /admin/sso/* bridges #10009) and the closed vocabulary could not otherwise express the standard enterprise combo "self-registration closed + IdP JIT on" (gating it would brick every SSO-enforced deployment's entire user base). Social-provider OAuth (socialProviders) is self-serve — a public IdP account is not an operator act — as is every unrecognized method (fail closed).
• Invitation carve-out: a pending, unexpired sys_invitation for the address admits its self-serve sign-up under every posture (and trumps the domain list — an invited external contractor must not dead-end). Without it, invite_only would kill the invitation surface for brand-new users, since better-auth's accept-invitation requires an existing account.
• Bootstrap bypass: zero users ⇒ admitted (mirrors the disableSignUp bypass — a fresh install must never lock its operator out).
• Sign-up route raise: the same decision is additionally raised in the /sign-up/email before-hook because the vendor's anti-enumeration shield (shouldReturnGenericDuplicateResponse, dist/api/routes/sign-up.mjs lines 163/235) converts any 403 from the creation seam into a synthetic 200 whenever requireEmailVerification is on — measured: with posture open/email_domain the refusal came back 200 token null with a synthetic user. An audience refusal is deterministic per (posture, domain, invitation) and reveals nothing about any account, so surfacing it is not an enumeration oracle. The validateUserInfo gate stays wired for that route too; the decision is idempotent, so the two asks cannot disagree.
• Invariants: any self-registration-permitting posture forces requireEmailVerification on (explicit false beside it is refused at config entry — constructor AND applyConfigPatch; getPublicConfig() mirrors the forced value so the advertised flag cannot disagree with the wired one); email_domain requires a non-empty, well-formed, duplicate-free domain list; the declared self-registrant permission set must resolve to an active sys_permission_set row at admission time — a dangling declaration refuses admission (AUTH_CONFIG_ERROR) rather than admitting an ungranted user, and an admitted self-registrant really receives the set (sys_user_permission_set row, org-scoped to the same target org the membership reconciler resolves; a failure to land it is reported at durability level with consequence + fix).
• Pinned domain matching (the rules are stated and test-locked, per the card): domain = everything after the LAST at-sign, lowercased; case-insensitive exact per-entry equality; subdomains NOT implied in either direction; plus-tag local parts irrelevant; no punycode/IDN normalization (declare the form addresses carry).

Breaking behaviour and its migration

FROM: undeclared config meant open email/password self-registration with no verification, self-registrants implicitly on member_default. TO: undeclared IS invite_only. One-line fix for deployments that mean to stay open is in the changeset and in the registered ADR-0087 entry (declare audience.posture: 'open' plus selfRegistrationPermissionSet). Operator lanes (admin create/import, SCIM, enterprise IdP JIT, invitations) are unaffected under every posture. In-repo fixture fallout was triaged accordingly: harness suites now create non-first fixture users through the invitation carve-out (audience-gate-test-support.ts) — the real admission lane, chosen over an open fixture posture because open forces verification and would stop sign-up from minting the sessions those suites exercise.

File surface — declared expansions beyond the card's named globs

The card named packages/spec/src/system/** (+ authorable-surface manifests), packages/plugins/plugin-auth/src/**, packages/platform-objects/src/** (unused — the permission-set predicate landed in plugin-auth, where the enforcement point lives). Also touched, each mechanically forced and declared here rather than silent:

• packages/spec/src/api/error-code-ledger.zod.ts — the card requires the two codes REGISTERED; the ledger is the registration.
• packages/spec/src/kernel/public-auth-features.ts — audiencePosture non-flag booking; the dispatch prompt names this file (the fix(platform-objects,spec): surface the email-invite entry on the org page default Members tab #11562 motion).
• packages/spec/src/migrations/entries/semantic/18.audience-posture-default-invite-only.ts + regenerated registry.ts — the ADR-0087 disposition the declared-breaking changeset must carry.
• Regenerated artifacts: packages/spec/{api-surface,authorable-surface,authorable-defaults,export-origins,json-schema.manifest}/system.json, content/docs/references/**, docs/audits/2026-07-unknown-key-strictness-ledger.counts.md, scripts/engine-double-contract.pinned.json (coverage ledger, --write after the new pinned double).
• .changeset/audience-posture-invite-only-default.md.

Verification (all at the head this PR points at, 38e5fea48; tree clean)

Every heavy command ran through scripts/pm/os-verify-lock.sh, which printed its lock-unusable verdict on this macOS host (no util-linux flock): declared narrowing — verification ran UNLOCKED, no serialization guarantee held. Verdict lines quoted from the runs:

• pnpm --filter @objectstack/plugin-auth test — Test Files 75 passed (75) / Tests 1559 passed (1559); union re-run at 38e5fea48 ended VERDICT command-exit 0 · UNLOCKED (declared).
• pnpm --filter @objectstack/spec typecheck + targeted spec suites (src/system src/api src/kernel src/migrations + the type-alias pin) — Test Files 128 passed (128) / Tests 3597 passed (3597).
• pnpm --filter @objectstack/spec check:generated — ✓ all 14 artifact gates (api-surface, authorable-surface, docs, spec-changes, upgrade-guide, migration-registry, strictness-ledger included).
• Full-workspace pnpm build --concurrency=2 (129 tasks), pnpm typecheck --concurrency=2 — Tasks: 129 successful, 129 total, and full pnpm lint (eslint . --no-inline-config, exit 0 in 32s — full run, no narrowing).
• The 40 path-derived gates from node scripts/pm/dispatch-gates.mjs (derivation stderr named this tree at 38e5fea48): 39 green. One environmental red, declared: pnpm check:objectui-changeset's self-test cannot run on this host (its bump-objectui.sh uses mapfile, absent from macOS bash 3.2 — status 127 in the self-test harness, not a verdict about this diff; the gate matched only because a changeset file was added). CI runs it on Linux.
• check-engine-double-contract — green, 385 (file, verb) row(s) held by the RETAINED ledger (+2 rows for the new double); check-error-code-casing, check-nul-bytes — green; check-adr-0087-registration — 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.

CI convergence is the PM's read per the dispatch contract; gate states at report time are as above.

---

Follow-up round (#11767 CI red): the declared bootstrap bypass did not actually fire

The first CI run on this branch turned two required gates red — Dogfood Regression Gate (all three shards) and Test Core (shards 1/6 and 2/6). One line explains all of them:

INFO [audience] self-registration refused by posture {"code":"SELF_REGISTRATION_CLOSED","method":"email-password","posture":"invite_only"}
WARN [auth] dev admin seed skipped: Self-registration is closed on this environment (audience posture invite_only). Ask an administrator for an invitation.

decideAudienceAdmission was correct — the WIRING behind isBootstrap was not, and nothing pinned it.

Root cause, measured at the real seam (not reasoned)

isBootstrapCreation probed ctx.context.adapter.findOne({ model: 'user', where: [] }). Instrumenting that exact call inside a real dogfood boot showed the adapter is present and the probe still does not answer — it throws:

OSPROBE adapter=true findOne=function
OSPROBE adapter.findOne THREW: findOne('sys_user') selects no particular record: 'where' is absent or empty
  and the query carries no 'orderBy'. ... (#4419)
  at _ObjectQL.requireFindOnePredicate (packages/objectql/src/engine.ts:8408)
OSPROBE engine sys_user rows=[]

where: [] lowers to an empty filter and requireFindOnePredicate (#4419) refuses a findOne that selects no particular record rather than return an arbitrary row. The surrounding catch { return false; } read that refusal as "users exist", so every bootstrap creation was judged non-bootstrap. The last line is the proof it was a false verdict: zero rows, read through the very path the fix now uses.

The in-memory engine double the #11739 matrix runs on has no such guard — an absent filter matches everything and returns null on an empty table — which is why 75 green plugin-auth files and a full posture x method matrix said nothing about it.

The fix

• isBootstrapCreation asks the question in a form that can be ANSWERED: a bounded find through withSystemReadContext, the same ctx-independent data path hasPendingInvitationFor uses one frame away. The posture's ruled semantics and the fail-closed floor are untouched — an unanswerable probe still reads as NOT bootstrap. None of the rejected shapes (exempting the harness at its own seam, a harness-declared open, an empty-environment default) is used.
• The population predicate is HUMANS, not rows, and is now owned once. isHumanUserRow (audience-posture.ts) is the single spelling, read by the gate AND by the dev-admin seed's own precondition, which had hand-spelled the same filter. They must agree: on a database still carrying the legacy usr_system service row, an any-row predicate would have plugin-security announcing "no human users yet — first sign-up will be promoted to platform admin" while the gate refused that very sign-up. The filter runs in JS because a store-side role != 'system' drops NULL-role rows under SQL three-valued logic — the direction that fails open.
• The sibling disableSignUp bootstrap bypass carried the identical dead probe and now routes through the same helper. Same defect class, same file, mechanical, one guard closing the whole class — declared here rather than left as a known-inert guard.
• @objectstack/verify's harness signUp enters through the invitation carve-out. Once the dev-admin seed was unblocked, the next wall was the harness's own second/third fixture identity — the population invite_only closes. Same lane, and the same two reasons, as audience-gate-test-support.ts: open/email_domain force verification on and would stop sign-up minting the token the helper returns, and the invitation lane keeps the gate honestly on the path.

The regression test is at the seam, and the ablation says so

packages/plugins/plugin-auth/src/audience-bootstrap-seam.test.ts — a REAL ObjectQL over @objectstack/driver-sql + better-sqlite3 :memory:, driving api.signUpEmail({ body }), the server-side lane the dev seed actually calls. Case 0 asserts the #4419 refusal itself, so the reason a fake engine cannot pin this is under test rather than asserted in prose; case 3 is the control that the bypass did not become "always admit"; case 4 pins the humans-not-rows decision on a usr_system-only database; case 5 pins the disableSignUp sibling.

Ablation (fix committed first; script self-restoring via trap): reverting ONLY isBootstrapCreation's body to the pre-fix adapter probe. Mutation confirmed on disk before the run — injected marker 1 (want 1), deleted BOOTSTRAP_USER_PROBE_LIMIT, 0 (want 0), restored where: [] 1 (want 1). Result Tests 5 failed | 1 passed (6), with case 0 green as predicted (it measures the engine, not the gate). The ablated failure text is byte-identical to the CI log line:

AssertionError: the operator's own first account was refused: Self-registration is closed on this
environment (audience posture invite_only). Ask an administrator for an invitation.

Restore leg verified: injected-marker count back to 0, fixed-form count back to 1, git status --porcelain empty. The mutated subject is same-package source resolved by vitest from src/, so no dist/ staleness is in play for either leg.

Verification for this round (all at 02580fba1, tree clean)

Same declared narrowing as above — every heavy command went through scripts/pm/os-verify-lock.sh, which reports NO USABLE flock on this macOS host: verification ran UNLOCKED (declared); nothing was serialized. Verdict lines quoted from the runs:

• pnpm --filter @objectstack/plugin-auth test — Test Files 76 passed (76) / Tests 1567 passed (1567).
• pnpm --filter @objectstack/plugin-auth typecheck — VERDICT command-exit 0 (the first run caught a real TS6133 on the now-unread ctx parameter; fixed).
• pnpm --filter @objectstack/verify test — Test Files 9 passed (9) / Tests 40 passed (40); typecheck VERDICT command-exit 0.
• pnpm --filter @objectstack/dogfood test — Test Files 126 passed | 1 skipped (127) / Tests 932 passed | 3 skipped (935). The same command reproduced the CI red on this host before the fix (org-create-default-team red in 7s with the refusal line).
• The three previously-red Test Core (1/6) CLI e2e files (serve-mcp-capability-collision, serve-mcp-stdio-answers, serve-stdio-stdout-purity) — Test Files 3 passed (3).
• pnpm lint (eslint . --no-inline-config) — full repo run, VERDICT command-exit 0 in 31s. No narrowing.
• pnpm --filter @objectstack/spec check:generated — ✓ All 14 generated artifacts are up to date.
• Re-derived families for the ACTUAL diff (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, stderr naming this tree at 3296e3096): check:cross-package-test-inputs OK: 16 package(s) read outside themselves, all declared; check:test-source-alias OK — 72 packages with tests scanned; check:engine-double-contract OK — 405 pinned, 133 in the DEBT ledger, 2 exempt; check-nul-bytes OK (scanned 6656 text file(s)); check-changeset-fixed / check-empty-changeset / check-changeset-no-major / check-adr-0087-registration all green.

Out of scope, filed rather than fixed here

plugin-security/src/bootstrap-platform-admin.ts carries a third hand-spelled copy of the same human-user predicate. Consolidating it needs the predicate to move to a package both plugins depend on (plugin-security does not depend on plugin-auth), which is a spec/api-surface change this PR should not carry.

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/plugin-auth, @objectstack/spec, @objectstack/verify, touching 82 documentable anchor(s). ⚠️ 5 changed file(s) yielded no anchor (packages/spec/api-surface/system.json, packages/spec/authorable-defaults/system.json, packages/spec/authorable-surface/system.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

21 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 3689991d2e67f80faacc6c38233e83593a22202c.

⛔ 7 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 5 changed file(s) yielded no anchor (packages/spec/api-surface/system.json, packages/spec/authorable-defaults/system.json, packages/spec/authorable-surface/system.json, …) — pages documenting those are invisible to this run
• 10 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 45 of 222 client-bound route-ledger rows — the other 177 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 131 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 3689991d2e67f80faacc6c38233e83593a22202c → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 719eefecc9034bc58f47c489a1341ed5062f2cec — the merge of head 02580fba14f6ed85b8fa509c7d16472ef46ab111 into base 3689991d2e67f80faacc6c38233e83593a22202c, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 719eefecc9034bc58f47c489a1341ed5062f2cec && git checkout 719eefecc9034bc58f47c489a1341ed5062f2cec
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 3689991d2e67f80faacc6c38233e83593a22202c 02580fba14f6ed85b8fa509c7d16472ef46ab111 && git checkout -B drift-repro 3689991d2e67f80faacc6c38233e83593a22202c && git merge --no-ff 02580fba14f6ed85b8fa509c7d16472ef46ab111

node scripts/docs-audit/affected-docs.mjs --json 3689991d2e67f80faacc6c38233e83593a22202c

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 3689991d2e67f80faacc6c38233e83593a22202c → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-zhuang]

Synced onto current main — CI now runs, and it has something to say

@os-sam — closing the loop you opened on the zero-CI reading. Your measurement held: the
head you read really had never been built. It has now, and the farm found a required-gate
red that nobody could have seen before.

⛔ Nothing here changes the reviewed behaviour: the branch's delta against origin/main is
still exactly the 39 paths / 2082 insertions / 33 deletions it was before the sync.
Left as draft; no label, no ready flip, no queue action.

What was synced

origin/main was merged into the branch (never rebased, never force-pushed). The base
had drifted 90 commits, and the diff crosses the whole os-regen artifact family
(api-surface/, authorable-surface/, authorable-defaults/, export-origins/,
json-schema.manifest/, content/docs/references/**, the strictness ledger) plus
src/migrations/registry.ts and the error-code ledger.

scripts/pm/os-regen-merge.sh cannot run on this macOS host (bash 3.2 has no mapfile), so
its documented order was executed by hand: merge, take origin/main's side of every
merge=os-regen path, commit the merge, then regenerate wholesale on the merged tree.

The zero-conflict merge was not taken as evidence — the artifacts were reset to main's
side and regenerated from scratch, and the regeneration reproduced eight of the ten
byte-identically while resolving the two the driver had deferred. Ledger entries from both
sides survive: audience-posture-default-invite-only (this branch),
field-master-detail-set-null-refused,
ui-cloud-connection-widgets-unknown-keys-refused, ui/PageComponent:responsive and the
ResponsiveConfig retired defs (main's).

CI reading — positive-controlled, same window

head	reading
38e5fea48 (old head, your measurement)	total_count: 0 — still 0
23af75116 (new head)	total_count: 29
PR #11929 head 96c7644f4 (control)	total_count: 37

So the instrument was never broken and the drift was the whole story: the same call that
read 0 on the stale head reads 29 on the synced one.

⚠️ What the first-ever run found — one root cause, four reds

Not a merge artifact, and not something this sync introduced: it is the PR's own default
flip meeting the composed runtime for the first time.

INFO [audience] self-registration refused by posture
     {"code":"SELF_REGISTRATION_CLOSED","method":"email-password","posture":"invite_only"}
WARN [auth]     dev admin seed skipped: Self-registration is closed on this environment
                (audience posture invite_only). Ask an administrator for an invitation.
...
Error: verify signIn failed: 401 {"message":"Invalid email or password","code":"INVALID_EMAIL_OR_PASSWORD"}

The @objectstack/verify harness seeds its admin through self-registration, which the
new invite_only default now refuses; every downstream signIn then 401s. It cascades to:

• Dogfood Regression Gate (1/3, 2/3, 3/3) — required
• Test Core (2/6) (@objectstack/verify's own suite) — required
• Dogfood Verify CLI — advisory

Build Core, Temporal Conformance (live PG + MySQL) and Type Check · source gates are
green; Lint & Repo Gates and the remaining shards were still running at the time of
writing.

Both the harness seed path and Dogfood Verify CLI are green on origin/main (0e5bea612)
and on control PR #11929 in the same window, so the signal is this diff's, not the base's.

Fixing it means changing behaviour on an already-ACCEPTed diff, which is outside this
sync's remit — flagging it for the owning seat rather than touching it. The shape of the
remedy is a decision, not a mechanical fix: either the dev/CI admin seed is exempted from
the posture at its own seam, or the harness declares audience.posture explicitly.

Local verification on the synced head

• pnpm --filter @objectstack/plugin-auth test — Test Files 75 passed (75) · Tests 1561 passed (1561)
• pnpm --filter @objectstack/spec test — Test Files 420 passed | 4 skipped (424) · Tests 11263 passed | 22 skipped (11285)
• pnpm --filter @objectstack/spec check:generated — ✓ All 14 generated artifacts are up to date.
• pnpm --filter @objectstack/spec typecheck / pnpm --filter @objectstack/plugin-auth typecheck — both clean
• node scripts/check-changeset-no-major.mjs — ✓ This diff introduces no major bump.
• node scripts/check-adr-0087-registration.mjs — ✓ 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.
• pnpm check:merge-driver, check:engine-double-contract, check:error-code-casing, check:nul-bytes, check-empty-changeset — all exit 0

The unit suites pass precisely because they exercise the gate in isolation; the breakage
lives at the composed-runtime seam, which is the half only CI boots.

Declared narrowing — verification ran UNLOCKED. scripts/pm/os-verify-lock.sh could not
take the shared verify lock on this host: no usable flock. The shared verify lock is
declared Linux-only (flock is util-linux, and a stock macOS does not ship it), so the
commands above ran directly, without the lock — a declared narrowing, not a silent one. No
serialization guarantee held for those runs.

Generated by Claude Code