fix(plugin-auth): report the zero-account boot dead end at kernel:ready

.changeset/auth-no-sign-in-account-boot-report.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+Report the zero-account boot dead end at `kernel:ready` (#14353)
+
+A deployment holding human `sys_user` rows and zero `sys_account` rows cannot
+be recovered from inside, and until now it booted silently. Nobody can sign in;
+the first-account bootstrap carve-out counts humans, and humans exist, so it
+does not open; the default `invite_only` audience posture refuses
+self-registration; and no administrator exists who could send an invitation.
+The only symptom was a 401 on credentials nobody holds.
+
+That state is now reported at `kernel:ready` at `error` level, under the name
+`no_sign_in_account_at_boot`, naming both the consequence (the deployment will
+keep looking healthy and cannot be recovered from inside) and the remedy
+(provision an account out of band, or open the audience posture).
+
+⛔ No admission semantics change. Whether the carve-out should count humans or
+logins was ruled on 2026-09-02 (option A — the door does not move); this only
+reports.
+
+The check extends the existing `kernel:ready` walled-owner reporter rather than
+opening a parallel one: it shares that hook, and the bounded human-population
+page is read ONCE per boot and handed to `probeWalledOwnerAccountState`, so no
+deployment pages `sys_user` twice. At most one report is emitted per boot — a
+deployment matching both shapes gets this error, and the walled-owner warning
+is suppressed rather than stacked on top of it.

content/docs/permissions/system-context.mdx

@@ -97,7 +97,7 @@ that silently does not happen.
 | 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3857` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
-| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1380` |
+| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1405` |
 | 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
 | 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -78,6 +78,10 @@ import {
  warnIfWalledOwnerCannotVerify,
  type WalledOwnerAccountState,
 } from './walled-owner-verification-path.js';
+import {
+ probeSignInReachability,
+ reportIfNoSignInAccountExists,
+} from './boot-sign-in-reachability.js';
 import { judgePlatformAdmin, isPlatformAdminUser, type PlatformAdminActor } from './platform-admin-gate.js';
 import {
  runAdminBanUser,
@@ -1036,21 +1040,42 @@ export class AuthPlugin implements Plugin {
  // hook below (registration order), so the probe reads the pre-seed
  // store — the predicate's dev-seed clauses are written for exactly
  // that reading.
+ let ql: IDataEngine | undefined;
+ try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
+
+ // [#14353] "Can ANYONE sign in?" — asked UNCONDITIONALLY, because it is
+ // independent of all four preconditions below: a deployment that is
+ // unwalled, or declares no owner, or wires an email transport is just as
+ // unrecoverable when it has human rows and no `sys_account` row. This is
+ // the family's ONE store read: the human-population page is paged here
+ // and the answer handed to the walled-owner probe, so no boot pages
+ // `sys_user` twice. Cost on a fresh store is a single bounded page.
+ const reachability = await probeSignInReachability(ql);
+ const deadEnd = reportIfNoSignInAccountExists(reachability, ctx.logger);
+
  let ownerAccountState: WalledOwnerAccountState = 'unknown';
  if (
  !hasEmailTransport &&
  !hasFederatedSignIn &&
  postureEnforcesWall(resolveTenancyPosture()) &&
  resolvePlatformOwnerEmail()
  ) {
- let ql: IDataEngine | undefined;
- try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
- ownerAccountState = await probeWalledOwnerAccountState(ql);
+ ownerAccountState = await probeWalledOwnerAccountState(ql, {
+ humanUsers: reachability.humanUsers,
+ });
+ }
+ // [#14353] ONE report per boot. A deployment can match both shapes at
+ // once (no accounts AND a declared owner that cannot verify); the
+ // no-sign-in error strictly subsumes the walled-owner warning there —
+ // an owner who cannot reach platform-admin standing is moot when nobody
+ // can sign in at all — so the warning is suppressed rather than stacked
+ // on top of it. When the error did not fire, the warning is untouched.
+ if (!deadEnd) {
+ warnIfWalledOwnerCannotVerify(
+ { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
+ ctx.logger,
+ );
  }
- warnIfWalledOwnerCannotVerify(
- { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
- ctx.logger,
- );
  });
 
  // Dev-only: provision a known, loginable platform admin on an empty DB.

.changeset/auth-no-sign-in-account-boot-report.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+Report the zero-account boot dead end at `kernel:ready` (#14353)
+
+A deployment holding human `sys_user` rows and zero `sys_account` rows cannot
+be recovered from inside, and until now it booted silently. Nobody can sign in;
+the first-account bootstrap carve-out counts humans, and humans exist, so it
+does not open; the default `invite_only` audience posture refuses
+self-registration; and no administrator exists who could send an invitation.
+The only symptom was a 401 on credentials nobody holds.
+
+That state is now reported at `kernel:ready` at `error` level, under the name
+`no_sign_in_account_at_boot`, naming both the consequence (the deployment will
+keep looking healthy and cannot be recovered from inside) and the remedy
+(provision an account out of band, or open the audience posture).
+
+⛔ No admission semantics change. Whether the carve-out should count humans or
+logins was ruled on 2026-09-02 (option A — the door does not move); this only
+reports.
+
+The check extends the existing `kernel:ready` walled-owner reporter rather than
+opening a parallel one: it shares that hook, and the bounded human-population
+page is read ONCE per boot and handed to `probeWalledOwnerAccountState`, so no
+deployment pages `sys_user` twice. At most one report is emitted per boot — a
+deployment matching both shapes gets this error, and the walled-owner warning
+is suppressed rather than stacked on top of it.

content/docs/permissions/system-context.mdx

@@ -97,7 +97,7 @@ that silently does not happen.
 | 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3857` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
-| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1380` |
+| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1405` |
 | 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
 | 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -78,6 +78,10 @@ import {
  warnIfWalledOwnerCannotVerify,
  type WalledOwnerAccountState,
 } from './walled-owner-verification-path.js';
+import {
+ probeSignInReachability,
+ reportIfNoSignInAccountExists,
+} from './boot-sign-in-reachability.js';
 import { judgePlatformAdmin, isPlatformAdminUser, type PlatformAdminActor } from './platform-admin-gate.js';
 import {
  runAdminBanUser,
@@ -1036,21 +1040,42 @@ export class AuthPlugin implements Plugin {
  // hook below (registration order), so the probe reads the pre-seed
  // store — the predicate's dev-seed clauses are written for exactly
  // that reading.
+ let ql: IDataEngine | undefined;
+ try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
+
+ // [#14353] "Can ANYONE sign in?" — asked UNCONDITIONALLY, because it is
+ // independent of all four preconditions below: a deployment that is
+ // unwalled, or declares no owner, or wires an email transport is just as
+ // unrecoverable when it has human rows and no `sys_account` row. This is
+ // the family's ONE store read: the human-population page is paged here
+ // and the answer handed to the walled-owner probe, so no boot pages
+ // `sys_user` twice. Cost on a fresh store is a single bounded page.
+ const reachability = await probeSignInReachability(ql);
+ const deadEnd = reportIfNoSignInAccountExists(reachability, ctx.logger);
+
  let ownerAccountState: WalledOwnerAccountState = 'unknown';
  if (
  !hasEmailTransport &&
  !hasFederatedSignIn &&
  postureEnforcesWall(resolveTenancyPosture()) &&
  resolvePlatformOwnerEmail()
  ) {
- let ql: IDataEngine | undefined;
- try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
- ownerAccountState = await probeWalledOwnerAccountState(ql);
+ ownerAccountState = await probeWalledOwnerAccountState(ql, {
+ humanUsers: reachability.humanUsers,
+ });
+ }
+ // [#14353] ONE report per boot. A deployment can match both shapes at
+ // once (no accounts AND a declared owner that cannot verify); the
+ // no-sign-in error strictly subsumes the walled-owner warning there —
+ // an owner who cannot reach platform-admin standing is moot when nobody
+ // can sign in at all — so the warning is suppressed rather than stacked
+ // on top of it. When the error did not fire, the warning is untouched.
+ if (!deadEnd) {
+ warnIfWalledOwnerCannotVerify(
+ { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
+ ctx.logger,
+ );
  }
- warnIfWalledOwnerCannotVerify(
- { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
- ctx.logger,
- );
  });
 
  // Dev-only: provision a known, loginable platform admin on an empty DB.

.changeset/auth-no-sign-in-account-boot-report.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+Report the zero-account boot dead end at `kernel:ready` (#14353)
+
+A deployment holding human `sys_user` rows and zero `sys_account` rows cannot
+be recovered from inside, and until now it booted silently. Nobody can sign in;
+the first-account bootstrap carve-out counts humans, and humans exist, so it
+does not open; the default `invite_only` audience posture refuses
+self-registration; and no administrator exists who could send an invitation.
+The only symptom was a 401 on credentials nobody holds.
+
+That state is now reported at `kernel:ready` at `error` level, under the name
+`no_sign_in_account_at_boot`, naming both the consequence (the deployment will
+keep looking healthy and cannot be recovered from inside) and the remedy
+(provision an account out of band, or open the audience posture).
+
+⛔ No admission semantics change. Whether the carve-out should count humans or
+logins was ruled on 2026-09-02 (option A — the door does not move); this only
+reports.
+
+The check extends the existing `kernel:ready` walled-owner reporter rather than
+opening a parallel one: it shares that hook, and the bounded human-population
+page is read ONCE per boot and handed to `probeWalledOwnerAccountState`, so no
+deployment pages `sys_user` twice. At most one report is emitted per boot — a
+deployment matching both shapes gets this error, and the walled-owner warning
+is suppressed rather than stacked on top of it.

content/docs/permissions/system-context.mdx

@@ -97,7 +97,7 @@ that silently does not happen.
 | 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3857` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
-| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1380` |
+| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1405` |
 | 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
 | 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -78,6 +78,10 @@ import {
  warnIfWalledOwnerCannotVerify,
  type WalledOwnerAccountState,
 } from './walled-owner-verification-path.js';
+import {
+ probeSignInReachability,
+ reportIfNoSignInAccountExists,
+} from './boot-sign-in-reachability.js';
 import { judgePlatformAdmin, isPlatformAdminUser, type PlatformAdminActor } from './platform-admin-gate.js';
 import {
  runAdminBanUser,
@@ -1036,21 +1040,42 @@ export class AuthPlugin implements Plugin {
  // hook below (registration order), so the probe reads the pre-seed
  // store — the predicate's dev-seed clauses are written for exactly
  // that reading.
+ let ql: IDataEngine | undefined;
+ try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
+
+ // [#14353] "Can ANYONE sign in?" — asked UNCONDITIONALLY, because it is
+ // independent of all four preconditions below: a deployment that is
+ // unwalled, or declares no owner, or wires an email transport is just as
+ // unrecoverable when it has human rows and no `sys_account` row. This is
+ // the family's ONE store read: the human-population page is paged here
+ // and the answer handed to the walled-owner probe, so no boot pages
+ // `sys_user` twice. Cost on a fresh store is a single bounded page.
+ const reachability = await probeSignInReachability(ql);
+ const deadEnd = reportIfNoSignInAccountExists(reachability, ctx.logger);
+
  let ownerAccountState: WalledOwnerAccountState = 'unknown';
  if (
  !hasEmailTransport &&
  !hasFederatedSignIn &&
  postureEnforcesWall(resolveTenancyPosture()) &&
  resolvePlatformOwnerEmail()
  ) {
- let ql: IDataEngine | undefined;
- try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
- ownerAccountState = await probeWalledOwnerAccountState(ql);
+ ownerAccountState = await probeWalledOwnerAccountState(ql, {
+ humanUsers: reachability.humanUsers,
+ });
+ }
+ // [#14353] ONE report per boot. A deployment can match both shapes at
+ // once (no accounts AND a declared owner that cannot verify); the
+ // no-sign-in error strictly subsumes the walled-owner warning there —
+ // an owner who cannot reach platform-admin standing is moot when nobody
+ // can sign in at all — so the warning is suppressed rather than stacked
+ // on top of it. When the error did not fire, the warning is untouched.
+ if (!deadEnd) {
+ warnIfWalledOwnerCannotVerify(
+ { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
+ ctx.logger,
+ );
  }
- warnIfWalledOwnerCannotVerify(
- { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
- ctx.logger,
- );
  });
 
  // Dev-only: provision a known, loginable platform admin on an empty DB.

.changeset/auth-no-sign-in-account-boot-report.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+Report the zero-account boot dead end at `kernel:ready` (#14353)
+
+A deployment holding human `sys_user` rows and zero `sys_account` rows cannot
+be recovered from inside, and until now it booted silently. Nobody can sign in;
+the first-account bootstrap carve-out counts humans, and humans exist, so it
+does not open; the default `invite_only` audience posture refuses
+self-registration; and no administrator exists who could send an invitation.
+The only symptom was a 401 on credentials nobody holds.
+
+That state is now reported at `kernel:ready` at `error` level, under the name
+`no_sign_in_account_at_boot`, naming both the consequence (the deployment will
+keep looking healthy and cannot be recovered from inside) and the remedy
+(provision an account out of band, or open the audience posture).
+
+⛔ No admission semantics change. Whether the carve-out should count humans or
+logins was ruled on 2026-09-02 (option A — the door does not move); this only
+reports.
+
+The check extends the existing `kernel:ready` walled-owner reporter rather than
+opening a parallel one: it shares that hook, and the bounded human-population
+page is read ONCE per boot and handed to `probeWalledOwnerAccountState`, so no
+deployment pages `sys_user` twice. At most one report is emitted per boot — a
+deployment matching both shapes gets this error, and the walled-owner warning
+is suppressed rather than stacked on top of it.

content/docs/permissions/system-context.mdx

@@ -97,7 +97,7 @@ that silently does not happen.
 | 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3857` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
-| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1380` |
+| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1405` |
 | 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
 | 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -78,6 +78,10 @@ import {
  warnIfWalledOwnerCannotVerify,
  type WalledOwnerAccountState,
 } from './walled-owner-verification-path.js';
+import {
+ probeSignInReachability,
+ reportIfNoSignInAccountExists,
+} from './boot-sign-in-reachability.js';
 import { judgePlatformAdmin, isPlatformAdminUser, type PlatformAdminActor } from './platform-admin-gate.js';
 import {
  runAdminBanUser,
@@ -1036,21 +1040,42 @@ export class AuthPlugin implements Plugin {
  // hook below (registration order), so the probe reads the pre-seed
  // store — the predicate's dev-seed clauses are written for exactly
  // that reading.
+ let ql: IDataEngine | undefined;
+ try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
+
+ // [#14353] "Can ANYONE sign in?" — asked UNCONDITIONALLY, because it is
+ // independent of all four preconditions below: a deployment that is
+ // unwalled, or declares no owner, or wires an email transport is just as
+ // unrecoverable when it has human rows and no `sys_account` row. This is
+ // the family's ONE store read: the human-population page is paged here
+ // and the answer handed to the walled-owner probe, so no boot pages
+ // `sys_user` twice. Cost on a fresh store is a single bounded page.
+ const reachability = await probeSignInReachability(ql);
+ const deadEnd = reportIfNoSignInAccountExists(reachability, ctx.logger);
+
  let ownerAccountState: WalledOwnerAccountState = 'unknown';
  if (
  !hasEmailTransport &&
  !hasFederatedSignIn &&
  postureEnforcesWall(resolveTenancyPosture()) &&
  resolvePlatformOwnerEmail()
  ) {
- let ql: IDataEngine | undefined;
- try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
- ownerAccountState = await probeWalledOwnerAccountState(ql);
+ ownerAccountState = await probeWalledOwnerAccountState(ql, {
+ humanUsers: reachability.humanUsers,
+ });
+ }
+ // [#14353] ONE report per boot. A deployment can match both shapes at
+ // once (no accounts AND a declared owner that cannot verify); the
+ // no-sign-in error strictly subsumes the walled-owner warning there —
+ // an owner who cannot reach platform-admin standing is moot when nobody
+ // can sign in at all — so the warning is suppressed rather than stacked
+ // on top of it. When the error did not fire, the warning is untouched.
+ if (!deadEnd) {
+ warnIfWalledOwnerCannotVerify(
+ { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
+ ctx.logger,
+ );
  }
- warnIfWalledOwnerCannotVerify(
- { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
- ctx.logger,
- );
  });
 
  // Dev-only: provision a known, loginable platform admin on an empty DB.

.changeset/auth-no-sign-in-account-boot-report.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+Report the zero-account boot dead end at `kernel:ready` (#14353)
+
+A deployment holding human `sys_user` rows and zero `sys_account` rows cannot
+be recovered from inside, and until now it booted silently. Nobody can sign in;
+the first-account bootstrap carve-out counts humans, and humans exist, so it
+does not open; the default `invite_only` audience posture refuses
+self-registration; and no administrator exists who could send an invitation.
+The only symptom was a 401 on credentials nobody holds.
+
+That state is now reported at `kernel:ready` at `error` level, under the name
+`no_sign_in_account_at_boot`, naming both the consequence (the deployment will
+keep looking healthy and cannot be recovered from inside) and the remedy
+(provision an account out of band, or open the audience posture).
+
+⛔ No admission semantics change. Whether the carve-out should count humans or
+logins was ruled on 2026-09-02 (option A — the door does not move); this only
+reports.
+
+The check extends the existing `kernel:ready` walled-owner reporter rather than
+opening a parallel one: it shares that hook, and the bounded human-population
+page is read ONCE per boot and handed to `probeWalledOwnerAccountState`, so no
+deployment pages `sys_user` twice. At most one report is emitted per boot — a
+deployment matching both shapes gets this error, and the walled-owner warning
+is suppressed rather than stacked on top of it.

content/docs/permissions/system-context.mdx

@@ -97,7 +97,7 @@ that silently does not happen.
 | 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3857` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
-| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1380` |
+| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1405` |
 | 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
 | 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -78,6 +78,10 @@ import {
  warnIfWalledOwnerCannotVerify,
  type WalledOwnerAccountState,
 } from './walled-owner-verification-path.js';
+import {
+ probeSignInReachability,
+ reportIfNoSignInAccountExists,
+} from './boot-sign-in-reachability.js';
 import { judgePlatformAdmin, isPlatformAdminUser, type PlatformAdminActor } from './platform-admin-gate.js';
 import {
  runAdminBanUser,
@@ -1036,21 +1040,42 @@ export class AuthPlugin implements Plugin {
  // hook below (registration order), so the probe reads the pre-seed
  // store — the predicate's dev-seed clauses are written for exactly
  // that reading.
+ let ql: IDataEngine | undefined;
+ try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
+
+ // [#14353] "Can ANYONE sign in?" — asked UNCONDITIONALLY, because it is
+ // independent of all four preconditions below: a deployment that is
+ // unwalled, or declares no owner, or wires an email transport is just as
+ // unrecoverable when it has human rows and no `sys_account` row. This is
+ // the family's ONE store read: the human-population page is paged here
+ // and the answer handed to the walled-owner probe, so no boot pages
+ // `sys_user` twice. Cost on a fresh store is a single bounded page.
+ const reachability = await probeSignInReachability(ql);
+ const deadEnd = reportIfNoSignInAccountExists(reachability, ctx.logger);
+
  let ownerAccountState: WalledOwnerAccountState = 'unknown';
  if (
  !hasEmailTransport &&
  !hasFederatedSignIn &&
  postureEnforcesWall(resolveTenancyPosture()) &&
  resolvePlatformOwnerEmail()
  ) {
- let ql: IDataEngine | undefined;
- try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
- ownerAccountState = await probeWalledOwnerAccountState(ql);
+ ownerAccountState = await probeWalledOwnerAccountState(ql, {
+ humanUsers: reachability.humanUsers,
+ });
+ }
+ // [#14353] ONE report per boot. A deployment can match both shapes at
+ // once (no accounts AND a declared owner that cannot verify); the
+ // no-sign-in error strictly subsumes the walled-owner warning there —
+ // an owner who cannot reach platform-admin standing is moot when nobody
+ // can sign in at all — so the warning is suppressed rather than stacked
+ // on top of it. When the error did not fire, the warning is untouched.
+ if (!deadEnd) {
+ warnIfWalledOwnerCannotVerify(
+ { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
+ ctx.logger,
+ );
  }
- warnIfWalledOwnerCannotVerify(
- { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
- ctx.logger,
- );
  });
 
  // Dev-only: provision a known, loginable platform admin on an empty DB.

.changeset/auth-no-sign-in-account-boot-report.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+Report the zero-account boot dead end at `kernel:ready` (#14353)
+
+A deployment holding human `sys_user` rows and zero `sys_account` rows cannot
+be recovered from inside, and until now it booted silently. Nobody can sign in;
+the first-account bootstrap carve-out counts humans, and humans exist, so it
+does not open; the default `invite_only` audience posture refuses
+self-registration; and no administrator exists who could send an invitation.
+The only symptom was a 401 on credentials nobody holds.
+
+That state is now reported at `kernel:ready` at `error` level, under the name
+`no_sign_in_account_at_boot`, naming both the consequence (the deployment will
+keep looking healthy and cannot be recovered from inside) and the remedy
+(provision an account out of band, or open the audience posture).
+
+⛔ No admission semantics change. Whether the carve-out should count humans or
+logins was ruled on 2026-09-02 (option A — the door does not move); this only
+reports.
+
+The check extends the existing `kernel:ready` walled-owner reporter rather than
+opening a parallel one: it shares that hook, and the bounded human-population
+page is read ONCE per boot and handed to `probeWalledOwnerAccountState`, so no
+deployment pages `sys_user` twice. At most one report is emitted per boot — a
+deployment matching both shapes gets this error, and the walled-owner warning
+is suppressed rather than stacked on top of it.

content/docs/permissions/system-context.mdx

@@ -97,7 +97,7 @@ that silently does not happen.
 | 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3857` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
-| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1380` |
+| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1405` |
 | 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
 | 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -78,6 +78,10 @@ import {
  warnIfWalledOwnerCannotVerify,
  type WalledOwnerAccountState,
 } from './walled-owner-verification-path.js';
+import {
+ probeSignInReachability,
+ reportIfNoSignInAccountExists,
+} from './boot-sign-in-reachability.js';
 import { judgePlatformAdmin, isPlatformAdminUser, type PlatformAdminActor } from './platform-admin-gate.js';
 import {
  runAdminBanUser,
@@ -1036,21 +1040,42 @@ export class AuthPlugin implements Plugin {
  // hook below (registration order), so the probe reads the pre-seed
  // store — the predicate's dev-seed clauses are written for exactly
  // that reading.
+ let ql: IDataEngine | undefined;
+ try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
+
+ // [#14353] "Can ANYONE sign in?" — asked UNCONDITIONALLY, because it is
+ // independent of all four preconditions below: a deployment that is
+ // unwalled, or declares no owner, or wires an email transport is just as
+ // unrecoverable when it has human rows and no `sys_account` row. This is
+ // the family's ONE store read: the human-population page is paged here
+ // and the answer handed to the walled-owner probe, so no boot pages
+ // `sys_user` twice. Cost on a fresh store is a single bounded page.
+ const reachability = await probeSignInReachability(ql);
+ const deadEnd = reportIfNoSignInAccountExists(reachability, ctx.logger);
+
  let ownerAccountState: WalledOwnerAccountState = 'unknown';
  if (
  !hasEmailTransport &&
  !hasFederatedSignIn &&
  postureEnforcesWall(resolveTenancyPosture()) &&
  resolvePlatformOwnerEmail()
  ) {
- let ql: IDataEngine | undefined;
- try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
- ownerAccountState = await probeWalledOwnerAccountState(ql);
+ ownerAccountState = await probeWalledOwnerAccountState(ql, {
+ humanUsers: reachability.humanUsers,
+ });
+ }
+ // [#14353] ONE report per boot. A deployment can match both shapes at
+ // once (no accounts AND a declared owner that cannot verify); the
+ // no-sign-in error strictly subsumes the walled-owner warning there —
+ // an owner who cannot reach platform-admin standing is moot when nobody
+ // can sign in at all — so the warning is suppressed rather than stacked
+ // on top of it. When the error did not fire, the warning is untouched.
+ if (!deadEnd) {
+ warnIfWalledOwnerCannotVerify(
+ { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
+ ctx.logger,
+ );
  }
- warnIfWalledOwnerCannotVerify(
- { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
- ctx.logger,
- );
  });
 
  // Dev-only: provision a known, loginable platform admin on an empty DB.

.changeset/auth-no-sign-in-account-boot-report.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+Report the zero-account boot dead end at `kernel:ready` (#14353)
+
+A deployment holding human `sys_user` rows and zero `sys_account` rows cannot
+be recovered from inside, and until now it booted silently. Nobody can sign in;
+the first-account bootstrap carve-out counts humans, and humans exist, so it
+does not open; the default `invite_only` audience posture refuses
+self-registration; and no administrator exists who could send an invitation.
+The only symptom was a 401 on credentials nobody holds.
+
+That state is now reported at `kernel:ready` at `error` level, under the name
+`no_sign_in_account_at_boot`, naming both the consequence (the deployment will
+keep looking healthy and cannot be recovered from inside) and the remedy
+(provision an account out of band, or open the audience posture).
+
+⛔ No admission semantics change. Whether the carve-out should count humans or
+logins was ruled on 2026-09-02 (option A — the door does not move); this only
+reports.
+
+The check extends the existing `kernel:ready` walled-owner reporter rather than
+opening a parallel one: it shares that hook, and the bounded human-population
+page is read ONCE per boot and handed to `probeWalledOwnerAccountState`, so no
+deployment pages `sys_user` twice. At most one report is emitted per boot — a
+deployment matching both shapes gets this error, and the walled-owner warning
+is suppressed rather than stacked on top of it.

content/docs/permissions/system-context.mdx

@@ -97,7 +97,7 @@ that silently does not happen.
 | 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3857` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
-| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1380` |
+| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1405` |
 | 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
 | 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -78,6 +78,10 @@ import {
  warnIfWalledOwnerCannotVerify,
  type WalledOwnerAccountState,
 } from './walled-owner-verification-path.js';
+import {
+ probeSignInReachability,
+ reportIfNoSignInAccountExists,
+} from './boot-sign-in-reachability.js';
 import { judgePlatformAdmin, isPlatformAdminUser, type PlatformAdminActor } from './platform-admin-gate.js';
 import {
  runAdminBanUser,
@@ -1036,21 +1040,42 @@ export class AuthPlugin implements Plugin {
  // hook below (registration order), so the probe reads the pre-seed
  // store — the predicate's dev-seed clauses are written for exactly
  // that reading.
+ let ql: IDataEngine | undefined;
+ try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
+
+ // [#14353] "Can ANYONE sign in?" — asked UNCONDITIONALLY, because it is
+ // independent of all four preconditions below: a deployment that is
+ // unwalled, or declares no owner, or wires an email transport is just as
+ // unrecoverable when it has human rows and no `sys_account` row. This is
+ // the family's ONE store read: the human-population page is paged here
+ // and the answer handed to the walled-owner probe, so no boot pages
+ // `sys_user` twice. Cost on a fresh store is a single bounded page.
+ const reachability = await probeSignInReachability(ql);
+ const deadEnd = reportIfNoSignInAccountExists(reachability, ctx.logger);
+
  let ownerAccountState: WalledOwnerAccountState = 'unknown';
  if (
  !hasEmailTransport &&
  !hasFederatedSignIn &&
  postureEnforcesWall(resolveTenancyPosture()) &&
  resolvePlatformOwnerEmail()
  ) {
- let ql: IDataEngine | undefined;
- try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
- ownerAccountState = await probeWalledOwnerAccountState(ql);
+ ownerAccountState = await probeWalledOwnerAccountState(ql, {
+ humanUsers: reachability.humanUsers,
+ });
+ }
+ // [#14353] ONE report per boot. A deployment can match both shapes at
+ // once (no accounts AND a declared owner that cannot verify); the
+ // no-sign-in error strictly subsumes the walled-owner warning there —
+ // an owner who cannot reach platform-admin standing is moot when nobody
+ // can sign in at all — so the warning is suppressed rather than stacked
+ // on top of it. When the error did not fire, the warning is untouched.
+ if (!deadEnd) {
+ warnIfWalledOwnerCannotVerify(
+ { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
+ ctx.logger,
+ );
  }
- warnIfWalledOwnerCannotVerify(
- { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
- ctx.logger,
- );
  });
 
  // Dev-only: provision a known, loginable platform admin on an empty DB.

.changeset/auth-no-sign-in-account-boot-report.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+Report the zero-account boot dead end at `kernel:ready` (#14353)
+
+A deployment holding human `sys_user` rows and zero `sys_account` rows cannot
+be recovered from inside, and until now it booted silently. Nobody can sign in;
+the first-account bootstrap carve-out counts humans, and humans exist, so it
+does not open; the default `invite_only` audience posture refuses
+self-registration; and no administrator exists who could send an invitation.
+The only symptom was a 401 on credentials nobody holds.
+
+That state is now reported at `kernel:ready` at `error` level, under the name
+`no_sign_in_account_at_boot`, naming both the consequence (the deployment will
+keep looking healthy and cannot be recovered from inside) and the remedy
+(provision an account out of band, or open the audience posture).
+
+⛔ No admission semantics change. Whether the carve-out should count humans or
+logins was ruled on 2026-09-02 (option A — the door does not move); this only
+reports.
+
+The check extends the existing `kernel:ready` walled-owner reporter rather than
+opening a parallel one: it shares that hook, and the bounded human-population
+page is read ONCE per boot and handed to `probeWalledOwnerAccountState`, so no
+deployment pages `sys_user` twice. At most one report is emitted per boot — a
+deployment matching both shapes gets this error, and the walled-owner warning
+is suppressed rather than stacked on top of it.

content/docs/permissions/system-context.mdx

@@ -97,7 +97,7 @@ that silently does not happen.
 | 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3857` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
-| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1380` |
+| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1405` |
 | 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
 | 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -78,6 +78,10 @@ import {
  warnIfWalledOwnerCannotVerify,
  type WalledOwnerAccountState,
 } from './walled-owner-verification-path.js';
+import {
+ probeSignInReachability,
+ reportIfNoSignInAccountExists,
+} from './boot-sign-in-reachability.js';
 import { judgePlatformAdmin, isPlatformAdminUser, type PlatformAdminActor } from './platform-admin-gate.js';
 import {
  runAdminBanUser,
@@ -1036,21 +1040,42 @@ export class AuthPlugin implements Plugin {
  // hook below (registration order), so the probe reads the pre-seed
  // store — the predicate's dev-seed clauses are written for exactly
  // that reading.
+ let ql: IDataEngine | undefined;
+ try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
+
+ // [#14353] "Can ANYONE sign in?" — asked UNCONDITIONALLY, because it is
+ // independent of all four preconditions below: a deployment that is
+ // unwalled, or declares no owner, or wires an email transport is just as
+ // unrecoverable when it has human rows and no `sys_account` row. This is
+ // the family's ONE store read: the human-population page is paged here
+ // and the answer handed to the walled-owner probe, so no boot pages
+ // `sys_user` twice. Cost on a fresh store is a single bounded page.
+ const reachability = await probeSignInReachability(ql);
+ const deadEnd = reportIfNoSignInAccountExists(reachability, ctx.logger);
+
  let ownerAccountState: WalledOwnerAccountState = 'unknown';
  if (
  !hasEmailTransport &&
  !hasFederatedSignIn &&
  postureEnforcesWall(resolveTenancyPosture()) &&
  resolvePlatformOwnerEmail()
  ) {
- let ql: IDataEngine | undefined;
- try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
- ownerAccountState = await probeWalledOwnerAccountState(ql);
+ ownerAccountState = await probeWalledOwnerAccountState(ql, {
+ humanUsers: reachability.humanUsers,
+ });
+ }
+ // [#14353] ONE report per boot. A deployment can match both shapes at
+ // once (no accounts AND a declared owner that cannot verify); the
+ // no-sign-in error strictly subsumes the walled-owner warning there —
+ // an owner who cannot reach platform-admin standing is moot when nobody
+ // can sign in at all — so the warning is suppressed rather than stacked
+ // on top of it. When the error did not fire, the warning is untouched.
+ if (!deadEnd) {
+ warnIfWalledOwnerCannotVerify(
+ { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
+ ctx.logger,
+ );
  }
- warnIfWalledOwnerCannotVerify(
- { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
- ctx.logger,
- );
  });
 
  // Dev-only: provision a known, loginable platform admin on an empty DB.