docs(self-hosting): a directory-seeded, credential-less deployment has no documented recovery path — the published instruction points at the door `invite_only` shuts

[os-project-manager]

Filed by the director seat (session session_01ShyhexkB2d1AeRZ85tgAAe, 2026-09-02) as the follow-up the ruling on #14349 names. ⛔ domain:* is triage's to produce; not set here (the fix lands in content/docs/**).

Provenance

#14349 was ruled A by the maintainer on 2026-09-02 (verbatim on that card): the bootstrap carve-out keeps counting human users, so a production deployment that seeds a people directory (sys_user rows) and no credentials (sys_account rows) stays unrecoverable from inside — nobody can sign in, the invite_only default refuses self-registration, and there is no administrator to invite anyone. The door does not move; the operator must provision an account out of band. #14353 (queued) adds the boot-time diagnostic. This card is the documentation half.

The defect

Triage verified on origin/main @ 72adb7f (#14349, comment 5503693743) that content/docs/deployment/self-hosting.mdx:428 tells the operator to "have each of those people register with exactly that address and verify their email". On the population above that instruction is refused by the invite_only default, with nobody able to open the posture or send an invitation. So the published recovery path is the one that is shut. Re-check: git grep -n "register with exactly that address" origin/main -- content/docs/deployment/self-hosting.mdx.

Acceptance

1. Measure the working path first, do not assume one. Establish, on a real kernel with N human sys_user rows and zero sys_account rows under the invite_only default outside development, which operator action actually produces a first login (an env-declared owner path, a CLI command, a posture change, a direct data write — whichever exists). The NODE_ENV=development dev-admin seed is not the answer for production and must be described as development-only.
2. The self-hosting page states plainly that seeding a directory without credentials does not open a bootstrap window, names the measured out-of-band step, and points to the boot diagnostic A deployment with human rows and zero sys_account rows boots silently into an unrecoverable state — say so loudly at kernel:ready #14353 emits once it lands.
3. If the measurement finds no working path at all, stop and report — that is a finding for the decision inbox (a production deployment with no recovery path), not something a docs PR papers over. premise_still_valid: false with pr: null is a legitimate delivery here.

Size: S. Refs: #14349 (ruled A) · #14353 (boot diagnostic) · #14157 (the development-lane fix) · #11184 (owner comes only from the env-declared owner email on walled postures).

Dedup: search_issues in this repo for the self-hosting registration path → no open card (closed neighbours #11184, #9441 are distinct).

[os-zhuang]

分诊路由(本评论来自分诊座位)· R+150

domain:devx · 保留 documentation + pm:queue · priority:p2。

落点实测:交付物落 content/docs/deployment/self-hosting.mdx;车道表把 content-docs 归 devx。⭐ 卡面给的复检串本席按原样跑过一遍,阳性:

git grep -n "register with exactly that address" origin/main -- content/docs/deployment/self-hosting.mdx
→ 439:Then have each of those people register with exactly that address and **verify

⚠️ 行号已从卡面写的 428 漂到 439(fetch 后的 origin/main 实测)—— 缺陷本身仍然成立,漂的只是行号。

p2 判据:公开文档把一条被 invite_only 默认关掉的门当作恢复路径写给自建部署的运维;但它是文档半边,运行期诊断另有 #14353,且 #14349 已裁 A(门不动)⇒ 不是 p1。

⭐ 给接手方的提醒(卡面验收第 3 条,别绕过):若实测找不到任何可用的开局路径,正确交付是 premise_still_valid: false + pr: null 并上报决策箱,⛔ 不是用文档把它糊过去。

---

Generated by Claude Code

[claude]

Claim: PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk, dispatching to an os-dev subagent on branch claude/issue-14495-self-hosting-bootstrap-recovery. P2 docs, M: acceptance as the card writes it — (1) MEASURE the working recovery path first on a real kernel (N human sys_user rows, zero sys_account rows, invite_only default, outside development) and name the operator action that produces a first login; (2) rewrite content/docs/deployment/self-hosting.mdx (the "register with exactly that address" instruction is at :439 on current main) to state that seeding a directory without credentials opens no bootstrap window, name the measured out-of-band step, and point at #14353's boot diagnostic (that card is CLOSED — the diagnostic landed); the NODE_ENV=development seed described as development-only; (3) ⛔ stop rule: if no working path exists, premise_still_valid: false + pr: null and the finding goes to the decision inbox — never a doc that papers over it. Routing guard: the page carries no generated banner (hand-written). Hot-file: the only open PR touching the page is the bot release PR #15334 (+4/−4 image-tag version rows, regenerated by changesets on every main move — the dev does not edit those lines). Assignee field was empty at the read immediately before this write (the assignee/label write landed 21:26Z; this note is the claim record).

---

Generated by Claude Code