fix(plugin-auth): report the zero-account boot dead end at kernel:ready

.changeset/auth-no-sign-in-account-boot-report.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+Report the zero-account boot dead end at `kernel:ready` (#14353)
+
+A deployment holding human `sys_user` rows and zero `sys_account` rows cannot
+be recovered from inside, and until now it booted silently. Nobody can sign in;
+the first-account bootstrap carve-out counts humans, and humans exist, so it
+does not open; the default `invite_only` audience posture refuses
+self-registration; and no administrator exists who could send an invitation.
+The only symptom was a 401 on credentials nobody holds.
+
+That state is now reported at `kernel:ready` at `error` level, under the name
+`no_sign_in_account_at_boot`, naming both the consequence (the deployment will
+keep looking healthy and cannot be recovered from inside) and the remedy
+(provision an account out of band, or open the audience posture).
+
+⛔ No admission semantics change. Whether the carve-out should count humans or
+logins was ruled on 2026-09-02 (option A — the door does not move); this only
+reports.
+
+The check extends the existing `kernel:ready` walled-owner reporter rather than
+opening a parallel one: it shares that hook, and the bounded human-population
+page is read ONCE per boot and handed to `probeWalledOwnerAccountState`, so no
+deployment pages `sys_user` twice. At most one report is emitted per boot — a
+deployment matching both shapes gets this error, and the walled-owner warning
+is suppressed rather than stacked on top of it.

content/docs/permissions/system-context.mdx

@@ -97,7 +97,7 @@ that silently does not happen.
 | 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3857` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
-| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1380` |
+| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1405` |
 | 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
 | 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -78,6 +78,10 @@ import {
   warnIfWalledOwnerCannotVerify,
   type WalledOwnerAccountState,
 } from './walled-owner-verification-path.js';
+import {
+  probeSignInReachability,
+  reportIfNoSignInAccountExists,
+} from './boot-sign-in-reachability.js';
 import { judgePlatformAdmin, isPlatformAdminUser, type PlatformAdminActor } from './platform-admin-gate.js';
 import {
   runAdminBanUser,
@@ -1036,21 +1040,42 @@ export class AuthPlugin implements Plugin {
       // hook below (registration order), so the probe reads the pre-seed
       // store — the predicate's dev-seed clauses are written for exactly
       // that reading.
+      let ql: IDataEngine | undefined;
+      try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
+
+      // [#14353] "Can ANYONE sign in?" — asked UNCONDITIONALLY, because it is
+      // independent of all four preconditions below: a deployment that is
+      // unwalled, or declares no owner, or wires an email transport is just as
+      // unrecoverable when it has human rows and no `sys_account` row. This is
+      // the family's ONE store read: the human-population page is paged here
+      // and the answer handed to the walled-owner probe, so no boot pages
+      // `sys_user` twice. Cost on a fresh store is a single bounded page.
+      const reachability = await probeSignInReachability(ql);
+      const deadEnd = reportIfNoSignInAccountExists(reachability, ctx.logger);
+
       let ownerAccountState: WalledOwnerAccountState = 'unknown';
       if (
         !hasEmailTransport &&
         !hasFederatedSignIn &&
         postureEnforcesWall(resolveTenancyPosture()) &&
         resolvePlatformOwnerEmail()
       ) {
-        let ql: IDataEngine | undefined;
-        try { ql = ctx.getService<IDataEngine>('objectql'); } catch { ql = undefined; }
-        ownerAccountState = await probeWalledOwnerAccountState(ql);
+        ownerAccountState = await probeWalledOwnerAccountState(ql, {
+          humanUsers: reachability.humanUsers,
+        });
+      }
+      // [#14353] ONE report per boot. A deployment can match both shapes at
+      // once (no accounts AND a declared owner that cannot verify); the
+      // no-sign-in error strictly subsumes the walled-owner warning there —
+      // an owner who cannot reach platform-admin standing is moot when nobody
+      // can sign in at all — so the warning is suppressed rather than stacked
+      // on top of it. When the error did not fire, the warning is untouched.
+      if (!deadEnd) {
+        warnIfWalledOwnerCannotVerify(
+          { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
+          ctx.logger,
+        );
       }
-      warnIfWalledOwnerCannotVerify(
-        { hasEmailTransport, hasFederatedSignIn, ownerAccountState },
-        ctx.logger,
-      );
     });
 
     // Dev-only: provision a known, loginable platform admin on an empty DB.