diff --git a/.claude/skills/add-architecture-test/SKILL.md b/.claude/skills/add-architecture-test/SKILL.md
index a7146b1..19414d4 100644
--- a/.claude/skills/add-architecture-test/SKILL.md
+++ b/.claude/skills/add-architecture-test/SKILL.md
@@ -120,7 +120,7 @@ The current set lives across these files; add yours to the right one:
 | `AuditTests.cs` | `AuditEntry` inheritance, no direct `audit_log` writes. |
 | `EntitlementTests.cs` | Plan-projected vs tenant-flag separation, FeatureKey registry. |
 | `PermissionTests.cs` | Closed action set, scope correctness, denied-test presence. |
-| `HubContractTests.cs` | No direct Hub-URL references, four-endpoint surface enforcement. |
+| `HubContractTests.cs` | No direct Hub-URL references; Hub clients only inside the named adapters (ADR-0034). |
 | `DomainGenericTests.cs` | `Core_Modules_HaveNo_DomainSpecific_Names`, no `Verticals/`. |
 | `DaprDirectInjectionTests.cs` | No `IConnectionMultiplexer` / `KafkaProducer` / `VaultClient` in modules. |
 | `ConventionTests.cs` | Strongly-typed ids in commands, validator pairing, etc. |
@@ -154,7 +154,15 @@ public void Every_TenantOwned_Table_HasRls_With_AppTenantId()
         if (content.Contains("CREATE TABLE") && content.Contains("tenant_id"))
         {
             Assert.Contains("ENABLE ROW LEVEL SECURITY", content);
-            Assert.Contains("current_setting('app.tenant_id')", content);
+            // FORCE is the half that matters: without it the table owner bypasses
+            // its own policy and the whole layer is inert while ENABLE stays green.
+            // Matched as a regex because the canonical template writes two spaces.
+            Assert.Matches(@"FORCE\s+ROW LEVEL SECURITY", content);
+            // Must match the canonical template's exact shape. A bare
+            // current_setting('app.tenant_id') assertion FAILS against every
+            // correct migration and PASSES against the superseded one-argument
+            // form — see ADR-0003 Amendment 3 and 05-database.md.
+            Assert.Contains("NULLIF(current_setting('app.tenant_id', true), '')", content);
         }
     }
 }
diff --git a/.claude/skills/add-audit-coverage/SKILL.md b/.claude/skills/add-audit-coverage/SKILL.md
index 7c235da..3881c4f 100644
--- a/.claude/skills/add-audit-coverage/SKILL.md
+++ b/.claude/skills/add-audit-coverage/SKILL.md
@@ -16,11 +16,19 @@ description: >
 ## Purpose
 
 Wire a new operation into LearnStack's central audit pipeline
-([ADR-0016](../../../docs/decisions/0016-audit-log-subsystem.md),
+([ADR-0033](../../../docs/decisions/0033-audit-durability-model.md) — the binding
+durability contract; [ADR-0016](../../../docs/decisions/0016-audit-log-subsystem.md) —
+superseded, read only for subsystem context;
 [31-audit-subsystem.md](../../../docs/architecture/31-audit-subsystem.md),
-[18-audit-coverage.md](../../../docs/standards/18-audit-coverage.md)) by extending
-the module's matrix and the audit catalogue. Modules never write `audit_log`
-directly; the catalogue + the `AuditLogBehavior` MediatR behaviour do.
+[18-audit-coverage.md](../../../docs/standards/18-audit-coverage.md)) by extending the
+module's matrix and the audit catalogue. Modules never write `audit_log` directly; the
+catalogue plus the pipeline do.
+
+The pipeline is **decide → write → reconcile**: `AuditLogBehavior` classifies at step 3
+and parks an intent, `TransactionBehavior` writes the row on the business transaction
+immediately before `COMMIT`, and `AuditLogBehavior` re-writes it standalone on the way out
+if that transaction did not commit. You do not touch any of it — but the classification
+you pick decides which of those paths a given operation takes.
 
 ## When to use
 
@@ -91,6 +99,30 @@ Use the rules from
 If your operation falls outside this list, it probably belongs as a sub-resource
 (see [add-permission § Closed Action Set](../add-permission/SKILL.md)).
 
+### Step 2b: What a MUST classification now costs
+
+Under [ADR-0033](../../../docs/decisions/0033-audit-durability-model.md) the class is
+**load-bearing, not documentary**. Before you write MUST, know what you are buying:
+
+- The row is inserted on the **same transaction** as the business write, immediately
+  before `COMMIT`, while `app.tenant_id` is set — so it commits with the state change or
+  not at all, and Row Level Security accepts it.
+- If the transaction rolls back, the row is **re-written standalone** with outcome
+  `failed`. A MUST-class operation is never left with no row, including on the ordinary
+  path where a handler saves and then returns `Result.Fail(...)`.
+- The operation **fails closed**. If the audit row cannot be written at all, the command
+  is rejected — the caller gets `503 audit_unavailable`, never a partial success.
+- MUST-class events with no business transaction — `denied` outcomes, read-sensitive
+  queries, non-mutating security events — get a standalone row in a short transaction
+  that sets its own tenant GUC. Classifying a *query* MUST is legitimate and costs a
+  synchronous write before the result is returned.
+- A tenant `AuditConfig` override can narrow SHOULD/MAY. It can never remove baseline
+  MUST coverage; the catalogue re-applies the MUST floor after the override.
+- SHOULD/MAY stays best-effort. Choosing it is choosing a **documented accepted loss** —
+  write that loss into the module's matrix rather than leaving it implied.
+
+So MUST is an availability trade as well as a compliance one. Classify deliberately.
+
 ### Step 3: Register in the catalogue
 
 In the module's `RegisterAuditCoverage`:
@@ -216,8 +248,17 @@ public async Task User_NationalId_isRedacted_In_AuditSnapshot()
 
 ## Common pitfalls
 
-- **Calling `IAuditStore` directly from the handler.** Forbidden. The
-  `AuditLogBehavior` does this once; a second write produces a duplicate row.
+- **Calling `IAuditStore` directly from the handler.** Forbidden. The pipeline does this
+  once per operation; a second write produces a duplicate row. `IAuditStore` is
+  infrastructure, not a handler collaborator —
+  `Modules_Do_Not_Write_AuditLog_Directly` enforces it.
+- **Adding `AuditEntry` to a module's `DbContext`** so a handler can "enrol the row in
+  its own `SaveChanges`". Forbidden and unnecessary: atomicity comes from the
+  transaction, not from sharing a `SaveChanges` call, and mapping the Audit module's
+  aggregate into another module's context inverts the dependency direction.
+- **`UPDATE`ing an audit row to add detail after the fact.** There is no second phase.
+  The row is composed complete at the commit boundary, `IAuditStore` has no update
+  method, and `learnstack_app` holds no `UPDATE` privilege on `audit_log`.
 - **Truncating snapshots silently.** If a `before/after` JSON is too large, store
   an external pointer (`audit_blob_id`); never an empty object.
 - **Skipping the matrix update.** `Module_<Name>_HasAuditMatrix` will fail; CI
diff --git a/.claude/skills/add-ef-migration/SKILL.md b/.claude/skills/add-ef-migration/SKILL.md
index 13a1ce5..2794859 100644
--- a/.claude/skills/add-ef-migration/SKILL.md
+++ b/.claude/skills/add-ef-migration/SKILL.md
@@ -87,49 +87,106 @@ migrationBuilder.Sql("""
         created_by       uuid NOT NULL,
         updated_at       timestamptz NOT NULL DEFAULT now(),
         updated_by       uuid NOT NULL,
-        row_version      bigint NOT NULL DEFAULT 0
+        row_version      bigint NOT NULL DEFAULT 0,
+        -- Exists solely so child tables can carry a composite FK into this one.
+        CONSTRAINT ux_<name_plural>_tenant_id_id UNIQUE (tenant_id, id)
     );
 
-    CREATE INDEX ix_<name_plural>_tenant_id ON <name_plural> (tenant_id);
-    CREATE INDEX ix_<name_plural>_organization_id ON <name_plural> (organization_id)
-        WHERE organization_id IS NOT NULL;
-
-    ALTER TABLE <name_plural> ENABLE ROW LEVEL SECURITY;
-
-    CREATE POLICY <name_plural>_tenant_isolation ON <name_plural>
-        USING (tenant_id = current_setting('app.tenant_id')::uuid);
-
-    CREATE POLICY <name_plural>_organization_isolation ON <name_plural>
-        USING (
-            organization_id IS NULL
-            OR organization_id = current_setting('app.organization_id', true)::uuid
-        );
+    -- Every foreign key from this table to another tenant-owned table is
+    -- COMPOSITE on tenant_id:
+    --
+    --     CONSTRAINT fk_<name_plural>_<parent>
+    --         FOREIGN KEY (tenant_id, <parent>_id)
+    --         REFERENCES <parents> (tenant_id, id)
+    --
+    -- Referential-integrity checks run on behalf of the table owner and are NOT
+    -- subject to Row Level Security, so a single-column FK lets one tenant
+    -- reference another tenant's rows and no policy ever observes it.
+
+    -- One composite index, deliberately NOT partial: the policy's
+    -- `organization_id IS NULL` branch matches every tenant-wide row and a b-tree
+    -- indexes NULLs, so the non-partial form serves both branches. No standalone
+    -- index on tenant_id — the UNIQUE constraints above already lead with it.
+    -- Drop organization_id from the index when the table is not org-scoped.
+    CREATE INDEX ix_<name_plural>_tenant_id_organization_id
+        ON <name_plural> (tenant_id, organization_id);
+
+    -- ─────────────────────────────────────────────────────────────────────────
+    -- RLS: DO NOT WRITE THE POLICY FROM MEMORY, AND DO NOT COPY IT HERE.
+    --
+    -- Open docs/standards/05-database.md § Tenant-Owned and Organization-Scoped
+    -- Tables and copy the canonical block into this migration now, substituting
+    -- <name_plural>. That file is the only place the template exists.
+    --
+    -- The pre-2026-08-08 template lived in four documents and was wrong in all
+    -- four — two PERMISSIVE policies, which PostgreSQL combines with OR, so every
+    -- tenant-wide row was visible across tenants (ADR-0003 Amendment 3). It was
+    -- corrected once, in one file. A second copy is how that recurs.
+    --
+    -- Checklist for what you paste:
+    --   * ENABLE *and* FORCE ROW LEVEL SECURITY            (both table kinds)
+    --   * explicit WITH CHECK                               (both table kinds)
+    --   * NULLIF(current_setting(...), '') on every GUC read (both table kinds)
+    --
+    --   TENANT-ONLY table: exactly ONE permissive policy carrying the tenant
+    --   predicate alone. No organization term, no restrictive guards — there is
+    --   no second scope to widen or narrow.
+    --
+    --   [OrganizationScoped] table: still exactly ONE permissive policy, but its
+    --   predicate ANDs the tenant term with the organization term; PLUS the two
+    --   AS RESTRICTIVE guards (FOR UPDATE, FOR DELETE), because the
+    --   app.scope='tenant' read hatch must not widen writes and DELETE has no
+    --   WITH CHECK.
+    -- ─────────────────────────────────────────────────────────────────────────
     """);
 ```
 
-**Session variable names** are canonical: `app.tenant_id` / `app.organization_id`.
-Architecture test `Every_TenantOwned_Table_HasRls_With_AppTenantId` enforces.
+> The canonical template is
+> [05-database.md § Tenant-Owned and Organization-Scoped Tables](../../../docs/standards/05-database.md),
+> and this skill deliberately does **not** mirror it — the block above tells you to open
+> that file and copy from it. See
+> [ADR-0003 Amendment 3](../../../docs/decisions/0003-tenant-isolation-defense-in-depth.md)
+> for why the two-policy shape was withdrawn.
+
+**Session variable names** are canonical: `app.tenant_id` / `app.organization_id` /
+`app.scope`. Always pass the second `true` argument so an unset context filters the row
+out instead of raising on a pooled connection.
 
-### Step 4: Append-only / partitioned table
+**Roles.** Migrations run as `learnstack_migration` (the table owner);
+the application connects as `learnstack_app` (`NOBYPASSRLS`, not the owner). Grant the
+new table to `learnstack_app` in the same migration, or the application cannot read it.
 
-If the table is append-only at scale (audit, large event log):
+### Step 4: Append-only table
+
+An append-only table ships **unpartitioned**, with a composite primary key that a
+future partition conversion can reuse. Do **not** write `PARTITION BY` in the first
+migration: partitioning is demand-gated to
+[Phase 11](../../../docs/roadmap/phase-11-production-hardening.md) on measured growth
+([ADR-0035](../../../docs/decisions/0035-demand-gated-infrastructure.md)), and shipping
+it early buys partition maintenance before there is anything to maintain.
 
 ```csharp
 migrationBuilder.Sql("""
     CREATE TABLE audit_log (
         id            uuid NOT NULL,
-        occurred_at   timestamptz NOT NULL,
+        timestamp     timestamptz NOT NULL DEFAULT now(),
         tenant_id     uuid NOT NULL,
         -- ... rest ...
-        PRIMARY KEY (id, occurred_at)
-    ) PARTITION BY RANGE (occurred_at);
-
-    -- First partition (others created by retention job per ADR-0028 reservation)
-    CREATE TABLE audit_log_2026_06 PARTITION OF audit_log
-        FOR VALUES FROM ('2026-06-01') TO ('2026-07-01');
+        -- The partition key must be IN the primary key for the Phase 11 conversion,
+        -- so declare the composite now even though nothing is partitioned yet.
+        -- Column name is `timestamp`, matching the canonical DDL in ADR-0033 and
+        -- 31-audit-subsystem — not `occurred_at`, which is outbox_messages' column.
+        CONSTRAINT audit_log_pkey PRIMARY KEY (id, timestamp)
+    );
     """);
 ```
 
+PostgreSQL has no `ALTER TABLE … PARTITION BY`, so Phase 11 does not convert this table
+in place: it creates a partitioned parent, attaches this table to it, and recreates the
+indexes and the policy on the parent. The composite key above is what keeps that a data
+operation rather than a key migration
+([ADR-0033 § Corrected `audit_log` DDL](../../../docs/decisions/0033-audit-durability-model.md)).
+
 The Postgres trigger that rejects `UPDATE` / `DELETE` on `audit_log` lives in the
 audit module's setup migration; reproduce it for any new append-only table.
 
@@ -183,8 +240,32 @@ before mutating data:
 ```csharp
 foreach (var tenantId in tenantIds)
 {
-    await connection.ExecuteAsync($"SET LOCAL app.tenant_id = '{tenantId}'");
-    await connection.ExecuteAsync("UPDATE ... WHERE tenant_id = current_setting('app.tenant_id')::uuid");
+    await using var tx = await connection.BeginTransactionAsync(ct);
+
+    // set_config(key, value, is_local: true) is the parameterised equivalent of
+    // SET LOCAL, and it MUST run inside an explicit transaction: PostgreSQL
+    // discards a SET LOCAL issued outside one (with a warning), so the UPDATE
+    // below would otherwise run with no tenant context at all — which, under a
+    // NULLIF-wrapped policy, means it silently updates zero rows.
+    //
+    // Parameterised, not interpolated. String-interpolated SQL is banned by
+    // 05-database.md § Forbidden.
+    await connection.ExecuteAsync(
+        "SELECT set_config('app.tenant_id', @tenantId, true)",
+        new { tenantId = tenantId.ToString() },
+        transaction: tx);
+
+    // No `WHERE tenant_id = current_setting(...)` clause. The connection runs as
+    // learnstack_migration, which is NOBYPASSRLS against a table that is FORCE ROW
+    // LEVEL SECURITY, so the policy scopes the statement to this tenant on its own;
+    // restating the predicate in application SQL is a second copy of the policy that
+    // can drift from the first. Note the consequence: skip the set_config above and
+    // the UPDATE matches ZERO rows and still reports success.
+    await connection.ExecuteAsync(
+        "UPDATE enrollments SET source = 'legacy' WHERE source IS NULL",
+        transaction: tx);
+
+    await tx.CommitAsync(ct);
 }
 ```
 
diff --git a/.claude/skills/add-feature-key/SKILL.md b/.claude/skills/add-feature-key/SKILL.md
index 3da4af8..62bea5c 100644
--- a/.claude/skills/add-feature-key/SKILL.md
+++ b/.claude/skills/add-feature-key/SKILL.md
@@ -187,7 +187,7 @@ See [add-feature-gated-ui](../add-feature-gated-ui/SKILL.md) for hook usage.
 
 ### Step 4: Hub-side plan editor (if PlanProjected)
 
-For plan-projected keys, the Hub operator portal (`learnstack-hub-web` in the
+For plan-projected keys, the Hub operator portal (`operator-portal` in the
 separate repo) lists every key declared in the `FeatureKeys` catalogue. The Hub
 plan editor surfaces them as toggle checkboxes. The Hub publishes the resulting
 JSON entitlement projection to LearnStack via
diff --git a/.claude/skills/add-frontend-route/SKILL.md b/.claude/skills/add-frontend-route/SKILL.md
index 724e524..e34f2e1 100644
--- a/.claude/skills/add-frontend-route/SKILL.md
+++ b/.claude/skills/add-frontend-route/SKILL.md
@@ -7,7 +7,7 @@ description: >
   portal), and SDK-based data fetching. USE FOR: a new public page, Studio screen,
   or learner / instructor portal screen. DO NOT USE FOR: thin BFF proxy endpoints
   (those live in `app/api/`), routes for the operator portal (that's the separate
-  `learnstack-hub-web` app), or hand-rolled `fetch` to the backend (use the typed
+  `operator-portal` app), or hand-rolled `fetch` to the backend (use the typed
   SDK).
 ---
 
@@ -30,7 +30,7 @@ contract per
 
 ## When not to use
 
-- Operator portal pages — they live in `learnstack-hub-web`, a separate repo.
+- Operator portal pages — they live in `operator-portal`, a separate repo.
 - Calling the API directly from a Client Component without the SDK — forbidden by
   ESLint (`no-restricted-imports`).
 - Routes that bypass tenant resolution — every authenticated route requires a
diff --git a/.claude/skills/add-mediatr-handler/SKILL.md b/.claude/skills/add-mediatr-handler/SKILL.md
index 7dae527..d743353 100644
--- a/.claude/skills/add-mediatr-handler/SKILL.md
+++ b/.claude/skills/add-mediatr-handler/SKILL.md
@@ -15,7 +15,7 @@ description: >
 ## Purpose
 
 Write a command/query handler that participates correctly in the LearnStack MediatR
-pipeline: `Validation → Logging → Audit → TenantContext → Authorization →
+pipeline: `Validation → Logging → AuditLog → TenantContext → Authorization →
 Transaction → OutboxFlush → Handler`. The pipeline is shared (per
 [ADR-0032 § Sub-decision 2](../../../docs/decisions/0032-exception-handling-logging-and-observability.md)
 and [Standards 02 § Pipeline Behaviors](../../../docs/standards/02-backend-coding.md)),
diff --git a/.claude/skills/add-permission/SKILL.md b/.claude/skills/add-permission/SKILL.md
index 59298ba..44d091c 100644
--- a/.claude/skills/add-permission/SKILL.md
+++ b/.claude/skills/add-permission/SKILL.md
@@ -58,7 +58,7 @@ education.course.write
 education.course.delete
 education.course_publication.write     ← "publish a course"
 enrollment.enrollment.write
-enrollment.entitlement.read
+enrollment.course_access.read
 tenancy.organization.admin
 identity.impersonation.write
 audit.export.read
@@ -83,12 +83,12 @@ In `<Module>.Application/<Module>Module.cs`:
 public void RegisterPermissions(IPermissionRegistry registry)
 {
     registry.Tenant(
-        key: "enrollment.entitlement.read",
+        key: "enrollment.course_access.read",
         description: "View entitlements",
         defaultGrants: [Roles.TenantAdmin, Roles.OrgAdmin, Roles.Instructor]);
 
     registry.Tenant(
-        key: "enrollment.entitlement.write",
+        key: "enrollment.course_access.write",
         description: "Grant or revoke entitlements",
         defaultGrants: [Roles.TenantAdmin]);
 
diff --git a/.claude/skills/add-provider-adapter/SKILL.md b/.claude/skills/add-provider-adapter/SKILL.md
index 54c794f..6376748 100644
--- a/.claude/skills/add-provider-adapter/SKILL.md
+++ b/.claude/skills/add-provider-adapter/SKILL.md
@@ -59,7 +59,7 @@ the canonical wiring per
   building blocks, handled by
   [wire-cross-cutting-foundation](../wire-cross-cutting-foundation/SKILL.md).
   Dapr's runtime provides retry + DLQ + circuit-breaker semantics already.
-- The four Hub HTTPS endpoints (`IEntitlementProvider`, `IUsageReporter`,
+- The Hub HTTPS contract surface (`IEntitlementProvider`, `IUsageReporter`,
   `IHubTenantSync`) — those use the dedicated mTLS + signed JWT + HMAC
   wrapper per [ADR-0019](../../../docs/decisions/0019-learnstack-hub.md).
 - Pure in-process integrations (a JSON converter, a hash function) — no
@@ -313,7 +313,7 @@ In `docs/modules/<module>/providers.md`, add the adapter:
 - Adapter: `LearnStack.Infrastructure.LiveClassroom.LiveKit.LiveKitClient`
 - Resilience section: `Resilience:liveclass:`
 - Exception subclass: `LiveClassProviderException`
-- ADR: [ADR-0005](../../decisions/0005-live-classroom-media-stack.md)
+- ADR: [ADR-0005](../../../docs/decisions/0005-live-classroom-media-stack.md)
 ```
 
 ## Validation
diff --git a/.claude/skills/add-tenant-owned-entity/SKILL.md b/.claude/skills/add-tenant-owned-entity/SKILL.md
index 3efa4da..eefb3aa 100644
--- a/.claude/skills/add-tenant-owned-entity/SKILL.md
+++ b/.claude/skills/add-tenant-owned-entity/SKILL.md
@@ -135,7 +135,16 @@ dotnet ef migrations add Add_<Name> \
   --startup-project backend/src/LearnStack.Api
 ```
 
-Edit the generated migration to add **both** RLS policies:
+Edit the generated migration to add the table and **one** RLS policy.
+
+> **The canonical template lives in
+> [05-database.md § Tenant-Owned and Organization-Scoped Tables](../../../docs/standards/05-database.md),
+> and this skill does not mirror it.** Open that file and copy the block from there.
+> Mirroring it here would be the same mistake that produced four divergent copies before
+> 2026-08-08, one of which leaked every tenant-wide row across tenants
+> ([ADR-0003 Amendment 3](../../../docs/decisions/0003-tenant-isolation-defense-in-depth.md)) —
+> and a disclaimer saying "the standard wins if they disagree" does not stop the drift,
+> it only predicts it.
 
 ```csharp
 migrationBuilder.Sql("""
@@ -148,29 +157,90 @@ migrationBuilder.Sql("""
         created_by       uuid NOT NULL,
         updated_at       timestamptz NOT NULL DEFAULT now(),
         updated_by       uuid NOT NULL,
-        row_version      bigint NOT NULL DEFAULT 0
+        row_version      bigint NOT NULL DEFAULT 0,
+        -- Exists solely so child tables can carry a composite FK into this one.
+        -- Looks redundant next to the primary key; it is not. See the note below.
+        CONSTRAINT ux_<name_plural>_tenant_id_id UNIQUE (tenant_id, id)
     );
 
-    CREATE INDEX ix_<name_plural>_tenant_id ON <name_plural> (tenant_id);
-    CREATE INDEX ix_<name_plural>_organization_id ON <name_plural> (organization_id)
-        WHERE organization_id IS NOT NULL;   -- omit if not org-scoped
-
-    ALTER TABLE <name_plural> ENABLE ROW LEVEL SECURITY;
-
-    CREATE POLICY <name_plural>_tenant_isolation ON <name_plural>
-        USING (tenant_id = current_setting('app.tenant_id')::uuid);
-
-    -- org policy: omit if not org-scoped
-    CREATE POLICY <name_plural>_organization_isolation ON <name_plural>
-        USING (
-            organization_id IS NULL
-            OR organization_id = current_setting('app.organization_id', true)::uuid
-        );
+    -- Every foreign key from this table to another tenant-owned table is
+    -- COMPOSITE on tenant_id:
+    --
+    --     CONSTRAINT fk_<name_plural>_<parent>
+    --         FOREIGN KEY (tenant_id, <parent>_id)
+    --         REFERENCES <parents> (tenant_id, id)
+    --
+    -- PostgreSQL evaluates referential integrity as a security-restricted
+    -- operation on behalf of the table owner, and RI checks are NOT subject to
+    -- Row Level Security. A single-column FK therefore lets a row in tenant A
+    -- reference a row in tenant B: the child's WITH CHECK passes because its
+    -- tenant_id is A's, and the FK check passes because it can see B's row. The
+    -- result is a permanent cross-tenant reference that no policy ever sees,
+    -- because no policy ran.
+
+    -- One composite index, deliberately NOT partial: the policy's
+    -- `organization_id IS NULL` branch matches every tenant-wide row and a b-tree
+    -- indexes NULLs, so the non-partial form serves both branches. No standalone
+    -- index on tenant_id — the UNIQUE constraints above already lead with it.
+    -- Drop organization_id from the index if the table is not org-scoped.
+    CREATE INDEX ix_<name_plural>_tenant_id_organization_id
+        ON <name_plural> (tenant_id, organization_id);
+
+    -- ─────────────────────────────────────────────────────────────────────────
+    -- RLS: DO NOT WRITE THE POLICY FROM MEMORY, AND DO NOT COPY IT HERE.
+    --
+    -- Open docs/standards/05-database.md § Tenant-Owned and Organization-Scoped
+    -- Tables and copy the canonical block into this migration NOW, substituting
+    -- <name_plural>. That file is the only place the template exists; this skill
+    -- deliberately does not carry a second instance of it.
+    --
+    -- The template that preceded 2026-08-08 lived in four documents and was wrong
+    -- in all four — two PERMISSIVE policies, which PostgreSQL combines with OR, so
+    -- every tenant-wide row was visible across tenants. It was corrected once, in
+    -- one file. A copy here is how that recurs (ADR-0003 Amendment 3).
+    --
+    -- What you are copying, so you can tell if you got it wrong:
+    --   * ENABLE *and* FORCE ROW LEVEL SECURITY  (without FORCE the owner bypasses)
+    --   * exactly ONE permissive policy, tenant AND organization in one predicate
+    --   * an explicit WITH CHECK, without the app.scope='tenant' read hatch
+    --   * two AS RESTRICTIVE guards, FOR UPDATE and FOR DELETE, when org-scoped
+    --   * NULLIF(current_setting(...), '') on every GUC read
+    -- Drop the organization terms entirely if the table is not org-scoped.
+    -- ─────────────────────────────────────────────────────────────────────────
     """);
 ```
 
-The session-variable names are **canonical**: `app.tenant_id`, `app.organization_id`
-([05-database.md](../../../docs/standards/05-database.md)). Other names break RLS.
+Five properties of the block you just copied are load-bearing. Check each one against
+what you pasted — a reviewer will:
+
+- **`FORCE ROW LEVEL SECURITY`** — without it the owner bypasses the policy and the
+  whole layer is inert while every structural test stays green.
+- **One policy with an `AND`-ed predicate** — splitting the tenant and organization
+  terms into two policies inverts the meaning from AND to OR.
+- **`WITH CHECK`** — `USING` governs reads; without `WITH CHECK` a write can place a
+  row in another tenant. Note the `app.scope = 'tenant'` term is deliberately absent
+  from `WITH CHECK`: tenant-scope reporting may *read* across organizations, but
+  nothing may *write* outside its own. `WITH CHECK` is not sufficient on its own for
+  that guarantee — PostgreSQL has no `WITH CHECK` for `DELETE`, and `USING` is also
+  what selects the rows an `UPDATE` may target — which is why the two `AS RESTRICTIVE`
+  guards above are part of the template and not an optional extra.
+- **The composite `UNIQUE (tenant_id, id)` and the composite foreign keys** — referential
+  integrity is checked on behalf of the table owner and bypasses RLS entirely, so a
+  single-column FK is a cross-tenant reference waiting to happen, invisible to every
+  policy. See
+  [05-database.md § Foreign keys between tenant-owned tables](../../../docs/standards/05-database.md).
+
+Always call `current_setting` with the second argument `true`. Without it an unset
+context raises inside a pooled connection instead of simply filtering the row out.
+
+The session-variable names are **canonical**: `app.tenant_id`, `app.organization_id`,
+`app.scope` ([05-database.md](../../../docs/standards/05-database.md)). Other names
+break RLS silently.
+
+The runtime connects as **`learnstack_app`** (`NOBYPASSRLS`, not the table owner);
+migrations run as `learnstack_migration`, which owns the table. Integration tests for
+this entity must connect as `learnstack_app` — a test that connects as the owner passes
+against an inert policy and proves nothing.
 
 ### Step 4: Architecture test (already covered by convention)
 
diff --git a/.claude/skills/code-review/SKILL.md b/.claude/skills/code-review/SKILL.md
index ff0d95d..4557684 100644
--- a/.claude/skills/code-review/SKILL.md
+++ b/.claude/skills/code-review/SKILL.md
@@ -262,7 +262,8 @@ Author intent: <one-paragraph restatement>
   `Asana`, `Kyu`, `CodeChallenge` — all forbidden; live as
   `TenantContentType` / `TenantLevelTaxonomy` / `TenantScoringRule` data).
 - **No `Verticals/` folder.** ADR-0018 superseded ADR-0011.
-- **Hub HTTPS contract surface closed at four endpoints.** Adding a fifth
+- **Hub HTTPS contract surface governed by two invariants** (the Hub stores no tenant
+  content; every crossing goes through a named adapter — ADR-0034). Adding an endpoint
   requires a new ADR.
 - **No direct `IConnectionMultiplexer` / `IDistributedCache` / `KafkaProducer` /
   `VaultClient` injection** (per [CLAUDE.md hard rules](../../../CLAUDE.md) and
diff --git a/.claude/skills/commit-and-pr/SKILL.md b/.claude/skills/commit-and-pr/SKILL.md
index a06e841..c9414e9 100644
--- a/.claude/skills/commit-and-pr/SKILL.md
+++ b/.claude/skills/commit-and-pr/SKILL.md
@@ -91,7 +91,7 @@ Trailers go at the **end** of the body (after a blank line). The supported set:
 Pick the trailer that matches the agent that did material work:
 
 - Claude Code session:
-  `Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>`
+  `Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>`
 - OpenAI Codex session:
   `Co-Authored-By: Codex Opus 4.7 (1M context) <noreply@anthropic.com>`
 
@@ -110,7 +110,7 @@ access shares the per-learner entitlement read path with free access.
 
 ADR: 0010
 Module: Enrollment, Billing
-Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 EOF
 )"
 ```
diff --git a/.claude/skills/local-dev-setup/SKILL.md b/.claude/skills/local-dev-setup/SKILL.md
index 31c69e2..6cd0f9b 100644
--- a/.claude/skills/local-dev-setup/SKILL.md
+++ b/.claude/skills/local-dev-setup/SKILL.md
@@ -184,7 +184,7 @@ make restart-api
 |---------|-----|
 | `Bind for 0.0.0.0:5432 failed: port is already allocated` | Stop your local Postgres (or change `POSTGRES_PORT` in `.env`). |
 | `relation "tenants" does not exist` | Migrations didn't run; `make migrate`. |
-| `unable to read app.tenant_id` | Connection pool checkout interceptor not wired; check `DeploymentMode`. |
+| `unable to read app.tenant_id` | The `DbCommandInterceptor` tenant-context guard is unwired, or `TransactionBehavior` did not issue the `SET LOCAL` pair. It is deliberately **not** a connection-checkout interceptor — checkout precedes `BEGIN`. |
 | Keycloak realm not found | First-run seed failed; `make seed-reset` rebuilds. |
 | Web app shows raw i18n keys | i18n bundle build skipped; `pnpm build:i18n`. |
 | Hub-backed mode hangs | The `learnstack-hub` repo's stack isn't up; start it or switch to `Development`. |
diff --git a/.claude/skills/seed-tenant/SKILL.md b/.claude/skills/seed-tenant/SKILL.md
index 2ad7bac..a467086 100644
--- a/.claude/skills/seed-tenant/SKILL.md
+++ b/.claude/skills/seed-tenant/SKILL.md
@@ -34,7 +34,7 @@ course tree, all as **data**, so:
 ## When not to use
 
 - Production tenant create. That's an operator action from the Hub portal
-  (`learnstack-hub-web`) via `POST /api/internal/tenants`.
+  (`operator-portal`) via `POST /api/internal/tenants`.
 - Self-Hosted license issuance. Hub-side (Phase 02c / 09b).
 - Reseeding production data. Never.
 
diff --git a/.claude/skills/standards-check/SKILL.md b/.claude/skills/standards-check/SKILL.md
index 1a76c18..e2ca21d 100644
--- a/.claude/skills/standards-check/SKILL.md
+++ b/.claude/skills/standards-check/SKILL.md
@@ -95,12 +95,20 @@ Walk every item in [CLAUDE.md § Hard rules](../../../CLAUDE.md) and
   LiveKit OSS, SeaweedFS, Meilisearch, Kafka, Vault).
 - [ ] **No domain-specific code in any module.** Domain shape = tenant data
   per ADR-0018.
-- [ ] **Foundation building blocks are Day-1.** Dapr / APISIX / audit
-  infrastructure / org scope / entitlement projection / host resolver / arch
-  tests all in Phase 02a, not later.
+- [ ] **Irreversible now, additive on demand — the one-way-door test**
+  (ADR-0035). Tenant + org isolation, the outbox table, typed IDs, the
+  localization schema, audit *correctness*, and the foundation **ports** are
+  Phase 02a. The Dapr / Kafka / APISIX / Vault **adapters**, the Hub
+  integration, signed licence keys, custom-domain TLS automation and
+  `audit_log` partitioning are demand-gated to their owning phase against a
+  written trigger — shipping them early is a finding, not a bonus.
 - [ ] **Provider adapters everywhere.** No SaaS lock-in in Domain /
   Application.
-- [ ] **Hub HTTPS surface closed at 4 endpoints.** Adding a 5th = new ADR.
+- [ ] **Hub contract surface honours its two invariants** (ADR-0034): the Hub
+  stores no tenant content, and every crossing goes through
+  `IEntitlementProvider` / `IUsageReporter` / `IHubTenantSync`. Nothing else
+  holds a Hub client; nothing resolves a host by calling the Hub. Adding an
+  endpoint still needs an ADR — it is a cross-repository contract.
 - [ ] **Three deployment modes, one binary.** Module code never branches on
   `DeploymentMode`.
 
@@ -180,17 +188,41 @@ domain the diff doesn't touch.
 #### `05-database.md`
 - [ ] Naming conventions (snake_case, plural tables, `ix_` / `ux_` / `ck_` /
   `tg_` / `fn_` prefixes).
-- [ ] Every `[TenantOwned]` table has `tenant_id` + index, RLS enabled,
-  policy keyed on `current_setting('app.tenant_id')`.
+- [ ] Every `[TenantOwned]` table has `tenant_id` + index, `ENABLE` **and**
+  `FORCE ROW LEVEL SECURITY`, and **exactly one** policy whose `USING` predicate
+  `AND`-s the tenant term with the organization term, plus an explicit `WITH CHECK`.
+  **Two policies is a defect, not a style choice** — both are `PERMISSIVE`, PostgreSQL
+  `OR`-s them, and the intended `AND` becomes an `OR` that exposes every tenant-wide
+  row across tenants
+  ([ADR-0003 Amendment 3](../../../docs/decisions/0003-tenant-isolation-defense-in-depth.md)).
 - [ ] Every `[OrganizationScoped]` table additionally has nullable
-  `organization_id` + index + RLS policy on `app.organization_id`.
+  `organization_id` + index, and its organization term is **inside** that same policy —
+  not in a second one.
+- [ ] `current_setting` is always called with the missing-OK second argument **and**
+  wrapped in `NULLIF(…, '')` — `NULLIF(current_setting('app.tenant_id', true), '')`.
+  The two cover different failure paths and both are required: missing-OK handles a
+  variable never set in this session, `NULLIF` handles one that *was* set and has since
+  reset. A customized (dotted) GUC's reset value is the empty string, and `''::uuid`
+  raises `22P02` instead of filtering. Text comparisons such as
+  `current_setting('app.scope', true) = 'tenant'` are the exception — `'' = 'tenant'`
+  is already false, which is the correct fail-closed result.
+- [ ] Org-scoped tables carry both `AS RESTRICTIVE` write guards, `FOR UPDATE` and
+  `FOR DELETE`. The `app.scope = 'tenant'` hatch is read-only, and `USING` is the only
+  gate a `DELETE` has.
+- [ ] Every foreign key between two tenant-owned tables is composite on `tenant_id`,
+  and the parent carries `UNIQUE (tenant_id, id)`. RI checks bypass RLS.
+- [ ] Isolation tests for the table connect as **`learnstack_app`**, not as the owner
+  or a `BYPASSRLS` role. A test that connects as the owner passes against an inert
+  policy and proves nothing.
 - [ ] Mutable aggregates carry the audit columns (`created_at` /
   `created_by` / `updated_at` / `updated_by` / `row_version`).
 - [ ] Migrations forward-only by default; destructive change has a two-step
   plan documented.
 - [ ] PgBouncer transaction-pooling assumption respected (no statement-mode
   patterns).
-- [ ] `correlation_id` columns are `text NULL` (canonical type).
+- [ ] `correlation_id` columns are `text` (holding the full W3C traceparent), never
+  `uuid`. On `outbox_messages` it is **`NOT NULL`**; on `audit_log` it stays nullable
+  ([31-audit-subsystem.md](../../../docs/architecture/31-audit-subsystem.md)).
 
 #### `06-testing.md`
 - [ ] Test pyramid respected (unit > integration > E2E in volume).
@@ -300,7 +332,8 @@ domain the diff doesn't touch.
 - [ ] Topic naming `learnstack.{module}.{aggregate}`.
 - [ ] APISIX in standalone YAML-reload mode; routes under `infra/apisix/` per
   [30-api-gateway.md § 2](../../../docs/architecture/30-api-gateway.md).
-- [ ] Hub HTTPS contract surface untouched (still 4 endpoints).
+- [ ] Hub contract surface still satisfies ADR-0034's two invariants; any new
+  endpoint carries its ADR and lands in both repositories.
 - [ ] Outbox + inbox usage correct (atomic with aggregate write; inbox guard
   in every consumer).
 
@@ -332,7 +365,7 @@ checklist:
   `docs/modules/<m>/permissions.md` updated.
 - [ ] Frontend i18n key changed → `I18n:` commit trailer present.
 - [ ] Hub-side change in this repo → flagged for coordination with
-  `learnstack-hub` repo (the four-endpoint contract is shared).
+  `learnstack-hub` repo (the contract surface is shared; see ADR-0034).
 
 ### Step 6 — Output
 
diff --git a/.claude/skills/update-glossary/SKILL.md b/.claude/skills/update-glossary/SKILL.md
index 864bcf0..ea168c9 100644
--- a/.claude/skills/update-glossary/SKILL.md
+++ b/.claude/skills/update-glossary/SKILL.md
@@ -99,7 +99,7 @@ Rules:
   doc, not a long glossary entry.
 - Lead with what it **is**, not what it's *for*.
 - Cite the authoritative source inline (e.g.
-  "[ADR-0017](decisions/0017-tenant-organization-hierarchy.md)").
+  "[ADR-0017](../../../docs/decisions/0017-tenant-organization-hierarchy.md)").
 - Avoid restating things the canonical doc already says — link.
 
 ### Step 4: Update downstream references
diff --git a/.claude/skills/wire-cross-cutting-foundation/SKILL.md b/.claude/skills/wire-cross-cutting-foundation/SKILL.md
index f3da7cf..c22160b 100644
--- a/.claude/skills/wire-cross-cutting-foundation/SKILL.md
+++ b/.claude/skills/wire-cross-cutting-foundation/SKILL.md
@@ -70,7 +70,7 @@ and
 You should be able to recite, before you write a line of code:
 
 - The eight pipeline behaviors and their order
-  (`Validation → Logging → Audit → TenantContext → Authorization → Transaction → OutboxFlush → Handler`).
+  (`Validation → Logging → AuditLog → TenantContext → Authorization → Transaction → OutboxFlush → Handler`).
 - The Sentry-vs-OTel boundary (`ShouldCapture(ex)` table).
 - The Serilog + OTLP wiring rule (no `AddOpenTelemetry().WithLogging()` alongside).
 - The composition-root branching for `IErrorTrackingProvider`.
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index fc38172..6f38b47 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -20,11 +20,24 @@ Configure these in **GitHub → Settings → Branches → Branch protection rule
     - `frontend (typecheck + lint + build + test)`
     - `meta (commit hygiene + link audit)`
     - `secret scan (leakwatch)`
-  - Deferred checks — flip the `if: false` guards in `ci.yml` AND add the
-    job name here when the owning phase lands:
-    - `backend integration (Testcontainers — deferred)` — Phase 02a.
-    - `openapi diff (deferred to Phase 03)` — Phase 03.
-    - `lighthouse budget (deferred to Phase 04)` — Phase 04.
+  - Deferred checks. Each is gated on a repository variable (`vars.ENABLE_*`,
+    unset by default — a constant `if: false` is rejected by actionlint).
+    Activating one is **four edits, in the same pull request wherever possible**:
+    set the variable in **Settings → Secrets and variables → Actions → Variables**,
+    replace the placeholder step with the real one, **rename the job** to drop the
+    `(deferred …)` suffix, and add the new name both to this list and to the live
+    branch-protection setting. Setting the variable alone leaves a job that runs
+    but gates nothing.
+    - `backend integration (Testcontainers — deferred)` — Phase 02a **Packet 7**,
+      with the first cross-tenant isolation test.
+    - `openapi diff (deferred to Phase 02d)` — **Phase 02d**, with the first real
+      `/api/v1/*` read endpoints.
+    - `lighthouse budget (deferred to Phase 02d)` — **Phase 02d**, with the first
+      content-bearing public pages.
+
+    GitHub matches required checks **by name**, so the rename is the dangerous
+    half: a renamed check that nobody re-required is a check that no longer blocks
+    anything, and the PR still shows green.
 - **Require conversation resolution before merging**: on.
 - **Require signed commits**: optional (off until the team rolls out signing keys).
 - **Require linear history**: on (we use squash-merge or rebase-merge, never bubble).
@@ -44,7 +57,7 @@ Per CLAUDE.md § Commit conventions:
 - **Conventional Commits**: `type(scope): subject` with subject in
   imperative mood, ≤ 72 chars.
 - AI-assisted commits carry the trailer
-  `Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>`
+  `Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>`
   (replace the model name when authoring with a different assistant).
 - `docs(scope)` for doc-only commits; scope ∈ `architecture | decisions |
   standards | roadmap` or omitted for cross-cutting changes.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 68b7696..79000ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,17 +10,20 @@
 #   - frontend : pnpm install + typecheck + lint + build + Vitest
 #   - meta     : `make lint`-style format verification
 #
-# Deferred to later phases (jobs are scaffolded as `if: false` placeholders
-# so the activation is a one-line flip):
+# Deferred to later phases. Each is scaffolded behind a repository variable
+# (`vars.ENABLE_*`), unset by default, so activation is one variable plus the
+# real steps. A constant `if: false` would be simpler but actionlint rejects it
+# ([if-cond] constant expression). Activation is never *only* the variable —
+# see .github/CONTRIBUTING.md § Branch protection for the three edits:
 #   - backend-integration : Testcontainers needs a real Docker socket inside
 #     the runner — works on `ubuntu-latest` natively. Activates when the
 #     first integration test lands (Phase 02a) so we have something to run.
 #   - openapi-diff        : oasdiff against the prior `main` spec. Activates
-#     in Phase 03 when the first real endpoint replaces `/healthz` as the
-#     only documented surface (until then there is nothing to diff).
+#     in Phase 02d, which ships the first real `/api/v1/*` read endpoints and
+#     retires `/healthz` as the only documented surface.
 #   - lighthouse-budget   : LHCI against the built Next.js app. Activates
-#     when Phase 04 ships the first content-bearing public page (the
-#     current placeholder routes are not worth scoring).
+#     in Phase 02d, which ships the first content-bearing public pages (the
+#     two tenant catalog / lesson pages a visitor actually loads).
 
 name: ci
 
@@ -109,7 +112,10 @@ jobs:
   backend-integration:
     name: backend integration (Testcontainers — deferred)
     runs-on: ubuntu-latest
-    if: false  # activate when LearnStack.Tests.Integration has its first test
+    # Disabled by default: unset vars are the empty string, so this is false until
+    # the repository variable is set to 'true'. Not `if: false` — actionlint rejects
+    # a constant condition ([if-cond]).
+    if: vars.ENABLE_BACKEND_INTEGRATION == 'true'
     steps:
       - run: echo "Placeholder — Phase 02a wires the first Testcontainers integration test."
 
@@ -161,21 +167,21 @@ jobs:
       - name: Test (Vitest)
         run: pnpm -r test
 
-  # ─── OpenAPI breaking-change check (deferred — Phase 03) ──────────────
+  # ─── OpenAPI breaking-change check (deferred — Phase 02d) ─────────────
   openapi-diff:
-    name: openapi diff (deferred to Phase 03)
+    name: openapi diff (deferred to Phase 02d)
     runs-on: ubuntu-latest
-    if: false  # activate when /api/v1/* endpoints replace the `/healthz` placeholder
+    if: vars.ENABLE_OPENAPI_DIFF == 'true'
     steps:
-      - run: echo "Placeholder — Phase 03 wires oasdiff against the prior main spec."
+      - run: echo "Placeholder — Phase 02d wires oasdiff against the prior main spec."
 
-  # ─── Lighthouse budget (deferred — Phase 04) ──────────────────────────
+  # ─── Lighthouse budget (deferred — Phase 02d) ─────────────────────────
   lighthouse-budget:
-    name: lighthouse budget (deferred to Phase 04)
+    name: lighthouse budget (deferred to Phase 02d)
     runs-on: ubuntu-latest
-    if: false  # activate when the first content-bearing public page ships
+    if: vars.ENABLE_LIGHTHOUSE_BUDGET == 'true'
     steps:
-      - run: echo "Placeholder — Phase 04 wires LHCI against the built Next.js app."
+      - run: echo "Placeholder — Phase 02d wires LHCI against the built Next.js app."
 
   # ─── Meta (commit-message format, link audit) ─────────────────────────
   meta:
diff --git a/AGENTS.md b/AGENTS.md
index c19a110..c3b1f64 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -16,7 +16,7 @@ There are no rule differences. The only thing that varies between agent runtimes
 the **`Co-Authored-By` commit trailer**, which names the assistant that contributed:
 
 - Claude Code sessions:
-  `Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>`
+  `Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>`
 - OpenAI Codex sessions:
   `Co-Authored-By: Codex Opus 4.7 (1M context) <noreply@anthropic.com>`
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 423134e..ba0fd5f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -6,47 +6,91 @@ the conventions you must follow when contributing.
 
 ## What this is
 
-LearnStack is a **multi-tenant core platform for building education
-products** — not a single LMS. It powers arbitrarily-domained education
-products (English-learning, yoga, coding bootcamps, music schools,
-driving schools, …) on the **same code paths**; the difference between
-them is **tenant customization data** loaded at provisioning, not code.
-The first showcase tenant is an online English-learning platform
-(Phase 10); the substrate-genericity proof is a second non-English
-tenant running the same code paths.
+LearnStack is a **white-label platform for multi-branch education
+businesses that teach live** — not a single LMS, and not an education
+product of its own. One binary, one schema, and one set of container
+images serve a language school, a yoga studio, a music school, or a
+coding bootcamp. What differs between them is **tenant customization
+data** loaded at provisioning, not code
+([ADR-0018](docs/decisions/0018-tenant-driven-customization-model.md)).
+
+That claim has a stated edge, and the edge lives in exactly one place:
+[Platform Vision § Genericity boundary](docs/architecture/01-platform-vision.md).
+Content shape, presentation, and pure rule evaluation are tenant data.
+Stateful entitlement (credit packs, session quotas) and external
+capability invocation (running submitted code, scoring speech) are
+platform features gated by plan — they need a release, not a
+customization row. Link to that section; do not restate it.
 
 LearnStack ships in three production deployment modes — SaaS, Dedicated,
-Self-Hosted — backed by the companion **`learnstack-hub`** repository
-(separate repo, see [ADR-0019](docs/decisions/0019-learnstack-hub.md)).
-The Hub repo lives at sibling path `../learnstack-hub` on developer
-workstations; GitHub: https://github.com/cemililik/LearnStack-Hub.
-Phase 02c P02c-0 (Hub repo bootstrap) shipped 2026-05-21 — see the
-Phase 02c roadmap doc for the per-packet status.
+Self-Hosted — backed by the companion **LearnStack Hub** control plane
+(separate repository, see
+[ADR-0019](docs/decisions/0019-learnstack-hub.md)). On developer
+workstations the Hub repo is the sibling directory `../LearnStack-Hub`;
+GitHub: https://github.com/HodeTech/LearnStack-Hub. The Hub repository
+**owns its own roadmap** at `../LearnStack-Hub/docs/roadmap/`; this
+repository holds only LearnStack's side of the boundary, in
+[Phase 02c](docs/roadmap/phase-02c-hub-foundation.md).
 
 ## What state this is in
 
-**Phase 01 complete — repository scaffolding, local infrastructure, DX,
-and CI baseline. No domain code yet — Phase 02a starts that.**
-
-What shipped: the .NET 10 solution scaffold under `backend/` (core + 7
-modules × 4 projects + 4 test projects including the non-skippable
-`LearnStack.Tests.Architecture`), the `pnpm` frontend monorepo under
-`frontend/` (`apps/web` Next.js App Router + `packages/{config,ui,sdk}`),
-the full local-dev compose stack at `infra/compose/dev.yml` — PostgreSQL
-18, Valkey, SeaweedFS, Mailpit, Meilisearch, Keycloak (two realms),
-LiveKit OSS + Coturn, Kafka + kafka-ui, Vault, Dapr sidecar + placement,
-APISIX in file-driven standalone mode — and the DX + CI surround
-(repo-root `Makefile`, `.env.example` single source of truth,
-`.githooks/pre-commit` formatter + Leakwatch, `infra/compose/e2e.yml`
-ephemeral overlay, `.github/workflows/ci.yml` with backend + frontend +
-meta + secret-scan required checks, `scripts/seed.sh`).
-
-Every module assembly is empty of domain code today. Module-level
+**Phase 01 complete.
+[Phase 02a](docs/roadmap/phase-02a-kernel-tenancy.md) in progress —
+packets 0–3 shipped; packets 3b–10 were re-scoped on 2026-08-08 after a
+four-report audit of the corpus.**
+
+**Phase 01** shipped the .NET 10 solution scaffold under `backend/`
+(core + 7 modules × 4 projects + 4 test projects including the
+non-skippable `LearnStack.Tests.Architecture`), the `pnpm` frontend
+monorepo under `frontend/` (`apps/web` Next.js App Router +
+`packages/{config,ui,sdk}`), the local-dev compose stack at
+`infra/compose/dev.yml`, and the DX + CI surround (repo-root `Makefile`,
+`.env.example` single source of truth, `.githooks/pre-commit` formatter +
+Leakwatch, `infra/compose/e2e.yml` ephemeral overlay,
+`.github/workflows/ci.yml` with backend + frontend + meta + secret-scan
+required checks, `scripts/seed.sh`).
+
+**Phase 02a packets 0–3** shipped the decision set (Vogen, API
+versioning, audit partition management), the shared kernel core
+(`Result<T>` + `LocalizedMessage`, `Entity<TId>` / `AuditableEntity<TId>`,
+domain events, cursor pagination, `IClock` / `IRandom` / `IGuidFactory`),
+and the [ADR-0032](docs/decisions/0032-exception-handling-logging-and-observability.md)
+cross-cutting foundation (L1 `IExceptionHandler`, the eight-step MediatR
+pipeline, Serilog → OTLP, `TenantContextSpanProcessor`,
+`IErrorTrackingProvider`, `IProviderResilience<TPort>`, the `LS0001`
+analyzer). Those records are frozen delivery history.
+
+**The 2026-08-08 restructure** re-scoped packets 3b–10 along three lines,
+all recorded in the Phase 02a Status block:
+
+- *Correctness moved earlier.* The Row Level Security template that four
+  documents carried produced two **permissive** policies, which
+  PostgreSQL combines with `OR` — leaking every tenant-wide row across
+  tenants. [ADR-0003 Amendment 3](docs/decisions/0003-tenant-isolation-defense-in-depth.md)
+  corrects it, and [ADR-0033](docs/decisions/0033-audit-durability-model.md)
+  makes MUST-class audit a durable intent inside the business
+  transaction — which is also what stops the corrected policy from
+  rejecting every audit insert.
+- *Additive infrastructure moved later.* Per
+  [ADR-0035](docs/decisions/0035-demand-gated-infrastructure.md), Packet 5
+  ships the foundation **ports and their default implementations**; the
+  Dapr, Kafka, APISIX and Vault adapters land in
+  [Phase 11](docs/roadmap/phase-11-production-hardening.md) against
+  written triggers.
+- *Proof moved earlier.* Two seed tenants in unrelated domains land in
+  Packet 7, and [Phase 02d](docs/roadmap/phase-02d-walking-skeleton.md)
+  renders both of them in a browser.
+
+**[Phase 02d: Two-Tenant Walking Skeleton](docs/roadmap/phase-02d-walking-skeleton.md)
+is the next user-visible milestone** — the first phase whose output
+someone who does not read C# can evaluate: two hosts, two tenants, two
+education sites, one binary and one database.
+
+Every module assembly is still empty of domain code. Module-level
 references in the docs (e.g. `LearnStack.Modules.Education.Application`,
 `ILiveClassProvider`, `ITenantSearch`) describe **intended** shape that
-the corpus anchors against — Phase 02a (Platform Kernel +
-Multi-Tenancy) is where those types actually land. Phase 02c (Hub
-Foundation, separate `learnstack-hub` repo) runs in parallel.
+the corpus anchors against; Phase 02a packets 6–9 and Phase 02d are
+where the first of those types actually land.
 
 ## Where to start
 
@@ -55,10 +99,19 @@ For any task, read in this order:
 1. [README.md](README.md) — direction at a glance.
 2. [docs/architecture/01-platform-vision.md](docs/architecture/01-platform-vision.md) — what we build and why.
 3. [docs/architecture/05-mvp-scope.md](docs/architecture/05-mvp-scope.md) — what is in / out / deferred.
-4. [docs/roadmap/README.md](docs/roadmap/README.md) — phased plan with explicit dependencies.
+4. [docs/roadmap/README.md](docs/roadmap/README.md) — phased plan with explicit dependencies and the one-way-door sequencing principle.
 5. [docs/standards/00-principles.md](docs/standards/00-principles.md) — the beliefs every other standard descends from.
 6. [docs/glossary.md](docs/glossary.md) — terminology; the single source of truth for project-specific terms.
 
+Then read the two phases that are live:
+
+- [docs/roadmap/phase-02a-kernel-tenancy.md](docs/roadmap/phase-02a-kernel-tenancy.md)
+  — the current phase, with a dated Status block listing every packet.
+- [docs/roadmap/phase-02d-walking-skeleton.md](docs/roadmap/phase-02d-walking-skeleton.md)
+  — what Phase 02a is building toward. `02d` sorts after `02b`/`02c` but
+  runs **before** them; the roadmap dependency map is authoritative for
+  order, filename order is not.
+
 Once the high-level reading is done, pick **exactly one** skill entry point based
 on the user's intent. The entry point dispatches the rest internally; do not
 chain entry points yourself.
@@ -82,8 +135,8 @@ let the entry point pick it.
 |-----------|---------|------------|
 | `docs/architecture/` | Conceptual descriptions of what we are building. Numbered `NN-topic.md` linearly. | Editable as the system evolves. |
 | `docs/decisions/` | ADRs — one-time decisions with status, context, decision, consequences. Redirect / superseded ADRs live under `_redirects/`. | Accepted ADRs are immutable except for dated Amendments. |
-| `docs/standards/` | Engineering rules (`NN-topic.md`, 00 – 20). Each anchored standard carries a `**Derives from:** ADR-NNNN` header. | Editable as the team learns; standard changes cite an ADR. |
-| `docs/roadmap/` | Phased plan (`phase-NN-topic.md`, 00 – 12 with 02a/02b/02c, 08a/08b/08c, and 09/09b splits). | Editable per phase. |
+| `docs/standards/` | Engineering rules (`NN-topic.md`, 00 – 21). Each anchored standard carries a `**Derives from:** ADR-NNNN` header. | Editable as the team learns; standard changes cite an ADR. |
+| `docs/roadmap/` | Phased plan (`phase-NN-topic.md`, 00 – 12 with 02a/02b/02c/**02d**, 08a/08b/08c, and 09/09b splits). Every phase doc carries the same six sections — Goal, Scope, Deliverables, Completion Criteria, Risks, Phase Exit Decision — with three declared exceptions listed in [the roadmap index](docs/roadmap/README.md): Phase 09b and Phase 12 are pointer documents into the Hub repository, and Phase 01 predates the convention. | Editable per phase; the Status block of a shipped packet is a dated delivery record and is not rewritten. |
 | `docs/glossary.md` | Terminology source of truth. | Editable; new term goes here first, then used. |
 
 > `docs/analysis/` exists locally but is **gitignored** — it is a private scratchpad
@@ -98,14 +151,17 @@ let the entry point pick it.
 - **Single source of truth.** Each piece of knowledge lives in exactly one place. The glossary holds terms. ADRs hold decisions. Standards hold ongoing rules. Architecture docs hold conceptual descriptions. Roadmap holds phases. Do not duplicate.
 - **ADR numbers are sequential and never reused.** Superseded ADRs become redirect stubs under `decisions/_redirects/`. Adding a new ADR uses the next free number.
 - **Standards changes cite an ADR.** A new standard rule or a change to an existing one is paired with an ADR when the rule is non-trivial.
-- **Modular monolith with four cross-module mechanisms** ([ADR-0010](docs/decisions/0010-cross-module-communication.md)): application contract, intra-module domain event, integration event via outbox (dispatched through Dapr pub/sub per Amendment 1), read-model projection. No fifth.
+- **Modular monolith with four cross-module mechanisms** ([ADR-0010](docs/decisions/0010-cross-module-communication.md)): application contract, intra-module domain event, integration event via outbox (dispatched through `IEventBus` — `InProcessEventBus` today, the Dapr/Kafka adapter on its trigger), read-model projection. No fifth.
 - **Tenant + organization isolation is defense-in-depth from day one** ([ADR-0003 Amendment 1](docs/decisions/0003-tenant-isolation-defense-in-depth.md), [ADR-0017](docs/decisions/0017-tenant-organization-hierarchy.md)): tenant + organization context + EF query filters + PostgreSQL RLS + architecture tests.
-- **Self-hosted infrastructure preferred** for Keycloak (auth, with two realms — `learnstack` + `learnstack-hub`), LiveKit OSS (live classroom), SeaweedFS (object storage), Meilisearch (search), Kafka (pub/sub backend), Vault (secrets). See ADRs 0004, 0005, 0014.
-- **The core platform stays domain-generic.** Domain-specific shapes (CEFR levels, English placement-test scoring, kyu/dan ranks, yoga asana catalogs, …) live as **tenant customization data** ([ADR-0018](docs/decisions/0018-tenant-driven-customization-model.md)), never as code in any module. There is no `Verticals/` folder. ADR-0011 is superseded.
-- **Foundation building blocks are Day-1, not Phase-11.** Dapr (`IEventBus`/`ICacheService`/`ISecretProvider`), APISIX gateway, audit infrastructure, organization scope, entitlement projection socket, host-to-tenant resolver, and architecture tests all ship in Phase 02a — not as later hardening.
-- **Provider adapters everywhere.** Payments, auth, storage, search, live classroom, notifications, **event bus, cache, secrets, Hub HTTPS contract, entitlement source, host resolver** — all sit behind interfaces. No SaaS lock-in in `Domain` or `Application`. See [20-infrastructure-stack.md](docs/standards/20-infrastructure-stack.md).
-- **Hub HTTPS contract surface is closed at four endpoints.** Adding a fifth requires a new ADR. See [ADR-0019](docs/decisions/0019-learnstack-hub.md).
-- **Three deployment modes, one binary.** `SaaS` / `Dedicated` / `SelfHosted` selection happens at composition root via `DeploymentMode`; module code never branches on the mode. See [ADR-0020](docs/decisions/0020-triple-deployment-hybrid-license.md).
+- **One canonical RLS template, in one file.** The corrected policy shape — one `AND`-ed policy per table, `ENABLE` **and** `FORCE ROW LEVEL SECURITY`, an explicit `WITH CHECK`, and the four-role model (`learnstack_migration` owns, `learnstack_app` connects with `NOBYPASSRLS`, `learnstack_platform` and `learnstack_outbox_admin` hold audited bypasses) — is decided in [ADR-0003 Amendment 3](docs/decisions/0003-tenant-isolation-defense-in-depth.md) and written as SQL in exactly one document: [Database Standards](docs/standards/05-database.md). Every other document links there. The superseded template lived in four documents and was wrong in all four — two *permissive* policies, which PostgreSQL combines with `OR`, so every tenant-wide row was visible across tenants.
+- **Self-hosted infrastructure preferred** for Keycloak (auth, with two realms — `learnstack` + `learnstack-hub`), LiveKit OSS (live classroom), SeaweedFS (object storage), Meilisearch (search), Kafka (pub/sub backend), Vault (secrets). See ADRs 0004, 0005, 0014. **What** LearnStack uses is settled; **when** each arrives is [ADR-0035](docs/decisions/0035-demand-gated-infrastructure.md)'s trigger table.
+- **The core platform stays domain-generic.** Domain-specific shapes (CEFR levels, English placement-test scoring, kyu/dan ranks, yoga asana catalogs, …) live as **tenant customization data** ([ADR-0018](docs/decisions/0018-tenant-driven-customization-model.md)), never as code in any module. There is no `Verticals/` folder. ADR-0011 is superseded. The boundary of that claim is in [Platform Vision § Genericity boundary](docs/architecture/01-platform-vision.md).
+- **Irreversible now, additive on demand — the one-way-door test** ([ADR-0035](docs/decisions/0035-demand-gated-infrastructure.md)): *if I add this six months from now, will I have to touch code that is already written?*
+  - **Yes → ship it now.** Tenant + organization isolation, the corrected RLS policies, the `outbox_messages` table and its ownership, strongly-typed identifiers, the localization schema, MUST-class audit durability, module boundaries and their architecture tests. These touch every query, every migration, and every job payload.
+  - **No → ship the port now, the adapter on a named trigger.** Dapr pub/sub, Kafka, Valkey-backed cache, Vault, APISIX, the Hub entitlement source, signed licence keys, custom-domain TLS automation, `audit_log` partitioning. Each has a port in `LearnStack.SharedKernel` (shipped, or landing in Phase 02a Packet 5), a working default implementation (`InProcessEventBus`, `InMemoryCacheService`, `ConfigurationSecretProvider`, `NullEntitlementProvider`), an owning phase, and a written trigger condition. A building block missing any of those four is not demand-gated — it is missing.
+- **Provider adapters everywhere.** Payments, auth, storage, search, live classroom, notifications, **event bus, cache, secrets, Hub contract, entitlement source, host resolver** — all sit behind interfaces. No SaaS lock-in in `Domain` or `Application`. See [20-infrastructure-stack.md](docs/standards/20-infrastructure-stack.md).
+- **The Hub contract is governed by two invariants, not by a count** ([ADR-0034](docs/decisions/0034-hub-contract-surface-invariant.md)): (1) the Hub stores **no tenant content** — courses, lessons, learners, enrollments, sessions and media live only in LearnStack, and the Hub holds tenant *metadata* only; (2) **every LearnStack↔Hub crossing goes through a named adapter** — `IEntitlementProvider`, `IUsageReporter`, `IHubTenantSync`, and nothing else may hold a Hub client. Adding an endpoint still requires an ADR, because the surface is a cross-repository contract both repositories have to agree on.
+- **One binary, five `DeploymentMode` values, two of them wired.** Selection happens at the composition root; module code never branches on the mode ([ADR-0020](docs/decisions/0020-triple-deployment-hybrid-license.md), enforced by `Modules_Do_Not_Reference_DeploymentMode`). `Development` and `SaaS` are wired end to end; `Dedicated`, `SelfHostedOnline` and `SelfHostedAirGapped` are **prepared seams, not supported deployments**, until [Phase 11](docs/roadmap/phase-11-production-hardening.md) builds their adapters and integration suites.
 
 ## Conventions when editing docs
 
@@ -128,7 +184,8 @@ rules:
   `frontend/apps/web` with route segments
   ([03](docs/standards/03-frontend-coding.md),
   [07](docs/standards/07-frontend-architecture.md)). The operator portal
-  (`learnstack-hub-web`) is a separate app in the `learnstack-hub` repo.
+  is a separate app, `frontend/apps/operator-portal`, in the
+  `LearnStack-Hub` repository.
 - REST + RFC 7807 Problem Details + cursor pagination + idempotency
   keys + ETag concurrency ([04](docs/standards/04-api-design.md)).
 - OpenTelemetry + correlation id end to end ([10](docs/standards/10-observability.md)).
@@ -136,9 +193,12 @@ rules:
 - Audit-coverage matrix required per module ([18](docs/standards/18-audit-coverage.md)).
 - Permission keys `{module}.{resource}.{action}` with closed action set + scope
   (Platform / Tenant / Organization) ([19](docs/standards/19-permissions.md)).
-- Infrastructure-stack rules (Dapr building blocks, APISIX, Hub HTTPS contract,
-  outbox + inbox, entitlement projection) in
-  [20](docs/standards/20-infrastructure-stack.md).
+- Infrastructure-stack rules (foundation ports and their default
+  implementations, the Hub contract surface, outbox + inbox, entitlement
+  projection) in [20](docs/standards/20-infrastructure-stack.md).
+- The architecture-test catalogue in
+  [21](docs/standards/21-architecture-tests-catalogue.md) — canonical rule
+  names live there; do not invent a second spelling.
 - Zero-tolerance review blockers enumerated in [17](docs/standards/17-code-review.md).
 
 ## Commit conventions
@@ -149,7 +209,7 @@ rules:
   `architecture`, `decisions`, `standards`, `roadmap`, or omitted for
   cross-cutting changes.
 - Commits made with AI assistance carry the trailer
-  `Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>`.
+  `Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>`.
 
 ## Things to never do
 
@@ -162,9 +222,45 @@ rules:
   [ADR-0018](docs/decisions/0018-tenant-driven-customization-model.md).
   There is no `Verticals/` folder; the architecture test
   `No_Source_Folder_Named_Verticals` enforces it.
-- Add a fifth endpoint to the Hub HTTPS contract surface without an ADR.
+- Add an endpoint to the Hub contract surface without an ADR. The count
+  is not the rule — [ADR-0034](docs/decisions/0034-hub-contract-surface-invariant.md)'s
+  two invariants are — but the surface is a cross-repository contract, so
+  it changes by decision record, in both repositories, or not at all.
 - Call Hub endpoints from anywhere except the dedicated
   `IEntitlementProvider` / `IUsageReporter` / `IHubTenantSync` adapters.
+- Resolve a host by calling the Hub. `IHostToTenantResolver` reads
+  `platform_host_to_tenant` and nothing else
+  ([ADR-0034](docs/decisions/0034-hub-contract-surface-invariant.md)); an
+  anonymous page load must never depend on a control plane being
+  reachable.
+- Carry TLS certificates or private keys in the entitlement payload. Cert
+  material moves by secret-store replication and is referenced by path
+  from `PUT /api/internal/tenants/{id}/host-mappings`, never by value
+  through a payload LearnStack caches, logs, audits and mirrors.
+- Copy the RLS template into a second document. It lives only in
+  [Database Standards](docs/standards/05-database.md); everywhere else
+  links to it. The last duplication shipped a broken policy into four
+  files at once.
+- Run a tenant- or organization-isolation test as the table owner or as a
+  `BYPASSRLS` role. Isolation tests connect as **`learnstack_app`** — a
+  test that runs as `learnstack_migration`, `learnstack_platform` or
+  `learnstack_outbox_admin` passes even when every policy is inert, and
+  therefore proves nothing.
+- Write a MUST-class audit row outside the business transaction. MUST-class
+  audit is written on the **same transaction** as the state change it describes
+  ([ADR-0033](docs/decisions/0033-audit-durability-model.md)) — `AuditLogBehavior`
+  classifies and parks the intent, `TransactionBehavior` writes it immediately
+  before `COMMIT` — so it commits with that change or not at all, and so it
+  executes while `app.tenant_id` is set and RLS accepts it. "The same
+  `SaveChanges` as the business write" was the earlier formulation and ADR-0033
+  **withdraws** it: the guarantee is the transaction, which is what a reader of
+  `audit_log` observes and which needs no cross-`DbContext` machinery. A tenant `AuditConfig` may
+  narrow SHOULD/MAY coverage but never removes baseline MUST coverage. Exactly
+  two failures reject the operation: an operation the catalogue does not
+  classify at all, and a MUST-class row that cannot be written durably. A
+  tenant-override **read** failure does not — it falls back to the in-process
+  catalogue, which carries the same MUST floor, so nothing proceeds unaudited
+  and a cache outage does not deny every request platform-wide.
 - Inject `IConnectionMultiplexer` / `IDistributedCache` / `KafkaProducer` /
   `VaultClient` directly — use `IEventBus` / `ICacheService` /
   `ISecretProvider`.
@@ -180,7 +276,11 @@ rules:
   the existing documents ambiguous about ownership; if a topic needs
   more space, expand the existing doc rather than splintering.
 - Mention a feature as "deferred to a later phase" without naming the
-  phase that owns it.
+  phase that owns it. For an infrastructure building block the bar is
+  higher: name the **port**, the **default implementation**, the **owning
+  phase**, and the **trigger condition**
+  ([ADR-0035](docs/decisions/0035-demand-gated-infrastructure.md)). Three
+  out of four is not demand-gating.
 - Throw `DomainException` for expected business-rule violations — use
   `Result.Fail(business_rule_violation, ...)`.
   `DomainException` is reserved for programmer errors / aggregate invariant
diff --git a/README.md b/README.md
index dd8b498..ee356fe 100644
--- a/README.md
+++ b/README.md
@@ -1,46 +1,70 @@
 # LearnStack
 
-LearnStack is a **multi-tenant core platform for building education products** — not a
-single LMS. It is an education-aware CMS and platform engine that powers different
-learning brands, landing pages, catalogs, portals, and **domain-agnostic** education
-products. The same code paths serve an online English-learning brand, a yoga studio,
-a coding bootcamp, a music school, or a driving school — the difference between them
-is **tenant customization data** loaded at provisioning, not compiled code.
-
-The first showcase tenant happens to be an online English-learning platform (Phase 10);
-the substrate-genericity proof is a second, non-English tenant running the same code
-paths against its own customization data.
+LearnStack is a **white-label platform for multi-branch education businesses that teach
+live** — not a single LMS, and not an education product of its own. It is an
+education-aware CMS, learning engine, and platform foundation that powers different
+brands, landing pages, catalogs, and learner portals. The same code paths serve a
+language school, a yoga studio, a music school, or a coding bootcamp — the difference
+between them is **tenant customization data** loaded at provisioning, not compiled code
+([ADR-0018](docs/decisions/0018-tenant-driven-customization-model.md)).
+
+That claim has a stated edge: content shape, presentation and pure rule evaluation are
+tenant data; stateful entitlement and external capability invocation are platform
+features gated by plan. See
+[Platform Vision § Genericity boundary](docs/architecture/01-platform-vision.md).
+
+Two tenants in unrelated domains exist from
+[Phase 02a Packet 7](docs/roadmap/phase-02a-kernel-tenancy.md) onward and are both
+rendered in a browser in [Phase 02d](docs/roadmap/phase-02d-walking-skeleton.md), so
+genericity is tested continuously rather than asserted and checked once at the end.
 
 LearnStack ships in three production deployment modes — SaaS, Dedicated, Self-Hosted —
-backed by the companion **`learnstack-hub`** repository which provides the SaaS /
+backed by the companion **LearnStack Hub** repository, which provides the SaaS /
 Dedicated control plane, plan editor, custom-domain admin, and license-key issuance.
 
-The Hub repo is expected to live at `../learnstack-hub` (sibling to this repo on the
-developer's workstation) so the cross-repo doc cross-links resolve. See
-[learnstack-hub on GitHub](https://github.com/cemililik/LearnStack-Hub) and
-[docs/roadmap/phase-02c-hub-foundation.md](docs/roadmap/phase-02c-hub-foundation.md).
+Today only `Development` and `SaaS` are wired and tested end to end. `Dedicated` and
+the two Self-Hosted `DeploymentMode` values (`SelfHostedOnline`,
+`SelfHostedAirGapped`) are **prepared seams, not supported deployments** — the
+composition root branches on them, but their adapters and integration suites land in
+[Phase 11](docs/roadmap/phase-11-production-hardening.md) per
+[ADR-0035](docs/decisions/0035-demand-gated-infrastructure.md). See
+[25-deployment-models.md](docs/architecture/25-deployment-models.md) for what a
+prepared seam means concretely.
+
+The Hub repo is expected to live at `../LearnStack-Hub` (sibling to this repo on the
+developer's workstation) so the cross-repo doc links resolve. The Hub repository owns
+its own roadmap at `../LearnStack-Hub/docs/roadmap/`. See
+[LearnStack-Hub on GitHub](https://github.com/HodeTech/LearnStack-Hub) and
+[docs/roadmap/phase-02c-hub-foundation.md](docs/roadmap/phase-02c-hub-foundation.md)
+for LearnStack's side of the boundary.
 
 ## Status
 
-Phase 01 complete. The repository now holds the .NET 10 solution scaffold (7
-modules × 4 projects + 4 test projects with `No_Source_Folder_Named_Verticals`
-architecture test), the `pnpm` frontend monorepo (`apps/web` +
-`packages/{config,ui,sdk}`), the full local-dev `docker-compose` stack —
-PostgreSQL 18, Valkey, SeaweedFS, Mailpit, Meilisearch, Keycloak (two realms),
-LiveKit OSS + Coturn, Kafka + kafka-ui, Vault, Dapr sidecar + placement, APISIX
-(file-driven standalone) — and the DX + CI surround: repo-root `Makefile`,
-`.env.example` single source of truth, `.githooks/pre-commit` formatter,
-`infra/compose/e2e.yml` ephemeral overlay, `.github/workflows/ci.yml`, and
-`scripts/seed.sh`. See [docs/roadmap/phase-01-repository-tooling.md](docs/roadmap/phase-01-repository-tooling.md)
-for the per-packet history. Phase 02a (Platform Kernel + Multi-Tenancy) is
-underway; see [Phase 02a Status & Packets](docs/roadmap/phase-02a-kernel-tenancy.md)
-for the 11-packet breakdown. Packets 0 (Kickoff) and 1 (Foundation decisions
-— [ADR-0023](docs/decisions/0023-strongly-typed-id-source-generator.md) Vogen,
+**Phase 01 complete. [Phase 02a](docs/roadmap/phase-02a-kernel-tenancy.md) in progress —
+packets 0–3 shipped; packets 3b–10 re-scoped on 2026-08-08.**
+
+Phase 01 shipped the .NET 10 solution scaffold, the `pnpm` frontend monorepo
+(`apps/web` + `packages/{config,ui,sdk}`), the local-dev `docker-compose` stack, and the
+DX + CI surround. See
+[phase-01-repository-tooling.md](docs/roadmap/phase-01-repository-tooling.md) for the
+per-packet history.
+
+Phase 02a packets 0–3 shipped the foundation decisions
+([ADR-0023](docs/decisions/0023-strongly-typed-id-source-generator.md) Vogen,
 [ADR-0024](docs/decisions/0024-api-versioning-policy.md) API versioning,
-[ADR-0028](docs/decisions/0028-audit-log-partition-management.md) audit
-partition mgmt) have shipped; Packet 2 — Shared Kernel core is next.
-Phase 02c (Hub Foundation, parallel, separate repo) starts once the 02a
-sockets it depends on are in place.
+[ADR-0028](docs/decisions/0028-audit-log-partition-management.md) audit partition
+management — whose *timing* later moved to Phase 11), the shared kernel core, and the
+[ADR-0032](docs/decisions/0032-exception-handling-logging-and-observability.md)
+cross-cutting foundation.
+
+The 2026-08-08 restructure moved correctness earlier (the corrected RLS template in
+[ADR-0003 Amendment 3](docs/decisions/0003-tenant-isolation-defense-in-depth.md), durable
+MUST-class audit in [ADR-0033](docs/decisions/0033-audit-durability-model.md)), moved
+additive infrastructure later behind its ports
+([ADR-0035](docs/decisions/0035-demand-gated-infrastructure.md)), and moved the
+genericity proof earlier — two seed tenants in Packet 7, rendered in a browser in
+[Phase 02d](docs/roadmap/phase-02d-walking-skeleton.md), the next user-visible
+milestone. Module assemblies hold no domain code yet.
 
 ```bash
 make install   # one-time: deps + git hooks
@@ -48,38 +72,56 @@ make dev       # bring local stack up
 make seed      # verify health + print demo credentials
 ```
 
+> `make seed`'s health gate currently times out, because three compose services declare
+> no healthcheck. [Phase 02a Packet 3b](docs/roadmap/phase-02a-kernel-tenancy.md) fixes
+> it along with the rest of the Phase 01 development-loop debt.
+
 ## Direction At A Glance
 
 - **Backend:** .NET 10, ASP.NET Core, Entity Framework Core, MediatR.
-- **Database:** PostgreSQL 18, with Row-Level Security from day one. Tenant + **Organization**
-  defense in depth ([ADR-0003 Amendment 1](docs/decisions/0003-tenant-isolation-defense-in-depth.md),
-  [ADR-0017](docs/decisions/0017-tenant-organization-hierarchy.md)).
-- **Cache / Pub-Sub / Secrets:** Valkey 8 (RESP-protocol Linux-Foundation BSD fork
-  per [ADR-0030](docs/decisions/0030-redis-compatible-store-valkey.md)), Kafka,
-  HashiCorp Vault — all accessed via **Dapr** building blocks (`IEventBus`,
-  `ICacheService`, `ISecretProvider`) per
-  [ADR-0014](docs/decisions/0014-adopt-dapr.md).
-- **API Gateway:** **APISIX** in file-driven standalone (`data_plane`) mode per
-  [ADR-0015](docs/decisions/0015-api-gateway-apisix.md).
+- **Database:** PostgreSQL 18, with Row-Level Security from day one. Tenant +
+  **Organization** defense in depth
+  ([ADR-0003](docs/decisions/0003-tenant-isolation-defense-in-depth.md) Amendment 1 for
+  organization scope, **Amendment 3** for the corrected policy template and the
+  four-role database model,
+  [ADR-0017](docs/decisions/0017-tenant-organization-hierarchy.md)). The canonical SQL
+  lives in exactly one file:
+  [Database Standards](docs/standards/05-database.md).
+- **Foundation ports:** `IEventBus`, `ICacheService`, `ISecretProvider`,
+  `IEntitlementProvider`, `IHostToTenantResolver` in `LearnStack.SharedKernel`, each
+  with a working default implementation. Vendor adapters — Dapr
+  ([ADR-0014](docs/decisions/0014-adopt-dapr.md)), Kafka, Valkey
+  ([ADR-0030](docs/decisions/0030-redis-compatible-store-valkey.md)), Vault, APISIX
+  ([ADR-0015](docs/decisions/0015-api-gateway-apisix.md)) — are **demand-gated**: each
+  has an owning phase and a written trigger condition in
+  [ADR-0035](docs/decisions/0035-demand-gated-infrastructure.md).
 - **Object storage:** SeaweedFS locally, S3-compatible storage in production.
-- **Search:** Meilisearch initially.
+- **Search:** PostgreSQL full-text search first; Meilisearch behind `ITenantSearch` when
+  quality or scale requires it.
 - **Frontend:** Next.js 15 (App Router), TypeScript, React. **One** application
-  (`apps/web`) with route segments for public, studio, and portal — multi-app split
-  inside this repo deferred. The operator portal (`learnstack-hub-web`) lives in the
-  separate `learnstack-hub` repository.
+  (`apps/web`) with route segments for public, studio, and portal; a multi-app split
+  inside this repo is not planned before
+  [Phase 11](docs/roadmap/phase-11-production-hardening.md). The operator portal
+  (`frontend/apps/operator-portal`) lives in the separate `LearnStack-Hub` repository.
 - **Identity:** Self-hosted Keycloak with **two realms** — `learnstack` for tenant
   users, `learnstack-hub` for operators.
 - **Architecture:** Modular monolith with explicit module contracts.
 - **Tenant customization:** Per [ADR-0018](docs/decisions/0018-tenant-driven-customization-model.md),
   content types, page blocks, lesson item types, level taxonomies, scoring rules,
   completion rules, custom fields, and notification templates are **data** authored
-  by tenants, not code. The core stays generic.
+  by tenants, not code. The core stays generic, within the boundary the ADR's 2026-08-08
+  amendment draws.
 - **Audit:** Append-only `LearnStack.Modules.Audit` with EF interceptor + MediatR
-  behavior + partitioned `audit_log` table per
-  [ADR-0016](docs/decisions/0016-audit-log-subsystem.md).
+  behavior. MUST-class audit is a durable intent written inside the business
+  transaction per [ADR-0033](docs/decisions/0033-audit-durability-model.md), which
+  supersedes ADR-0016; `audit_log` partitioning and retention land in
+  [Phase 11](docs/roadmap/phase-11-production-hardening.md).
 - **Entitlements:** Feature-based projection mirrored from the Hub per
   [ADR-0021](docs/decisions/0021-feature-based-entitlement.md); typed
-  `FeatureKeys` / `LimitKeys` registries.
+  `FeatureKeys` / `LimitKeys` registries. The Hub contract is governed by two
+  invariants — the Hub stores no tenant content, and every crossing goes through a
+  named adapter — per
+  [ADR-0034](docs/decisions/0034-hub-contract-surface-invariant.md).
 - **Live classroom:** In-app WebRTC; **self-hosted LiveKit OSS** is the default;
   LiveKit Cloud available behind the same `ILiveClassProvider` interface. A custom
   WebRTC SFU is explicitly out of scope.
@@ -131,6 +173,7 @@ Platform substrate deep dives:
 - [30 — API Gateway (APISIX)](docs/architecture/30-api-gateway.md)
 - [31 — Audit Subsystem](docs/architecture/31-audit-subsystem.md)
 - [32 — Tenant Customization Model](docs/architecture/32-tenant-customization-model.md)
+- [33 — Cross-Cutting Concerns](docs/architecture/33-cross-cutting-concerns.md)
 
 Decision context:
 - [18 — WebRTC Build vs Adopt](docs/architecture/18-webrtc-build-vs-adopt.md)
@@ -138,16 +181,25 @@ Decision context:
 
 ### Decisions (`docs/decisions/`)
 - [ADR index](docs/decisions/README.md) — accepted decisions with their reasoning and
-  consequences. The 2026-05-18 redesign added ADRs 0014–0022.
+  consequences. The 2026-05-18 redesign added ADRs 0014–0022; the 2026-08-08
+  restructure added [ADR-0033](docs/decisions/0033-audit-durability-model.md) (audit
+  durability, supersedes ADR-0016),
+  [ADR-0034](docs/decisions/0034-hub-contract-surface-invariant.md) (Hub contract
+  invariants) and
+  [ADR-0035](docs/decisions/0035-demand-gated-infrastructure.md) (demand-gated
+  infrastructure).
 
 ### Engineering Standards (`docs/standards/`)
 - [Standards index](docs/standards/README.md) — rules that apply to every PR: coding,
   testing, security, observability, accessibility, performance,
-  [infrastructure-stack rules](docs/standards/20-infrastructure-stack.md), and more.
+  [infrastructure-stack rules](docs/standards/20-infrastructure-stack.md), and the
+  [architecture-test catalogue](docs/standards/21-architecture-tests-catalogue.md).
 
 ### Roadmap (`docs/roadmap/`)
-- [Phased roadmap](docs/roadmap/README.md) — phases 00 through 12, including the
-  Phase 02c (Hub Foundation) and Phase 09b (Hub Billing) parallel tracks.
+- [Phased roadmap](docs/roadmap/README.md) — phases 00 through 12, including
+  [Phase 02d](docs/roadmap/phase-02d-walking-skeleton.md) (Two-Tenant Walking Skeleton)
+  and the Phase 02c (Hub Integration) and Phase 09b (Hub Billing) parallel tracks. The
+  dependency map there is authoritative for order; filename order is not.
 
 ### Reference
 - [Glossary](docs/glossary.md) — canonical definitions.
@@ -168,7 +220,11 @@ For the strategy and the headline decisions:
 1. [Platform Vision](docs/architecture/01-platform-vision.md)
 2. [MVP Scope](docs/architecture/05-mvp-scope.md)
 3. [Roadmap overview](docs/roadmap/README.md)
-4. [ADR index](docs/decisions/README.md)
+4. [Phase 02a: Kernel + Tenancy](docs/roadmap/phase-02a-kernel-tenancy.md) — where the
+   work is now
+5. [Phase 02d: Two-Tenant Walking Skeleton](docs/roadmap/phase-02d-walking-skeleton.md)
+   — where it is going next
+6. [ADR index](docs/decisions/README.md)
 
 For the technical foundations:
 1. [Technical Architecture](docs/architecture/04-technical-architecture.md)
diff --git a/backend/analyzers/LearnStack.Analyzers/DomainExceptionThrowAnalyzer.cs b/backend/analyzers/LearnStack.Analyzers/DomainExceptionThrowAnalyzer.cs
index 86fedd3..fb7b67d 100644
--- a/backend/analyzers/LearnStack.Analyzers/DomainExceptionThrowAnalyzer.cs
+++ b/backend/analyzers/LearnStack.Analyzers/DomainExceptionThrowAnalyzer.cs
@@ -61,7 +61,7 @@ public sealed class DomainExceptionThrowAnalyzer : DiagnosticAnalyzer
         defaultSeverity: DiagnosticSeverity.Warning,
         isEnabledByDefault: true,
         description: Description,
-        helpLinkUri: "https://github.com/cemililik/LearnStack/blob/main/docs/decisions/0032-exception-handling-logging-and-observability.md");
+        helpLinkUri: "https://github.com/HodeTech/LearnStack/blob/main/docs/decisions/0032-exception-handling-logging-and-observability.md");
 
     public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics
         => ImmutableArray.Create(Rule);
diff --git a/backend/src/LearnStack.SharedKernel/Secrets/ConfigurationSecretProvider.cs b/backend/src/LearnStack.SharedKernel/Secrets/ConfigurationSecretProvider.cs
index 9fae778..7d1ff1d 100644
--- a/backend/src/LearnStack.SharedKernel/Secrets/ConfigurationSecretProvider.cs
+++ b/backend/src/LearnStack.SharedKernel/Secrets/ConfigurationSecretProvider.cs
@@ -5,9 +5,9 @@ namespace LearnStack.SharedKernel.Secrets;
 /// <summary>
 /// Default <see cref="ISecretProvider"/> that delegates to
 /// <see cref="IConfiguration"/>. Phase 02a Packet 3 ships this as the
-/// composition-root default for every <c>DeploymentMode</c>; Packet 5
-/// swaps it for the Dapr-backed implementation when running against a
-/// Vault-equipped environment.
+/// composition-root default for every <c>DeploymentMode</c>. Per ADR-0035 the
+/// Dapr/Vault-backed implementation is demand-gated to Phase 11, triggered by
+/// secrets needing rotation without a redeploy or a non-development deployment.
 /// </summary>
 /// <remarks>
 /// The configuration layer already merges environment variables, user
diff --git a/docs/architecture/01-platform-vision.md b/docs/architecture/01-platform-vision.md
index 8a82cce..8bcbc49 100644
--- a/docs/architecture/01-platform-vision.md
+++ b/docs/architecture/01-platform-vision.md
@@ -1,23 +1,42 @@
 # Platform Vision
 
-LearnStack is a **PaaS for education** — a platform on which customers build their own
-education platforms in arbitrary domains and disciplines. It is not itself an education
-product. Customers might use LearnStack to build:
+LearnStack is a **white-label platform for multi-branch education businesses that teach
+live**. Its customer is an education business — a language school with three branches, a
+yoga studio with four, a coding bootcamp, a music school — that sells courses, teaches
+them partly or wholly in scheduled live sessions, and wants its own brand on its own
+domain rather than a listing inside someone else's marketplace. LearnStack is not itself
+an education product.
+
+Three properties define the fit. A prospect that has none of them is not the target
+customer:
+
+- **Multi-branch.** Campuses, studios, departments, or cohorts that share one brand and
+  one catalog but keep their own members, staff, and schedules. This is the
+  `Organization` level ([ADR-0017](../decisions/0017-tenant-organization-hierarchy.md)),
+  and it is the reason a single-teacher course seller is a poor fit.
+- **Teaches live.** Scheduling, booking, attendance, and an in-app live classroom are
+  first-class subsystems, not an add-on bolted to a video library.
+- **Owns its brand.** Own domain, own design tokens, own locales, own notification
+  senders, own catalog — no LearnStack logo in the learner's browser.
+
+What is **not** fixed is the subject those businesses teach. The same code paths serve:
 
 - An online English-learning platform with CEFR levels and placement tests.
 - A yoga studio platform with asana taxonomy, sequence-based lessons, and teacher
   scheduling.
-- A coding bootcamp with code-challenge lesson items and automatic test-runner grading.
+- A coding bootcamp with programming-exercise lesson items and automatic grading.
 - A music school with score-reading lesson items, MIDI playback, and audio submissions.
 - A meditation app with timed practice sessions and habit-streak tracking.
 - A driving school with vehicle scheduling and progress-checkpoint workflows.
 - An art workshop with portfolio uploads and peer-review assessments.
-- A meditation, certification, exam-prep, or any domain not anticipated above.
+- A certification body, an exam-prep provider, or a domain not anticipated above.
 
 LearnStack ships **one codebase, one set of container images, one Helm chart** that
 serves all of these customers. The differentiator across customers is their **data**
 (content, content type definitions, page block schemas, scoring rules, level taxonomies,
 custom fields) — not their code. LearnStack engineers never write per-vertical code.
+That claim holds inside a stated edge — see
+[Genericity boundary](#genericity-boundary) below.
 
 ## Product thesis
 
@@ -37,6 +56,9 @@ Education businesses need infrastructure that is:
   ([24-learnstack-hub.md](24-learnstack-hub.md)).
 - **Deployment-flexible.** Same codebase deploys as SaaS, Dedicated (LearnStack-managed
   single-tenant), or Self-Hosted ([25-deployment-models.md](25-deployment-models.md)).
+  `Development` and `SaaS` are wired end to end today; the other three `DeploymentMode`
+  values are prepared seams until Phase 11 builds their adapters and integration suites
+  ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)).
 
 ## The three layers
 
@@ -85,11 +107,56 @@ flowchart TB
 See [28-platform-tenant-organization.md](28-platform-tenant-organization.md) for the full
 conceptual model.
 
+## Genericity boundary
+
+"The domain is data" is true inside a boundary, and stating the boundary is what keeps
+the claim credible. The boundary is drawn in
+[ADR-0018 Amendment (2026-08-08)](../decisions/0018-tenant-driven-customization-model.md);
+this section is its product-facing statement.
+
+**Inside the boundary — tenant customization data, no LearnStack release required:**
+
+| Dimension | What the tenant declares | Example |
+|---|---|---|
+| **Content shape** | A `TenantContentType` JSON Schema | A vocabulary card, an asana pose, a grammar topic, a repertoire piece |
+| **Presentation** | Which blocks compose a page, which fields a card renders, what the level taxonomy is called | CEFR A1–C2 versus Foundation–Advanced versus kyu/dan |
+| **Pure rule evaluation** | A `TenantScoringRule` or `TenantCompletionRule` expression | Map a placement-test answer set to a recommended level; decide a lesson is complete from facts already recorded |
+
+The discriminating property is that all three are **pure functions of tenant data and
+already-recorded state**. Nothing in this column holds new state or reaches outside the
+process, so a schema plus an evaluator is a complete answer.
+
+**Outside the boundary — platform features, written by LearnStack, gated by plan:**
+
+| Dimension | Example | Why it cannot be a customization row |
+|---|---|---|
+| **Stateful entitlement** | A ten-session credit pack; "three make-up classes per term"; a per-learner session quota | The tenant needs a balance that is decremented on booking, refunded on cancellation, expired on a schedule, and reconstructible in a dispute. **A JSON Schema declares a shape; it cannot declare a ledger.** |
+| **External capability invocation** | Running a learner's submitted program; scoring pronunciation from an audio clip; automated proctoring | The tenant needs a sandbox, a runtime, a resource budget, and a security boundary that survives hostile input. **A rule DSL evaluates; it does not execute arbitrary programs.** |
+
+Said plainly: **a tenant that needs something in the second column needs a LearnStack
+release, or an integration with an external provider through an adapter. It does not
+need — and cannot have — a customization row.** Sales conversations, plan design, and
+roadmap intake all depend on that sentence being said out loud rather than discovered
+during implementation.
+
+Two things this boundary does **not** change:
+
+- **The core stays domain-neutral either way.** A credit-pack ledger is not a yoga
+  feature and an execution sandbox is not a coding-bootcamp feature. Both are named for
+  the capability, never for the domain that first asked for it — the rule
+  `Core_Modules_HaveNo_DomainSpecific_Names` enforces the naming mechanically from
+  [Phase 02a Packet 10](../roadmap/phase-02a-kernel-tenancy.md).
+- **There is still no `Verticals/` folder.** A platform feature is a generic capability
+  offered to every tenant and switched on by a `FeatureKey`; it is not a per-vertical
+  code package. [ADR-0011](../decisions/0011-extension-points.md) stays superseded.
+
 ## Design principles
 
-- **Generic-only core.** No domain-specific code in LearnStack modules. CEFR, asanas,
-  code challenges live as **tenant data** (ADR-0018), never as `LearnStack.Verticals.*`
-  source code.
+- **Generic-only core.** No domain-specific code in LearnStack modules. CEFR levels,
+  asana taxonomies, and programming-exercise shapes live as **tenant data** (ADR-0018),
+  never as `LearnStack.Verticals.*` source code. Where a tenant need falls outside the
+  customization model, it becomes a **generically named platform capability** — see
+  [Genericity boundary](#genericity-boundary) — not a vertical package.
 - **Multi-tenant from day one.** Tenant isolation is non-negotiable; defense-in-depth =
   tenant context + organization filter + EF query filter + RLS + architecture tests
   (ADR-0003 Amendment 1).
@@ -100,9 +167,16 @@ conceptual model.
   The renderer is a client of the core, not the other way around.
 - **Provider adapters everywhere.** Payments, auth, storage, search, live classroom,
   notifications, recording — all behind interfaces. No SaaS lock-in baked into core code.
-- **Auditability and event tracking as platform primitives.** Domain events, integration
-  events (outbox → Dapr pub/sub → Kafka — ADR-0014), and audit log (ADR-0016) are designed
-  in, not bolted on.
+- **Auditability and event tracking as platform primitives.** Domain events, the
+  LearnStack-owned outbox, and the audit log are designed in, not bolted on. MUST-class
+  audit is a durable intent written inside the business transaction
+  ([ADR-0033](../decisions/0033-audit-durability-model.md), superseding ADR-0016).
+- **Ports on day one, adapters on demand.** The one-way-door test
+  ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)) separates decisions that
+  get more expensive every week — isolation, schema ownership, typed identifiers — from
+  decisions a port makes reversible. `IEventBus` ships in Phase 02a; its Dapr/Kafka
+  adapter ships in Phase 11 when a second process needs to consume an integration event
+  (ADR-0014 decides *what*, ADR-0035 decides *when*).
 - **Versioned publish workflows** for content and courses that affect learners.
 - **Hub-separated control plane.** Tenant lifecycle, billing, licensing, custom domains,
   compliance run in a separate codebase (`learnstack-hub`, ADR-0019). LearnStack core
@@ -134,9 +208,12 @@ When the foundation is in place, LearnStack should be able to:
   sales-assisted for Enterprise.
 - **Map a custom domain end-to-end** — DNS verification → Let's Encrypt cert → APISIX
   hot-reload → tenant resolver mapping. All Hub-orchestrated, ADR-0022.
-- **Run three radically different tenant platforms on the same binary** — English
-  learning + yoga studio + coding bootcamp + driving school — without LearnStack writing
-  any domain code.
+- **Run radically different tenant platforms on the same binary** — English learning +
+  yoga studio + coding bootcamp + driving school — without LearnStack writing any domain
+  code. Two such tenants exist from
+  [Phase 02a Packet 7](../roadmap/phase-02a-kernel-tenancy.md) and render side by side in
+  a browser from [Phase 02d](../roadmap/phase-02d-walking-skeleton.md), so the claim is
+  tested continuously rather than asserted until the showcase phase.
 - **Tenant admin defines a custom content type in Admin Studio** (e.g. "BreathTechnique"
   for a yoga tenant) — JSON Schema authored in a visual editor — and immediately uses it
   in a course lesson.
@@ -148,8 +225,10 @@ When the foundation is in place, LearnStack should be able to:
 - **Air-gapped customer renews a license key offline** — signed `.lic` file delivered via
   SFTP, placed on disk, SIGHUP triggers re-read, entitlement refreshed — no outbound
   network required.
-- **Regulator inquires about a specific tenant's history** — audit log (ADR-0016) plus
-  Hub audit stream answer "who did what when" with full correlation.
+- **Regulator inquires about a specific tenant's history** — audit log
+  ([ADR-0033](../decisions/0033-audit-durability-model.md)) plus Hub audit stream answer
+  "who did what when" with full correlation, and the MUST-class rows are there because
+  the operation would have been rejected if they could not be written.
 - **Customer migrates from SaaS to Self-Hosted** — same binary, same data export tools, no
   rewrite.
 
@@ -170,13 +249,20 @@ When the foundation is in place, LearnStack should be able to:
 
 ## References to formative decisions
 
-- ADR-0003 Amendment 1 — Tenant Isolation + Organization scope.
-- ADR-0014 — Adopt Dapr.
-- ADR-0015 — APISIX gateway.
-- ADR-0016 — Audit log subsystem.
+- ADR-0003 Amendment 1 (Organization scope) + Amendment 3 (corrected RLS template and
+  database role model) — Tenant Isolation.
+- ADR-0014 — Adopt Dapr (what), with ADR-0035 deciding when.
+- ADR-0015 — APISIX gateway (what), with ADR-0035 deciding when.
 - ADR-0017 — Tenant + Organization hierarchy.
-- ADR-0018 — Tenant-driven customization (supersedes ADR-0011 vertical packs).
+- ADR-0018 — Tenant-driven customization (supersedes ADR-0011 vertical packs); the
+  2026-08-08 Amendment draws the genericity boundary above.
 - ADR-0019 — LearnStack Hub.
 - ADR-0020 — Triple deployment + hybrid license.
 - ADR-0021 — Feature-based entitlement.
 - ADR-0022 — Custom domain & TLS.
+- [ADR-0033](../decisions/0033-audit-durability-model.md) — Audit durability model
+  (supersedes ADR-0016).
+- [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md) — Hub contract surface
+  invariant.
+- [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) — Demand-gated
+  infrastructure.
diff --git a/docs/architecture/02-domain-model.md b/docs/architecture/02-domain-model.md
index 0edb2ba..9d38047 100644
--- a/docs/architecture/02-domain-model.md
+++ b/docs/architecture/02-domain-model.md
@@ -130,7 +130,7 @@ flowchart LR
 
   subgraph enrollment["Enrollment"]
     Enrollment
-    Entitlement
+    CourseAccess
     Cohort
     Progress
   end
@@ -298,7 +298,7 @@ per ADR-0018, not on `Membership` extension tables.
 | Entity | Aggregate root? | Notes |
 |--------|-----------------|-------|
 | `Enrollment` | Yes | Grant of access to a `CourseVersion` (optionally bound to a `Cohort`). Has status (active, suspended, completed, cancelled) and source (manual, billing, invitation, integration). |
-| `Entitlement` | Yes | Right to access a paid or assigned capability. Enrollment is one source. |
+| `CourseAccess` | Yes | A learner's right to open a specific course. Sources: manual grant, invitation, cohort membership, billing. Not an `Entitlement` — that term is reserved for the Hub-owned, tenant-subject projection (see [glossary](../glossary.md)). |
 | `Cohort` | Yes | Group of learners progressing on a shared timeline through a `CourseVersion`. Has its own lifecycle (open → in-progress → completed → archived). |
 | `Progress` | Inside Enrollment | Learner advancement record. |
 
@@ -365,7 +365,7 @@ See [In-App Live Classroom](07-in-app-live-classroom.md) for the provider abstra
 | `InvoiceReference` | Inside Order | Pointer to external invoice/payment record. |
 | `PaymentProviderAccount` | Yes | Per-tenant provider configuration. |
 
-Billing produces `Entitlement`s; the Enrollment module consumes them through an integration event.
+Billing produces `CourseAccess` grants; the Enrollment module creates them on consuming `OrderPaidV1`.
 
 ## Analytics
 
@@ -406,12 +406,14 @@ examples live in [32-tenant-customization-model.md](32-tenant-customization-mode
 
 ## Audit
 
-Per [ADR-0016](../decisions/0016-audit-log-subsystem.md), the Audit module owns the
-append-only platform-level audit trail.
+Per [ADR-0033](../decisions/0033-audit-durability-model.md), which supersedes
+[ADR-0016](../decisions/0016-audit-log-subsystem.md), the Audit module owns the
+append-only platform-level audit trail and MUST-class rows commit with the state change
+they describe.
 
 | Entity | Aggregate root? | Notes |
 |--------|-----------------|-------|
-| `AuditEntry` | Yes (append-only — inherits `Entity<TId>` NOT `AuditableEntity<T>`) | One row per command/sensitive query/security event. Fields: `tenant_id`, `organization_id?`, `actor_user_id?`, `module`, `operation`, `operation_type`, `operation_class`, `entity_type?`, `entity_id?`, `is_success`, `error_key?`, `before_state` (jsonb), `after_state` (jsonb), `changes` (jsonb), `correlation_id?`, `ip_address?`, `user_agent?`, `timestamp`, `metadata?`. Stored in `audit_log` table partitioned by month. |
+| `AuditEntry` | Yes (append-only — inherits `Entity<TId>` NOT `AuditableEntity<T>`) | One row per command/sensitive query/security event. Fields: `tenant_id`, `organization_id?`, `actor_user_id?`, `module`, `operation`, `operation_type`, `operation_class`, `entity_type?`, `entity_id?`, `outcome` (`success` \| `denied` \| `failed`), `error_key?`, `before_state` (jsonb), `after_state` (jsonb), `changes` (jsonb), `correlation_id?`, `ip_address?`, `user_agent?`, `reason?`, `timestamp`, `metadata?`. Stored in the `audit_log` table — a single plain table with the composite key `(id, timestamp)` in Phase 02a; partitioned by month from [Phase 11](../roadmap/phase-11-production-hardening.md) per [ADR-0035](../decisions/0035-demand-gated-infrastructure.md). |
 | `AuditConfig` | Yes | Per-tenant override of per-(module, operation) audit enablement. Tenant-overridable within MUST/SHOULD/MAY classification. |
 
 Capture pipeline (`AuditChangeTrackerInterceptor` → `IAuditStateCapture` →
diff --git a/docs/architecture/03-module-boundaries.md b/docs/architecture/03-module-boundaries.md
index 4b05c37..430efcc 100644
--- a/docs/architecture/03-module-boundaries.md
+++ b/docs/architecture/03-module-boundaries.md
@@ -121,7 +121,7 @@ flowchart TB
   audit -. integration event consumer .-> classroom
 
   hubapi -. "mTLS + signed JWT + HMAC<br/>POST /api/internal/*" .-> tenancy
-  identity -. "API key<br/>POST /api/v1/internal/license/verify" .-> hubapi
+  identity -. "mTLS + JWT + HMAC<br/>POST /api/v1/internal/license/verify" .-> hubapi
 ```
 
 The dashed arrows are **integration events** (via Dapr pub/sub → Kafka, ADR-0014), **read-model projections**, or **Hub HTTPS contracts** — not direct calls or shared tables.
@@ -237,7 +237,7 @@ Owns external provider credentials, webhooks, API keys, LTI/xAPI readiness, inte
 | Read another module's **public read model** (projection table). | Joining across module-owned tables in SQL. |
 | Use the **shared kernel** (ids, audit fields, errors, pagination, base types, `IEventBus`, `ICacheService`, `ISecretProvider`, `IEntitlementProvider`). | Importing another module's `Domain` namespace. |
 | Provide an **adapter implementation** at the composition root. | Domain-specific names (`CEFR`, `Asana`, `Kyu`, …) anywhere in a core module — those belong to tenant customization data, not code. |
-| Read a **Hub-mirrored projection** (`platform_entitlement_cache`, `platform_host_to_tenant`) for read-only entitlement / host resolution. | Direct HTTPS calls to Hub from anywhere except `IEntitlementProvider` / `IHostToTenantResolver` adapter implementations. |
+| Read a **Hub-mirrored projection** (`platform_entitlement_cache`, `platform_host_to_tenant`) for read-only entitlement / host resolution. | Direct HTTPS calls to Hub from anywhere except the `IEntitlementProvider` / `IUsageReporter` / `IHubTenantSync` adapter implementations; resolving a host by calling the Hub at all — `IHostToTenantResolver` reads `platform_host_to_tenant` and nothing else ([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)). |
 | Reference the `LearnStack.Modules.Audit` module via integration events (Audit subscribes to events from other modules). | Writing to `audit_log` directly from outside the Audit infrastructure pipeline. |
 
 Architecture tests enforce these rules — see [Testing Standards](../standards/06-testing.md).
diff --git a/docs/architecture/04-technical-architecture.md b/docs/architecture/04-technical-architecture.md
index 0c082fb..0b9447d 100644
--- a/docs/architecture/04-technical-architecture.md
+++ b/docs/architecture/04-technical-architecture.md
@@ -17,7 +17,7 @@
 | Search | Meilisearch (initial), OpenSearch (later, if needed). See [ADR 0012](../decisions/0012-search-strategy.md) |
 | Auth | Keycloak (self-hosted OIDC) — two realms: `learnstack` (tenant users) + `learnstack-hub` (operators); ADR-0004 Amendment 1 |
 | Live classroom | LiveKit OSS (self-hosted) + coturn — see [07-in-app-live-classroom.md](07-in-app-live-classroom.md) |
-| Frontend | Next.js (App Router), React, TypeScript — one app for tenant users (`apps/web`); separate Next.js app for Hub operators (`learnstack-hub-web`, in `learnstack-hub` repo) |
+| Frontend | Next.js (App Router), React, TypeScript — one app for tenant users (`apps/web`); separate Next.js app for Hub operators (`operator-portal`, in `learnstack-hub` repo) |
 | API gateway | **Apache APISIX** (standalone mode) — JWT validation, rate limit, CORS, correlation ID; [30-api-gateway.md](30-api-gateway.md), [ADR-0015](../decisions/0015-api-gateway-apisix.md) |
 | API contract | REST + OpenAPI + RFC 7807 Problem Details; GraphQL only if a clear frontend requirement appears |
 | Observability | OpenTelemetry (traces + metrics + logs), Sentry, Grafana + Tempo + Loki + Prometheus |
@@ -31,7 +31,7 @@
 flowchart LR
   subgraph clients["Clients"]
     web[Public Site / Studio / Portal<br/>Next.js apps/web]
-    hubweb[Hub Operator Portal<br/>Next.js learnstack-hub-web]
+    hubweb[Hub Operator Portal<br/>Next.js operator-portal]
   end
 
   subgraph edge["Edge"]
@@ -97,7 +97,7 @@ flowchart LR
   lk --> egress
 
   hubapi -- "mTLS + signed JWT + HMAC<br/>POST /api/internal/*" --> api
-  api -- "API key<br/>POST /api/v1/internal/license/verify" --> hubapi
+  api -- "mTLS + JWT + HMAC<br/>POST /api/v1/internal/license/verify" --> hubapi
   hubapi --> kc_hub
   hubapi --> pg
 ```
@@ -147,7 +147,7 @@ Future options (deferred): schema-per-tenant for enterprise tenants, read replic
 - **Cursor pagination** for list endpoints. Offset pagination is allowed only for admin-bounded lists.
 - **Idempotency keys** for `POST` operations that have external side effects (payments, webhooks, send-notification).
 - **Optimistic concurrency** for any mutable entity using `xmin` or `row_version` column.
-- **API versioning** via URL prefix: `/v1/...`. Breaking changes bump to `/v2/...`; non-breaking additions stay on the existing version. ADR-pending.
+- **API versioning** via URL prefix: `/api/v1/...`. Breaking changes bump to `/api/v2/...`; non-breaking additions stay on the existing version. See [ADR-0024](../decisions/0024-api-versioning-policy.md), which fixed exactly this `/v1/` vs `/api/v1/` inconsistency.
 - **Authentication** via OIDC bearer tokens issued by Keycloak. Frontends use Auth.js to bridge.
 - **Authorization** layered: tenant scope → role/permission → resource ownership where applicable.
 
diff --git a/docs/architecture/05-mvp-scope.md b/docs/architecture/05-mvp-scope.md
index 7757e2c..5f56fe8 100644
--- a/docs/architecture/05-mvp-scope.md
+++ b/docs/architecture/05-mvp-scope.md
@@ -24,8 +24,12 @@ Run an end-to-end online English-learning tenant on LearnStack, where:
   scoring rule, speaking-practice lesson item, lesson-package custom fields) is loaded
   from `TenantContentType`, `TenantLevelTaxonomy`, `TenantScoringRule`, etc. **No
   English-specific code lives in any module.**
-- A second tenant exists in parallel with a **different** domain shape (e.g. coding or
-  yoga) loaded from its own customization data, proving the substrate is generic.
+- A second tenant — a **yoga studio** — has existed since
+  [Phase 02a Packet 7](../roadmap/phase-02a-kernel-tenancy.md), with its own
+  taxonomy, content types and branding loaded from its own customization data. The
+  substrate-genericity proof is therefore continuous from
+  [Phase 02d](../roadmap/phase-02d-walking-skeleton.md) onward, not a checkbox at MVP
+  exit.
 
 ## Vertical Slice First
 
@@ -200,9 +204,11 @@ contracts and the option to point at a Hub instance are MVP-complete:
 - Separate `learnstack-hub` repository ([ADR-0019](../decisions/0019-learnstack-hub.md)).
 - Separate Keycloak realm (`learnstack-hub`).
 - `Plan` / `HubSubscription` / `Entitlement` aggregates on the Hub side.
-- mTLS + signed JWT + HMAC internal API:
-  `PUT /api/internal/tenants/{id}/entitlements`, `POST /api/internal/tenants`,
-  `POST /api/v1/internal/license/verify`, `POST /api/v1/usage/report`.
+- mTLS + RS256 JWT + HMAC internal API, governed by the two invariants in
+  [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md) rather than by an
+  endpoint count: the Hub stores no tenant content, and every crossing goes through
+  `IEntitlementProvider` / `IUsageReporter` / `IHubTenantSync`. ADR-0034 § The
+  endpoint set enumerates the current paths.
 - Feature-based entitlement projection per
   [ADR-0021](../decisions/0021-feature-based-entitlement.md).
 
@@ -217,8 +223,12 @@ Delivered as **tenant customization data** loaded at provisioning, **not** as co
   etc.
 - `TenantTemplateLibrary` populated with English-locale email templates.
 
-The same provisioning pipeline loads a **second tenant** with a non-English customization
-data set (the second tenant is the substrate-genericity proof; see Exit Criteria).
+The **second tenant already exists** — the yoga studio seeded in
+[Phase 02a Packet 7](../roadmap/phase-02a-kernel-tenancy.md) and rendered in a browser
+since [Phase 02d](../roadmap/phase-02d-walking-skeleton.md). Phase 10 is therefore a
+**depth** showcase rather than a breadth one: its job is to exercise *every*
+customization aggregate against one real tenant, proving the customization surface is
+complete. Genericity is already proven, and re-proven on every CI run.
 
 ## Deferred
 
@@ -270,9 +280,19 @@ extend a customization aggregate?" — not "should we add a core module?".
   instructor and tenant admin. Recording execution itself is **tenant-configurable and
   off by default** ([16-media-pipeline.md](16-media-pipeline.md)); whether any session
   actually records during MVP exit depends on the tenant's policy.
-- A **second tenant** exists in parallel with a different customization data set (e.g.
-  a coding bootcamp with `Track` levels and `CodeChallenge` lesson items); cross-tenant
-  isolation tests pass and the same code paths serve both tenants without modification.
+- The **second tenant** (the yoga studio, seeded in
+  [Phase 02a Packet 7](../roadmap/phase-02a-kernel-tenancy.md)) still runs on the same
+  code paths with a different customization data set; cross-tenant isolation tests pass
+  under the `learnstack_app` role.
+
+  > A coding bootcamp was the other candidate and was **dropped**. Its distinguishing
+  > feature — running a learner's submitted code — falls outside the genericity
+  > boundary drawn in
+  > [ADR-0018's amendment](../decisions/0018-tenant-driven-customization-model.md):
+  > external capability invocation needs a sandbox, a runtime and a resource budget,
+  > so it is a plan-gated platform feature written by LearnStack, not a customization
+  > row. Choosing it as the genericity proof would have proven the opposite of the
+  > intended point.
 - Every MUST-class audit event in [Audit Coverage Standard](../standards/18-audit-coverage.md)
   is captured for both tenants and queryable via the Audit admin API.
 - LearnStack runs against either `NullEntitlementProvider` (no Hub) or against a real
diff --git a/docs/architecture/06-extension-model.md b/docs/architecture/06-extension-model.md
index f5583a0..8e7312b 100644
--- a/docs/architecture/06-extension-model.md
+++ b/docs/architecture/06-extension-model.md
@@ -74,7 +74,9 @@ The original Extension Model document's invariants are preserved by ADR-0018:
 
 - **Core stays generic.** No `Cefr`, `Asana`, `CodeChallenge`, `EnglishPlacement`,
   `YogaSequence` etc. in any LearnStack module. Architecture test
-  `No_DomainSpecific_Names_In_Modules` enforces this.
+  `Core_Modules_HaveNo_DomainSpecific_Names` enforces this
+  ([canonical spelling](../standards/21-architecture-tests-catalogue.md)); the folder
+  rule is the separate `No_Source_Folder_Named_Verticals`.
 - **Anti-patterns to reject** (still apply):
   - Adding domain-specific columns to core entities.
   - Importing live-classroom SDK types in Domain or Application.
@@ -151,10 +153,18 @@ implementations:
 | `ISmsProvider` | `TwilioSmsProvider`, `NetGsmSmsProvider` |
 | `ILiveClassProvider` | `LiveKitSelfHostedProvider`, `LiveKitCloudProvider` |
 | `IFileStorageService` | `MinioFileStorageService`, `S3FileStorageService` |
-| `IEventBus` | `DaprEventBus` (default), `InProcessEventBus` (dev fallback) |
-| `ICacheService` | `DaprCacheService` (default), `InMemoryCacheService` (dev fallback) |
-| `ISecretProvider` | `DaprSecretProvider` (default), `EnvironmentSecretProvider` (dev fallback) |
-| `IEntitlementProvider` | `NullEntitlementProvider` (dev), `HubEntitlementProvider` (online), `SignedLicenseKeyEntitlementProvider` (air-gapped) |
+| `IEventBus` | `InProcessEventBus` (lands with the port in Packet 5), `DaprEventBus` (demand-gated to Phase 11) |
+| `ICacheService` | `InMemoryCacheService` (lands with the port in Packet 5), `DaprCacheService` (demand-gated to Phase 11) |
+| `ISecretProvider` | `ConfigurationSecretProvider` (**registered today**, shipped in Packet 3), `DaprSecretProvider` (demand-gated to Phase 11) |
+| `IEntitlementProvider` | `NullEntitlementProvider` (Packet 9), `HubEntitlementProvider` (Phase 02c), `SignedLicenseKeyEntitlementProvider` (skeleton from Hub `P02c-6`, hardened in Phase 11) |
+
+The last three rows are the demand-gated set from
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md): the port and its default
+ship together, and the vendor adapter ships in the phase named against its written
+trigger. Only `ISecretProvider` has shipped so far — the other two ports and their
+defaults land in [Phase 02a Packet 5](../roadmap/phase-02a-kernel-tenancy.md). The
+in-process implementations are not a development convenience: once registered they are
+the only implementations in **every** deployment mode until Phase 11.
 
 Adding a new provider is a code change in core (new adapter implementation in
 `LearnStack.Infrastructure`) — not a tenant action.
diff --git a/docs/architecture/09-tenant-isolation.md b/docs/architecture/09-tenant-isolation.md
index 35b003c..7bc6ae9 100644
--- a/docs/architecture/09-tenant-isolation.md
+++ b/docs/architecture/09-tenant-isolation.md
@@ -15,8 +15,14 @@ two scopes (tenant + organization):
 - `tenant_id` on every tenant-owned table (mandatory).
 - `organization_id` on every org-scoped tenant-owned table (nullable; null = tenant-wide).
 - EF Core global query filters for both `tenant_id` and `organization_id`.
-- PostgreSQL Row Level Security policies on every tenant-owned table; org-scoped tables
-  carry an additional policy.
+- PostgreSQL Row Level Security on every tenant-owned table: **one** permissive policy
+  whose predicate `AND`s the tenant term with the organization term, plus the two
+  `AS RESTRICTIVE` write guards when the table is org-scoped. Never a second permissive
+  policy — PostgreSQL combines those with `OR`, which is the defect
+  [ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md)
+  corrects. Platform-scoped tables — the ones read *before* the tenant is known — follow
+  a different rule; see
+  [Database Standards § Table classes](../standards/05-database.md).
 - Architecture tests that detect unprotected tenant-owned / org-scoped entities.
 - Explicit platform-admin paths for cross-tenant operations (Hub-driven, audited).
 - Tenant- and org-aware storage, cache, search, analytics, audit, and logs.
@@ -27,11 +33,11 @@ two scopes (tenant + organization):
 |-------|------------------|------------------------|
 | Application context | `ITenantContextAccessor.Current.TenantId` (AsyncLocal) | `ITenantContextAccessor.Current.OrganizationId` (AsyncLocal; nullable) |
 | EF Core | Global query filter `e.TenantId == currentTenantId` | Global query filter `e.OrganizationId == null OR e.OrganizationId == currentOrgId` |
-| PostgreSQL | RLS policy `tenant_id = current_setting('app.tenant_id', true)::uuid` | RLS policy `organization_id IS NULL OR organization_id = current_setting('app.organization_id', true)::uuid` |
+| PostgreSQL | The tenant term of the single policy: `tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid` | The organization term `AND`-ed into that **same** policy, plus the restrictive `UPDATE` / `DELETE` write guards. Canonical SQL in [Database Standards](../standards/05-database.md) |
 | Identity | Single-realm `learnstack` with `tenant_id` JWT claim (default per [ADR-0004](../decisions/0004-authentication-strategy.md); realm-per-tenant is an opt-in for enterprise isolation only) | `organization_id` JWT claim populated from active org membership |
 | Cache | Cache key auto-prefixed `{tenant_id}:{key}` | `{tenant_id}:{org_id}:{key}` when org context set |
 | Files (SeaweedFS) | Object key prefix `tenants/{tenant_id}/...` | `tenants/{tenant_id}/organizations/{org_id}/...` for org-scoped assets |
-| Search (Meilisearch) | `tenant_id` as mandatory filter | `organization_id = X OR organization_id IS NULL` clause when org context |
+| Search | `tenant_id` as a mandatory filter composed **inside** `ITenantSearch` — callers pass criteria, never filter strings. Until Meilisearch's demand gate fires ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)), search runs on PostgreSQL full-text over tenant-owned tables and inherits Row Level Security; the engine-enforced per-request tenant token arrives with the Meilisearch adapter in [Phase 09](../roadmap/phase-09-billing-integrations-analytics.md) | `organization_id = X OR organization_id IS NULL` clause when org context |
 | Jobs (Hangfire) | `JobParams.TenantId` mandatory | `JobParams.OrganizationId` nullable |
 | Audit (ADR-0016) | `audit_log.tenant_id` mandatory | `audit_log.organization_id` nullable |
 | Logs (Serilog) | Every log scope carries `TenantId` | `OrganizationId` when context set |
@@ -55,8 +61,8 @@ sequenceDiagram
     API->>MW: HTTP pipeline
     MW->>MW: Read tenant_id, organization_id from JWT claims
     MW->>Accessor: SetTenant(tenantId, organizationId, userId)
-    Accessor->>PG: SET LOCAL app.tenant_id = '...'<br/>SET LOCAL app.organization_id = '...'
     MW->>API: continue
+    API->>EF: BeginTransaction, then SET LOCAL app.tenant_id /<br/>app.organization_id as the first statement (TransactionBehavior, step 6)
     API->>EF: Query tenant-owned aggregate
     EF->>EF: Apply global filter (tenant + org)
     EF->>PG: Query with WHERE tenant_id = X AND (organization_id = Y OR IS NULL)
@@ -66,38 +72,31 @@ sequenceDiagram
 
 ## RLS policy templates
 
-### Tenant-only entity
-
-```sql
-ALTER TABLE <table> ADD COLUMN tenant_id uuid NOT NULL;
-CREATE INDEX ix_<table>_tenant_id ON <table> (tenant_id);
-
-ALTER TABLE <table> ENABLE ROW LEVEL SECURITY;
-CREATE POLICY <table>_tenant_isolation ON <table>
-    USING (tenant_id = current_setting('app.tenant_id', true)::uuid);
-```
-
-### Tenant + Organization entity
-
-```sql
-ALTER TABLE <table> ADD COLUMN tenant_id uuid NOT NULL;
-ALTER TABLE <table> ADD COLUMN organization_id uuid NULL;
-CREATE INDEX ix_<table>_tenant_org ON <table> (tenant_id, organization_id);
-
-ALTER TABLE <table> ENABLE ROW LEVEL SECURITY;
-CREATE POLICY <table>_tenant_isolation ON <table>
-    USING (tenant_id = current_setting('app.tenant_id', true)::uuid);
-CREATE POLICY <table>_organization_isolation ON <table>
-    USING (
-        organization_id IS NULL                                                  -- tenant-wide row, visible to all orgs in tenant
-        OR organization_id = current_setting('app.organization_id', true)::uuid  -- org-scoped row, only matching org
-        OR current_setting('app.scope', true) = 'tenant'                         -- tenant-scope operation (admin / reporting) sees all orgs
-    );
-```
+The **canonical SQL template** — for both the tenant-only and the tenant + organization
+shape — lives in exactly one place:
+[Database Standards § Tenant-Owned and Organization-Scoped Tables](../standards/05-database.md).
+It is not repeated here. Copying it into a second document is how the four divergent
+copies that preceded [ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md)
+came about.
+
+Three properties of that template matter to the isolation model described on this page:
+
+- **One policy, one `AND`-ed predicate.** Tenant and organization scope are evaluated
+  together. Two separate policies would both be *permissive*, and PostgreSQL combines
+  permissive policies with `OR` — under which a tenant-wide row (`organization_id IS
+  NULL`) satisfies the organization half on its own and becomes visible to every
+  tenant. A second policy may only ever be added `AS RESTRICTIVE`.
+- **`ENABLE` and `FORCE ROW LEVEL SECURITY`.** Without `FORCE`, the table owner
+  bypasses its own policies — and the default Entity Framework Core arrangement makes
+  the application that owner.
+- **An explicit `WITH CHECK`.** `USING` decides what is readable; `WITH CHECK` decides
+  what is writable.
 
 The `app.scope = 'tenant'` setting is set by middleware when the request comes from a
-tenant-admin role with a tenant-wide operation flag (e.g. cross-org reporting). The
-default scope (`null` or `'organization'`) honours both filters strictly.
+tenant-admin role with a tenant-wide operation flag (e.g. cross-org reporting). It
+widens **reads** across organizations within the caller's tenant; it never widens
+writes, and it never crosses a tenant boundary. The default scope (`null` or
+`'organization'`) restricts reads to the caller's organization plus tenant-wide rows.
 
 ## Default org semantics
 
@@ -118,9 +117,14 @@ Platform admin (LearnStack operator) access must be explicit:
   not `learnstack` realm.
 - Cross-tenant queries from Hub go through `/api/internal/*` endpoints with mTLS + signed
   JWT + HMAC; never proxied via APISIX (ADR-0019).
-- LearnStack-side endpoint receives request with no tenant context; sets a special
-  `learnstack_audit_admin` Postgres role for the query, which **bypasses RLS** (and
-  emits a `read-sensitive` audit row for every cross-tenant access).
+- The LearnStack-side endpoint receives a request with no tenant context and runs the
+  query through `EnterPlatformAdminScope(reason)`, which opens a **second connection**
+  authenticated as `learnstack_platform` — the `BYPASSRLS` role of the four-role model.
+  There is no `learnstack_audit_admin` role, and `learnstack_app` is not a member of
+  `learnstack_platform`, so the application role cannot reach the bypass by `SET ROLE`.
+  Every cross-tenant access emits a `read-sensitive` audit row, written inside the scope
+  under the sentinel platform tenant id. See
+  [Database Standards § Database roles](../standards/05-database.md).
 - No hidden arbitrary `IgnoreQueryFilters()` usage; architecture test
   `IgnoreQueryFilters_OnlyInPlatformAdminScope` forbids it outside the
   `LearnStack.Modules.Identity.Application.Platform` namespace.
@@ -181,8 +185,8 @@ public abstract class PlatformJob<TParams> : LearnStackJob<TParams>
 |------|---------|
 | `Every_TenantOwned_Entity_HasTenantId` | Every aggregate marked `[TenantOwned]` (or inheriting `AuditableEntity<>`) has a `TenantId` property and an EF query filter referencing it. |
 | `Every_OrgScoped_Entity_HasOrgIdAndFilter` | Every aggregate marked `[OrganizationScoped]` has `OrganizationId` nullable + EF query filter. |
-| `Every_TenantOwned_Table_HasRlsPolicy` | Migration scan: every tenant-owned table has at least one RLS policy. |
-| `Every_OrgScoped_Table_HasOrgRlsPolicy` | Migration scan: every org-scoped table has the org isolation policy. |
+| `Every_TenantOwned_Table_HasRlsPolicy` | Migration scan: every tenant-owned table has `ENABLE` **and** `FORCE ROW LEVEL SECURITY` and **exactly one** permissive policy with an explicit `WITH CHECK`. Two permissive policies fail the test. |
+| `Every_OrgScoped_Table_HasOrgRlsPolicy` | Migration scan: the organization term is `AND`-ed inside that single policy — not in a second permissive one — and both `AS RESTRICTIVE` write guards are present. |
 | `IgnoreQueryFilters_OnlyInPlatformAdminScope` | Roslyn source scan: `IgnoreQueryFilters()` appears only in `LearnStack.Modules.Identity.Application.Platform` or behind an `architecture-allow: ignore-query-filters ADR-NNNN` marker. |
 | `Hangfire_JobPayloads_IncludeTenantId` | Reflection: every `LearnStackJob<TParams>` subclass's `TParams` has `TenantId`. |
 | `LearnStackJob_RunAsync_SetsTenantBeforeExecute` | Source-grep + reflection: `RunAsync` is non-virtual; `SetTenant(...)` precedes `ExecuteAsync(...)`. |
diff --git a/docs/architecture/12-localization.md b/docs/architecture/12-localization.md
index 9227260..2e7a57d 100644
--- a/docs/architecture/12-localization.md
+++ b/docs/architecture/12-localization.md
@@ -51,35 +51,70 @@ For entities like `Course`, `Lesson`, `Page`, `ContentEntry`:
 
 ```sql
 CREATE TABLE courses (
-    id UUID PRIMARY KEY,
-    tenant_id UUID NOT NULL,
-    slug_key TEXT NOT NULL,        -- locale-independent stable identifier
-    visibility TEXT NOT NULL,
-    -- non-translatable fields only
-    created_at TIMESTAMPTZ NOT NULL,
+    id              uuid PRIMARY KEY,
+    tenant_id       uuid NOT NULL,
+    organization_id uuid NULL,          -- null = tenant-wide, per ADR-0017
+    slug_key        text NOT NULL,      -- stable authoring handle; NOT routable
+    visibility      text NOT NULL,
+    -- non-translatable columns only: no title, no description, no slug
+    created_at      timestamptz NOT NULL,
     -- ...
-    UNIQUE (tenant_id, slug_key)
+    CONSTRAINT ux_courses_tenant_id_slug_key UNIQUE (tenant_id, slug_key),
+    CONSTRAINT ux_courses_tenant_id_id       UNIQUE (tenant_id, id)
 );
 
 CREATE TABLE course_translations (
-    course_id UUID NOT NULL REFERENCES courses(id) ON DELETE CASCADE,
-    locale TEXT NOT NULL,
-    title TEXT NOT NULL,
-    description TEXT,
-    slug TEXT NOT NULL,            -- locale-specific URL slug
-    seo_title TEXT,
-    seo_description TEXT,
-    PRIMARY KEY (course_id, locale)
+    course_id       uuid NOT NULL,
+    tenant_id       uuid NOT NULL,      -- a real column: RLS is per table, never inherited
+    organization_id uuid NULL,          -- mirrors the parent; for RLS, never for uniqueness
+    locale          text NOT NULL,
+    title           text NOT NULL,
+    description     text NULL,
+    slug            text NOT NULL,      -- locale-specific URL slug
+    seo_title       text NULL,
+    seo_description text NULL,
+    PRIMARY KEY (course_id, locale),
+    -- The routing constraint. Every column in it is NOT NULL, so PostgreSQL's
+    -- nulls-are-distinct rule cannot apply and it rejects every duplicate.
+    CONSTRAINT ux_course_translations_tenant_id_locale_slug
+        UNIQUE (tenant_id, locale, slug),
+    CONSTRAINT fk_course_translations_course
+        FOREIGN KEY (tenant_id, course_id) REFERENCES courses (tenant_id, id)
+        ON DELETE CASCADE
 );
-
-CREATE UNIQUE INDEX course_translations_slug_unique
-    ON course_translations (course_id, locale, slug);
 ```
 
-- A row in the parent table represents the entity.
-- A row in the translation table represents the entity *in a specific locale*.
-- Slug is per-locale; the same course has `/tr/kurslar/baslangic-ingilizce` and `/en/courses/beginner-english`.
-- Both tables include or join via `tenant_id` for RLS purposes (translation tables inherit tenant ownership through the parent via a check constraint).
+> **Corrected 2026-08-09.** The block above previously declared
+> `CREATE UNIQUE INDEX course_translations_slug_unique ON
+> course_translations (course_id, locale, slug)`. Those index columns are a proper
+> superset of the primary key `(course_id, locale)`, so the primary key already
+> guaranteed it and the index could reject no row the table would otherwise accept — two
+> different courses in one tenant could both hold `/en/courses/beginner`. The block also
+> claimed translation tables inherit tenant ownership through a parent check constraint,
+> which PostgreSQL does not do. Both are fixed here; the rule is published in
+> [Localization Standards § Pattern A](../standards/08-localization.md).
+
+- A row in the parent table represents the entity. A row in the translation table
+  represents the entity *in a specific locale*.
+- Slug is per-locale; the same course has `/tr/kurslar/baslangic-ingilizce` and
+  `/en/courses/beginner-english`.
+- `slug_key` is an authoring convenience — a stable handle for translators and for
+  import / export. **Nothing routes on it.** The routable identifier is
+  `course_translations.slug`.
+- Translation tables carry `tenant_id` as a real column and declare their own
+  `ENABLE` + `FORCE ROW LEVEL SECURITY` and the full policy set from the canonical
+  template in [Database Standards](../standards/05-database.md). Row Level Security is
+  per table; it is not inherited from a parent through a check constraint, and a
+  satellite carrying `title` and `slug` carries the content.
+- `organization_id` mirrors the parent and exists **only** so the satellite can carry the
+  same isolation predicate. It is deliberately absent from the slug constraint — see
+  [§ Slugs and URLs](#slugs-and-urls). Denormalizing it is safe because
+  `organization_id` on a tenant-owned row is immutable after insert; see
+  [Database Standards § Translation satellite tables](../standards/05-database.md).
+- The foreign key is composite on `tenant_id` for the reason in
+  [Database Standards § Foreign keys between tenant-owned tables](../standards/05-database.md):
+  referential-integrity checks run with Row Level Security bypassed, so a single-column
+  key would let one tenant's translation row reference another tenant's course.
 
 ### Pattern B: JSONB Field (for compact, optional translations)
 
@@ -143,7 +178,35 @@ Slugs are **per locale**. Two patterns:
 
 The Next.js renderer reads tenant locale config at the edge and produces locale-aware routes.
 
-Slug uniqueness is `(tenant_id, locale, slug)`. The same entity can have completely different slugs per locale.
+Slug uniqueness is `UNIQUE (tenant_id, locale, slug)`, declared on the translation table,
+and **flat across organizations**. The same entity can have completely different slugs
+per locale; two different entities in one tenant cannot share one slug in one locale.
+
+`organization_id` is deliberately not part of that key. A host resolves to
+`(tenant_id, organization_id?)`, and the canonical isolation policy admits
+`organization_id IS NULL OR organization_id = <caller's org>` — so an organization's host
+serves tenant-wide rows *and* its own, both tiers compete for one URL, and a key that
+partitioned them would force the renderer to pick a winner. Preferring the
+organization-scoped row means publishing a branch course silently changes what an
+already-published tenant URL serves, with no redirect and no signal to the author who
+owns the tenant-wide row — the "URL changes are breaking" risk below, arrived at without
+anyone editing a slug. Preferring the tenant-wide row is worse: it lets an organization
+author create a row no URL can reach. One flat namespace per `(tenant_id, locale)`
+removes the question. An organization that wants its own variant of a shared course gives
+it its own slug, and the publish command rejects the collision with a business-rule
+failure rather than resolving it at render time.
+
+The routing consequences follow directly, and are behaviour rather than defects:
+
+- A host resolving to `(tenant_id, NULL)` serves tenant-wide rows only. Organization-scoped
+  rows are filtered out by the isolation policy, so their slugs 404 there even though the
+  slug is reserved tenant-wide.
+- A host resolving to `(tenant_id, organization_id)` serves both tiers, and the flat key
+  guarantees at most one match.
+- Slug lookup is **exact**. The fallback chain below resolves display fields after the
+  entity is found; it never resolves a slug. An entity with no translation in the
+  requested locale has no URL in that locale, and a link to it is omitted rather than
+  rendered dead.
 
 ## UI String Catalogue
 
@@ -189,15 +252,37 @@ CREATE TABLE tenant_template_library (
     created_by      uuid NOT NULL,
     updated_at      timestamptz NOT NULL DEFAULT now(),
     updated_by      uuid NOT NULL,
+    -- NULLS NOT DISTINCT (PostgreSQL 15+; LearnStack pins 18 per ADR-0031) is
+    -- load-bearing here. organization_id is null on every tenant-wide template, and a
+    -- standard UNIQUE treats nulls as distinct, so without it a tenant could hold
+    -- unlimited duplicate tenant-wide rows for one (key, channel, locale) and dispatch
+    -- would pick one arbitrarily. organization_id genuinely belongs in this key: an org
+    -- override is a distinct row that dispatch resolves through the org -> tenant
+    -- fallback chain described below. Contrast a routable slug, where the two tiers
+    -- compete for one URL and the column is dropped from the key instead -- see
+    -- Database Standards section Constraints.
     CONSTRAINT ux_tenant_template_library
-        UNIQUE (tenant_id, organization_id, key, channel, locale)
+        UNIQUE NULLS NOT DISTINCT (tenant_id, organization_id, key, channel, locale)
 );
 
-ALTER TABLE tenant_template_library ENABLE ROW LEVEL SECURITY;
-CREATE POLICY tenant_template_library_tenant_isolation ON tenant_template_library
-    USING (tenant_id = current_setting('app.tenant_id')::uuid);
+
+-- Row Level Security: apply the canonical template from
+-- docs/standards/05-database.md § Tenant-Owned and Organization-Scoped Tables
+-- to this table verbatim, substituting tenant_template_library. It is org-scoped,
+-- so it takes the full set: ENABLE + FORCE, one permissive policy with the
+-- organization term AND-ed in, and both AS RESTRICTIVE write guards. The SQL is
+-- deliberately not repeated here — it lives in exactly one file, because the
+-- version that lived in four was wrong in all four (ADR-0003 Amendment 3).
 ```
 
+This table is org-scoped (`organization_id` is nullable and participates in the
+uniqueness constraint), so its organization term lives **inside** the single policy —
+per the canonical template in
+[Database Standards](../standards/05-database.md) and
+[ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md). A
+separate organization policy would be `PERMISSIVE` and `OR`-ed with this one, which
+would expose every tenant-wide template to every tenant.
+
 Dispatch (in the Notifications module) resolves the recipient's preferred locale,
 applies the organization → tenant → tenant-default fallback chain, then renders the
 chosen row with the dispatch context. The two-table `notification_templates` +
diff --git a/docs/architecture/14-frontend-architecture.md b/docs/architecture/14-frontend-architecture.md
index 2a46b41..dcf69e9 100644
--- a/docs/architecture/14-frontend-architecture.md
+++ b/docs/architecture/14-frontend-architecture.md
@@ -7,7 +7,7 @@ LearnStack ships **two independent Next.js applications**:
   marketing/CMS rendering, admin Studio, and learner/instructor portals. The multi-app
   split is deferred until concrete need
   ([ADR 0009 — Frontend Single App First](../decisions/0009-frontend-single-app-first.md)).
-- **`learnstack-hub-web`** in the **separate `learnstack-hub` repository** — the
+- **`operator-portal`** in the **separate `learnstack-hub` repository** — the
   **operator portal** at `hub.learnstack.dev`. Operators authenticate against the
   `learnstack-hub` Keycloak realm (ADR-0004 Amendment 1); different realm, different
   user pool, different domain. The two apps **do not share code at runtime**. If a
@@ -61,7 +61,7 @@ frontend/
     config/                               # eslint, tsconfig, tailwind shared bits
 ```
 
-The operator portal (`learnstack-hub-web`) is a **separate Next.js application in the
+The operator portal (`operator-portal`) is a **separate Next.js application in the
 separate `learnstack-hub` repository**; nothing about it lives under this `frontend/`
 tree.
 
@@ -264,7 +264,7 @@ actions**. The tenant-facing surface in `apps/web` is read-only:
 - Studio renders a banner with the DNS records the tenant must add and a "Recheck now"
   button that **proxies to a Hub admin endpoint** through the internal API.
 - Registering a *new* custom domain happens in the **operator portal**
-  (`learnstack-hub-web`), not in `apps/web`. Tenant admins request a domain via a form
+  (`operator-portal`), not in `apps/web`. Tenant admins request a domain via a form
   in Studio that creates a support ticket / Hub-side request — the actual create is an
   operator action.
 
@@ -304,14 +304,14 @@ CI runs Lighthouse on representative public pages on every PR; budgets failing t
 
 ## Splitting into Multiple Apps Later
 
-The operator portal split has already happened: `learnstack-hub-web` is a *separate
+The operator portal split has already happened: `operator-portal` is a *separate
 repository*, not a separate app within this repo. Within `apps/web`, if and when the
 single-app model breaks down (rebuild times, deploy cadence conflicts, separate teams
 owning different surfaces), the split path is:
 
 1. Extract `packages/ui` first — duplicated primitives become a shared package. (This
    is the same `packages/ui` candidate that, post-extraction, could be a build-time
-   dependency for `learnstack-hub-web` as well.)
+   dependency for `operator-portal` as well.)
 2. Extract `packages/sdk` — already generated, easy lift.
 3. Move `(studio)` into `apps/studio`. Keep `(public)` and `(portal)` together
    initially.
diff --git a/docs/architecture/15-event-and-outbox.md b/docs/architecture/15-event-and-outbox.md
index 4c4cda6..5087195 100644
--- a/docs/architecture/15-event-and-outbox.md
+++ b/docs/architecture/15-event-and-outbox.md
@@ -1,25 +1,52 @@
 # Events and Outbox
 
 Events allow modules to collaborate without cross-module database coupling. This document
-defines the event types, the outbox pattern, and how dispatch is delivered via Dapr
-pub/sub to Kafka (ADR-0010 Amendment 1 + ADR-0014).
+defines the event types, the outbox pattern, the claim protocol that makes concurrent
+dispatch safe, and how dispatch reaches subscribers — in process today, through Dapr
+pub/sub to Kafka when the trigger for that adapter fires (ADR-0010 Amendment 1 +
+ADR-0014 + ADR-0035).
 
 ## Decision
 
 Use **domain events** within a module (in-process MediatR notifications, same transaction
 as the aggregate change) and **integration events** across modules (written to an outbox
-in the same transaction; dispatched at-least-once to subscribers via Dapr pub/sub to
-Kafka with retry / backoff / dead-lettering).
+in the same transaction; dispatched at-least-once to subscribers with retry / backoff /
+dead-lettering on both the producer and the subscriber side).
 
-The outbox table is **LearnStack-owned** (per-module in PostgreSQL); Dapr is the
-**dispatch transport**, not the durable buffer.
+The outbox table is **LearnStack-owned** (a single shared table in PostgreSQL); the event
+bus is the **dispatch transport**, not the durable buffer. That ownership split is what
+makes the transport swappable without touching a single producer or consumer.
+
+## What ships when
+
+Three separable things are often collapsed into one; they are not the same and they do
+not land together.
+
+| Piece | Owning phase | State |
+|---|---|---|
+| `outbox_messages` table, its schema, and its LearnStack ownership | [Phase 02a Packet 6](../roadmap/phase-02a-kernel-tenancy.md) | Ships even though nothing dispatches from it yet — the schema and its ownership are a one-way door |
+| `IEventBus` port + `InProcessEventBus` | [Phase 02a Packet 5](../roadmap/phase-02a-kernel-tenancy.md) | The only registered implementation |
+| `OutboxProcessor`, `IInboxGuard`, the claim protocol, the first real integration event | [Phase 02b](../roadmap/phase-02b-events-auth.md) | The durable dispatcher |
+| `DaprEventBus` → Dapr pub/sub → Kafka | [Phase 11](../roadmap/phase-11-production-hardening.md) | Demand-gated; trigger: a second process needs to consume an integration event, or event volume / replay / cross-process ordering is required ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)) |
+
+**`InProcessEventBus` is a first-class transport, not a stub.** It uses the same
+`IIntegrationEventHandler<T>` interface, the same `IInboxGuard` deduplication, and the
+same tenant-context restoration as the durable path. A development transport that skips
+those is a development transport that never exercises the isolation code — and it forces
+every consumer to carry two implementations, one of which is never tested against the
+other. Everything in this document about consumer obligations applies identically to both
+transports; the only difference is what carries the bytes between publish and handle.
+
+[ADR-0014](../decisions/0014-adopt-dapr.md) stands as the decision that Dapr is the
+cross-process transport LearnStack uses. [ADR-0035](../decisions/0035-demand-gated-infrastructure.md)
+decides when it arrives, and the answer is "when a second process exists".
 
 ## Event types
 
 | Type | Scope | Transport | Example |
 |------|-------|-----------|---------|
 | **Domain event** | Inside one module | MediatR `INotification` in-process | `CourseVersionPublished` |
-| **Integration event** | Cross-module | Outbox → `IEventBus.PublishAsync` → Dapr pub/sub → Kafka | `OrderPaidV1`, `EnrollmentCreated`, `TenantSuspended` |
+| **Integration event** | Cross-module | Outbox → `IEventBus.PublishAsync` → transport (in-process dispatcher today; Dapr pub/sub → Kafka from Phase 11) | `OrderPaidV1`, `EnrollmentCreated`, `TenantSuspended` |
 | **Analytics event** | Reporting stream | Same channel as integration events | `LessonCompleted` |
 | **Provider event** | External callback (webhook) | Provider → API endpoint → outbox → ... | `LiveKitParticipantJoined`, `StripeInvoicePaid` |
 
@@ -28,12 +55,11 @@ The outbox table is **LearnStack-owned** (per-module in PostgreSQL); Dapr is the
 ```mermaid
 sequenceDiagram
     participant Module as Owning Module
-    participant DB as PostgreSQL (module schema)
+    participant DB as PostgreSQL
     participant Outbox as outbox_messages
     participant Processor as OutboxProcessor (BackgroundService)
-    participant Dapr as Dapr sidecar
-    participant Kafka
-    participant ConsumerDapr as Consumer Dapr sidecar
+    participant Bus as IEventBus
+    participant Transport as Transport (in-process dispatcher, or Dapr to Kafka)
     participant Consumer as Consuming Module
     participant Inbox as inbox_messages
 
@@ -42,60 +68,56 @@ sequenceDiagram
     DB->>DB: COMMIT (atomic: aggregate + outbox row)
 
     loop Polling (every 200ms; configurable)
-        Processor->>Outbox: SELECT WHERE processed_at IS NULL<br/>FOR UPDATE SKIP LOCKED LIMIT @batch
-        Processor->>Dapr: IEventBus.PublishAsync → DaprClient.PublishEventAsync<br/>(topic: learnstack.{module}.{aggregate})
-        Dapr->>Kafka: produce
-        Processor->>Outbox: UPDATE processed_at = now()
+        Processor->>Outbox: CLAIM — UPDATE SET locked_by, locked_until<br/>WHERE id IN (SELECT ... FOR UPDATE SKIP LOCKED)<br/>RETURNING *; the claim survives the COMMIT
+        Processor->>Bus: PublishAsync(event, partitionKey)<br/>topic learnstack.{module}.{aggregate}
+        Bus->>Transport: deliver
+        Processor->>Outbox: UPDATE processed_at = now()<br/>WHERE id = @id AND locked_by = @me
     end
 
-    Kafka->>ConsumerDapr: deliver to subscribed sidecar
-    ConsumerDapr->>Consumer: HTTP POST /events/{topic}
-    Consumer->>Inbox: IsAlreadyProcessedAsync(@event.EventId)
+    Transport->>Consumer: deliver to subscribed handler
+    Consumer->>Consumer: Restore tenant context from event.TenantId
+    Consumer->>Inbox: IsAlreadyProcessedAsync(event.EventId)
     alt Already processed
         Inbox-->>Consumer: skip
     else New event
         Consumer->>Consumer: Handle business logic
-        Consumer->>Inbox: MarkAsProcessed(@event.EventId, @event.GetType().Name)
+        Consumer->>Inbox: MarkAsProcessed(event.EventId, event type name)
         Consumer->>DB: SaveChangesAsync (business write + inbox marker, atomic)
     end
 ```
 
+Read as text: the producer writes the aggregate change and the outbox row in one
+transaction. A processor **claims** a batch of unprocessed rows by stamping a lease on
+them, and the claim outlives the claiming transaction. It publishes each claimed row and
+marks it processed only if it still holds the lease. The transport delivers to the
+consumer, which restores tenant context, deduplicates through its inbox, and commits the
+business write and the inbox marker together.
+
 ## Outbox table
 
-Each module owns its own outbox table inside the module's schema (or in a shared
-namespace with module-prefixed key). LearnStack uses a single shared `outbox_messages`
-table with `tenant_id` for RLS isolation:
+LearnStack uses a **single shared `outbox_messages` table** — not one per module — with
+`tenant_id` for Row Level Security isolation. The canonical DDL, its indexes, and its RLS
+policy live in exactly one place:
+[Database Standards § Outbox](../standards/05-database.md). Do not copy the DDL into a
+third document; the last time this table's policy was duplicated, the copy carried the
+superseded two-permissive-policy shape that
+[ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md) corrects.
 
-```sql
-CREATE TABLE outbox_messages (
-    id              uuid PRIMARY KEY,
-    occurred_at     timestamptz NOT NULL DEFAULT now(),
-    tenant_id       uuid NOT NULL,
-    correlation_id  text NULL,
-    causation_id    uuid NULL,
-    actor_user_id   uuid NULL,
-    type            text NOT NULL,           -- assembly-qualified event type name
-    topic           text NOT NULL,           -- "learnstack.identity.user"
-    payload         jsonb NOT NULL,
-    metadata        jsonb NULL,
-    processed_at    timestamptz NULL,
-    attempts        int NOT NULL DEFAULT 0,
-    last_error      text NULL,
-    available_after timestamptz NOT NULL DEFAULT now()
-);
+Three columns exist for reasons this document owns rather than the schema, and the two
+guarantees below (ordering, single-claimant dispatch) cannot be honoured without them:
 
-CREATE INDEX ix_outbox_pending
-    ON outbox_messages (available_after)
-    WHERE processed_at IS NULL;
-CREATE INDEX ix_outbox_tenant_pending
-    ON outbox_messages (tenant_id, available_after)
-    WHERE processed_at IS NULL;
-
-ALTER TABLE outbox_messages ENABLE ROW LEVEL SECURITY;
-CREATE POLICY outbox_messages_tenant_isolation ON outbox_messages
-    USING (tenant_id = current_setting('app.tenant_id', true)::uuid);
--- OutboxProcessor uses learnstack_outbox_admin role that bypasses RLS to read all tenants.
-```
+| Column | Why it exists | Lands with |
+|---|---|---|
+| `partition_key text NOT NULL` | The ordering guarantee below is expressed entirely through this value. Defaults to the aggregate id; falls back to `tenant_id` when the event names no aggregate. Set at enqueue time by `IOutbox.EnqueueAsync`, never by the transport. | The table itself, in [Phase 02a Packet 6](../roadmap/phase-02a-kernel-tenancy.md) — a producer-side column is cheaper to ship with the table than to backfill |
+| `locked_by text NULL` + `locked_until timestamptz NULL` | The dispatch **lease**. A processor stamps them to claim a row, and the claim survives the claiming transaction's commit. See the claim protocol below. | The dispatcher, in [Phase 02b](../roadmap/phase-02b-events-auth.md) |
+| `available_after timestamptz NOT NULL` | Retry backoff. A failed dispatch pushes this forward instead of blocking the batch. | Already in the canonical DDL |
+
+Both additions go into the canonical DDL in Standards 05 when their phase ships; this
+document does not carry a second copy of the table.
+
+The pending index therefore covers `(available_after)` filtered on
+`processed_at IS NULL`, and the claim predicate additionally reads
+`locked_until IS NULL OR locked_until < now()`.
 
 ### Why the `learnstack_outbox_admin` role bypasses RLS — and what bounds the bypass
 
@@ -104,13 +126,25 @@ BackgroundService instance; setting `app.tenant_id` per row would defeat the
 `FOR UPDATE SKIP LOCKED` batching pattern. The role bypasses RLS by design, and
 the bypass is bounded by:
 
-- **Scope by grant**. The role has `SELECT`, `UPDATE` only on `outbox_messages`
-  (status column transitions: `processed_at`, `attempts`, `last_error`,
-  `available_after`). It has **no** access to any other tenant-owned table; the
-  bypass cannot be used as a generic backdoor.
-- **No connection sharing**. The role is used only by the `OutboxProcessor`
-  BackgroundService DI scope; no MediatR handler or API endpoint ever runs
-  under this role (architecture test
+- **Scope by grant, and grant is the only bound.** `BYPASSRLS` bypasses *policies*, not
+  `GRANT`s: a role holding the attribute with no privilege on a table gets
+  `permission denied for table`. The role holds `SELECT` on `outbox_messages` plus a
+  **column-level** `UPDATE (processed_at, attempts, last_error, available_after)` — and
+  nothing anywhere else. It has no `DELETE` (purging processed rows is a
+  `learnstack_platform` operation) and cannot touch `payload`, `tenant_id`, `topic` or
+  `type`. `SELECT … FOR UPDATE SKIP LOCKED` works with a column-level `UPDATE` grant, so
+  the claim protocol needs no table-wide `UPDATE`. When `locked_by` and `locked_until`
+  land in [Phase 02b](../roadmap/phase-02b-events-auth.md), that migration extends the
+  column list; a column added without extending it fails at runtime with
+  `permission denied for table`, which is the intended loud failure. Because grant scope
+  is the *only* thing bounding the bypass, no privilege is ever granted to `PUBLIC` and
+  no `ALTER DEFAULT PRIVILEGES` grant exists — either would silently un-bound this role
+  the next time a table is created.
+- **No connection sharing.** The role has its own login credential and its own
+  connection string (`ConnectionStrings:OutboxDispatcher`), present only in the worker
+  host that runs `OutboxProcessor`. It is not reached by `SET ROLE` from
+  `learnstack_app`, which is not a member of it. No MediatR handler or API endpoint ever
+  runs under this role (architecture test
   `LearnStack_OutboxAdmin_Role_OnlyUsedBy_OutboxProcessor` enforces this).
 - **Audited on use**. Every dispatch attempt produces a structured log entry
   with `event_id`, `tenant_id`, `event_type`, and outcome. Bypass-as-such is
@@ -121,10 +155,14 @@ the bypass is bounded by:
   the RLS bypass is the minimum privilege escalation that makes that pattern
   work. It is not an exception to ADR-0003 — it is the only legitimate path.
 
-The same shape applies to `learnstack_audit_admin` (read-side cross-tenant
-audit queries, see [31-audit-subsystem.md](31-audit-subsystem.md)) and any
-future `learnstack_*_admin` role: bounded by grant, isolated by DI scope,
-discoverable by log.
+`learnstack_outbox_admin` is one of the **four** roles in the database model fixed by
+[ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md) —
+`learnstack_migration` (owner, `NOBYPASSRLS`), `learnstack_app` (runtime,
+`NOBYPASSRLS`), `learnstack_platform` (audited cross-tenant admin, `BYPASSRLS`), and
+this one. Cross-tenant audit reads use `learnstack_platform` through the audited
+`EnterPlatformAdminScope(reason)` path; there is no separate audit role. Adding a fifth
+role requires an ADR — every `BYPASSRLS` role is a hole in the isolation model that has
+to earn its existence by grant scope, DI-scope isolation, and log discoverability.
 
 ## Inbox table (per consumer module)
 
@@ -166,7 +204,9 @@ public async Task<Result<EnrollmentDto>> Handle(CreateEnrollmentCommand cmd, Can
 ```
 
 `IOutbox.EnqueueAsync` writes to the same `DbContext` (no separate transaction); commit
-is atomic with the aggregate write.
+is atomic with the aggregate write. It also resolves and stores the row's
+`partition_key` — here `EnrollmentId`, the aggregate this event is about. See
+[Ordering](#ordering).
 
 ## Consumer pattern
 
@@ -196,13 +236,34 @@ public sealed class CreateAuditTrailOnEnrollmentCreated(
 
 ## OutboxProcessor (BackgroundService)
 
-Continuously polls `outbox_messages` and dispatches:
+### The claim problem
+
+`SELECT ... FOR UPDATE SKIP LOCKED` holds its row locks **only until the transaction that
+took them ends**. A processor that selects a batch, commits to release the locks, and
+*then* starts publishing has released every row it is about to work on. A second
+processor polling one millisecond later sees those rows with `processed_at IS NULL`, is
+not blocked by any lock, and dispatches the same events. The first processor then marks
+them processed, and nothing in the system records that they went out twice.
+
+That is why this document no longer claims "no double dispatch". The delivery contract is
+**at-least-once**, and consumer-side idempotency through `IInboxGuard` is what makes it
+safe — not the row lock. What the claim protocol buys is that duplicates come from crash
+recovery and lease expiry, which are rare and bounded, rather than from every concurrent
+poll, which is neither.
+
+### The claim protocol
+
+The row lock has to survive the transaction that takes it, which means the claim must be
+**written to the row**, not held in the lock table:
 
 ```csharp
 public sealed class OutboxProcessor : BackgroundService
 {
     private const int BatchSize = 100;
     private static readonly TimeSpan PollInterval = TimeSpan.FromMilliseconds(200);
+    private static readonly TimeSpan LeaseDuration = TimeSpan.FromSeconds(60);
+
+    private readonly string _processorId = $"{Environment.MachineName}:{Guid.NewGuid():N}";
 
     protected override async Task ExecuteAsync(CancellationToken ct)
     {
@@ -220,35 +281,40 @@ public sealed class OutboxProcessor : BackgroundService
     {
         var db = services.GetRequiredService<OutboxDbContext>();
         var eventBus = services.GetRequiredService<IEventBus>();
-        // Connection set to learnstack_outbox_admin role; RLS bypassed.
+        // Connection runs as learnstack_outbox_admin: BYPASSRLS skips the policy,
+        // and the GRANT is what bounds what it can reach (see § the bypass bounds).
 
-        await using var tx = await db.Database.BeginTransactionAsync(ct);
+        // 1. CLAIM. One statement, its own short transaction. The lease is written to the
+        //    row, so it outlives the commit that releases the physical locks.
         var batch = await db.Set<OutboxMessage>()
             .FromSqlInterpolated($@"
-                SELECT * FROM outbox_messages
-                WHERE processed_at IS NULL AND available_after <= now()
-                ORDER BY occurred_at
-                LIMIT {BatchSize}
-                FOR UPDATE SKIP LOCKED")
+                UPDATE outbox_messages
+                   SET locked_by    = {_processorId},
+                       locked_until = now() + {LeaseDuration},
+                       attempts     = attempts + 1
+                 WHERE id IN (
+                       SELECT id FROM outbox_messages
+                        WHERE processed_at IS NULL
+                          AND available_after <= now()
+                          AND (locked_until IS NULL OR locked_until < now())
+                        ORDER BY occurred_at
+                        LIMIT {BatchSize}
+                          FOR UPDATE SKIP LOCKED)
+             RETURNING *")
             .ToListAsync(ct);
 
-        if (batch.Count == 0)
-        {
-            await tx.CommitAsync(ct);
-            return 0;
-        }
-
-        // Commit the SELECT FOR UPDATE transaction immediately to release row locks.
-        await tx.CommitAsync(ct);
+        if (batch.Count == 0) return 0;
 
+        // 2. PUBLISH. One short transaction per message. A single poisoned message does
+        //    not roll back the batch.
         foreach (var msg in batch)
         {
             await using var perMessageTx = await db.Database.BeginTransactionAsync(ct);
             try
             {
                 var eventInstance = JsonSerializer.Deserialize(msg.Payload, Type.GetType(msg.Type)!);
-                await eventBus.PublishAsync((IIntegrationEvent)eventInstance!, ct);
-                msg.MarkProcessed(DateTimeOffset.UtcNow);
+                await eventBus.PublishAsync((IIntegrationEvent)eventInstance!, msg.PartitionKey, ct);
+                msg.MarkProcessed(_clock.UtcNow, _processorId);   // no-op if the lease was lost
             }
             catch (Exception ex)
             {
@@ -264,32 +330,84 @@ public sealed class OutboxProcessor : BackgroundService
 }
 ```
 
-Key invariants:
+`MarkProcessed` writes `processed_at` **and** clears the lease under the predicate
+`locked_by = @me`, so a processor whose lease expired mid-batch — because the transport
+hung past `LeaseDuration` — cannot overwrite the state of whichever processor took the
+row next. A lost lease is logged at warning level and surfaces on the
+`learnstack_outbox_lease_lost_total` counter; a non-zero rate means `LeaseDuration` is
+shorter than the transport's tail latency and must be raised.
+
+### The simpler alternative, and its cost
+
+Holding one transaction open across the whole batch — `BEGIN`, `SELECT ... FOR UPDATE
+SKIP LOCKED`, publish each, `UPDATE processed_at`, `COMMIT` — is also correct, and is an
+acceptable implementation of the same contract. Its costs are real and must be accepted
+knowingly:
+
+- The transaction stays open for the duration of every network publish in the batch,
+  pinning the `VACUUM` horizon and the oldest transaction id for that long.
+- One poisoned message rolls back the batch unless every publish is wrapped in a
+  savepoint, which reintroduces most of the complexity the approach was meant to avoid.
+- A crash mid-batch republishes everything already published in it.
+
+The lease is the specified design. The batch-held transaction is the acceptable fallback
+if a deployment cannot add the two columns. Whichever ships, the choice is made once, in
+[Phase 02b](../roadmap/phase-02b-events-auth.md), and written into the dispatcher — not
+left to each reader of this document.
+
+### What the processor guarantees
+
+- **At-least-once delivery.** Duplicates are expected; consumers deduplicate through
+  `IInboxGuard`. This is the contract, not a defect.
+- **At most one active claimant per row.** Two processors cannot both hold a live lease
+  on the same row, so concurrent polling does not multiply dispatches. Duplicates arise
+  only from lease expiry and crash recovery.
+- **Batch independence.** Each message gets its own transaction; one failure does not
+  roll back the batch.
+- **Bounded retry.** Failed messages retry with exponential backoff (1s, 5s, 30s, 5min,
+  1h). On reaching `MaxAttempts` the row moves to the producer-side dead-letter state
+  described below.
+- **Horizontal scalability.** `SKIP LOCKED` plus the lease predicate lets N processors
+  across N pods drain the same table without coordination.
+
+## `IEventBus` and the partition key
+
+The port takes the partition key explicitly. It is not derived inside the transport,
+because the transport is the one component that does not know what the event's ordering
+domain is:
 
-- `FOR UPDATE SKIP LOCKED` allows horizontal scaling (multiple OutboxProcessor instances
-  across pods can run concurrently without double-dispatch).
-- The `SELECT FOR UPDATE` transaction commits immediately to release row locks.
-- Each message gets its own transaction; one failure doesn't roll back the batch.
-- Failed messages are retried with exponential backoff (1s, 5s, 30s, 5min, 1h);
-  permanent failures (max retries reached) move to dead-letter (manual intervention).
+```csharp
+public interface IEventBus
+{
+    Task PublishAsync<TEvent>(TEvent @event, string partitionKey, CancellationToken ct = default)
+        where TEvent : IIntegrationEvent;
+}
+```
 
-## `IEventBus` → Dapr pub/sub → Kafka
+The durable implementation forwards it as Dapr's `partitionKey` metadata, which the Kafka
+pub/sub component maps onto the Kafka message key:
 
 ```csharp
 public sealed class DaprEventBus(DaprClient daprClient) : IEventBus
 {
-    public Task PublishAsync<TEvent>(TEvent @event, CancellationToken ct = default)
+    public Task PublishAsync<TEvent>(TEvent @event, string partitionKey, CancellationToken ct = default)
         where TEvent : IIntegrationEvent
-    {
-        var topic = ConventionTopicName(@event);   // "learnstack.{module}.{aggregate}"
-        return daprClient.PublishEventAsync("pubsub", topic, @event, ct);
-    }
+        => daprClient.PublishEventAsync(
+               "pubsub",
+               ConventionTopicName(@event),          // "learnstack.{module}.{aggregate}"
+               @event,
+               new Dictionary<string, string> { ["partitionKey"] = partitionKey },
+               ct);
 
     private static string ConventionTopicName(IIntegrationEvent @event)
         => $"learnstack.{ExtractModule(@event.GetType())}.{ExtractAggregate(@event.GetType())}";
 }
 ```
 
+`InProcessEventBus` honours the same key by serialising dispatch per partition key —
+concurrent across keys, sequential within one — so a consumer cannot observe an ordering
+in development that the durable transport would not also produce.
+
 Topic naming convention: `learnstack.{module}.{aggregate}`. Examples:
 
 - `learnstack.identity.user`
@@ -300,22 +418,46 @@ Topic naming convention: `learnstack.{module}.{aggregate}`. Examples:
 - `learnstack.hub.entitlement` (Hub-side)
 - `learnstack.cache.invalidation` (cross-instance L1 cache)
 
-## Development mode
+## `InProcessEventBus`
+
+Until the Dapr adapter's trigger fires, `InProcessEventBus` is the only registered
+`IEventBus`. It is a **transport**, not a shortcut, and it carries the same four
+obligations as the durable path:
 
-When `DeploymentMode.Development` and Dapr sidecar isn't running, `InProcessEventBus`
-replaces `DaprEventBus`:
+| Obligation | Why it cannot be skipped in development |
+|---|---|
+| Same handler interface — `IIntegrationEventHandler<T>`, never a bare `INotificationHandler<T>` | Two interfaces means two implementations per consumer, and the one that runs in CI is not the one that runs in production |
+| Same `IInboxGuard` deduplication | Deduplication bugs are the most common integration-event defect; a transport that never delivers a duplicate never surfaces them |
+| Same tenant-context restoration from `@event.TenantId` before the handler runs | A dev path that skips it is a dev path where Row Level Security and the query filters are never exercised on the consumer side |
+| Same per-partition-key ordering | Ordering assumptions that hold only in process are discovered in production |
 
 ```csharp
-public sealed class InProcessEventBus(IPublisher publisher) : IEventBus
+public sealed class InProcessEventBus(
+    IServiceScopeFactory scopeFactory,
+    ITenantContextAccessor tenantAccessor,
+    IPartitionSerializer partitions) : IEventBus
 {
-    public Task PublishAsync<TEvent>(TEvent @event, CancellationToken ct = default)
+    public Task PublishAsync<TEvent>(TEvent @event, string partitionKey, CancellationToken ct = default)
         where TEvent : IIntegrationEvent
-        => publisher.Publish(@event, ct);
+        => partitions.RunSequentiallyFor(partitionKey, async () =>
+        {
+            await using var scope = scopeFactory.CreateAsyncScope();
+            tenantAccessor.Set(TenantContext.FromEvent(@event));    // same restore as the durable path
+            foreach (var handler in scope.ServiceProvider.GetServices<IIntegrationEventHandler<TEvent>>())
+                await handler.HandleAsync(@event, ct);              // handler calls IInboxGuard itself
+        });
 }
 ```
 
-Module subscribers (`INotificationHandler<TIntegrationEvent>` for dev / `IIntegrationEventHandler<TEvent>`
-for prod) handle the event. The composition root chooses based on `DeploymentMode`.
+What the in-process transport genuinely does **not** provide, and what therefore
+constitutes the trigger for the Dapr adapter: delivery to a second process, broker-side
+replay, and durability of the in-flight message if the process dies between publish and
+handle. The outbox row covers the third — an unhandled event has not been marked
+processed and is redelivered — which is precisely why the outbox is LearnStack-owned and
+ships before any transport.
+
+The composition root selects the implementation by `DeploymentMode`; modules never see
+the choice.
 
 ## Rules
 
@@ -325,25 +467,103 @@ for prod) handle the event. The composition root chooses based on `DeploymentMod
 - Consumers are **idempotent** via `IInboxGuard` (per-module inbox table).
 - Mandatory metadata on every integration event: `EventId`, `TenantId`, `OccurredAt`,
   `CorrelationId`. Optional but recommended: `CausationId`, `ActorUserId`.
-- **Tenant context** restored on the consumer side before any business logic runs
-  (Dapr passes the event payload; consumer middleware sets `accessor.SetTenant(...)`
-  from `@event.TenantId` before invoking the handler).
-- Ordering is **not** guaranteed across topics; **per-partition** ordering within a Kafka
-  topic is preserved by partition-keying on the aggregate id when ordering is required
-  (rare).
-- Failed dispatches **retry with exponential backoff**; permanent failures move to a
-  dead-letter state (manual review via the `OutboxStatusEndpoints` admin API).
+- **Tenant context** restored on the consumer side before any business logic runs. The
+  transport delivers the event payload; the consumer scope sets the ambient context from
+  `@event.TenantId` before invoking the handler, so the handler's queries carry the same
+  filters and the same `app.tenant_id` as an HTTP-originated command.
+
+## Ordering
+
+Ordering is **not** guaranteed across topics, and never has been. Within one topic,
+ordering is guaranteed **per partition key** — and a partition key that nobody sets is a
+guarantee nobody has.
+
+The rule, therefore, is that **every outbox row carries a non-null `partition_key`**:
+
+| Event shape | Partition key |
+|---|---|
+| Event about one aggregate instance (the normal case) | The aggregate id — `EnrollmentCreatedIntegrationEvent` keys on `EnrollmentId` |
+| Event about the tenant as a whole (`TenantSuspended`, `EntitlementUpdated`) | `TenantId` |
+| Event with an explicit ordering domain that is neither (rare) | Declared by the event type through `IPartitionedIntegrationEvent.PartitionKey` |
+
+`IOutbox.EnqueueAsync` resolves the key at enqueue time and writes it to the row; the
+processor reads it from the row and passes it to `IEventBus.PublishAsync`. Nothing
+downstream re-derives it, so the ordering domain is decided once, by the producer that
+knows it.
+
+Consequences worth stating plainly:
+
+- Two events about the **same** aggregate arrive in publish order at every consumer.
+- Two events about **different** aggregates may arrive in any relative order, even inside
+  one topic. A consumer that needs a cross-aggregate order needs a different design —
+  usually a read model, not an ordering assumption.
+- Keying on `TenantId` for high-volume events serialises that tenant's whole stream onto
+  one partition. That is a deliberate throughput cost, paid only where the ordering is
+  genuinely tenant-wide.
+- The column is `NOT NULL`, so the database asserts it. The catalogued
+  `Outbox_Row_Carries_Correlation_Context` integration test extends its assertion to
+  `partition_key` when the column lands, so a new enqueue path that forgets it fails in
+  CI rather than in a consumer.
+
+## Dead-letter: two sides, two failure domains
+
+The distinction the earlier draft of this document missed: a producer-side dispatch
+success means "the transport accepted the bytes". It says nothing about whether any
+consumer processed them. The two sides fail independently and need separate handling.
+
+### Producer side — dispatch never succeeded
+
+The outbox row reaches `MaxAttempts` without a successful `PublishAsync`.
+
+- The row stays in the table with `processed_at IS NULL`, `attempts >= MaxAttempts`, and
+  the final `last_error`.
+- `available_after` is pushed beyond the retry horizon so the poller stops picking it up.
+- It surfaces on the `OutboxStatusEndpoints` admin API and on the
+  `learnstack_outbox_deadletter_total{event_type}` counter; the alert is on the counter's
+  rate, not on the table's size.
+- Recovery is a manual replay: an operator clears the lease, resets `attempts`, and
+  resets `available_after`.
+
+### Subscriber side — dispatch succeeded, handling did not
+
+A consumer's handler throws on every attempt: a malformed payload, a schema version it
+cannot read, a permanently failing downstream dependency. The producer's row is long
+since `processed_at`-stamped, and no amount of producer-side retry will help.
+
+- The transport retries the handler with backoff. On exhausting its retry policy it
+  routes the message to a **dead-letter topic**, `learnstack.dlq.{module}` — one per
+  subscribing module, three segments, satisfying
+  `Dapr_PubSub_TopicNames_FollowConvention`. Under Dapr this is the subscription's
+  `deadLetterTopic`; under `InProcessEventBus` the equivalent is a row in
+  `dead_letter_messages` carrying the same envelope.
+- **The inbox row is not marked processed.** A dead-lettered message has not been
+  handled, and recording it as handled would make a later replay a silent no-op.
+- Every module subscribes to its own dead-letter topic with a handler that does nothing
+  but persist the envelope, emit `learnstack_inbox_deadletter_total{module, event_type}`,
+  and raise an operational alert. A dead-letter topic nobody consumes is a queue that
+  grows until the broker's retention silently deletes the evidence.
+- Recovery is an operator-initiated replay from the dead-letter store back onto the
+  original topic. Because the inbox never marked the event processed, the replayed
+  message is handled normally; because `IInboxGuard` is still in the path, a replay that
+  races a late success is still idempotent.
+- Poison-message containment is per subscription. One module's dead-lettered event does
+  not block another module's consumption of the same topic — each subscription has its
+  own offset and its own dead-letter path.
 
 ## Service extraction readiness
 
 The outbox + `IEventBus` is the future service boundary. If a module is promoted to a
 separate service later:
 
-- The module's integration events already cross a real broker (Kafka).
-- The consumer-side subscription pattern (Dapr `[Topic]` attribute or programmatic
-  subscription) works identically across in-process and cross-service.
-- The producer-side outbox is durable; service extraction doesn't require dual-write
-  semantics.
+- The producer-side outbox is durable and LearnStack-owned; service extraction does not
+  require dual-write semantics.
+- The consumer-side contract — `IIntegrationEventHandler<T>`, `IInboxGuard`, tenant-context
+  restoration, partition key — is identical under both transports, so extraction changes
+  which process runs the handler, not how the handler is written.
+- Swapping `InProcessEventBus` for `DaprEventBus` is a composition-root change. That is
+  the whole reason the transport is demand-gated: extraction gets no cheaper by having
+  built the adapter early, and the platform pays the operational cost of a broker every
+  day until then.
 
 ## Architecture tests
 
@@ -360,23 +580,46 @@ separate service later:
   LearnStack-core topics remain 3-segment (`learnstack.{module}.{aggregate}`).
 - `OutboxProcessor_NeverBlocks_OnSingleMessageFailure` — integration test asserts one
   poisoned message doesn't prevent others in the batch from processing.
+- `Integration_Event_Handler_Restores_Tenant_Context` — catalogued in
+  [Architecture Tests Catalogue](../standards/21-architecture-tests-catalogue.md); runs
+  against whichever transport is registered, so `InProcessEventBus` is held to the same
+  restoration contract as the durable path.
+- `Outbox_Row_Carries_Correlation_Context` — extended to assert a non-null
+  `partition_key`.
+- Concurrent-claim integration test: two `OutboxProcessor` instances draining one table
+  produce **one** claim per row while both leases are live. This is the test that would
+  have caught the released-lock defect, and it needs two processors — a single-processor
+  test passes against the broken protocol.
 
 ## Observability
 
-- Outbox lag metric: `learnstack_outbox_pending_count{tenant_id}` (gauge).
+- Outbox lag: `learnstack_outbox_pending_count{tenant_id}` (gauge).
 - Dispatch duration: `learnstack_outbox_dispatch_duration_seconds{event_type}` (histogram).
 - Dispatch failures: `learnstack_outbox_dispatch_failed_total{event_type}` (counter).
-- Inbox dedup count: `learnstack_inbox_dedup_total{module, event_type}` (counter).
-
-Grafana dashboard surfaces these alongside Dapr's own pub/sub metrics
-(`dapr_component_pubsub_*`).
+- Producer-side dead letter: `learnstack_outbox_deadletter_total{event_type}` (counter).
+- Lost leases: `learnstack_outbox_lease_lost_total` (counter) — non-zero means the lease
+  is shorter than the transport's tail latency.
+- Inbox dedup: `learnstack_inbox_dedup_total{module, event_type}` (counter).
+- Subscriber-side dead letter: `learnstack_inbox_deadletter_total{module, event_type}`
+  (counter).
+
+The two dead-letter counters are **separate signals on separate dashboards**. A
+producer-side spike means the transport is down; a subscriber-side spike means a handler
+or a payload is broken. Collapsing them into one "events failed" number destroys the only
+information that distinguishes the two incidents. Once the Dapr adapter lands, both sit
+alongside Dapr's own `dapr_component_pubsub_*` metrics.
 
 ## References
 
-- ADR-0006 (Amendment 1) — Events and Outbox; Dapr pub/sub dispatch transport.
+- ADR-0006 (Amendment 1) — Events and Outbox; dispatch transport.
 - ADR-0010 (Amendment 1) — Cross-Module Communication; outbox dispatch target.
-- ADR-0014 — Adopt Dapr.
-- ADR-0016 — Audit Log Subsystem.
+- ADR-0014 — Adopt Dapr (what LearnStack uses for cross-process pub/sub).
+- [ADR-0033](../decisions/0033-audit-durability-model.md) — Audit durability model;
+  audit fan-out to external sinks rides this outbox, MUST-class audit does not.
+- [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) — Demand-gated
+  infrastructure; when the Dapr and Kafka adapters arrive.
+- [Database Standards § Outbox](../standards/05-database.md) — the canonical
+  `outbox_messages` DDL and RLS policy.
 - [29-dapr-integration.md](29-dapr-integration.md) — Dapr deep dive.
 - [10-cross-module-contracts.md](10-cross-module-contracts.md) — the four sanctioned
   cross-module mechanisms.
diff --git a/docs/architecture/20-search.md b/docs/architecture/20-search.md
index e5c963e..e053d0b 100644
--- a/docs/architecture/20-search.md
+++ b/docs/architecture/20-search.md
@@ -1,5 +1,16 @@
 # Search
 
+> **Read this first.** Meilisearch is **demand-gated**
+> ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)). The `ITenantSearch`
+> port and a **PostgreSQL full-text** implementation ship in
+> [Phase 04](../roadmap/phase-04-cms-media-pages.md), which is the first phase with
+> content to index; the Meilisearch adapter lands in
+> [Phase 09](../roadmap/phase-09-billing-integrations-analytics.md) when its trigger
+> fires — search quality or scale exceeds PostgreSQL full-text. Everything below
+> describes the Meilisearch target, not the running system. The tenant-filter rule is
+> the part that applies to **both** implementations: the predicate is composed inside
+> the port, never by a caller.
+
 LearnStack uses **Meilisearch** for tenant-scoped full-text search across courses, content entries, media metadata, and lesson item titles. This document defines index layout, tenant + locale isolation, indexing pipeline, query path, and operational rules.
 
 The strategic decision lives in [ADR 0012: Search Strategy](../decisions/0012-search-strategy.md). This document is the implementation reference.
diff --git a/docs/architecture/21-feature-flags.md b/docs/architecture/21-feature-flags.md
index 8392919..7da7e4f 100644
--- a/docs/architecture/21-feature-flags.md
+++ b/docs/architecture/21-feature-flags.md
@@ -117,26 +117,47 @@ CREATE TABLE tenant_feature_flags (
 );
 
 -- Hub-projected entitlement cache (plan-level features + limits + compliance caps).
--- One row per tenant; replaced on `learnstack.hub.entitlement` Dapr pub/sub event.
+-- One row per tenant. Despite the name this is a DURABLE projection store, not a
+-- cache: it is the layer that makes the grace window real. Written only by
+-- `IEntitlementProvider.RefreshAsync`, from PUT /api/internal/tenants/{id}/entitlements
+-- or from a signed licence key. The `learnstack.hub.entitlement` event is the eager
+-- INVALIDATION signal for the L1/L2 caches in front of it, not the write path.
 CREATE TABLE platform_entitlement_cache (
     tenant_id        uuid PRIMARY KEY,
-    plan_code        text NOT NULL,
-    features         jsonb NOT NULL,    -- Dictionary<string, bool>
-    limits           jsonb NOT NULL,    -- Dictionary<string, long>
-    compliance       jsonb NOT NULL,    -- caps, regions, retention overrides
-    valid_until      timestamptz NOT NULL,
+    plan_code        text NOT NULL,         -- wire field `tier`
+    features         jsonb NOT NULL,        -- Dictionary<string, bool>
+    limits           jsonb NOT NULL,        -- Dictionary<string, long>
+    compliance       jsonb NOT NULL,        -- caps, regions, retention overrides
+    valid_until      timestamptz NOT NULL,  -- wire field `expires_at`
+    grace_until      timestamptz NULL,      -- null unless in grace; bounds the window
+    generation       bigint NOT NULL DEFAULT 1,  -- monotonic; a push is accepted only
+                                            -- when received.generation >= stored
     refreshed_at     timestamptz NOT NULL DEFAULT now(),
-    source           text NOT NULL      -- 'hub' | 'signed-license-key' | 'null-provider'
+    source           text NOT NULL          -- 'hub' | 'signed-license-key' | 'null-provider'
 );
 ```
 
+The wire shape and the column names differ in two places, and the mapping is normative:
+the projection field `tier` persists to `plan_code`, and `expires_at` persists to
+`valid_until`. `grace_until` and `generation` keep their wire names. `grace_until` is
+nullable — a tenant not in grace has none, and the Hub sends null. `generation` defaults
+to 1 so the tenant-provisioning insert at `POST /api/internal/tenants` needs no special
+case; every later push must carry a value greater than or equal to the stored one, which
+is what makes an out-of-order or replayed push a no-op rather than a downgrade. The wire
+shape is pinned by `entitlement-v1.schema.json` in both repositories; the Hub-side
+rendering is in the `learnstack-hub` repository's
+`docs/architecture/entitlement-projection.md`.
+
 Rules:
 
 - `tenant_id = NULL` is **not** allowed. Platform-wide flags use a sentinel "platform"
   tenant id, never `NULL`.
 - The Hub is the **owner** of `platform_entitlement_cache`; the LearnStack core only
-  reads + invalidates. Writes happen through `IEntitlementProvider.RefreshAsync` on
-  the inbound Dapr event from Hub. See
+  reads + invalidates. Writes happen through `IEntitlementProvider.RefreshAsync`
+  only, driven by the HTTP push (`PUT /api/internal/tenants/{id}/entitlements`) or by a
+  signed licence key. The inbound `learnstack.hub.entitlement` event invalidates the
+  L1 / L2 layers; it is not the write path
+  ([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)). See
   [ADR-0021](../decisions/0021-feature-based-entitlement.md) and
   [29-dapr-integration.md](29-dapr-integration.md).
 - A short-TTL Valkey cache (60 s) fronts both tables for hot-path reads. Eager
@@ -278,7 +299,7 @@ Both surfaces are MUST-audit security-events (see
 - **Phase 06** — Admin Studio surface for editing per-tenant flag overrides and
   viewing the entitlement projection. The Studio screen for `platform_entitlement_cache`
   is **read-only** — actual plan edits happen in the operator portal
-  (`learnstack-hub-web`).
+  (`operator-portal`).
 - **Phase 09** — Audit + observability hooks for both flag writes and entitlement
   refreshes plug into the audit + analytics pipeline.
 - **Phase 11** — Quarterly hygiene review and CI surfacing of stale flags become
diff --git a/docs/architecture/23-data-protection.md b/docs/architecture/23-data-protection.md
index e9036d3..fc3a66a 100644
--- a/docs/architecture/23-data-protection.md
+++ b/docs/architecture/23-data-protection.md
@@ -56,13 +56,32 @@ Per category:
 - Payment → retained for legal period; user notified of the exception.
 - Audit → actor field anonymised; action record retained.
 
-Deletion is a workflow, not a single SQL statement:
-
-1. Tenant admin (or user via self-service post-MVP) initiates the request.
-2. Platform validates eligibility (no active payment dispute, no legal hold).
-3. `UserAnonymisationRequestedV1` event published.
-4. Each module consumes the event and performs its part: anonymise rows, delete storage objects, invalidate Keycloak user.
-5. A final reconciliation job confirms every module reported completion within 30 days. Failures escalate to platform admin.
+Deletion is a workflow, not a single SQL statement — and there are **two** of them,
+separated by authority. Conflating them lets a tenant admin close a person's account
+([Phase 03 § Tenant Data Ownership](../roadmap/phase-03-identity-admin.md)).
+
+**Tenant-scoped erasure.** Initiated by a tenant admin, or by the person acting inside
+that tenant.
+
+1. Eligibility is validated (no active payment dispute, no legal hold).
+2. The `Membership` and its `MembershipProfile` are removed.
+3. That tenant's behaviour rows are anonymised; that tenant's audit entries keep the
+   action record with the actor field anonymised.
+4. The `users` row survives for as long as any membership remains anywhere. Nothing in
+   this flow touches Keycloak.
+
+**Global account closure.** A **platform-scoped** operation. There is no tenant-admin
+endpoint for it.
+
+1. The platform admin enters scope through the audited `EnterPlatformAdminScope(reason)`
+   — the only path that reads across tenants.
+2. Eligibility is validated (no active payment dispute, no legal hold).
+3. `UserAnonymisationRequestedV1` fans out to every tenant the person belongs to.
+4. Each module consumes the event and performs its part: anonymise rows, delete storage
+   objects. **The Keycloak user is invalidated once, at the end, by the platform-scoped
+   step — never by a module reacting to a tenant-scoped request.**
+5. A final reconciliation job confirms every module reported completion within 30 days.
+   Failures escalate to platform admin.
 
 ### Right to Restriction of Processing
 
@@ -145,9 +164,10 @@ not residency-bound.
 Two flows legitimately cross regions:
 
 - **LearnStack ↔ Hub** internal API. Hub may live in a single region (e.g. eu-west)
-  while serving tenants in multiple regions. The four-endpoint contract is small,
-  audit-friendly, and carries no tenant content — only plan / entitlement / license
-  metadata. Tenants whose plan forbids cross-region operator access are served by a
+  while serving tenants in multiple regions. The contract surface is small,
+  audit-friendly, and — by the first invariant of
+  [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md) — carries no tenant
+  content, only plan / entitlement / licence metadata. Tenants whose plan forbids cross-region operator access are served by a
   region-local Hub instance (Hub federation is a Phase-11+ topic, not MVP).
 - **Telemetry → centralised OpenTelemetry collector**. Trace and metric data can be
   shipped cross-region for unified observability; PII redaction in the pipeline keeps
diff --git a/docs/architecture/24-learnstack-hub.md b/docs/architecture/24-learnstack-hub.md
index 16f90aa..922b38a 100644
--- a/docs/architecture/24-learnstack-hub.md
+++ b/docs/architecture/24-learnstack-hub.md
@@ -27,7 +27,7 @@ flowchart TB
     subgraph Hub["learnstack-hub (separate repo)"]
         HubApi["LearnStack.Hub.Api"]
         HubDb[("Hub Postgres<br/>(tenant metadata only,<br/>no tenant content)")]
-        HubWeb["learnstack-hub-web<br/>(operator portal Next.js)"]
+        HubWeb["operator-portal<br/>(operator portal Next.js)"]
     end
 
     subgraph External
@@ -45,7 +45,7 @@ flowchart TB
     HubApi --> Vault
 
     HubApi -- "mTLS + signed JWT + HMAC<br/>POST /api/internal/*<br/>(tenant lifecycle, entitlement push)" --> LSApi
-    LSApi -- "API key<br/>(license verify, usage report)<br/>POST /api/v1/internal/*" --> HubApi
+    LSApi -- "mTLS + signed JWT + HMAC<br/>(license verify, usage report)<br/>POST /api/v1/internal/*" --> HubApi
 
     LSApi --> LSDb
     LSDb -. "RLS isolated; Hub NEVER queries" .- HubApi
@@ -182,43 +182,59 @@ erDiagram
 
 ## 3. Communication contracts
 
-### Contract surface — "closed at four"
-
-The **closed Hub HTTPS contract surface** is the set of endpoints that the
-`LearnStack_Modules_DoNotReference_Hub` architecture test and the "no fifth without
-ADR" rule (per [ADR-0019](../decisions/0019-learnstack-hub.md) and
-[20-infrastructure-stack.md § Hub HTTPS Contract Surface](../standards/20-infrastructure-stack.md))
-guard. Those four endpoints are the **load-bearing entitlement + lifecycle + telemetry
-contract**:
-
-| # | Direction | Method | Path | Purpose |
-|---|-----------|--------|------|---------|
-| 1 | Hub → LS | POST | `/api/internal/tenants` | Create tenant + default organization |
-| 2 | Hub → LS | PUT | `/api/internal/tenants/{id}/entitlements` | Push updated entitlement projection (status, features, limits, compliance.caps) |
-| 3 | LS → Hub | POST | `/api/v1/internal/license/verify` | Pull / verify entitlement (called by `HubEntitlementProvider`) |
-| 4 | LS → Hub | POST | `/api/v1/usage/report` | Report usage metric (idempotent; Hub aggregates per period) |
-
-Adding a fifth endpoint to this closed set requires a new ADR.
-
-### Auxiliary lifecycle endpoints (within the closed surface)
-
-The operational endpoints below are **specializations of endpoint #2** in the closed
-set — they share the same `/api/internal/tenants/{id}` resource, the same
-mTLS + signed JWT + HMAC chain, the same `Hub → LearnStack` direction, and the same
-authorization scope. They are listed separately for clarity but do not count as new
-contract entries:
-
-| Method | Path | Purpose | Belongs to closed-set # |
-|--------|------|---------|--------------------------|
-| PUT | `/api/internal/tenants/{id}/status` | Suspend / activate / archive (status field of entitlement projection) | #2 |
-| GET | `/api/internal/tenants/{id}/usage` | Pull aggregated usage metrics (Hub-side mirror of #4 reports) | #4 |
-| DELETE | `/api/internal/tenants/{id}` | Terminate (hard delete with confirmation) | #1 (inverse) |
-| POST | `/api/v1/internal/license/refresh` | Phone-home refresh used by `SelfHostedOnline` mode — a scheduled call shape of #3 | #3 |
-
-If any of these auxiliary endpoints needs a contract or auth model that **differs**
-from its parent (different role, different rate limit, different payload shape that
-isn't a subset of the parent), it must be promoted to a new ADR-registered closed-set
-entry.
+### Contract surface — two invariants, not a count
+
+Per [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md), the Hub contract
+surface is governed by two properties rather than by an endpoint count:
+
+1. **The Hub stores no tenant content.** Courses, lessons, learners, enrollments,
+   classroom sessions, media and content entries live exclusively in LearnStack. The
+   Hub holds tenant *metadata*: plan, subscription, licence, custom domain, compliance
+   caps, aggregated usage. Enforced by `Hub_NeverStores_TenantData`.
+2. **Every crossing goes through a named adapter** — `IEntitlementProvider`,
+   `IUsageReporter`, `IHubTenantSync`. No other type holds a Hub client, and nothing
+   resolves a host by calling the Hub. Enforced by
+   `LearnStack_Modules_DoNotReference_Hub` and
+   `Hub_Client_Referenced_Only_By_Named_Adapters`.
+
+This section previously declared the surface "closed at four" and then listed four
+further endpoints as "specializations" that did not count. An HTTP endpoint is a path
+plus a method; `DELETE /api/internal/tenants/{id}` is not `POST /api/internal/tenants`
+because one is the inverse of the other. Worse, the pressure to keep the count at four
+is what drove [ADR-0022](../decisions/0022-custom-domain-tls.md) Amendment 1 to tunnel
+TLS private keys through the entitlement payload. The invariants above are what anyone
+actually needed the count to stand for.
+
+**Hub → LearnStack** (`/api/internal/*`, internal listener only):
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| `POST` | `/api/internal/tenants` | Create tenant + default organization |
+| `PUT` | `/api/internal/tenants/{id}/entitlements` | Push the entitlement projection |
+| `PUT` | `/api/internal/tenants/{id}/status` | Suspend / activate / archive |
+| `DELETE` | `/api/internal/tenants/{id}` | Terminate |
+| `GET` | `/api/internal/tenants/{id}/usage` | Pull aggregated usage |
+| `PUT` | `/api/internal/tenants/{id}/host-mappings` | Push host → `(tenant_id, organization_id?)` mappings. Carries the tuple only — certificate material moves by secret-store replication and is referenced by path |
+
+**LearnStack → Hub:**
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| `POST` | `/api/v1/internal/license/verify` | Verify / pull the entitlement projection |
+| `POST` | `/api/v1/internal/license/refresh` | Scheduled phone-home refresh |
+| `POST` | `/api/v1/usage/report` | Report a usage metric (idempotent) |
+| `POST` | `/api/v1/internal/tenants/{id}/custom-domains` | Submit a custom domain on behalf of a tenant admin (proxied through `IHubTenantSync`; the Admin Studio never calls the Hub directly, because a `learnstack` realm token is rejected there) |
+
+Every one of these carries the same auth chain: mTLS with LearnStack-internal CA-signed
+client certificates, an RS256 JWT with `aud=learnstack-internal` and `exp ≤ 5min`
+replay-protected on `jti`, and an HMAC-SHA256 body signature in `X-Signature`.
+
+Adding an endpoint still requires an ADR — not because the count is sacred, but because
+the surface is a cross-repository contract and both repositories have to agree.
+
+The Hub's own tenant-facing and operator-facing APIs (`/api/v1/tenants/*`,
+`/api/v1/subscriptions/*`, `/api/v1/webhooks/*`) are **not** part of this surface; they
+are the Hub's public API, governed by the Hub repository.
 
 ### Authentication chain (applies to every endpoint above)
 
@@ -229,9 +245,15 @@ entry.
 - Bound to internal listener; **never** proxied through APISIX
 
 **LearnStack → Hub `/api/v1/internal/*` and `/api/v1/usage/*`:**
-- API key per LearnStack instance, stored in Vault (`learnstack/hub/api-key`)
-- Rate limit: 100 req/min per key
-- Scope strictly limited to license verification + usage reporting
+- The same three layers: mTLS client cert, RS256 JWT (`aud=learnstack-internal`,
+  `exp ≤ 5 min`, `jti` replay-protected), HMAC-SHA256 body signature
+- Scope strictly limited to licence verification, phone-home refresh, usage reporting, and
+  proxied custom-domain submission — the set enumerated in
+  [ADR-0034 § The endpoint set](../decisions/0034-hub-contract-surface-invariant.md)
+- The per-instance API key from [ADR-0019](../decisions/0019-learnstack-hub.md) is
+  superseded by [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md); rate
+  limiting for this direction is enforced by the Hub's own gateway, not by the
+  credential
 
 ### 3.3. Hub-internal: Stripe / Iyzico webhooks
 
@@ -335,7 +357,7 @@ sequenceDiagram
     HubAPI->>HubAPI: Create LearnStackTenant + HubSubscription + Entitlement (gen=1)
     HubAPI->>Keycloak: Provision tenant in `learnstack` realm<br/>(create tenant_admin user, set tenant_id claim)
     HubAPI->>LSApi: POST /api/internal/tenants {tenant_id, slug, default_org}<br/>(mTLS + signed JWT + HMAC)
-    LSApi->>LSDB: INSERT tenants, organizations (default), platform_entitlement_cache
+    LSApi->>LSDB: INSERT tenants, organizations (default),<br/>platform_host_to_tenant ({slug}.learnstack.app), platform_entitlement_cache
     LSApi-->>HubAPI: 201 Created
     HubAPI->>HubAPI: Schedule welcome email
     HubAPI-->>HubUI: Tenant ready, redirect to {slug}.learnstack.app
@@ -379,7 +401,7 @@ sequenceDiagram
     alt Cache fresh (<15m)
         Cache-->>LSApi: Entitlement (gen=42)
     else Cache stale or miss
-        LSApi->>HubAPI: POST /api/v1/internal/license/verify<br/>(API key, tenant_id, feature_key)
+        LSApi->>HubAPI: POST /api/v1/internal/license/verify<br/>(mTLS + JWT + HMAC; tenant_id, feature_key)
         HubAPI-->>LSApi: Entitlement (gen=42)
         LSApi->>Cache: UPSERT
     end
@@ -433,7 +455,7 @@ sequenceDiagram
 
 ## 6. Operator portal (frontend)
 
-`learnstack-hub-web` is a separate Next.js 16 app deployed at `hub.learnstack.dev`.
+`operator-portal` is a separate Next.js 16 app deployed at `hub.learnstack.dev`.
 Authenticates against `learnstack-hub` Keycloak realm. Operators see:
 
 ```
@@ -544,7 +566,7 @@ In Self-Hosted (especially air-gapped) deployments, Hub may not exist at all; th
 
 Hub's `LearnStack.Hub.Architecture.Tests` runs:
 
-1. `Hub_NeverStores_TenantContent` — Hub DbContext does not contain `Course`, `Lesson`,
+1. `Hub_NeverStores_TenantData` — Hub DbContext does not contain `Course`, `Lesson`,
    `User`, `Enrollment`, `LiveSession`, `LessonItem` entities (or any LearnStack core
    aggregate). Migration scan asserts the absence.
 2. `Hub_Modules_DoNotReference_LearnStack_Internals` — Hub modules reference only
@@ -556,7 +578,15 @@ Hub's `LearnStack.Hub.Architecture.Tests` runs:
    `LearnStack.Hub.Modules.Subscriptions.Infrastructure.Stripe`.
 5. `Iyzico_SDK_Types_NotImportedOutsideInfrastructure` — same for `Iyzipay.*`.
 6. `Hub_Operator_JWT_NeverAccepted_On_LearnStack_Routes` — integration test asserts a
-   `learnstack-hub` realm JWT is rejected by any LearnStack tenant-facing endpoint.
+   `learnstack-hub` realm JWT is rejected by any LearnStack tenant-facing endpoint, and a
+   `learnstack` realm token by `/api/internal/*`.
+7. `Hub_Client_Referenced_Only_By_Named_Adapters` — the second invariant of
+   [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md): a Hub client type is
+   referenced only from `IEntitlementProvider` / `IUsageReporter` / `IHubTenantSync`
+   implementations, never from a module assembly.
+
+`LearnStack_Modules_DoNotReference_Hub` is the mirror of test 2 and is owned and run by
+the **LearnStack** repository, which is why it does not appear in this list.
 
 ## 11. Phasing
 
diff --git a/docs/architecture/25-deployment-models.md b/docs/architecture/25-deployment-models.md
index 7a9c7c8..d689025 100644
--- a/docs/architecture/25-deployment-models.md
+++ b/docs/architecture/25-deployment-models.md
@@ -4,8 +4,19 @@
 [ADR-0019](../decisions/0019-learnstack-hub.md).
 
 LearnStack supports three deployment models from **one codebase, one Helm chart, one set
-of container images**. The differentiator across modes is configuration + Dapr component
-YAML + `IEntitlementProvider` implementation choice — never application code.
+of container images**. The differentiator across modes is configuration + component
+wiring + `IEntitlementProvider` implementation choice — never application code.
+
+> **Support state (2026-08-08).** The `DeploymentMode` enum has five values and the
+> composition root branches on all five. Only **`Development`** and **`SaaS`** are wired
+> and tested end to end today. `Dedicated`, `SelfHostedOnline`, and
+> `SelfHostedAirGapped` are **prepared seams, not supported deployments**, until
+> [Phase 11](../roadmap/phase-11-production-hardening.md) builds their adapters and
+> integration suites, per
+> [ADR-0035](../decisions/0035-demand-gated-infrastructure.md). See
+> [§ 5](#5-deploymentmode-configuration) for what "prepared seam" means concretely. The
+> rest of this document describes the target topologies; it is a design document for all
+> five, and a description of running systems for two.
 
 ## 1. The three modes
 
@@ -83,8 +94,29 @@ Internet
   time: < 1 minute.
 - **Tenant URL**: Starts on `{slug}.learnstack.app`; upgrades to custom domain on
   Growth+ tier.
-- **Failure isolation**: RLS protects tenant rows; one tenant's burst doesn't starve
-  others (rate limits per remote_addr; Phase 11+ per-tenant consumer keys).
+- **Failure isolation**: two different problems, and only one of them is solved today.
+  **Correctness** isolation — no tenant can read or write another tenant's rows — is
+  covered by tenant context + EF query filters + Row Level Security + architecture tests
+  ([ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md)).
+  **Resource** isolation — no tenant can starve another of connections, CPU, or job
+  workers — is **not** covered by any of those. Row Level Security is a visibility
+  predicate: it filters rows, and a filtered query consumes exactly as much of the
+  database as an unfiltered one. A single tenant running an unbounded report can hold a
+  connection, saturate the pool, and degrade every other tenant on the instance while
+  every isolation test stays green.
+
+  What exists today: APISIX `limit-req` keyed on `remote_addr`, which throttles a noisy
+  client but not a noisy tenant — one tenant behind many IPs is unaffected, and many
+  tenants behind one NAT are punished together.
+
+  What is required, and where it lives: **resource fairness is
+  [Phase 11](../roadmap/phase-11-production-hardening.md)** — `statement_timeout` per
+  connection class, per-tenant connection-pool partitioning, query cost ceilings on
+  report and export paths, Hangfire queue fairness so one tenant's bulk import cannot
+  monopolise the workers, and per-tenant rate limiting keyed on the resolved tenant
+  rather than on the client address. No earlier phase owns this work, and until Phase 11
+  ships it, SaaS multi-tenancy is protected against **leakage** but not against
+  **contention**.
 
 ## 3. Dedicated mode
 
@@ -188,17 +220,46 @@ public enum DeploymentMode
 }
 ```
 
-`Program.cs` wires the entitlement provider based on this value (see ADR-0020).
+`Program.cs` wires the entitlement provider based on this value (see ADR-0020). Modules
+never read the enum — `Modules_Do_Not_Reference_DeploymentMode` enforces that the
+composition root branches once.
 
-Other config settings switched by mode:
+### Supported today versus prepared seam
+
+| Value | State | What that means concretely |
+|---|---|---|
+| `Development` | **Supported** | Wired, run daily, covered by the integration suite |
+| `SaaS` | **Supported** | Wired and covered end to end from [Phase 02c](../roadmap/phase-02c-hub-foundation.md) |
+| `Dedicated` | Prepared seam | The branch exists and resolves to the default implementations; no dedicated-topology integration suite, no operational runbook |
+| `SelfHostedOnline` | Prepared seam | Same; the phone-home path needs the Hub adapter and its failure-mode tests |
+| `SelfHostedAirGapped` | Prepared seam | Same, plus a signed-licence provider and a no-egress telemetry target that do not exist yet |
+
+A prepared seam is a **branch point with no adapter behind it**: the value is accepted,
+the composition root routes it, and the implementations it selects are the same defaults
+`Development` gets. It is honest to design for it; it is not honest to sell it. Each seam
+becomes a supported mode in [Phase 11](../roadmap/phase-11-production-hardening.md) when
+its trigger fires — for `SelfHostedAirGapped`, that trigger is a signed Self-Hosted
+contract ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)).
+
+The same ADR adds a rule that this document must obey: **a deployment mode without a
+signed contract cannot be the deciding factor in a technical choice.** It may break a tie
+between otherwise-equal options. It may not, on its own, reject a dependency or justify
+an abstraction.
+
+### Other config settings switched by mode
 
 - **Hub URL** — pointed at LearnStack-hosted (SaaS / Dedicated / SelfHostedOnline) OR
   customer-hosted (rare) OR not set (SelfHostedAirGapped).
-- **Default secret store** — Dapr Vault (most modes) OR file-based (air-gapped optional).
+- **Secret store** — `ConfigurationSecretProvider` today in every mode; the Vault-backed
+  provider is demand-gated to Phase 11 behind `ISecretProvider`, triggered by secrets
+  needing rotation without a redeploy or by a non-development deployment existing.
 - **Telemetry sink** — LearnStack OTel collector (SaaS / Dedicated) OR customer OTel
-  (Self-Hosted).
-- **Dapr pub/sub component** — Kafka backend differs by deployment (managed Kafka vs
-  bundled Kafka).
+  (Self-Hosted). `SelfHostedAirGapped` wires no network exporter at all; its file target
+  lands in Phase 11.
+- **Event transport** — `InProcessEventBus` today in every mode; the Dapr pub/sub
+  component and its Kafka backend land in Phase 11, triggered by a second process needing
+  to consume an integration event. See
+  [15-event-and-outbox.md](15-event-and-outbox.md).
 
 ## 6. Same Helm chart
 
@@ -210,7 +271,8 @@ deployment:
   mode: SaaS
   hub:
     url: https://hub.learnstack.dev
-    apiKeyRef: { name: hub-api-key, key: token }
+    # mTLS client cert + HMAC secret + JWT signing key; no API key (ADR-0034)
+    credentialsRef: { name: hub-internal-api, key: bundle }
   postgres:
     managed: true
     connectionRef: { name: postgres-creds, key: connection-string }
@@ -254,12 +316,14 @@ Same chart. Same templates. Different values.
 
 ## 7. Deployment-mode-conditional behaviour
 
-A small list of behaviours change across modes:
+A small list of behaviours change across modes. This is the **target** table; the two
+supported modes reach it today and the three seams reach it in Phase 11.
 
 | Behaviour | SaaS | Dedicated | Self-Hosted Online | Self-Hosted Air-Gapped |
 |-----------|------|-----------|--------------------|------------------------|
 | `IEntitlementProvider` | Hub | Hub | Hub | SignedLicenseKey |
-| `ISecretProvider` | Dapr → Vault | Dapr → Vault | Dapr → Vault | Dapr → Vault OR file |
+| `ISecretProvider` (target) | Vault | Vault | Vault | Vault OR file |
+| `ISecretProvider` (today) | `ConfigurationSecretProvider` in every mode — the Vault adapter is demand-gated to Phase 11 | ← | ← | ← |
 | Phone-home enabled | Yes | Yes | Yes | No |
 | Outbound HTTP to Hub | Yes | Yes | Yes | No |
 | OTel collector endpoint | LearnStack-hosted | LearnStack-hosted | Customer-hosted | Customer-hosted |
@@ -295,7 +359,7 @@ ghcr.io/learnstack/learnstack-api:v1.0.1
 ghcr.io/learnstack/learnstack-hub-api:v1.0.0
 ghcr.io/learnstack/learnstack-hub-api:v1.0.1
 ghcr.io/learnstack/learnstack-web:v1.0.0
-ghcr.io/learnstack/learnstack-hub-web:v1.0.0
+ghcr.io/learnstack/learnstack-hub-operator-portal:v1.0.0
 ```
 
 For Self-Hosted Air-Gapped, customers pull images into their own registry (script in
@@ -324,6 +388,9 @@ To be authored:
 - `docs/operations/migration-orchestration.md` — Schema migration coordination.
 - `docs/operations/security-incident.md` — Security incident response.
 - `docs/operations/data-export-and-portability.md` — GDPR data export per tenant.
+- `docs/operations/resource-fairness.md` — the SaaS contention controls named in
+  [§ 2](#2-saas-mode): `statement_timeout` classes, pool partitioning, query cost
+  ceilings, Hangfire queue fairness, per-tenant rate limits.
 
 ## 12. Non-goals
 
@@ -338,6 +405,12 @@ To be authored:
 
 - ADR-0020 — Triple Deployment + Hybrid License.
 - ADR-0019 — LearnStack Hub.
+- [ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md) — what
+  Row Level Security does and does not guarantee.
+- [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) — which modes are
+  supported, which are seams, and what promotes a seam.
 - [26-hybrid-license-model.md](26-hybrid-license-model.md) — license payload + lifecycle.
 - [24-learnstack-hub.md](24-learnstack-hub.md) — Hub architecture.
 - [04-technical-architecture.md](04-technical-architecture.md) — overall stack.
+- [Phase 11: Production Hardening, Operations, and Scale](../roadmap/phase-11-production-hardening.md)
+  — owns resource fairness and the three prepared seams.
diff --git a/docs/architecture/26-hybrid-license-model.md b/docs/architecture/26-hybrid-license-model.md
index 987d57a..9d22865 100644
--- a/docs/architecture/26-hybrid-license-model.md
+++ b/docs/architecture/26-hybrid-license-model.md
@@ -15,14 +15,47 @@ The model handles all three deployment modes (SaaS / Dedicated / Self-Hosted) wi
 common implementation. This document describes the license payload, lifecycle, signing
 procedure, refresh cadence, revocation flow, and operational runbook.
 
+## 0. Canonical key vocabulary
+
+The corpus has carried two incompatible spellings for the same cross-repository
+projection: `classroom.recording` versus `classroom.recording.enabled`, and
+`tenancy.max_learners` versus `limits.max_users` versus a bare `max_users`. Since the
+payload is parsed by two repositories and cached in a third place, "close enough" means a
+feature silently reads `false`.
+
+**One form is canonical, and it is the one fixed by
+[ADR-0021 Amendment 1 (2026-05-18)](../decisions/0021-feature-based-entitlement.md) and
+[21-feature-flags.md](21-feature-flags.md):**
+
+| Rule | Canonical | Not canonical |
+|---|---|---|
+| Every key is `{area}.{name}`, lowercase, dot-separated, `snake_case` within a segment | `classroom.recording` | `recording`, `Classroom.Recording` |
+| Feature keys carry **no** `.enabled` suffix — a `FeatureKey` is boolean by construction | `classroom.recording` | `classroom.recording.enabled` |
+| Limit keys are prefixed by their **subject area**, never by the word `limits` | `tenancy.max_learners` | `limits.max_users`, `max_users` |
+| The area is the capability's owner, not the payload section it appears in | `media.storage_gb` | `limits.media_storage_gb` |
+
+Two further rules make the vocabulary enforceable rather than aspirational:
+
+- **A key that is not in `FeatureKeys` / `LimitKeys` may not appear in a payload.** The
+  registries in [21-feature-flags.md](21-feature-flags.md) are the closed set; adding a
+  key is a code change in both repositories plus a plan-editor update, not a Hub-side
+  string.
+- **`FeatureKey_AllReferences_AreInRegistry`** (catalogued in
+  [Architecture Tests Catalogue](../standards/21-architecture-tests-catalogue.md)) fails
+  the build on a free-form string, and the schema snapshot test in
+  [§ 5](#5-entitlement-read-path-and-grace-enforcement) fails on a payload that carries
+  an unregistered key.
+
+Every older spelling elsewhere in the corpus is superseded by this table. Where a
+document still shows `limits.max_users`, it is stale, not an alternative.
+
 ## 1. License key payload
 
 The key is a JWT-style RS256-signed token with a custom header `typ: "LSL"`
-("LearnStack License"). The embedded `entitlement.features` key strings follow
-the typed `FeatureKey` catalog in
-[21-feature-flags.md](21-feature-flags.md) and
-[ADR-0021 Amendment 1](../decisions/0021-feature-based-entitlement.md) — the
-trailing `.enabled` suffix used in earlier drafts has been dropped.
+("LearnStack License"). Its `entitlement` object is the **same shape** the Hub pushes
+over `PUT /api/internal/tenants/{id}/entitlements` and the same shape
+`platform_entitlement_cache` stores — one wire contract, three carriers — and it is
+pinned by `entitlement-v1.schema.json` (see [§ 5](#5-entitlement-read-path-and-grace-enforcement)).
 
 ```json
 {
@@ -51,13 +84,13 @@ trailing `.enabled` suffix used in earlier drafts has been dropped.
         "compliance.data_residency": true
       },
       "limits": {
-        "limits.max_users": 50000,
-        "limits.max_organizations": 100,
-        "limits.classroom_minutes_per_month": -1,
-        "limits.recording_storage_gb": 10000,
-        "limits.media_storage_gb": 50000,
-        "limits.media_bandwidth_gb_per_month": -1,
-        "limits.api_rate_per_minute": 60000
+        "tenancy.max_learners": 50000,
+        "tenancy.max_organizations": 100,
+        "classroom.minutes_per_month": -1,
+        "classroom.recording_storage_gb": 10000,
+        "media.storage_gb": 50000,
+        "media.bandwidth_gb_per_month": -1,
+        "integrations.api_rate": 60000
       },
       "compliance": {
         "caps": {
@@ -71,7 +104,7 @@ trailing `.enabled` suffix used in earlier drafts has been dropped.
     "expires_at": "2028-05-18T00:00:00Z",
     "grace_until": "2028-06-17T00:00:00Z",
     "phone_home_url": "https://hub.learnstack.dev/api/v1/internal/license/refresh",
-    "revocation_list_url": "https://hub.learnstack.dev/api/v1/internal/license/revocations"
+    "revocation_list_url": "https://hub.learnstack.dev/.well-known/learnstack/revocation-list.signed.json"
   },
   "signature": "base64url-encoded-RS256-signature-over-base64url(header).base64url(payload)"
 }
@@ -186,46 +219,126 @@ public sealed class LicenseRefreshJob : LearnStackJob<LicenseRefreshJobParams>
 hit Hub at the same time. The job adds a random 0-119 minute offset per tenant when first
 enqueued.
 
-## 5. Grace period enforcement
+## 5. Entitlement read path and grace enforcement
+
+### What was wrong
+
+The earlier `HubEntitlementProvider.GetAsync` had two defects that cancelled out the
+guarantee this whole document exists to provide:
+
+1. **No cold-start fallback.** On a cache miss it called the Hub unguarded. A Hub outage
+   therefore threw a transport exception **out of a feature-flag check** — so a pod
+   restart during a Hub incident turned "is recording enabled?" into a 500 on an
+   unrelated request path.
+2. **The durable table was never read.** `platform_entitlement_cache` — the table that
+   carries `valid_until` and `grace_until` — did not appear anywhere in the read path.
+   Grace was evaluated against whatever happened to be in the distributed cache, whose
+   TTL is ≤ 15 minutes. The advertised **30-day grace period was, in practice, a 15-minute
+   cache TTL**: on eviction, the only source left was the Hub, which was the thing that
+   was down.
 
-`HubEntitlementProvider.GetAsync(tenantId)`:
+Those are the same defect seen twice: a *freshness* mechanism (cache TTL) was being used
+as an *authorisation* mechanism (grace window). They are different clocks and they need
+different storage.
+
+### The normative order
+
+[ADR-0034 § The entitlement read path](../decisions/0034-hub-contract-surface-invariant.md)
+fixes the order, and the order is normative — an implementation may not skip a layer:
+
+```text
+L1 in-process cache                 (per pod; seconds)
+  → L2 distributed cache             (ICacheService; ≤ 15 min TTL — freshness only)
+    → platform_entitlement_cache     (durable table; carries valid_until + grace_until)
+      → Hub  POST /api/v1/internal/license/verify   (last resort, always guarded)
+```
 
 ```csharp
-public async Task<Entitlement> GetAsync(Guid tenantId, CancellationToken ct)
+public async Task<EntitlementLookup> GetAsync(TenantId tenantId, CancellationToken ct)
 {
-    var cached = await _cache.GetAsync<Entitlement>(CacheKey(tenantId), ct);
-    if (cached is null)
-    {
-        // First access; fetch from Hub
-        cached = await _hubClient.VerifyAsync(tenantId, ct);
-        await _cache.SetAsync(CacheKey(tenantId), cached, ct);
-        return cached;
-    }
+    // 1-2. L1 → L2, both pure freshness layers.
+    if (await _cache.GetAsync<Entitlement>(CacheKey(tenantId), ct) is { } cached)
+        return Evaluate(cached, source: EntitlementSource.Cache);
 
-    var now = _clock.UtcNow;
-    if (now < cached.ExpiresAt)
-    {
-        return cached;                               // Fresh; serve as-is
-    }
+    // 3. Durable projection. This is the layer that makes grace real: it survives pod
+    //    restarts, cache flushes and Hub outages, and it is the only place valid_until /
+    //    grace_until are authoritative.
+    var durable = await _entitlementCacheStore.FindAsync(tenantId, ct);
 
-    if (cached.GraceUntil is not null && now < cached.GraceUntil)
+    // 4. Hub — only when the durable row is missing or stale, and never unguarded.
+    if (durable is null || _clock.UtcNow >= durable.ValidUntil)
     {
-        _logger.LogWarning("Entitlement for {TenantId} in grace period (expired {Expiry}, grace until {Grace})",
-            tenantId, cached.ExpiresAt, cached.GraceUntil);
-        return cached with { InGracePeriod = true };   // Serve cached; flag for UI banner
+        try
+        {
+            var refreshed = await _hubClient.VerifyAsync(tenantId, ct);
+            await _entitlementCacheStore.UpsertAsync(refreshed, ct);   // durable first
+            await _cache.SetAsync(CacheKey(tenantId), refreshed, ct);  // then fast layers
+            return Evaluate(refreshed, source: EntitlementSource.Hub);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            // A control-plane outage must not throw out of a feature-flag check.
+            _logger.LogWarning(ex, "Hub verify failed for {TenantId}; falling back", tenantId);
+            _metrics.HubVerifyFailed();
+            if (durable is null)
+                return EntitlementLookup.Unresolved(tenantId);   // policy table below decides
+        }
     }
 
-    // Past grace; read-only mode
-    return Entitlement.ReadOnly(tenantId, cached.Generation);
+    await _cache.SetAsync(CacheKey(tenantId), durable!, ct);
+    return Evaluate(durable!, source: EntitlementSource.Durable);
 }
 ```
 
-When in grace, the Admin Studio surfaces a banner: "Your license is in a 30-day grace
-period. Contact support / renew via Hub."
+`Evaluate` applies the lifecycle from [§ 3](#3-lifecycle): fresh → serve; past
+`valid_until` but within `grace_until` → serve with `InGracePeriod = true`; past
+`grace_until` → read-only.
+
+The provider **never throws** out of a feature-flag or limit check. Every path returns an
+`EntitlementLookup` carrying the values, the source, and whether the answer is degraded.
+
+### Failure policy by key class
+
+`EntitlementLookup.Unresolved` — no cache, no durable row, no Hub — is the only genuinely
+hard case, and one blanket answer is wrong for it. Each key class declares its posture
+**explicitly in the registry**, so the behaviour is a property of the key rather than of
+the call site:
+
+| Key class | Posture when unresolved | Why |
+|---|---|---|
+| Compliance caps (`compliance.*`, `audit.retention.days`, `data.residency.region`) | **Fail closed** — reject the operation that depends on the cap | An unknown residency or retention cap must never be read as permissive; a wrong answer here is a regulatory finding |
+| Security-surface features (`identity.sso.saml`, `identity.scim`, `audit.export`, `integrations.api_access`) | **Fail closed** — treat as disabled | An unknown answer must not open an export or an API surface |
+| Product capability features (`classroom.recording`, `classroom.breakout_rooms`, `tenancy.custom_domain`, `analytics.advanced_reporting`) | **Fail closed on a cold start, fail open to the last known value otherwise** | A paying tenant mid-class should not lose recording because the Hub is down — but the platform must not invent an entitlement it has never seen |
+| Numeric limits (`tenancy.*`, `classroom.*`, `media.*`, `integrations.api_rate`) | **Fall back to the built-in floor** — the Starter-tier defaults compiled into the binary. Never `-1`, never `0` | Unlimited is a gift; zero is an outage. The floor keeps a tenant working at the smallest plan's ceiling until the answer arrives |
+
+Two consequences worth naming:
+
+- Cold-start-unresolved is **rare and loud**: it requires an empty L1, an empty L2, no
+  durable row, and an unreachable Hub. It is alerted on
+  `learnstack_entitlement_unresolved_total{tenant_id}`, not silently absorbed.
+- The source of every answer is observable —
+  `learnstack_entitlement_source_total{source}` over `cache | durable | hub | floor`. A
+  rising `durable` share means the Hub is degraded; a non-zero `floor` share means
+  tenants are being served the fallback and someone must know.
+
+### The wire contract is pinned
 
-When past grace, every feature flag returns `false`; every limit returns `0`. Writes
-return `Result.Failure("license.expired_read_only")`. Reads continue (so customers don't
-lose access to their own data).
+The projection's shape is checked into **both** repositories as
+`entitlement-v1.schema.json`, and a snapshot test in each fails the build when the
+serialised payload drifts from it. This is what makes the read path above safe to
+evolve: a Hub-side field rename that LearnStack cannot parse breaks a test in the Hub
+repository, not a tenant's feature flag in production.
+
+The schema also encodes the vocabulary from [§ 0](#0-canonical-key-vocabulary) —
+`features` and `limits` keys are validated against the registry — so an unregistered key
+cannot reach a payload that LearnStack will cache.
+
+### UI surface
+
+When in grace, Admin Studio surfaces a banner: "Your license is in a 30-day grace period.
+Contact support / renew via Hub." When past grace, every feature flag returns `false` and
+every limit returns `0`; writes return `Result.Fail("license.expired_read_only")` and
+reads continue, so customers never lose access to their own data.
 
 ## 6. Signed-key delivery (air-gapped)
 
@@ -249,11 +362,23 @@ Same pattern as Nexora's license hot-reload
 
 ## 7. Revocation
 
+The revocation list is a **signed static artefact at a fixed URL**, not an internal-API
+endpoint:
+
 ```
-GET https://hub.learnstack.dev/api/v1/internal/license/revocations
+https://hub.learnstack.dev/.well-known/learnstack/revocation-list.signed.json
 ```
 
-Returns a signed bundle:
+It is deliberately **not** part of the Hub contract surface
+([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)), and it is
+unauthenticated: the RS256 signature is its authentication, and its contents are opaque
+licence ids — no tenant name, no slug, no plan. An unauthenticated reader learns how many
+licences were revoked, not whose. This is also the only form an air-gapped customer can
+consume: a file they can carry in on media, verify offline, and place next to their
+licence. [ADR-0020 § Revocation](../decisions/0020-triple-deployment-hybrid-license.md)
+names the same artefact. Moving it onto an endpoint would require an ADR.
+
+The bundle:
 
 ```json
 {
@@ -269,8 +394,12 @@ Returns a signed bundle:
 }
 ```
 
-LearnStack runtime (any deployment mode) fetches this bundle daily via a Hangfire job.
-The signed bundle is cached locally; signature verified against the same key set.
+The fetch is performed by `SignedLicenseKeyEntitlementProvider` on a daily Hangfire job
+— the same named adapter that reads the `.lic` file, so no unnamed type holds a Hub
+reference and [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)'s second
+invariant holds. Because the artefact is static, signed and unauthenticated, the fetch is
+not a contract-surface crossing. The bundle is cached locally; the signature is verified
+against the same key set.
 
 License verification:
 
@@ -305,8 +434,9 @@ Hub operator portal exposes:
 | Air-gapped customer over-running expiry | 30-day grace + LearnStack-operator visibility for proactive renewal contact |
 | Customer extending license offline | License is RSA-signed; customer cannot forge a new signature |
 | Customer tampering with cached entitlement | Cache table protected by RLS + DB-level read-only role for non-admin paths |
-| Stolen Hub API key | Per-tenant API key; rotatable; scope limited to license verify + usage report |
-| Revoked license still cached | Cache TTL ≤ 15 min; eager invalidation via Dapr event when revoked online; revocation list pulled daily |
+| Stolen phone-home credential | Per-instance client certificate + short-lived RS256 JWT + HMAC body signature; all three rotatable; scope limited to license verify, refresh and usage report ([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)) |
+| Revoked license still cached | Revocation invalidates **all four** layers, in the order that closes the window: `platform_entitlement_cache` row first, then L2, then L1 via the invalidation event. Invalidating only the fast layers leaves the durable row to re-serve the revoked entitlement on the next miss. Cache TTL ≤ 15 min and the daily revocation-list pull are the backstops, not the mechanism |
+| Grace window silently collapsing to a cache TTL | `valid_until` / `grace_until` are read from `platform_entitlement_cache`, never from a cache entry. An integration test flushes both cache layers, stops the Hub, and asserts the tenant still resolves through the durable row for the full grace window |
 
 ## 10. Architecture tests
 
@@ -317,17 +447,32 @@ Hub operator portal exposes:
 3. `NullEntitlementProvider_RejectedInProduction` — runtime startup check: in any non-
    Development environment, `IEntitlementProvider` is `HubEntitlementProvider` or
    `SignedLicenseKeyEntitlementProvider`; never `NullEntitlementProvider`.
-4. `LicenseKey_Payload_MatchesSchema` — `entitlement-v1.schema.json` snapshot test; any
-   breaking change requires schema-version bump.
+4. `LicenseKey_Payload_MatchesSchema` — `entitlement-v1.schema.json` snapshot test, run
+   in **both** repositories against the same checked-in schema; any breaking change
+   requires a schema-version bump and a coordinated change in both. A snapshot test in
+   only one repository proves only that that repository is self-consistent.
+5. `Entitlement_Read_Path_Falls_Through_To_Durable_Row` — integration test: flush L1 and
+   L2, make the Hub unreachable, assert the tenant resolves from
+   `platform_entitlement_cache` and that no exception escapes the feature-flag call.
+6. `FeatureKey_AllReferences_AreInRegistry` — catalogued in
+   [Architecture Tests Catalogue](../standards/21-architecture-tests-catalogue.md);
+   backs the vocabulary rule in [§ 0](#0-canonical-key-vocabulary).
 
 ## 11. Phasing
 
-| Phase | Deliverable |
-|-------|-------------|
-| 02 | `IEntitlementProvider` interface in SharedKernel. `NullEntitlementProvider` default. `platform_entitlement_cache` table. `DeploymentMode` config enum. |
-| 02c | `HubEntitlementProvider` (calls Hub `/internal/license/verify`); Hub-side `Entitlement` recompute on subscription change. |
-| 09b | License-key issuance UI in Hub operator portal. |
-| 11 | `SignedLicenseKeyEntitlementProvider` (air-gapped). Revocation list signing + distribution. Phone-home retry / backoff tuning. Grace period enforcement integration tests. SIGHUP hot-reload. Key rotation procedure documented. |
+Per [ADR-0035](../decisions/0035-demand-gated-infrastructure.md), the port ships early
+and each implementation ships against a written trigger.
+
+| Phase | Deliverable | Trigger |
+|-------|-------------|---------|
+| [02a Packet 6](../roadmap/phase-02a-kernel-tenancy.md) | `platform_entitlement_cache` table; `DeploymentMode` config enum | One-way door — the durable projection's schema and ownership |
+| [02a Packet 9](../roadmap/phase-02a-kernel-tenancy.md) | `IEntitlementProvider` socket; `NullEntitlementProvider` (all features enabled, no limits) as the **only** implementation | — |
+| [02c](../roadmap/phase-02c-hub-foundation.md) | `HubEntitlementProvider` with the four-layer read path above; `entitlement-v1.schema.json` in both repositories; Hub-side `Entitlement` recompute on subscription change | A tenant must be billed or plan-gated |
+| [09b](../roadmap/phase-09b-hub-billing.md) | License-key issuance UI in the Hub operator portal | Commercial billing needed |
+| [11](../roadmap/phase-11-production-hardening.md) | `SignedLicenseKeyEntitlementProvider` (air-gapped); revocation-list signing + distribution; phone-home retry / backoff tuning; grace-period integration tests; SIGHUP hot-reload; key-rotation procedure | A Self-Hosted contract is signed |
+
+`NullEntitlementProvider` must not be registered outside `Development` once Phase 02c
+lands (`NullEntitlementProvider_NotRegistered_OutsideDevelopment`).
 
 ## 12. Operational runbook (Phase 11)
 
@@ -339,8 +484,13 @@ Hub operator portal exposes:
 ## References
 
 - ADR-0020 — Triple Deployment + Hybrid License.
-- ADR-0021 — Feature-Based Entitlement.
+- ADR-0021 (Amendment 1) — Feature-Based Entitlement; the canonical key vocabulary.
 - ADR-0019 — LearnStack Hub.
+- [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md) — the normative
+  entitlement read path and the Hub contract surface invariants.
+- [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) — which entitlement
+  implementation ships when.
+- [21-feature-flags.md](21-feature-flags.md) — the `FeatureKeys` / `LimitKeys` registries.
 - [25-deployment-models.md](25-deployment-models.md) — three-mode topology.
 - [24-learnstack-hub.md](24-learnstack-hub.md) — Hub architecture.
 - Nexora reference: `Nexora/docs/decisions/0030-license-hot-reload-mechanism.md`,
diff --git a/docs/architecture/27-custom-domain-tls.md b/docs/architecture/27-custom-domain-tls.md
index bfa6070..10d1710 100644
--- a/docs/architecture/27-custom-domain-tls.md
+++ b/docs/architecture/27-custom-domain-tls.md
@@ -27,7 +27,7 @@ sequenceDiagram
 
     Tenant->>Studio: Enter domain "anatoliayoga.com"
     Studio->>LSApi: POST /api/v1/tenant/custom-domains (acts as proxy)
-    LSApi->>HubAPI: POST /api/v1/tenants/{id}/custom-domains<br/>(internal API, mTLS)
+    LSApi->>HubAPI: POST /api/v1/internal/tenants/{id}/custom-domains<br/>(via IHubTenantSync; mTLS + JWT + HMAC)
     HubAPI->>HubAPI: Insert CustomDomain row, status=Pending
     HubAPI->>Studio: 201 + verification instructions<br/>(CNAME instructions)
 
@@ -40,10 +40,11 @@ sequenceDiagram
             HubJob->>HubJob: Status=Verifying
             HubJob->>LE: ACME order via DNS-01 (or HTTP-01 fallback)
             LE-->>HubJob: Cert issued
-            HubJob->>HubAPI: Store cert in Vault; update CustomDomain<br/>Status=Active, cert_expires_at=2026-08-16
-            HubAPI->>HubAPI: Publish learnstack.hub.custom-domain.activated event<br/>via Dapr pub/sub
-            HubAPI->>APISIX: Hot-reload route table partial<br/>(add SNI cert + route entry)
-            HubAPI->>LSApi: Cache invalidation for host→tenant lookup
+            HubJob->>HubAPI: Store cert + key in the Hub secret store;<br/>update CustomDomain Status=Active, cert_expires_at
+            HubAPI->>HubAPI: Replicate cert + key to the LearnStack-side secret store<br/>(secret-store replication — never over HTTP payload)
+            HubAPI->>HubAPI: Publish learnstack.hub.custom-domain.activated event
+            HubAPI->>APISIX: Hot-reload route table partial<br/>(SNI entry referencing the secret BY PATH)
+            HubAPI->>LSApi: PUT /api/internal/tenants/{id}/host-mappings<br/>(host to tenant/org mapping only — no key material)
         else CNAME mismatch
             HubJob->>HubJob: Increment attempt; retry in 60s
         end
@@ -165,11 +166,21 @@ routes:
 ssl:
   - id: ssl-anatoliayoga
     sni: anatoliayoga.com
-    # cert/key materialized via Vault Agent sidecar in production
-    cert_ref: vault://learnstack-hub/certs/anatoliayoga.com/cert
-    key_ref:  vault://learnstack-hub/certs/anatoliayoga.com/key
+    # Materialised from the LEARNSTACK-side secret store by the secret-agent sidecar.
+    # The path is the replication target of the Hub-side secret; the value never
+    # travels in an HTTP payload. See § 6.
+    cert_ref: secret://learnstack/certs/anatoliayoga.com/cert
+    key_ref:  secret://learnstack/certs/anatoliayoga.com/key
 ```
 
+> **Phasing note.** APISIX itself is demand-gated to
+> [Phase 11](../roadmap/phase-11-production-hardening.md) per
+> [ADR-0035](../decisions/0035-demand-gated-infrastructure.md); until it arrives, host
+> routing and TLS termination are the deployment's ingress concern and
+> `platform_host_to_tenant` remains the sole authority for host → tenant resolution
+> inside the application. The route-partial mechanism described here is the target
+> design, not a running system.
+
 APISIX watches the file (standalone mode); changes are picked up within seconds.
 
 In Kubernetes, the file is in a ConfigMap; rolling update of the ConfigMap propagates;
@@ -179,35 +190,112 @@ Etcd-backed APISIX (Phase 11+) replaces file-write with direct Admin API call.
 
 ## 6. Tenant resolver mapping
 
-LearnStack runtime needs to map `Host: anatoliayoga.com` → `tenant_id`. Implementation:
+LearnStack runtime needs to map `Host: anatoliayoga.com` → `(tenant_id,
+organization_id?)`.
+
+### Host resolution never calls the Hub
+
+An earlier version of this document showed `CachedHostToTenantResolver` taking an
+`IHubClient` and calling `LookupHostAsync` on every cache miss. That broke three rules at
+once, and the third is the one that matters operationally:
+
+1. It was an **unrecorded endpoint** — no ADR, no entry in the contract surface, and no
+   counterpart in the Hub's own API documentation.
+2. It was a **Hub call from outside the sanctioned adapters**. Only
+   `IEntitlementProvider`, `IUsageReporter` and `IHubTenantSync` may hold a Hub client
+   ([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)).
+3. It put the **Hub on the hot path of anonymous public page loads**. Every cache miss on
+   every marketing page of every tenant became a synchronous dependency on the control
+   plane. A Hub outage — or a cold cache after a deploy during one — would have taken
+   every tenant's public site down, for a lookup whose answer LearnStack already stores.
+
+**`IHubClient.LookupHostAsync` is deleted.** `IHostToTenantResolver` reads
+`platform_host_to_tenant` and nothing else:
 
 ```csharp
 namespace LearnStack.Infrastructure.MultiTenancy;
 
 public interface IHostToTenantResolver
 {
-    Task<Guid?> ResolveAsync(string host, CancellationToken ct = default);
+    Task<HostResolution?> ResolveAsync(string host, CancellationToken ct = default);
 }
 
+public sealed record HostResolution(TenantId TenantId, OrganizationId? OrganizationId);
+
 public sealed class CachedHostToTenantResolver(
     ICacheService cache,
-    IHubClient hubClient) : IHostToTenantResolver
+    TenancyDbContext db) : IHostToTenantResolver
 {
-    public async Task<Guid?> ResolveAsync(string host, CancellationToken ct = default)
-    {
-        return await cache.GetOrSetAsync(
-            $"hub:host:{host}",
-            async _ => await hubClient.LookupHostAsync(host, _),
+    public Task<HostResolution?> ResolveAsync(string host, CancellationToken ct = default)
+        => cache.GetOrSetAsync(
+            $"host:{host}",
+            async token => await db.HostMappings
+                .AsNoTracking()
+                .Where(m => m.Host == host && m.IsActive)
+                .Select(m => new HostResolution(m.TenantId, m.OrganizationId))
+                .SingleOrDefaultAsync(token),
             new CacheOptions(L1Ttl: TimeSpan.FromMinutes(2), L2Ttl: TimeSpan.FromMinutes(15)),
             ct);
-    }
 }
 ```
 
-Cache invalidated on `learnstack.hub.custom-domain.activated` and
-`learnstack.hub.custom-domain.revoked` Dapr pub/sub events. `TenantMiddleware` calls this
-resolver first (before JWT validation, since the tenant context is needed for some
-public anonymous routes too).
+`platform_host_to_tenant` is a **platform-level table**, not tenant-owned — the row is
+what *determines* the tenant, so it cannot be filtered by a tenant context that does not
+exist yet. It is read before `ITenantContext` is populated, and the read is the only
+database access in the request that legitimately runs unscoped.
+
+Consequences of the change:
+
+- A Hub outage degrades **billing and provisioning**. It does not touch page loads.
+- The cache in front of the table is a latency optimisation, not an availability
+  mechanism. Even a total cache failure leaves a single indexed primary-key lookup.
+- `TenantResolverMiddleware` calls this resolver first, before JWT validation, because
+  anonymous public routes need a tenant context too.
+
+### How mappings arrive
+
+Hub pushes host mappings over a dedicated endpoint, **not** through the entitlement
+payload:
+
+```text
+PUT /api/internal/tenants/{id}/host-mappings
+```
+
+The endpoint is part of the enumerated Hub → LearnStack surface in
+[ADR-0034](../decisions/0034-hub-contract-surface-invariant.md), carries the same auth
+chain as every other internal call (mTLS + RS256 JWT with `aud=learnstack-internal` +
+HMAC body signature + `jti` replay protection), and is handled by `IHubTenantSync`. The
+handler upserts `platform_host_to_tenant` and invalidates the resolver cache for the
+affected hosts on `learnstack.hub.custom-domain.activated` /
+`.revoked`.
+
+### Certificate material never rides the mapping payload
+
+The host-mapping payload carries **hosts and identifiers only**. TLS certificates and
+private keys are never carried in an HTTP payload that LearnStack caches, logs, audits or
+mirrors — which is precisely what the superseded design did when it tunnelled cert
+material through `PUT /api/internal/tenants/{id}/entitlements`, a payload that lands in
+`platform_entitlement_cache`.
+
+Key material moves by **secret-store replication** between the Hub-owned and
+LearnStack-owned secret stores, and the mapping payload references it **by path**:
+
+```json
+{
+  "host": "anatoliayoga.com",
+  "tenant_id": "…",
+  "organization_id": null,
+  "certificate_ref": "learnstack/certs/anatoliayoga.com",
+  "is_active": true
+}
+```
+
+`certificate_ref` is a path, resolvable only by a principal that already holds read
+access to that secret store. Possession of the payload — in a log line, an audit row, a
+cache entry, or a support ticket screenshot — grants nothing.
+[ADR-0022 Amendment 1](../decisions/0022-custom-domain-tls.md)'s step 3 is superseded
+accordingly; its central guarantee, that the Hub never holds Kubernetes credentials on
+the LearnStack cluster, is unchanged.
 
 ## 7. Cert renewal
 
@@ -301,16 +389,29 @@ instead of just `tenant_id`.
   always derived from authenticated session, never from request body / query.
 - `CustomDomain_Revocation_RemovesTenantResolverMapping` — integration test ends with the
   resolver returning null for the revoked host.
+- `Hub_Client_Referenced_Only_By_Named_Adapters` — from
+  [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md); a resolver, a
+  middleware or a controller holding an `IHubClient` fails the build. This is the
+  mechanical guard against the deleted `LookupHostAsync` pattern reappearing.
+- `Host_Resolution_Makes_No_Outbound_Calls` — integration test resolves a host with the
+  Hub client registered as a throwing stub and asserts the resolution still succeeds.
 
 ## 11. Phasing
 
-| Phase | Deliverable |
-|-------|-------------|
-| 02a | `IHostToTenantResolver` interface + `CachedHostToTenantResolver` implementation in LearnStack. |
-| 02c | `CustomDomain` aggregate in Hub. Submission endpoint scaffolded; verification logic stubbed (always returns success in dev). |
-| 04 | Admin Studio custom-domain settings page: submission UI, DNS instructions, real-time status. |
-| 09b | Hub operator portal: Pending Queue, Active List, Renewal Watch dashboards. Compliance caps editor includes domain-gating policy. |
-| 11 | Production hardening: cert-manager + Let's Encrypt automation finalised; DNS provider API integrations (Cloudflare, Route 53, GCP DNS, Azure DNS); HTTP-01 fallback; renewal job tested at scale; APISIX hot-reload validated. |
+| Phase | Deliverable | Trigger |
+|-------|-------------|---------|
+| [02a Packet 6](../roadmap/phase-02a-kernel-tenancy.md) | `platform_host_to_tenant` table | One-way door — the table that determines the tenant |
+| [02a Packet 7](../roadmap/phase-02a-kernel-tenancy.md) | `IHostToTenantResolver` + `CachedHostToTenantResolver` reading `platform_host_to_tenant` and nothing else; two hosts wired to two seed tenants | — |
+| [02d](../roadmap/phase-02d-walking-skeleton.md) | Host-based resolution exercised end to end: two hosts, two tenants, one binary | — |
+| [02c](../roadmap/phase-02c-hub-foundation.md) | LearnStack-side `PUT /api/internal/tenants/{id}/host-mappings` handler behind `IHubTenantSync`; Hub-side `CustomDomain` aggregate and submission endpoint live in the Hub repository | A tenant is provisioned through the Hub |
+| [04](../roadmap/phase-04-cms-media-pages.md) | Admin Studio custom-domain settings page: submission UI, DNS instructions, real-time status | — |
+| [09b](../roadmap/phase-09b-hub-billing.md) | Hub operator portal: Pending Queue, Active List, Renewal Watch dashboards; compliance-caps editor includes domain gating | Commercial billing needed |
+| [11](../roadmap/phase-11-production-hardening.md) | **The TLS automation itself**: ACME client, Let's Encrypt integration, DNS provider APIs (Cloudflare, Route 53, GCP DNS, Azure DNS), HTTP-01 fallback, renewal job at scale, secret-store replication, APISIX hot-reload validation | A tenant needs its own domain in production ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)) |
+
+The split is deliberate: **the mapping is a one-way door and ships early; the automation
+that populates it is additive and ships on demand.** A tenant can run on a custom domain
+before Phase 11 by having an operator insert the mapping row and place the certificate in
+the secret store by hand. What Phase 11 removes is the operator, not the capability.
 
 ## 12. Operational runbook (Phase 11)
 
@@ -333,7 +434,13 @@ instead of just `tenant_id`.
 
 ## References
 
-- ADR-0022 — Custom Domain & TLS.
+- ADR-0022 — Custom Domain & TLS. Amendment 1's step 3 (certificate material inside the
+  entitlement payload) is superseded by ADR-0034.
+- [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md) — Hub contract surface
+  invariant: the `host-mappings` endpoint, key material leaving the entitlement payload,
+  and the rule that host resolution never calls the Hub.
+- [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) — when the TLS automation
+  ships.
 - ADR-0019 — LearnStack Hub.
 - ADR-0021 — Feature-Based Entitlement (gate).
 - ADR-0015 — APISIX Gateway (hot-reload of route table + SSL config).
diff --git a/docs/architecture/28-platform-tenant-organization.md b/docs/architecture/28-platform-tenant-organization.md
index c6dd405..587c964 100644
--- a/docs/architecture/28-platform-tenant-organization.md
+++ b/docs/architecture/28-platform-tenant-organization.md
@@ -252,19 +252,21 @@ operational discipline:
 
 Both repositories carry a row for a tenant. Each field belongs to **exactly one** of
 the two as the source of truth; the other side mirrors read-only and is invalidated
-by integration events. The closed Hub HTTPS contract surface (four endpoints,
-ADR-0019) means the only legitimate cross-system writes flow through one of those
-endpoints.
+by integration events. The Hub HTTPS contract surface
+([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)) means the only
+legitimate cross-system writes flow through one of its enumerated endpoints, and every
+one of them goes through a named adapter — `IEntitlementProvider`, `IUsageReporter` or
+`IHubTenantSync`.
 
 | Field | Authoritative side | Mirrored side | Sync direction & event |
 |-------|--------------------|---------------|------------------------|
 | `tenant_id` (UUID) | Hub (issued on tenant create) | LearnStack | One-time push at provisioning via `POST /api/internal/tenants` |
 | `slug` (handle) | Hub | LearnStack | `POST /api/internal/tenants` at create; renames require an ADR (none today) |
 | `display_name` | **LearnStack** | Hub | LearnStack publishes `learnstack.tenancy.tenant.renamed`; Hub consumer updates its mirror |
-| `status` (Trial/Active/Suspended/Archived) | Hub | LearnStack | `PUT /api/internal/tenants/{id}/entitlements` carries the status; or a dedicated lifecycle endpoint to be added by future ADR |
+| `status` (Trial/Active/Suspended/Archived) | Hub | LearnStack | `PUT /api/internal/tenants/{id}/status` |
 | `plan_code` | Hub | LearnStack | Carried inside entitlement projection (`PUT /api/internal/tenants/{id}/entitlements`) |
 | `features` / `limits` / `compliance` | Hub | LearnStack (`platform_entitlement_cache`) | `PUT /api/internal/tenants/{id}/entitlements`; eagerly invalidated by Dapr event `learnstack.hub.entitlement` |
-| Custom-domain `host → tenant` mapping | Hub | LearnStack (`platform_host_to_tenant`) | Hub pushes after DNS / TLS verification; Dapr event `learnstack.hub.custom-domain.activated` / `.deactivated` |
+| Custom-domain `host → tenant` mapping | Hub | LearnStack (`platform_host_to_tenant`) | Hub pushes after DNS / TLS verification via `PUT /api/internal/tenants/{id}/host-mappings`, which carries the tuple only — certificate material moves by secret-store replication and is referenced by path. LearnStack resolves hosts from `platform_host_to_tenant` and **never** calls the Hub |
 | Branding (logo, colours, typography) | **LearnStack** | Hub (denormalised summary only, optional) | LearnStack-side write only; no sync needed today |
 | Organizations + memberships | **LearnStack** | — | Hub does not mirror; tenant-internal shape |
 | Course / content / lesson / enrollment / progress data | **LearnStack** | — | Hub never stores tenant content (invariant #3 above) |
@@ -274,9 +276,9 @@ endpoints.
 
 **Rename rule.** The two fields that can change after provisioning
 (`display_name`, branding) are LearnStack-authoritative — there is no Hub endpoint to
-write them, only a LearnStack-published event the Hub consumer mirrors. This keeps the
-four-endpoint contract closed; adding a Hub-side write for `display_name` would
-require a new ADR.
+write them, only a LearnStack-published event the Hub consumer mirrors. Adding a
+Hub-side write for `display_name` would require a new ADR, because the contract surface
+is a cross-repository agreement.
 
 **Mirror staleness budget.** The entitlement projection is **eagerly** invalidated via
 Dapr and otherwise has a 15-min TTL. The host → tenant mapping is invalidated by Dapr
diff --git a/docs/architecture/29-dapr-integration.md b/docs/architecture/29-dapr-integration.md
index 8de0750..8e21f75 100644
--- a/docs/architecture/29-dapr-integration.md
+++ b/docs/architecture/29-dapr-integration.md
@@ -4,6 +4,19 @@
 [ADR-0006](../decisions/0006-events-and-outbox.md),
 [ADR-0010](../decisions/0010-cross-module-communication.md).
 
+> **Read this first.** This document describes Dapr in the present tense as the **target
+> design**. Per [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) no Dapr
+> component is wired today. Of the three ports, only `ISecretProvider` has shipped —
+> `ConfigurationSecretProvider`, in Packet 3. `IEventBus` and `ICacheService` land with
+> their in-process defaults (`InProcessEventBus`, `InMemoryCacheService`) in
+> [Phase 02a Packet 5](../roadmap/phase-02a-kernel-tenancy.md); from then on those
+> defaults are the only registrations in every deployment mode. The three Dapr adapters
+> land in
+> [Phase 11](../roadmap/phase-11-production-hardening.md) against written triggers — a
+> second process consuming an integration event, a second application instance, and
+> secrets needing rotation without a redeploy. Nothing below is wrong; none of it is
+> running.
+
 LearnStack uses **Dapr** (Distributed Application Runtime) for three building blocks:
 **pub/sub** (Kafka), **state store** (Valkey), **secret store** (Vault). Application code
 interacts with Dapr only through SharedKernel abstractions (`IEventBus`, `ICacheService`,
@@ -150,12 +163,13 @@ secret/learnstack/seaweedfs               endpoint, access-key, secret-key
 secret/learnstack/meilisearch         master-key, public-key
 secret/learnstack/livekit             api-key, api-secret, ws-url
 secret/learnstack/coturn              shared-secret
-secret/learnstack/hub                 api-key, internal-api-hmac-key, internal-api-mtls-cert
+secret/learnstack/hub                 internal-api-hmac-key, internal-api-mtls-cert,
+                                      internal-api-mtls-key, internal-api-jwt-signing-key
 ```
 
 In `Development` the **primary** `ISecretProvider` implementation is
-`EnvironmentSecretProvider` (reads from process env vars; configured via
-`.env`; matches the composition-root table in
+`ConfigurationSecretProvider` (reads `IConfiguration`, which already merges environment
+variables, user secrets and `appsettings.{env}.json`; matches the composition-root table in
 [20-infrastructure-stack.md § Composition Root and Deployment Mode](../standards/20-infrastructure-stack.md)).
 For dev workflows that prefer Dapr-shaped secrets (e.g. exercising the
 `DaprSecretProvider` code path locally), an optional
@@ -207,6 +221,8 @@ public interface ICacheService
         CacheOptions? options = null, CancellationToken ct = default);
     Task SetAsync<T>(string key, T value, CacheOptions? options = null, CancellationToken ct = default);
     Task RemoveAsync(string key, CancellationToken ct = default);
+    // Removed, or redesigned to a generation-key pattern, before Phase 02a Packet 5
+    // ships (ADR-0035). See the note under the reference implementation below.
     Task RemoveByPrefixAsync(string prefix, CancellationToken ct = default);
 }
 
@@ -291,6 +307,11 @@ internal sealed class DaprCacheService : ICacheService
         return _dapr.SaveStateAsync(StateStoreName, prefixed, value, metadata: metadata, cancellationToken: ct);
     }
 
+    // NOTE: superseded. `_trackedKeys` is instance-local, so keys written by another
+    // pod are never evicted and this method silently under-invalidates the moment a
+    // second instance runs. Per ADR-0035 it is removed from `ICacheService` or
+    // redesigned to a generation-key pattern before Phase 02a Packet 5 ships; see
+    // 32-tenant-customization-model.md § 8.2 for the generation-counter shape.
     public async Task RemoveByPrefixAsync(string prefix, CancellationToken ct = default)
     {
         var prefixed = PrefixKey(prefix);
@@ -312,10 +333,14 @@ internal sealed class DaprCacheService : ICacheService
 }
 ```
 
-Cross-instance L1 invalidation: when one pod calls `RemoveByPrefixAsync`, it publishes a
-`learnstack.cache.invalidation` event. A `CacheInvalidationSubscriber` (background
-service) on every pod consumes the event and clears matching L1 entries — except those
-published by its own instance (`InstanceId` skip-self).
+Cross-instance L1 invalidation was originally specified against `RemoveByPrefixAsync`:
+one pod publishes a `learnstack.cache.invalidation` event, and a
+`CacheInvalidationSubscriber` on every pod clears matching L1 entries except those it
+published itself. That contract is superseded. A tenant-scoped **generation counter**
+embedded in the cache key makes every stale key unreachable at once without enumerating
+keys, and needs no invalidation topic on the write path. See
+[32-tenant-customization-model.md § 8.2](32-tenant-customization-model.md) and
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md).
 
 ## 5. Sidecar deployment
 
diff --git a/docs/architecture/30-api-gateway.md b/docs/architecture/30-api-gateway.md
index 3933652..4e67593 100644
--- a/docs/architecture/30-api-gateway.md
+++ b/docs/architecture/30-api-gateway.md
@@ -7,6 +7,33 @@
 LearnStack uses **Apache APISIX** in standalone mode as the API gateway in front of both
 the LearnStack core API and the LearnStack Hub API.
 
+> **Status (2026-08-08).** APISIX is **demand-gated to
+> [Phase 11](../roadmap/phase-11-production-hardening.md)** per
+> [ADR-0035](../decisions/0035-demand-gated-infrastructure.md); its trigger is a non-development
+> deployment that needs edge rate limiting, host routing, or JWT pre-validation. Until
+> then the same responsibilities are carried by ASP.NET middleware inside the API
+> process: correlation-id assignment, CORS, JWT bearer validation, rate limiting, and
+> header normalisation. [ADR-0015](../decisions/0015-api-gateway-apisix.md) stands as the
+> decision that APISIX is the gateway LearnStack uses; ADR-0035 decides when.
+>
+> **A gap worth naming rather than discovering.** In the shipped
+> `infra/apisix/apisix.yaml`, route 100's `openid-connect` block is **commented out**, so
+> today every `/api/v*` request reaches the backend unauthenticated **at the gateway**.
+> **Neither layer authenticates today.** The backend does not re-validate, because there
+> is nothing yet to re-validate against: `grep AddAuthentication\|UseAuthentication` over
+> `backend/src` returns no registration, and `AuthorizationBehavior.Handle` is
+> `return next()` with a Phase 03 TODO. Authentication lands in
+> [Phase 02b](../roadmap/phase-02b-events-auth.md) and authorization in
+> [Phase 03](../roadmap/phase-03-identity-admin.md); until then every `/api/v*` route is
+> open, which is survivable only because no tenant-owned table and no protected endpoint
+> exists yet. The "validated twice" property in § 5 describes the Phase 11 target, not
+> the running system — and the first half of it arrives well before the gateway half.
+> The block is uncommented in
+> [Phase 11](../roadmap/phase-11-production-hardening.md), with the rest of APISIX:
+> [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) demand-gates the gateway,
+> so [Phase 03](../roadmap/phase-03-identity-admin.md) delivers authorization in ASP.NET
+> middleware and corrects this route table, but does not stand APISIX up in front of it.
+
 ## 1. Topology
 
 ```mermaid
@@ -36,7 +63,7 @@ flowchart LR
     APISIX -- "host: app.learnstack.dev OR<br/>{tenant-custom-domain}" --> LSApi
     APISIX -- "host: hub.learnstack.dev" --> HubApi
     HubApi -- "mTLS + signed JWT + HMAC<br/>NEVER via APISIX" --> LSApi
-    LSApi -- "metering / verify (API key)" --> HubInternal
+    LSApi -- "metering / verify (mTLS + JWT + HMAC)" --> HubInternal
     LSApi <-.-> LSDapr
     HubApi <-.-> HubDapr
 ```
@@ -96,6 +123,10 @@ Client request
 6. limit-count      ─── per-window count limit for write endpoints (60/min/token)
   │
   ▼
+6b. basic-auth      ─── consumer credentials from the secret store; used only by the
+  │                       `/admin/hangfire*` infrastructure route, never on `/api/v*`
+  │
+  ▼
 7. proxy-rewrite    ─── header normalisation; strip Authorization-Internal if leaked
   │
   ▼
@@ -129,6 +160,7 @@ plugins:
   - openid-connect
   - limit-req
   - limit-count
+  - basic-auth        # /admin/hangfire* only; a route may not use an undeclared plugin
   - proxy-rewrite
   - response-rewrite
   - prometheus
@@ -137,72 +169,166 @@ plugins:
 
 ## 4. Route table
 
-`apisix.yaml` declares routes with priority bands:
+Three rules govern this table, and each exists because its violation has already been
+found in the corpus.
+
+### Rule 1 — the URI wildcard is a single trailing `*`
+
+`lua-resty-radixtree`, the matcher APISIX uses, supports **one** wildcard and only at the
+**end** of the path. There is no `**` form, and a `*` in the middle of a path is not a
+wildcard — it is a literal asterisk. A route declared as `/api/v*/**` therefore does not
+mean "any version, any sub-path"; it means something no client will ever send.
+
+Because [ADR-0024](../decisions/0024-api-versioning-policy.md) puts the version in the
+URL and the version set is small and enumerable, the correct spelling is one route per
+live version:
+
+| Wrong | Right |
+|---|---|
+| `/api/v*/**` | `/api/v1/*` (and `/api/v2/*` when v2 ships) |
+| `/api/v*/localization/*` | `/api/v1/localization/*` |
+
+Adding a version adds routes. That is the intended cost of URL versioning, and it keeps
+the deprecation window in ADR-0024 visible in the gateway config rather than hidden
+behind a wildcard.
+
+### Rule 2 — every route declares an explicit `priority`
+
+APISIX resolves overlapping routes by `priority`, **higher wins**, and an omitted
+`priority` defaults to `0`. The `id` field is an identifier, not an ordering — a fact the
+earlier version of this table obscured by using `id` values that looked like priority
+bands.
+
+The consequence of that confusion was concrete: the public `GET /api/v*/localization/*`
+route carried no `priority` (so `0`) while the authenticated catch-all carried
+`priority: 100`. Both matched a localization request, the catch-all won, and **a route
+documented as public anonymous would have demanded a bearer token** — an anonymous
+learner loading a public page would have received 401 from the gateway.
+
+The banding is therefore **specific-beats-general, written down**:
+
+| Band | Priority | Contents |
+|---|---|---|
+| Infrastructure | 400 | `/healthz`, `/openapi/*` (environment-gated), `/admin/hangfire*` |
+| Public anonymous | 300 | Named public paths: localization, public catalog reads, auth endpoints with their own strict limits |
+| CORS preflight | 200 | `OPTIONS` on the versioned prefix — must beat the authenticated band so preflight never reaches `openid-connect` |
+| Authenticated catch-all | 100 | Everything else under the versioned prefix |
+
+**A public route always outranks the catch-all.** The invariant is **not** asserted in CI
+today — there is no route-table lint, and calling a rule enforced when the check does not
+exist is precisely the failure
+[Standards 21](../standards/21-architecture-tests-catalogue.md) is written against. The
+lint ships with APISIX itself in
+[Phase 11](../roadmap/phase-11-production-hardening.md). It will fail when any route omits
+`priority`, and when any route whose plugin
+set lacks `openid-connect` shares a path prefix with a higher-or-equal-priority route
+that has it.
+
+### Rule 3 — one trust domain per credential
+
+Route 100 previously carried
+`client_secret_ref: vault://learnstack/hub/internal-api-hmac-key`. That path is the
+**Hub internal API HMAC body-signing key** — a credential from an entirely different
+trust domain, whose possession lets the holder forge a signed entitlement push for **any
+tenant**. Handing it to the edge gateway as an OIDC client secret placed the platform's
+highest-value secret on its most exposed component.
+
+The line is **deleted**, and no substitute is needed: the route is `bearer_only: true`,
+which means APISIX validates a presented bearer token against the realm's public JWKS and
+never performs a code exchange. A `bearer_only` OIDC route has no use for a client
+secret at all.
 
 ```yaml
 routes:
-  # Public anonymous — priority 1
+  # ---- Infrastructure band — priority 400 -------------------------------
   - id: 1
-    uri: /health
+    uri: /healthz
+    methods: [GET]
+    priority: 400
     plugins:
-      limit-req:
-        rate: 10
-        burst: 5
-        rejected_code: 429
-        key: remote_addr
+      limit-req: { rate: 10, burst: 5, key: remote_addr, rejected_code: 429 }
     upstream: { type: roundrobin, nodes: { "learnstack-api:5000": 1 } }
 
   - id: 2
-    uri: /api/v*/localization/*
+    uri: /openapi/*
+    priority: 400
+    upstream: { type: roundrobin, nodes: { "learnstack-api:5000": 1 } }
+    # Dev-only; environment-gated to 404 in production.
+
+  # Hangfire dashboard — defense-in-depth: gateway BasicAuth + backend role check
+  - id: 3
+    uri: /admin/hangfire*
+    priority: 400
+    plugins:
+      basic-auth: {}             # consumer credentials from the secret store
+    upstream: { type: roundrobin, nodes: { "learnstack-api:5000": 1 } }
+
+  # ---- Public anonymous band — priority 300 -----------------------------
+  # MUST outrank the authenticated catch-all, or these become 401s.
+  - id: 10
+    uri: /api/v1/localization/*
     methods: [GET]
+    priority: 300
     plugins:
-      cors:
-        allow_origins: "https://app.learnstack.dev,https://hub.learnstack.dev"
-      limit-req: { rate: 50, burst: 20, key: remote_addr }
+      cors: { allow_origins: "https://app.learnstack.dev,https://hub.learnstack.dev" }
+      limit-req: { rate: 50, burst: 20, key: remote_addr, rejected_code: 429 }
     upstream: { type: roundrobin, nodes: { "learnstack-api:5000": 1 } }
 
-  - id: 3
-    uri: /openapi/*
+  - id: 11
+    uri: /api/v1/auth/*
+    methods: [POST]
+    priority: 300
+    plugins:
+      # allow_origins takes EXACT origins or `**`. It has no `*.domain` wildcard —
+      # `*.learnstack.app` matches nothing and silently blocks every tenant origin.
+      # Subdomain patterns go through allow_origins_by_regex, anchored at both ends.
+      cors:
+        allow_origins: "https://app.learnstack.dev"
+        allow_origins_by_regex: ["^https://[a-z0-9-]+\\.learnstack\\.app$"]
+      limit-count: { count: 5, time_window: 60, key: remote_addr, rejected_code: 429 }
     upstream: { type: roundrobin, nodes: { "learnstack-api:5000": 1 } }
-    # Dev-only; rejected by environment-gated NGINX rule in production.
 
-  # CORS preflight separation — priority 99 (just above main authenticated band)
-  # OPTIONS bypasses openid-connect (which would reject preflight without Authorization header).
-  - id: 99
-    uri: /api/v*/**
+  # ---- CORS preflight band — priority 200 -------------------------------
+  # OPTIONS carries no Authorization header; openid-connect would reject it.
+  - id: 20
+    uri: /api/v1/*
     methods: [OPTIONS]
+    priority: 200
     plugins:
       cors:
-        allow_origins: "https://app.learnstack.dev,*.learnstack.app"
+        allow_origins: "https://app.learnstack.dev"
+        allow_origins_by_regex: ["^https://[a-z0-9-]+\\.learnstack\\.app$"]
         allow_methods: "GET,POST,PUT,PATCH,DELETE,OPTIONS"
-        allow_headers: "Authorization,Content-Type,X-Tenant-Id,X-Correlation-Id"
+        allow_headers: "Authorization,Content-Type,X-Tenant-Id,X-Organization-Id,X-Correlation-Id"
         max_age: 3600
 
-  # Authenticated band — priority 100
+  # ---- Authenticated catch-all — priority 100 ---------------------------
   - id: 100
-    uri: /api/v*/**
+    uri: /api/v1/*
     methods: [GET, POST, PUT, PATCH, DELETE]
+    priority: 100
     plugins:
       openid-connect:
         client_id: learnstack-gateway
-        client_secret_ref: vault://learnstack/hub/internal-api-hmac-key   # via Vault Agent sidecar
         discovery: http://keycloak:8080/realms/learnstack/.well-known/openid-configuration
-        bearer_only: true
-        realm: learnstack
+        bearer_only: true          # validates a presented token; no code exchange,
+        realm: learnstack          # therefore no client secret — see Rule 3
         scope: openid
         set_access_token_header: true
         access_token_in_authorization_header: true
       cors:
-        allow_origins: "https://app.learnstack.dev,*.learnstack.app"
-      limit-req: { rate: 100, burst: 50, key: remote_addr }
+        allow_origins: "https://app.learnstack.dev"
+        allow_origins_by_regex: ["^https://[a-z0-9-]+\\.learnstack\\.app$"]
+      limit-req: { rate: 100, burst: 50, key: remote_addr, rejected_code: 429 }
       request-id: { include_in_response: true }
     upstream: { type: roundrobin, nodes: { "learnstack-api:5000": 1 } }
 
-  # Hub host band — priority 200
+  # ---- Hub host — same banding, scoped by host --------------------------
   - id: 200
     host: hub.learnstack.dev
-    uri: /api/v*/**
+    uri: /api/v1/*
     methods: [OPTIONS]
+    priority: 200
     plugins:
       cors:
         allow_origins: "https://hub.learnstack.dev"
@@ -211,28 +337,27 @@ routes:
 
   - id: 201
     host: hub.learnstack.dev
-    uri: /api/v*/**
+    uri: /api/v1/*
     methods: [GET, POST, PUT, PATCH, DELETE]
+    priority: 100
     plugins:
       openid-connect:
         client_id: learnstack-hub-gateway
         discovery: http://keycloak:8080/realms/learnstack-hub/.well-known/openid-configuration
         bearer_only: true
         realm: learnstack-hub
-      cors:
-        allow_origins: "https://hub.learnstack.dev"
-      limit-req: { rate: 60, burst: 30, key: remote_addr }   # stricter on Hub
+      cors: { allow_origins: "https://hub.learnstack.dev" }
+      limit-req: { rate: 60, burst: 30, key: remote_addr, rejected_code: 429 }   # stricter on Hub
       request-id: { include_in_response: true }
     upstream: { type: roundrobin, nodes: { "learnstack-hub:5000": 1 } }
-
-  # Hangfire dashboard — defense-in-depth: gateway BasicAuth + backend role check
-  - id: 300
-    uri: /admin/hangfire*
-    plugins:
-      basic-auth: {}             # consumer credentials in Vault
-    upstream: { type: roundrobin, nodes: { "learnstack-api:5000": 1 } }
 ```
 
+The corrections in Rules 1–3 land in the shipped `infra/apisix/apisix.yaml` in
+[Phase 03](../roadmap/phase-03-identity-admin.md), alongside uncommenting the
+`openid-connect` block against the realm that exists by then. APISIX becomes a real
+gateway — TLS termination, consumer-keyed limits, WAF — in
+[Phase 11](../roadmap/phase-11-production-hardening.md).
+
 ## 5. Defense-in-depth: JWT validated twice
 
 **Why validate JWT both at APISIX and at the backend?**
@@ -247,6 +372,13 @@ If APISIX is misconfigured, bypassed (someone hits the backend directly on the i
 network), or compromised, the backend still rejects unauthenticated requests. This is
 non-negotiable.
 
+That property is what makes today's state a gap rather than a breach: with route 100's
+`openid-connect` block commented out, layer 1 is absent and layer 2 carries the whole
+load. The system is not open — it is running on one line of defense where the design
+calls for two, and the cheap fast rejection at the edge is not happening. Restoring
+layer 1 is [Phase 03](../roadmap/phase-03-identity-admin.md) work; nothing about the
+backend's obligations changes when it lands.
+
 ```csharp
 // LearnStack.Host/Program.cs
 builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
@@ -274,15 +406,19 @@ builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
 
 | Surface | Rate | Burst | Key |
 |---------|------|-------|-----|
-| `/health` | 10/s | 5 | remote_addr |
-| `/api/v*/localization/*` | 50/s | 20 | remote_addr |
+| `/healthz` | 10/s | 5 | remote_addr |
+| `/api/v1/localization/*` | 50/s | 20 | remote_addr |
+| `/api/v1/auth/*` (login, password reset) | 5/min | 0 | remote_addr |
 | Authenticated GET/POST/PUT/PATCH/DELETE (main API) | 100/s | 50 | remote_addr |
 | Hub authenticated API | 60/s | 30 | remote_addr |
-| `/api/v*/auth/*` (login, password reset) | 5/min | 0 | remote_addr |
-| Write endpoints (POST/PUT/PATCH/DELETE) on authenticated routes | 60/min/token | — | consumer (when consumer-key authn enabled, Phase 11) |
+| Write endpoints (POST/PUT/PATCH/DELETE) on authenticated routes | 60/min/token | — | consumer (when consumer-key authn is wired, Phase 11) |
 
-Phase 11+ moves from `remote_addr`-keyed limits to consumer-key-keyed limits when APISIX
-consumer support is wired (etcd-backed mode required for dynamic consumer issuance).
+`remote_addr` keying limits a noisy **client**, not a noisy **tenant**: one tenant behind
+many addresses is unaffected, and many tenants behind one NAT are throttled together.
+Per-tenant fairness — at the gateway and inside the database — is
+[Phase 11](../roadmap/phase-11-production-hardening.md) work, described in
+[25-deployment-models.md § 2](25-deployment-models.md). Consumer-key-keyed limits require
+etcd-backed mode for dynamic consumer issuance and land in the same phase.
 
 ## 7. CORS preflight separation
 
@@ -290,9 +426,11 @@ The `openid-connect` plugin **rejects OPTIONS requests** because they don't carr
 `Authorization` header. This breaks browser CORS preflight unless OPTIONS is handled
 separately.
 
-Solution: a higher-priority OPTIONS-only route (id 99 / 200) carries the `cors` plugin
-without `openid-connect`. The browser's preflight succeeds; the subsequent actual
-request (with the `Authorization` header) hits the authenticated route.
+Solution: an OPTIONS-only route in the **preflight band (priority 200)** carries the
+`cors` plugin without `openid-connect`. Because 200 outranks the authenticated
+catch-all's 100, the browser's preflight succeeds; the subsequent actual request, with
+its `Authorization` header and a non-OPTIONS method, falls through to the authenticated
+route.
 
 Nexora pattern verbatim (see `Nexora/docs/decisions/0003-deployment-strategy.md` and
 `Nexora/docs/operations/HELM_INSTALLATION.md`).
@@ -351,10 +489,18 @@ Phase 11 deliverables:
 ## 11. Architecture tests
 
 - `Apisix_RouteYaml_IsValid` — CI step running `apisix test` against `apisix.yaml`.
+- `Apisix_Routes_Declare_Explicit_Priority` — route-table lint: every route sets
+  `priority`; a default-`0` route is a latent ordering bug (Rule 2).
+- `Apisix_Public_Routes_Outrank_Authenticated_Catchall` — route-table lint: no route
+  lacking `openid-connect` shares a path prefix with a higher-or-equal-priority route
+  that has it (Rule 2).
+- `Apisix_Uri_Patterns_Are_RadixtreeValid` — route-table lint: at most one `*`, and only
+  as the final path segment (Rule 1).
 - `Apisix_NeverFronts_InternalApi` — integration test asserts requests to
   `app.learnstack.dev/api/internal/*` return 404 from APISIX (route not defined).
 - `Backend_RequiresJwt_OnAllAuthenticatedRoutes` — `WebApplicationFactory` integration
   test: every endpoint outside the public allow-list returns 401 without a bearer token.
+  This is the test that holds the line while the gateway's OIDC block is commented out.
 
 ## 12. Non-goals
 
@@ -367,7 +513,11 @@ Phase 11 deliverables:
 
 ## References
 
-- ADR-0015 — API Gateway with APISIX.
+- ADR-0015 — API Gateway with APISIX (what).
+- [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) — Demand-gated
+  infrastructure (when), and what carries the gateway's responsibilities until then.
+- [ADR-0024](../decisions/0024-api-versioning-policy.md) — URL versioning; why the route
+  table enumerates versions instead of wildcarding them.
 - ADR-0004 Amendment 1 — `learnstack-hub` realm.
 - [11-security.md](../standards/11-security.md) — defense-in-depth.
 - [13-identity-and-auth.md](13-identity-and-auth.md) — Keycloak realm
diff --git a/docs/architecture/31-audit-subsystem.md b/docs/architecture/31-audit-subsystem.md
index 37ac7f6..999125e 100644
--- a/docs/architecture/31-audit-subsystem.md
+++ b/docs/architecture/31-audit-subsystem.md
@@ -1,42 +1,110 @@
 # Audit Subsystem
 
-**Derives from:** [ADR-0016](../decisions/0016-audit-log-subsystem.md),
+**Derives from:** [ADR-0033](../decisions/0033-audit-durability-model.md)
+(supersedes [ADR-0016](../decisions/0016-audit-log-subsystem.md)),
 [ADR-0017 (Tenant + Organization)](../decisions/0017-tenant-organization-hierarchy.md),
 [18-audit-coverage.md](../standards/18-audit-coverage.md).
 
 The audit subsystem captures and persists an append-only history of security- and
 compliance-relevant operations across every LearnStack module. This document describes
-the three-piece pipeline, data model, retention, redaction, and operational concerns.
-
-## 1. Pipeline overview
+the pipeline, the durability model, the data model, retention, redaction, and operational
+concerns.
+
+## 1. Two durability classes
+
+The single most important thing to understand about this subsystem is that **audit is not
+one mechanism**. ADR-0016 treated it as one and inherited a contradiction: Standards 18
+required MUST-class rows to be written in the same transaction as the change they record,
+while ADR-0016 required that audit never block business logic. Under the shipped MediatR
+order — `Validation → Logging → AuditLog → TenantContext → Authorization → Transaction →
+OutboxFlush → Handler` — `AuditLogBehavior` wraps `TransactionBehavior` from the outside,
+so its write lands **after** the business transaction has already committed or rolled
+back. Both requirements could not hold.
+
+Worse, once the corrected Row Level Security template from
+[ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md) lands, an
+audit insert executed outside that transaction runs with no `app.tenant_id` set. The
+policy's `WITH CHECK` rejects the row, and a catch-and-log posture swallows the
+rejection: the audit log would record nothing while reporting success. A silent, complete
+audit failure is strictly worse than a loud one.
+
+[ADR-0033](../decisions/0033-audit-durability-model.md) resolves it by splitting the
+classes rather than reordering the pipeline:
+
+| Class | Where the row is written | On failure | Rationale |
+|---|---|---|---|
+| **MUST**, with a business transaction — security, compliance, privileged access | **Inside the business transaction**, as one parameterised `INSERT` issued by `IAuditStore.WritePendingAsync` immediately before `COMMIT` | **Fail closed** — the transaction rolls back and the caller receives `503 audit_unavailable` | For these events the audit row *is* part of the operation's contract. "Platform admin read tenant B's learner records" with no audit row is an audit finding |
+| **MUST**, with no committed business transaction — `denied` outcomes, read-sensitive queries, non-mutating security events, **and any request whose transaction rolled back or whose commit outcome is unknown** | **Standalone**, through `IAuditStore.WriteStandaloneAsync`, on a connection outside the business transaction: `BEGIN; SET LOCAL app.tenant_id; INSERT; COMMIT` | **Fail closed** — the caller receives `503 audit_unavailable` instead of the original result, never a propagated exception | There is no business transaction to ride, or the one that existed is gone. The row must still satisfy `audit_log`'s `WITH CHECK`, so it sets the GUC on its own terms. Reusing the *business* connection here would be a defect: a row written inside a transaction that is about to roll back rolls back with it |
+| **SHOULD / MAY** — operational, diagnostic | Outside any business transaction, best-effort, same standalone shape | Logged and dropped; the accepted loss is written down in the module's matrix, not assumed | Losing "course renamed" costs a support conversation |
+
+The single most important consequence: **"written" is not "committed".** The
+in-transaction `INSERT` at step 6 becomes durable only when `COMMIT` returns. Between the
+two, a constraint violation, a lost connection, or — far more commonly — a handler that
+calls `SaveChanges` and then returns `Result.Fail(...)` takes the audit row away with the
+business row. A per-request "consumed" flag cannot observe that: the flag lives in a DI
+scope and a database rollback does not touch it. `TransactionBehavior` therefore reports
+the commit boundary explicitly — `Committed`, `RolledBack` or `Indeterminate` — and
+`AuditLogBehavior` re-writes the row standalone for anything that is not `Committed`.
+
+Redaction, projection and external fan-out happen after the commit, reading the committed
+row; none of them updates it. ADR-0016's "audit never blocks business logic" is preserved
+for that second stage and withdrawn for the first.
+
+## 2. Pipeline overview
 
 ```mermaid
-flowchart LR
-    Cmd["Command / Query / Action"] --> Behavior["AuditLogBehavior<br/>(MediatR pipeline)"]
-    Behavior --> Handler["Module handler<br/>(business logic)"]
-    Handler --> SaveChanges["DbContext.SaveChangesAsync"]
-    SaveChanges --> Interceptor["AuditChangeTrackerInterceptor<br/>(EF SaveChangesInterceptor)"]
-    Interceptor --> Buffer["IAuditStateCapture<br/>(scoped buffer)"]
-    Handler --> ReturnsResult["Handler returns Result<T>"]
-    ReturnsResult --> Behavior
-    Behavior --> Buffer
-    Behavior --> Build["Build AuditEntry"]
-    Build --> Store["IAuditStore.SaveAsync"]
-    Store --> Table[("audit_log<br/>(partitioned by month)")]
+flowchart TB
+    Cmd["Command / Query / Action"] --> Behavior["AuditLogBehavior (step 3)<br/>DECIDE"]
+    Behavior --> Config["IAuditConfigService.ClassifyAsync<br/>in-process catalogue + cached audit_config<br/>(no request-path DB read)"]
+    Config -->|"not in the catalogue"| Closed["REJECT<br/>audit_unclassified_operation"]
+    Config --> Intent["MUST-class: park a pending intent<br/>in IAuditStateCapture (no DbContext)"]
+    Intent --> Tx["TransactionBehavior (step 6)<br/>BEGIN; SET LOCAL app.tenant_id"]
+    Tx --> Handler["Handler + OutboxFlush<br/>DbContext.SaveChangesAsync (1..n)"]
+    Handler --> Capture["AuditChangeTrackerInterceptor<br/>snapshots the ChangeTracker into<br/>IAuditStateCapture (writes nothing)"]
+    Capture --> Write["WRITE — IAuditStore.WritePendingAsync<br/>one INSERT on the ambient transaction"]
+    Write --> Commit[("COMMIT — business rows + MUST audit row,<br/>atomically, with app.tenant_id set")]
+    Commit -->|"CommitAsync returned"| Ok["state := Committed"]
+    Commit -->|"rolled back / commit faulted"| NotOk["state := RolledBack | Indeterminate"]
+    Ok --> Recon["RECONCILE — AuditLogBehavior, on the way out"]
+    NotOk --> Recon
+    Recon -->|"state = Committed"| Done["nothing to do — the row is durable"]
+    Recon -->|"anything else, MUST"| Standalone["IAuditStore.WriteStandaloneAsync<br/>own transaction, real outcome"]
+    Recon -->|"SHOULD / MAY"| Best["IAuditStore.WriteBestEffortAsync"]
 ```
 
-Three pieces, separated concerns:
-
-1. **`AuditChangeTrackerInterceptor`** — runs inside `DbContext.SaveChangesAsync`,
-   walks the ChangeTracker, snapshots state for every entity inheriting `AuditableEntity<T>`.
-2. **`IAuditStateCapture`** — a scoped (per-request) buffer that holds entity snapshots
-   until the MediatR behavior reads them.
-3. **`AuditLogBehavior<TRequest, TResponse>`** — wraps the handler, awaits it (catching
-   exceptions to still audit failed operations), reads the buffer, builds one `AuditEntry`
-   per request, writes via `IAuditStore.SaveAsync`. Failure to write never blocks the
-   business response.
-
-## 2. The interceptor
+Read as text — **decide → write → reconcile**. At step 3 the behavior classifies the
+operation from in-process state and, for MUST, parks a pending intent in the scoped
+`IAuditStateCapture`; it opens no transaction and touches no `DbContext`. The handler
+runs inside the transaction `TransactionBehavior` opened, which issued
+`SET LOCAL app.tenant_id` as its first statement; the interceptor snapshots each flush's
+ChangeTracker into the same buffer and writes nothing. Immediately before `COMMIT`,
+`TransactionBehavior` calls `IAuditStore.WritePendingAsync`, which composes the complete
+row and inserts it on that transaction — so it commits with the business write or not at
+all, and Row Level Security accepts it. `TransactionBehavior` then records the commit
+boundary. On the way out, the behavior reconciles: `Committed` means there is nothing to
+do, and anything else means the row is re-written standalone with the real outcome.
+SHOULD/MAY rows and all fan-out are written on that same outbound pass, best-effort.
+
+Four components, separated concerns:
+
+1. **`AuditChangeTrackerInterceptor`** — runs inside `DbContext.SaveChangesAsync`, walks
+   the ChangeTracker, snapshots state for every entity inheriting `AuditableEntity<T>`
+   into `IAuditStateCapture`. It **never** constructs an `AuditEntry` and never inserts
+   one. Making it the writer would work in EF Core terms but would leave two questions
+   unanswerable: which of several flushes in one transaction owns the row, and how the
+   audit type gets mapped into every module's `DbContext` without inverting the
+   dependency direction (see § 7 and [ADR-0033 § Implementation Notes](../decisions/0033-audit-durability-model.md)).
+2. **`IAuditStateCapture`** — the scoped (per-request) audit state: the entity snapshots,
+   the pending MUST-class intent, and the intent's lifecycle state.
+3. **`TransactionBehavior`** — owns the commit boundary, and therefore owns both the
+   durable audit write (immediately before `COMMIT`) and the `Committed` / `RolledBack` /
+   `Indeterminate` signal the reconcile step reads.
+4. **`AuditLogBehavior<TRequest, TResponse>`** — keeps its shipped position and its
+   shipped exception responsibility: catch handler exceptions, record the outcome,
+   rethrow via `ExceptionDispatchInfo`. It decides on the way in and reconciles on the
+   way out; it no longer writes the MUST-class row itself except in the standalone case.
+
+## 3. The interceptor
 
 ```csharp
 namespace LearnStack.Infrastructure.Audit;
@@ -86,24 +154,56 @@ public sealed class AuditChangeTrackerInterceptor : ISaveChangesInterceptor
 }
 ```
 
+The interceptor's job is **capture only**. It returns the unmodified
+`InterceptionResult`, adds nothing to the context, and issues no SQL. It runs once per
+flush, and a MUST-class command may flush more than once inside one transaction — which
+is precisely why the audit row is not built here. `TransactionBehavior` composes it once,
+after the last flush and before `COMMIT`, so the snapshots are complete regardless of how
+many times the handler saved.
+
 Pattern explicitly mirrors Nexora's `AuditChangeTrackerInterceptor` (see
 `Nexora/docs/modules/tier-1-core/audit/SPEC.md` and
 `Nexora/docs/decisions/0009-audit-repository-pattern.md`) — verbatim port to
 LearnStack naming.
 
-## 3. The scoped buffer
+## 4. The scoped buffer
 
 ```csharp
 namespace LearnStack.SharedKernel.Abstractions.Audit;
 
+public enum AuditIntentState
+{
+    None,                  // no MUST-class intent for this request
+    Pending,               // declared at step 3; nothing written yet
+    WrittenInTransaction,  // INSERTed on the ambient transaction — NOT yet durable
+    Committed,             // the ambient transaction committed; the row is durable
+    RolledBack,            // the ambient transaction rolled back; the row is gone
+    Indeterminate,         // COMMIT faulted; the server-side outcome is unknown
+}
+
 public interface IAuditStateCapture
 {
     IReadOnlyList<CapturedEntityChange> Changes { get; }
     void Add(CapturedEntityChange change);
+
+    // The MUST-class intent and its lifecycle. Exactly one intent per request.
+    AuditIntent? Intent { get; }
+    AuditIntentState State { get; }
+
+    void Declare(AuditIntent intent);       // AuditLogBehavior, step 3
+    void MarkWrittenInTransaction();        // IAuditStore.WritePendingAsync
+    void MarkCommitted();                   // TransactionBehavior, after CommitAsync
+    void MarkRolledBack();                  // TransactionBehavior, after RollbackAsync
+    void MarkIndeterminate(Exception cause);// TransactionBehavior, CommitAsync faulted
+
     void Clear();
 }
 ```
 
+`State` is the only durability signal in the system, and it is deliberately **not**
+a "consumed" flag. `WrittenInTransaction` is not durable; only `Committed` is. This
+interface is a `SharedKernel` abstraction and names no EF Core type.
+
 ```csharp
 namespace LearnStack.Infrastructure.Audit;
 
@@ -117,9 +217,13 @@ public sealed class AuditStateCapture : IAuditStateCapture
 ```
 
 Registered as **scoped** in DI (per-request lifetime). Cleared at the end of every
-request to prevent cross-request bleed (architecture test enforces this).
+request to prevent cross-request bleed
+([`AuditStateCapture_ClearedPerRequest`](../standards/21-architecture-tests-catalogue.md)
+enforces this). Because the lifetime is the DI scope and not the database transaction, a
+rollback leaves every field of this object intact — which is exactly why `State` must be
+set by the component that owns the commit, and never inferred.
 
-## 4. The MediatR behavior
+## 5. The MediatR behavior
 
 ```csharp
 namespace LearnStack.Infrastructure.Behaviors;
@@ -130,9 +234,11 @@ public sealed class AuditLogBehavior<TRequest, TResponse>(
     IAuditStore auditStore,
     IAuditStateCapture stateCapture,
     ITenantContextAccessor tenantAccessor,
+    IClock clock,
     ILogger<AuditLogBehavior<TRequest, TResponse>> logger)
     : IPipelineBehavior<TRequest, TResponse>
-    where TRequest : IRequest<TResponse>
+    where TRequest : notnull
+    where TResponse : IResultBase
 {
     public async Task<TResponse> Handle(TRequest request,
         RequestHandlerDelegate<TResponse> next, CancellationToken ct)
@@ -141,101 +247,146 @@ public sealed class AuditLogBehavior<TRequest, TResponse>(
         if (requestKind == RequestKind.Other) return await next();
 
         var (module, operation) = ExtractModuleAndOperation(request, requestKind);
-        var defaultEnabled = requestKind == RequestKind.Command;
-
-        bool auditEnabled;
-        try
-        {
-            auditEnabled = await configService.IsEnabledAsync(module, operation, ct, defaultEnabled);
-        }
-        catch (Exception ex)
-        {
-            // Audit config check failed → skip audit; never block business write.
-            logger.LogError(ex, "Audit config check failed for {Module}.{Operation}",
-                module, operation);
-            return await next();
-        }
 
-        if (!auditEnabled) return await next();
+        // DECIDE. ClassifyAsync reads the in-process catalogue plus the tenant's cached
+        // audit_config overrides. It issues NO query on the request path, and that is a
+        // correctness requirement, not an optimisation: at step 3 no transaction is open,
+        // app.tenant_id is unset, and audit_config carries ENABLE + FORCE row level
+        // security (§ 7). A read here would return ZERO ROWS SILENTLY — indistinguishable
+        // from "this tenant has no overrides" — so no catch could ever fire. On a cache
+        // miss the loader opens its OWN short transaction and sets app.tenant_id itself.
+        var classification = await configService.ClassifyAsync(module, operation, ct);
+
+        // The catalogue is in-process and cannot be unavailable, so "proceeding
+        // unaudited" is impossible by construction. What can happen is an operation
+        // nobody classified — that is rejected, loudly.
+        if (classification == AuditClassification.Unclassified)
+            return Result.FailFor<TResponse>(AuditErrors.UnclassifiedOperation);
+
+        if (classification == AuditClassification.Off) return await next();
+
+        // MUST-class: declare the intent. The id is minted here so the in-transaction row
+        // and any standalone replacement carry the same identity. Nothing is written yet
+        // and no DbContext is touched.
+        if (classification == AuditClassification.Must)
+            stateCapture.Declare(new AuditIntent(
+                AuditEntryId:   AuditEntryId.New(),
+                Module:         module,
+                Operation:      operation,
+                OperationType:  DeriveOperationType(operation),
+                OperationClass: OperationClass.Must,
+                DeclaredAt:     clock.UtcNow));
 
         TResponse response;
-        bool handlerFailed = false;
         Exception? handlerException = null;
 
         try
         {
             response = await next();
         }
-        catch (Exception ex)
+        catch (Exception ex) when (ex is not OperationCanceledException)
         {
-            handlerFailed = true;
             handlerException = ex;
             response = default!;
         }
 
+        // RECONCILE. TransactionBehavior already wrote the MUST-class row on the ambient
+        // transaction and already reported the commit boundary. The only question left is
+        // whether that transaction COMMITTED — "written" is not "committed", and a
+        // per-request flag cannot observe a rollback.
         try
         {
-            var (isSuccess, errorKey) = handlerFailed
-                ? (false, (string?)"audit.handler_exception")
-                : DetermineOutcome(response);
-
-            var entry = new AuditEntry(
-                Id: AuditEntryId.New(),
-                TenantId: tenantAccessor.Current?.TenantId ?? Guid.Empty,
-                OrganizationId: tenantAccessor.Current?.OrganizationId,
-                Module: module,
-                Operation: operation,
-                OperationType: DeriveOperationType(operation),
-                OperationClass: DeriveOperationClass(module, operation),
-                ActorUserId: auditContext.UserId,
-                ActorEmail: auditContext.UserEmail,
-                CorrelationId: auditContext.CorrelationId,
-                IpAddress: auditContext.IpAddress,
-                UserAgent: auditContext.UserAgent,
-                IsSuccess: isSuccess,
-                ErrorKey: errorKey,
-                EntityType: stateCapture.Changes.Count == 1 ? stateCapture.Changes[0].EntityType : null,
-                EntityId:   stateCapture.Changes.Count == 1 ? stateCapture.Changes[0].EntityId : null,
-                BeforeState: SerializeBefore(stateCapture.Changes),
-                AfterState:  SerializeAfter(stateCapture.Changes),
-                Changes:     SerializeChanges(stateCapture.Changes),
-                Timestamp:   DateTimeOffset.UtcNow);
-
-            await auditStore.SaveAsync(entry, ct);
+            if (stateCapture.Intent is { } intent)
+            {
+                if (stateCapture.State != AuditIntentState.Committed)
+                    await auditStore.WriteStandaloneAsync(
+                        BuildDraft(intent, response, handlerException, stateCapture), ct);
+            }
+            else
+            {
+                await auditStore.WriteBestEffortAsync(
+                    BuildDraft(module, operation, classification, response,
+                               handlerException, stateCapture), ct);
+            }
+        }
+        catch (Exception ex) when (classification != AuditClassification.Must)
+        {
+            // SHOULD/MAY only: log and drop. The accepted loss is written down in the
+            // module's audit-coverage matrix, not assumed.
+            logger.LogError(ex, "Best-effort audit save failed for {Module}.{Operation}",
+                module, operation);
         }
         catch (Exception ex)
         {
-            // Audit save failed → log, never block business write.
-            logger.LogError(ex, "Audit save failed for {Module}.{Operation}", module, operation);
+            // MUST-class, and even the standalone write failed. End of the line: the
+            // platform cannot reach PostgreSQL at all. Report loudly and return
+            // audit_unavailable — never a silent success.
+            logger.LogCritical(ex,
+                "MUST-class audit could not be written for {Module}.{Operation}; rejecting",
+                module, operation);
+            return Result.FailFor<TResponse>(AuditErrors.Unavailable);
         }
         finally
         {
             stateCapture.Clear();
         }
 
-        if (handlerFailed)
-            ExceptionDispatchInfo.Capture(handlerException!).Throw();
+        if (handlerException is not null)
+            ExceptionDispatchInfo.Capture(handlerException).Throw();
 
         return response;
     }
 
-    // ClassifyRequest, ExtractModuleAndOperation, DetermineOutcome, DeriveOperationType,
-    // DeriveOperationClass, SerializeBefore/After/Changes are private static helpers.
+    // ClassifyRequest, ExtractModuleAndOperation, DeriveOperationType and the two
+    // BuildDraft overloads are private helpers. BuildDraft resolves the outcome:
+    //   Denied        — the Result carries `forbidden`
+    //   Failed        — any other failure Result, or a handler exception, or
+    //                   stateCapture.State == RolledBack
+    //   Indeterminate — stateCapture.State == Indeterminate
+    //   Success       — otherwise
+    // and fills tenant / organization from ITenantContextAccessor, actor + correlation
+    // from IAuditContext, and the snapshots from stateCapture.Changes.
 }
 ```
 
 Key invariants enforced by this behavior:
 
-- **Audit failure never blocks business write.** The `try { auditStore.SaveAsync(...) }
-  catch { log }` and the surrounding `finally { stateCapture.Clear(); }` guarantee that
-  even a totally broken audit store doesn't reject business commands.
+- **Only `Committed` counts.** The reconcile step branches on
+  `IAuditStateCapture.State`, never on a "consumed" flag. `WrittenInTransaction`,
+  `RolledBack` and `Indeterminate` all produce a standalone row. A MUST-class row that
+  was inserted and then rolled back is re-written with outcome `failed`, so a rolled-back
+  privileged operation is still on the record.
+- **An unclassified operation is rejected.** The in-process catalogue cannot be
+  unavailable, so "proceeding unaudited" is not a reachable state; what is reachable is an
+  operation nobody classified, and that fails with `audit_unclassified_operation`.
+- **A tenant-override read failure does not reject.** Classification falls back to the
+  in-process catalogue, which carries the MUST floor, and the failure is logged at `Error`
+  and surfaced on the audit health check. Rejecting every request platform-wide because a
+  cache is unavailable is a worse compliance outcome than losing one tenant's voluntary
+  SHOULD→MUST elevation; the property ADR-0016 lost — silently switching auditing *off* —
+  is impossible here either way.
+- **MUST-class audit failure fails the operation.** The durable write throws and
+  `TransactionBehavior` rolls back; if even the standalone write fails, the unfiltered
+  `catch` returns `audit_unavailable` (HTTP 503). This is a real availability trade-off,
+  stated in [ADR-0033 § Consequences](../decisions/0033-audit-durability-model.md) and
+  required to be visible in the operational runbooks.
+- **SHOULD/MAY audit failure never blocks the business write.** The cheap path stays
+  cheap; the platform does not pay compliance-grade cost for "a course was renamed".
 - **Failed handlers still get audited.** The behavior catches the handler exception,
-  writes an audit entry with `IsSuccess=false`, then re-throws via `ExceptionDispatchInfo`
-  to preserve the original stack trace.
-- **Per-(module, operation) toggling.** `IAuditConfigService.IsEnabledAsync` reads from
-  per-tenant config (`audit_config` table) with module-declared defaults.
-
-## 5. Pipeline order
+  writes the `failed` outcome through the standalone path — the business transaction has
+  rolled back, so there is no transaction left to ride — then rethrows via
+  `ExceptionDispatchInfo` so the original stack trace survives.
+- **`Indeterminate` prefers a duplicate to a loss.** When `CommitAsync` faults, the row's
+  fate is genuinely unknown, so the standalone row is written anyway, carrying the same
+  `AuditEntryId` as the in-transaction attempt and outcome `indeterminate`. Two rows with
+  one id is the recorded signature of a commit-in-doubt event; the audit read model groups
+  by id and flags it. Losing the audit for a possibly-committed privileged operation is
+  the failure this whole ADR exists to prevent.
+- **A tenant override cannot remove MUST coverage.** `IAuditConfigService.ClassifyAsync`
+  applies the per-tenant `audit_config` override and then re-applies the catalogue's MUST
+  floor. A tenant may audit *more* than the baseline, never less.
+
+## 6. Pipeline order
 
 MediatR pipeline behaviors are registered in this order in
 `LearnStack.Infrastructure.DependencyInjection`:
@@ -244,7 +395,7 @@ MediatR pipeline behaviors are registered in this order in
 services.AddTransient(typeof(IPipelineBehavior<,>), typeof(ValidationBehavior<,>));
 services.AddTransient(typeof(IPipelineBehavior<,>), typeof(LoggingBehavior<,>));
 services.AddTransient(typeof(IPipelineBehavior<,>), typeof(AuditLogBehavior<,>));
-services.AddTransient(typeof(IPipelineBehavior<,>), typeof(TenantContextCheckBehavior<,>));
+services.AddTransient(typeof(IPipelineBehavior<,>), typeof(TenantContextBehavior<,>));
 services.AddTransient(typeof(IPipelineBehavior<,>), typeof(AuthorizationBehavior<,>));
 services.AddTransient(typeof(IPipelineBehavior<,>), typeof(TransactionBehavior<,>));
 services.AddTransient(typeof(IPipelineBehavior<,>), typeof(OutboxFlushBehavior<,>));
@@ -256,15 +407,88 @@ Effective execution order (outer → inner):
 Request
   → Validation        (reject before any work; FluentValidation)
   → Logging           (request scope; correlation id)
-  → AuditLog          (wraps the rest; audit failure never blocks)
-  → TenantContextCheck (assert tenant_id resolved)
+  → AuditLog          (classifies; rejects an unclassified operation)
+  → TenantContext     (assert tenant_id resolved)
   → Authorization     (resource-scoped checks beyond endpoint-level [Authorize])
-  → Transaction       (begin transaction; commit/rollback on outcome)
+  → Transaction       (begin transaction; SET LOCAL app.tenant_id; commit/rollback)
   → OutboxFlush       (flush outbox writes to DbContext before commit)
   → Handler           (business logic)
 ```
 
-## 6. Data model
+**The order did not change, and does not need to.** `AuditLogBehavior` still sits outside
+`TransactionBehavior`, which is exactly why its *own* write cannot be the durable one. The
+durable MUST-class row is written by `TransactionBehavior` — the behavior that owns the
+commit boundary — from the intent the outer behavior declared. The decision travels inward
+through the pipeline; the commit outcome travels back out.
+
+```csharp
+// LearnStack.Application.Pipeline.TransactionBehavior — step 6. The commit boundary owns
+// the durable audit write AND the durability signal, because they are the same fact.
+public async Task<TResponse> Handle(TRequest request,
+    RequestHandlerDelegate<TResponse> next, CancellationToken ct)
+{
+    if (!RequiresTransaction(request)) return await next();
+
+    await unitOfWork.BeginTransactionAsync(ct);
+    // First statement inside the transaction, per ADR-0003 Amendment 3.
+    await unitOfWork.SetTenantContextAsync(tenantContext, ct);
+
+    try
+    {
+        var response = await next();
+
+        if (!response.IsSuccess)
+        {
+            await unitOfWork.RollbackAsync(CancellationToken.None);
+            stateCapture.MarkRolledBack();
+            return response;                       // audited standalone, outcome = failed
+        }
+
+        // WRITE. No-op unless a MUST-class intent is pending. Throws on failure, which
+        // reaches the catch below and rolls the business write back — fail closed.
+        await auditStore.WritePendingAsync(unitOfWork, ct);
+
+        try
+        {
+            await unitOfWork.CommitAsync(ct);
+            stateCapture.MarkCommitted();          // the ONLY place durability is claimed
+        }
+        catch (Exception ex)
+        {
+            // A faulted COMMIT leaves the server-side outcome genuinely unknown.
+            stateCapture.MarkIndeterminate(ex);
+            throw;
+        }
+
+        return response;
+    }
+    catch (Exception ex) when (stateCapture.State != AuditIntentState.Indeterminate)
+    {
+        await unitOfWork.RollbackAsync(CancellationToken.None);
+        stateCapture.MarkRolledBack();
+
+        if (ex is AuditWriteFailedException)
+            return Result.FailFor<TResponse>(AuditErrors.Unavailable);
+
+        throw;
+    }
+}
+```
+
+`IUnitOfWork` is the seam that lets this generic behavior open and commit a transaction
+without naming any module's `DbContext`, and through which `IAuditStore` reaches the
+ambient connection. It is a [Phase 02a Packet 6](../roadmap/phase-02a-kernel-tenancy.md)
+deliverable that the shipped `TransactionBehavior` shell already presumes.
+
+The alternative — moving `TransactionBehavior` outward so it wraps `AuditLogBehavior` —
+was considered and rejected in
+[ADR-0033 § Considered Options](../decisions/0033-audit-durability-model.md): it would
+also drag `TenantContext` and `Authorization` inside the transaction and open the
+transaction before validation has finished, changing a shipped, test-asserted global
+ordering (`MediatR_Pipeline_Order_Matches_Canonical_Sequence`) to solve a problem
+belonging to one behavior.
+
+## 7. Data model
 
 ### `AuditEntry` aggregate
 
@@ -325,6 +549,29 @@ public enum OperationClass { Must, Should, May }
 
 ### `audit_log` table
 
+`audit_log` ships in [Phase 02a Packet 9](../roadmap/phase-02a-kernel-tenancy.md) as a
+**single, plain, correct table**. Monthly partitioning, the partition-management job, and
+the retention purge from [ADR-0028](../decisions/0028-audit-log-partition-management.md)
+move to [Phase 11](../roadmap/phase-11-production-hardening.md) per
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md), against the trigger
+"measured `audit_log` growth justifies partition maintenance". Audit **correctness**
+cannot be added later; audit **scale** can, and the platform has no rows yet to scale.
+
+Two details that a partition-ready design gets wrong if it is copied carelessly:
+
+- The primary key is the **composite** `(id, timestamp)`. ADR-0016's DDL declared a
+  primary key twice — inline on `id` and again as a table constraint on `(id, timestamp)`
+  — and PostgreSQL rejects that table outright. When partitioning arrives, a partitioned
+  table must include every partition-key column in its primary key, so the composite is
+  the correct one and the inline declaration was the error. Shipping the composite now
+  means Phase 11 adds `PARTITION BY RANGE (timestamp)` without a key migration.
+- Cross-tenant reads use **`learnstack_platform`**, entered through the audited
+  `EnterPlatformAdminScope(reason)` path. There is no separate `learnstack_audit_admin`
+  role: the database role model fixed by
+  [ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md) has
+  exactly four roles, and every additional `BYPASSRLS` role is a hole in the isolation
+  model that would need its own ADR.
+
 ```sql
 CREATE TABLE audit_log (
     id               uuid NOT NULL,
@@ -338,8 +585,9 @@ CREATE TABLE audit_log (
     operation_class  text NOT NULL,
     entity_type      text NULL,
     entity_id        text NULL,
-    is_success       boolean NOT NULL,
+    outcome          text NOT NULL,     -- 'success' | 'denied' | 'failed'
     error_key        text NULL,
+    reason           text NULL,          -- EnterPlatformAdminScope(reason), denial cause
     before_state     jsonb NULL,
     after_state      jsonb NULL,
     changes          jsonb NULL,
@@ -348,14 +596,15 @@ CREATE TABLE audit_log (
     user_agent       text NULL,
     timestamp        timestamptz NOT NULL DEFAULT now(),
     metadata         jsonb NULL,
-    PRIMARY KEY (id, timestamp)
-) PARTITION BY RANGE (timestamp);
-
-CREATE TABLE audit_log_2026_05 PARTITION OF audit_log
-    FOR VALUES FROM ('2026-05-01') TO ('2026-06-01');
-CREATE TABLE audit_log_2026_06 PARTITION OF audit_log
-    FOR VALUES FROM ('2026-06-01') TO ('2026-07-01');
--- ... auto-created monthly by a Hangfire recurring job (LearnStackJob)
+    CONSTRAINT audit_log_pkey PRIMARY KEY (id, timestamp)
+);
+-- Phase 11 does NOT alter this table in place: PostgreSQL has no
+-- ALTER TABLE ... PARTITION BY. It creates a partitioned parent, attaches this
+-- table to it, and recreates the indexes and the policy on the parent, under a
+-- lock. The composite key above is what keeps that a data operation rather than
+-- a key migration (ADR-0033 § Corrected audit_log DDL).
+-- The composite key above is already partition-compatible, so that change is
+-- additive rather than a key migration.
 
 CREATE INDEX ix_audit_log_tenant_timestamp
     ON audit_log (tenant_id, timestamp DESC);
@@ -368,13 +617,102 @@ CREATE INDEX ix_audit_log_correlation
 CREATE INDEX ix_audit_log_module_operation_timestamp
     ON audit_log (module, operation, timestamp DESC);
 
--- RLS
+-- RLS: built from the canonical template in Database Standards § Tenant-Owned and
+-- Organization-Scoped Tables — one AND-ed policy, ENABLE *and* FORCE, explicit
+-- WITH CHECK. Do not hand-write it here; the template is the single source of truth.
 ALTER TABLE audit_log ENABLE ROW LEVEL SECURITY;
-CREATE POLICY audit_log_tenant_isolation ON audit_log
-    USING (tenant_id = current_setting('app.tenant_id', true)::uuid);
--- Platform admin role bypasses RLS via SET role learnstack_audit_admin (audited).
+ALTER TABLE audit_log FORCE  ROW LEVEL SECURITY;
+CREATE POLICY audit_log_isolation ON audit_log
+    USING      (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid)
+    WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid);
+-- Cross-tenant reads run as learnstack_platform, entered through the audited
+-- EnterPlatformAdminScope(reason) path.
+```
+
+The `WITH CHECK` clause is the reason a MUST-class audit row must be written either inside
+the business transaction or inside a short transaction that sets the GUC itself. With
+neither, `app.tenant_id` is unset or reset to `''`, `NULLIF(current_setting(…), '')`
+yields `NULL`, the predicate is false, and the insert is rejected — which the old
+catch-and-log posture would have swallowed. Note honestly what this clause does and does
+not buy: because the standalone writer derives both the GUC and the row's `tenant_id` from
+the same `ITenantContext`, `WITH CHECK` is vacuous for that write. The guard that matters
+is that `tenant_id` on an audit row comes from `ITenantContext` and **never** from the
+request payload. See [Database Standards](../standards/05-database.md) for the template
+and [ADR-0033](../decisions/0033-audit-durability-model.md) for the durability rule.
+
+Platform-scope events with no resolved tenant (provisioning, Hub-operator actions) are
+written with the reserved nil UUID `00000000-0000-0000-0000-000000000000` as `tenant_id`,
+and the standalone writer sets `app.tenant_id` to the same value. No tenant may ever be
+provisioned with the nil UUID, so those rows are invisible to every tenant policy and
+readable only through `learnstack_platform`.
+
+### Append-only enforcement
+
+Append-only is enforced by **privilege first, trigger second** — not by convention and
+not by an architecture test alone.
+
+```sql
+-- The runtime role may only add rows and read them back.
+REVOKE UPDATE, DELETE ON audit_log FROM learnstack_app;
+
+-- Exactly two mutating paths exist. Both are owned by the Audit module and both run as
+-- learnstack_platform through the audited EnterPlatformAdminScope(reason) path:
+--   1. GDPR redaction  — UPDATE, restricted to the redactable columns (§ 10).
+--   2. Retention purge — DELETE of rows past retention (§ 9). After Phase 11
+--      partitioning this becomes DETACH + DROP PARTITION and issues no DELETE at all.
+CREATE OR REPLACE FUNCTION audit_log_append_only()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+    IF current_user <> 'learnstack_platform' THEN
+        RAISE EXCEPTION 'audit_log is append-only (attempted % as %)', TG_OP, current_user
+            USING ERRCODE = 'insufficient_privilege';
+    END IF;
+
+    IF TG_OP = 'DELETE' THEN
+        RETURN OLD;   -- allow the purge; returning NULL here would cancel it
+    END IF;
+
+    -- UPDATE: every column except the six redactable ones must be unchanged. Expressed
+    -- as a jsonb difference rather than a column list so the guard survives every future
+    -- column addition — including is_success -> outcome — without an edit here.
+    IF (to_jsonb(NEW) - 'actor_email' - 'ip_address' - 'user_agent'
+                      - 'before_state' - 'after_state' - 'changes')
+       IS DISTINCT FROM
+       (to_jsonb(OLD) - 'actor_email' - 'ip_address' - 'user_agent'
+                      - 'before_state' - 'after_state' - 'changes')
+    THEN
+        RAISE EXCEPTION 'audit_log UPDATE may only redact actor_email, ip_address, user_agent, before_state, after_state, changes'
+            USING ERRCODE = 'insufficient_privilege';
+    END IF;
+
+    RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER audit_log_append_only_guard
+    BEFORE UPDATE OR DELETE ON audit_log
+    FOR EACH ROW EXECUTE FUNCTION audit_log_append_only();
 ```
 
+Three properties worth stating, because a careless copy loses each of them:
+
+- **`actor_user_id` is deliberately immutable.** Once the `users` row is erased it is an
+  orphan surrogate key with no path back to a natural person, which is what keeps the
+  audit row's existence auditable after erasure. Redacting it would collapse every erased
+  user's history into one indistinguishable bucket and make the probe-detection queries
+  [Audit Coverage Standards](../standards/18-audit-coverage.md) justifies the whole
+  `denied` class with unanswerable.
+- **`BEFORE` row triggers on partitioned tables are supported from PostgreSQL 13**, and
+  LearnStack runs 18+ ([ADR-0031](../decisions/0031-postgresql-major-version.md)). The
+  trigger is inherited by partitions created later, so Phase 11 partitioning remains
+  additive — no re-creation, no gap.
+- **The trigger is the second layer, not the first.** `learnstack_app` holds no `UPDATE`
+  or `DELETE` privilege at all, so the ordinary path fails with `42501` before the trigger
+  is reached. The trigger's job is to constrain `learnstack_platform`, the one role that
+  can mutate.
+
 ### `audit_config` table
 
 ```sql
@@ -389,14 +727,24 @@ CREATE TABLE audit_config (
     UNIQUE (tenant_id, module, operation)
 );
 ALTER TABLE audit_config ENABLE ROW LEVEL SECURITY;
-CREATE POLICY audit_config_tenant_isolation ON audit_config
-    USING (tenant_id = current_setting('app.tenant_id', true)::uuid);
+ALTER TABLE audit_config FORCE  ROW LEVEL SECURITY;
+CREATE POLICY audit_config_isolation ON audit_config
+    USING      (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid)
+    WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid);
 ```
 
 Defaults declared in each module via `IModule.RegisterAuditDefaults()`; the table holds
 per-tenant overrides only.
 
-## 7. Per-module coverage matrix (baseline)
+`is_enabled` is deliberately **not** the whole story. A row here can narrow SHOULD/MAY
+coverage; it cannot switch off an operation the catalogue classifies MUST.
+`ClassifyAsync` applies the override and then re-applies the MUST floor, and a read
+failure against this table falls back to the in-process catalogue — which carries that
+same MUST floor — logged at `Error` and surfaced on the audit health check, rather than
+rejecting the operation. Rejecting would turn a cache outage into a platform-wide denial
+of service; see [§ 5](#5-the-mediatr-behavior), which is the authority.
+
+## 8. Per-module coverage matrix (baseline)
 
 Standard 18 defines the MUST / SHOULD / MAY matrix per module. Excerpt for Tier-1 core
 modules:
@@ -417,7 +765,7 @@ modules:
 Hub-side modules audit to **Hub's own audit stream**, separate from LearnStack's; same
 shape, different table.
 
-## 8. Retention
+## 9. Retention
 
 Default retention by operation class (per-tenant overridable within plan limits):
 
@@ -429,66 +777,102 @@ Default retention by operation class (per-tenant overridable within plan limits)
 | ReadSensitive | **2 years** | 6 months – 5 years |
 | Other Action | **1 year** | 3 months – 3 years |
 
-Retention purge runs as a Hangfire recurring job (`LearnStackJob` analog):
+Both retention jobs run **daily**. Three documents previously disagreed — daily in
+[Audit Coverage Standards](../standards/18-audit-coverage.md) and
+[ADR-0028](../decisions/0028-audit-log-partition-management.md), weekly here — and this
+document was the outlier. Daily is correct: a weekly purge means a tenant's stated
+retention can be exceeded by up to six days, which is a compliance answer nobody wants to
+give.
 
-- `learnstack:audit:partition-management` — runs daily; creates next month's partition
-  (if not exists); drops partitions older than max retention window across all tenants
-  (10y for safety; tenant-specific retention enforced by row-level deletes within
-  partition).
-- `learnstack:audit:retention-purge` — runs weekly; deletes individual rows per tenant's
-  configured retention. Uses tenant-config retention values; bypasses RLS via
-  `learnstack_audit_admin` role; the purge itself emits a `SecurityEvent` audit row
-  summarising what was deleted.
+Both jobs land in [Phase 11](../roadmap/phase-11-production-hardening.md) alongside
+partitioning; until then `audit_log` is a single table and nothing purges it.
 
-## 9. GDPR / PII redaction
+| Hangfire recurring job | Cadence | What it does |
+|---|---|---|
+| `learnstack:audit:partition-management` | Daily | Creates next month's partition if absent; drops partitions older than the maximum retention window across all tenants (10y for safety) |
+| `learnstack:audit:retention-purge` | **Daily** | Deletes individual rows per the tenant's configured retention, in batches. Runs as `learnstack_platform` through the audited platform-admin scope. The purge itself emits a `SecurityEvent` audit row summarising what was deleted |
+
+## 10. GDPR / PII redaction
 
 When a user is GDPR-erased (`UserGdprDeletedIntegrationEvent` published), audit rows
 containing that user's PII are **redacted in place** (not deleted — the audit row's
 existence must remain auditable):
 
+Redaction is one of exactly **two** sanctioned mutations of `audit_log` (the other is the
+retention purge, § 9). It is not an exception carved out of the append-only rule by
+convention — it is the shape the `audit_log_append_only_guard` trigger in § 7 was written
+to permit, and nothing else.
+
 ```csharp
 // LearnStack.Modules.Audit.Infrastructure.IntegrationEvents
 public sealed class UserGdprDeletedIntegrationEventHandler(
-    AuditDbContext db, ILogger<UserGdprDeletedIntegrationEventHandler> logger)
+    AuditDbContext db,
+    IPlatformAdminScope platformScope,
+    IAuditStore auditStore,
+    IInboxGuard inboxGuard,
+    IEnumerable<IUserReferenceLocator> userReferenceLocators)
     : IIntegrationEventHandler<UserGdprDeletedIntegrationEvent>
 {
     public async Task HandleAsync(UserGdprDeletedIntegrationEvent @event, CancellationToken ct)
     {
-        // 1. Idempotent: inbox guard
-        if (await _inboxGuard.IsAlreadyProcessedAsync(@event.EventId, ct)) return;
-
-        // 2. Redact rows where actor_user_id == @event.UserId
-        await db.Database.ExecuteSqlInterpolatedAsync($@"
-            UPDATE audit_log
-            SET actor_email = '[REDACTED]',
-                ip_address = NULL,
-                user_agent = '[REDACTED]',
-                before_state = jsonb_set(before_state, '{{redacted}}', 'true'),
-                after_state  = jsonb_set(after_state,  '{{redacted}}', 'true'),
-                changes      = jsonb_set(changes,      '{{redacted}}', 'true')
-            WHERE actor_user_id = {@event.UserId}
-              AND tenant_id = {@event.TenantId}", ct);
-
-        // 3. Redact rows where entity references this user (via per-module IUserReferenceLocator)
-        foreach (var locator in _userReferenceLocators)
-            await locator.RedactReferencesAsync(@event.UserId, ct);
-
-        // 4. Inbox: mark processed; SaveChanges
-        _inboxGuard.MarkAsProcessed(@event.EventId, @event.GetType().Name);
-        await db.SaveChangesAsync(ct);
-
-        // 5. Audit the redaction itself as a SecurityEvent (meta-audit)
-        logger.LogInformation("GDPR redaction applied for User {UserId} in Tenant {TenantId}",
-            @event.UserId, @event.TenantId);
+        // 1. Idempotent: inbox guard.
+        if (await inboxGuard.IsAlreadyProcessedAsync(@event.EventId, ct)) return;
+
+        // 2. learnstack_app holds no UPDATE privilege on audit_log, so the redaction runs
+        //    as learnstack_platform. Entering the scope is itself a MUST-class audit event.
+        await using (await platformScope.EnterAsync(
+            reason: $"gdpr-redaction:{@event.UserId}", ct))
+        {
+            // 3. Actor PII only. The payload columns are NOT touched here. A blanket
+            //    jsonb_set('{redacted}', 'true') would (a) not redact anything — it adds a
+            //    flag and leaves the PII in place — and (b) raise
+            //    'cannot set path in scalar' on any snapshot that is a JSON scalar or
+            //    array. Payload redaction belongs to the per-module locator below, which
+            //    knows which JSON paths in its own snapshots reference a user.
+            await db.Database.ExecuteSqlInterpolatedAsync($@"
+                UPDATE audit_log
+                SET actor_email = '[REDACTED]',
+                    ip_address  = NULL,
+                    user_agent  = '[REDACTED]'
+                WHERE actor_user_id = {@event.UserId}
+                  AND tenant_id     = {@event.TenantId}", ct);
+
+            // 4. Payload references, per module. Each locator issues column-restricted
+            //    UPDATEs against before_state / after_state / changes only.
+            foreach (var locator in userReferenceLocators)
+                await locator.RedactReferencesAsync(@event.UserId, @event.TenantId, ct);
+
+            // 5. Inbox: mark processed; SaveChanges.
+            inboxGuard.MarkAsProcessed(@event.EventId, @event.GetType().Name);
+            await db.SaveChangesAsync(ct);
+        }
+
+        // 6. Meta-audit. The redaction is itself a MUST-class security event, and a log
+        //    line is not an audit row — the previous version of this handler logged and
+        //    called it audited.
+        await auditStore.WriteStandaloneAsync(
+            AuditEntryDraft.SecurityEvent(
+                tenantId:  @event.TenantId,
+                module:    "audit",
+                operation: "audit.redaction.apply",
+                outcome:   AuditOutcome.Success,
+                metadata:  new { subjectUserId = @event.UserId }),
+            ct);
     }
 }
 ```
 
+`actor_user_id`, `module`, `operation`, `operation_type`, `operation_class`, `outcome`,
+`correlation_id` and `timestamp` are **never** redacted; the trigger rejects an `UPDATE`
+that changes any of them. What survives erasure is a pseudonymous record that a regulator
+can still reconstruct "who did what, when, with what outcome" from — which is the point of
+redacting in place rather than deleting.
+
 Every module that stores user references in audit payloads must register an
 `IUserReferenceLocator` implementation (architecture test enforces this — same shape as
 Nexora's `IContactReferenceLocator`).
 
-## 10. Querying audit log
+## 11. Querying audit log
 
 The Audit module's admin API exposes:
 
@@ -508,7 +892,7 @@ Required permission: `audit.events.read` (tenant scope).
 Required for export: `audit.events.export`.
 Required for cross-tenant query (platform admin only): `platform.audit.events.read`.
 
-## 11. Hub-side audit stream
+## 12. Hub-side audit stream
 
 Hub maintains a parallel audit stream in its own database (`hub_audit_log`), capturing
 operator actions:
@@ -523,43 +907,84 @@ operator actions:
 Cross-stream correlation by `correlation_id`. A regulatory inquiry covering "what
 happened to tenant X on date Y" pulls from both streams and joins by correlation.
 
-## 12. Architecture tests
-
-Five blocker-level tests added in Phase 02:
-
-1. `Every_Command_HasAuditCoverage` — auto-discovers commands by interface
-   (`ICommand<TResponse>`); for each, asserts the (module, operation) appears in
-   `IAuditConfigService.GetCoverageMatrix()` with at least SHOULD classification.
-2. `AuditEntry_Is_AppendOnly` — `AuditEntry` does not implement `ISoftDeletable`; has no
-   `Update*` public methods; reflection assertion.
-3. `AuditLogBehavior_NeverBlocks_BusinessWrites` — integration test asserts that when
-   `IAuditStore.SaveAsync` throws, the command result is still returned (handler success
-   path).
-4. `AuditStateCapture_ClearedPerRequest` — integration test asserts that after a request
-   completes (success or failure), the scoped `IAuditStateCapture.Changes` collection is
-   empty for the next request.
-5. `Every_PII_Module_RegistersUserReferenceLocator` — modules storing user references in
-   audit payloads (declared via `[StoresUserReference]` attribute or
-   `IModule.RegisterUserReferences()`) must register an `IUserReferenceLocator` impl.
-
-## 13. Phasing
+## 13. Architecture tests
+
+Blocker-level tests, registered in
+[Architecture Tests Catalogue](../standards/21-architecture-tests-catalogue.md) by
+[Phase 02a Packet 9](../roadmap/phase-02a-kernel-tenancy.md):
+
+1. `Every_TenantOwned_Command_HasAuditCoverage` — auto-discovers commands by interface;
+   for each, asserts the (module, operation) appears in the coverage matrix with at least
+   a SHOULD classification.
+2. `AuditEntry_Inherits_Entity_Not_AuditableEntity` — append-only by construction: an
+   audit row that carries `UpdatedAt` / `DeletedAt` is a contradiction.
+3. `MustClass_Audit_Writes_Share_The_Business_Transaction` — the binding test for
+   [ADR-0033](../decisions/0033-audit-durability-model.md). One MUST-class command
+   produces exactly one `audit_log` row, inserted on the same transaction as the business
+   write; a command whose durable audit write is forced to fail produces **zero** business
+   rows and returns `503 audit_unavailable`. Runs as `learnstack_app` (`NOBYPASSRLS`).
+4. `Audit_Survives_Transaction_Rollback` — the test that closes the gap a "consumed" flag
+   would have left open. A MUST-class command whose transaction is forced to roll back at
+   `COMMIT` produces zero business rows and **exactly one** `audit_log` row with outcome
+   `failed`. A companion case covers the ordinary path: a handler that calls `SaveChanges`
+   and then returns `Result.Fail(...)` produces the same pair.
+5. `Audit_Classification_Does_Not_Read_The_Database_On_The_Request_Path` — with the
+   `audit_config` table made unreadable, a MUST-class command still completes and still
+   writes its row at the catalogue classification; an operation absent from the catalogue
+   is rejected with `audit_unclassified_operation`. Without this, a silent RLS-filtered
+   empty read is indistinguishable from "this tenant has no overrides".
+6. `AuditLog_Update_Is_Column_Restricted` — as `learnstack_app`, any `UPDATE` or `DELETE`
+   on `audit_log` raises `42501`. As `learnstack_platform`, an `UPDATE` touching only the
+   six redactable columns succeeds, an `UPDATE` touching any other column raises, and a
+   `DELETE` succeeds (the retention purge).
+7. `AuditStateCapture_ClearedPerRequest` — after a request completes, success or failure,
+   the scoped `IAuditStateCapture` holds no changes, no intent, and `State == None` for
+   the next request.
+8. `Every_Module_Has_An_AuditCoverage_Matrix` — a module without a matrix cannot classify
+   its operations, and under ADR-0033 classification is functional, not documentary.
+9. `Every_PII_Module_RegistersUserReferenceLocator` — modules storing user references in
+   audit payloads must register an `IUserReferenceLocator`.
+
+`Audit_Config_Failure_Rejects_Operation` from the earlier draft is **withdrawn**, not
+renamed: under ADR-0033 as settled, a tenant-override read failure falls back to the
+in-process catalogue rather than rejecting, so the assertion would have locked in a
+platform-wide denial of service triggered by a cache outage. Entry 5 above asserts the
+property that actually matters.
+
+`AuditLogBehavior_NeverBlocks_BusinessWrites` from the ADR-0016 era is **replaced**: the
+property it asserted is now true only for SHOULD/MAY-class operations, and asserting it
+for MUST-class would lock in exactly the defect ADR-0033 removes.
+
+## 14. Phasing
 
 | Phase | Deliverable |
 |-------|-------------|
-| 02 | Infrastructure: `AuditChangeTrackerInterceptor`, `IAuditStateCapture` + impl, `AuditLogBehavior`, `IAuditStore` + `PostgresAuditStore`, `audit_log` table + first month partition, `LearnStackJob` for partition management. |
-| 03 | `LearnStack.Modules.Audit`: `AuditEntry` aggregate, repository, admin API endpoints. `UserGdprDeletedIntegrationEventHandler` + per-module `IUserReferenceLocator`. |
-| 06+ | Admin Studio audit UI: timeline view, filter by user/module/operation/operation_class/timestamp, diff viewer, CSV / JSON export. |
-| 09 | Hub-side `hub_audit_log` + cross-stream correlation query. |
-| 11 | Production: long-term partition lifecycle automation, off-archive policy for partitions > 1 year (e.g. move to cheaper storage tier), per-tenant retention enforcement under plan limits. |
+| [02a Packet 9](../roadmap/phase-02a-kernel-tenancy.md) | `AuditChangeTrackerInterceptor`, `IAuditStateCapture` + impl, `AuditLogBehavior` lit up per ADR-0033, `IAuditStore` + `PostgresAuditStore`, `AuditEntry` aggregate, `AuditConfig` with the fail-closed MUST floor, `audit_log` as a **single plain table** with the composite primary key. |
+| [03](../roadmap/phase-03-identity-admin.md) | Admin API endpoints over the audit stream; `UserGdprDeletedIntegrationEventHandler` + per-module `IUserReferenceLocator`. |
+| [06](../roadmap/phase-06-renderer-admin-studio.md) | Admin Studio audit UI: timeline view, filters, diff viewer, CSV / JSON export. |
+| [09](../roadmap/phase-09-billing-integrations-analytics.md) | Hub-side `hub_audit_log` + cross-stream correlation query. |
+| [11](../roadmap/phase-11-production-hardening.md) | **Scale, not correctness**: `PARTITION BY RANGE (timestamp)` plus monthly partitions, the daily partition-management job, the daily retention purge, off-archive policy for partitions older than a year, per-tenant retention enforcement under plan limits. Trigger: measured `audit_log` growth ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)). |
 
 ## References
 
-- ADR-0016 — Audit Log Subsystem.
-- ADR-0003 Amendment 1 — Organization scope (audit row carries organization_id).
+- [ADR-0033](../decisions/0033-audit-durability-model.md) — Audit Durability Model
+  (supersedes ADR-0016); the two durability classes, the fail-closed rules, and the
+  corrected `audit_log` primary key.
+- [ADR-0016](../decisions/0016-audit-log-subsystem.md) — Audit Log Subsystem
+  (**superseded**; retained for its data model and coverage rationale).
+- [ADR-0003 Amendment 1 + Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md)
+  — organization scope on the audit row; the corrected RLS template and four-role model.
+- [ADR-0028](../decisions/0028-audit-log-partition-management.md) — partition management
+  via Hangfire; lands in Phase 11.
+- [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) — why partitioning is
+  demand-gated and correctness is not.
+- [Database Standards](../standards/05-database.md) — the canonical RLS template.
 - [18-audit-coverage.md](../standards/18-audit-coverage.md) — MUST/SHOULD/MAY matrix
   (standard).
+- [15-event-and-outbox.md](15-event-and-outbox.md) — audit fan-out to external sinks
+  rides the outbox; MUST-class audit does not.
 - [29-dapr-integration.md](29-dapr-integration.md) — `UserGdprDeletedIntegrationEvent`
-  arrives via Dapr pub/sub.
+  transport.
 - Nexora reference: `Nexora/docs/modules/tier-1-core/audit/SPEC.md`,
   `Nexora/docs/decisions/0009-audit-repository-pattern.md`,
   `Nexora/docs/standards/audit-coverage.md`.
diff --git a/docs/architecture/32-tenant-customization-model.md b/docs/architecture/32-tenant-customization-model.md
index 099e7d4..4dd0f48 100644
--- a/docs/architecture/32-tenant-customization-model.md
+++ b/docs/architecture/32-tenant-customization-model.md
@@ -89,14 +89,15 @@ These map 1:1 to JSON Schema `type` + `format` combinations:
 
 ```typescript
 const COMPOSITE_RENDERERS = {
-  'default-card':    DefaultCardRenderer,      // image + title + description
-  'content-list':    ContentListRenderer,      // grid / carousel / list of items
-  'media-gallery':   MediaGalleryRenderer,
-  'rich-page':       RichPageRenderer,
-  'lesson-shell':    LessonShellRenderer,      // standard lesson play UI
-  'quiz-shell':      QuizShellRenderer,
-  'placement-shell': PlacementShellRenderer,
-  'live-shell':      LiveShellRenderer,
+  'default-card':     DefaultCardRenderer,      // image + title + description
+  'content-list':     ContentListRenderer,      // grid / carousel / list of items
+  'media-gallery':    MediaGalleryRenderer,
+  'rich-page':        RichPageRenderer,
+  'lesson-shell':     LessonShellRenderer,      // standard lesson play UI
+  'quiz-shell':       QuizShellRenderer,
+  'placement-shell':  PlacementShellRenderer,
+  'live-shell':       LiveShellRenderer,
+  'submission-shell': SubmissionShellRenderer,  // prompt + authoring surface + submit + result
   // ... small, fixed list
 } as const;
 ```
@@ -104,6 +105,12 @@ const COMPOSITE_RENDERERS = {
 Adding a new primitive or composite renderer is a LearnStack release (CODEOWNERS rule on
 this folder). Tenants compose existing primitives — they cannot bring custom JSX.
 
+**Every key in both registries is named for a capability, never for a domain.** A
+`cefr-level-badge` or `asana-card` key would fail
+`Core_Modules_HaveNo_DomainSpecific_Names`. When a tenant needs a domain-flavoured
+presentation, it declares a `TenantPageBlock` row pointing at a generic composite — the
+domain lives in the row's display name and its schema, not in the registry.
+
 ## 3. Worked example: three tenants, same modules
 
 ### Example A — English learning platform
@@ -253,14 +260,39 @@ Same modules. Different data.
       "difficulty":     { "type": "string", "x-taxonomy": "coding-difficulty" }
     }
   },
-  "renderer_key": "code-challenge-shell"
+  "renderer_key": "submission-shell"
 }
 ```
 
-Note: `code-challenge-shell` is a **composite renderer** that LearnStack ships (since
-running test suites server-side is a paid LearnStack feature, gated by
-`FeatureKeys.CodeChallengeRunner`). The composite is generic — it works for any language
-declared in the schema; the tenant doesn't bring custom JSX.
+**Two naming rules meet in this example, and they point in opposite directions.**
+
+The content type's `key` is `code-challenge`. That is fine: it is a **row in the tenant's
+database**, authored by the tenant, and it may name its domain as specifically as the
+tenant likes. `vocabulary-card`, `asana-pose`, `code-challenge` and `breath-technique`
+are all legitimate tenant data.
+
+The renderer key and the feature key are **code**, and code may not name a domain. Both
+were previously named for the first tenant that asked for them:
+
+| Was | Is | Why |
+|---|---|---|
+| `code-challenge-shell` (composite renderer) | **`submission-shell`** | The capability is "prompt + authoring surface + submit + evaluated result panel". It serves a code exercise, a pronunciation recording, an essay, and a portfolio upload equally |
+| `FeatureKeys.CodeChallengeRunner` | **`FeatureKeys.SandboxedEvaluation`** (`assessment.sandboxed_evaluation`) | The capability is "evaluate a learner's submitted artefact in a sandbox with a resource budget". Nothing about it is specific to code |
+
+The rule is not stylistic. `Core_Modules_HaveNo_DomainSpecific_Names` enforces it
+mechanically from
+[Phase 02a Packet 10](../roadmap/phase-02a-kernel-tenancy.md) — a module type, namespace
+or registry key matching `Cefr`, `Asana`, `CodeChallenge`, `English*`, `Yoga*` fails the
+build. The old names would have failed it.
+
+`submission-shell` is also where this document meets the **genericity boundary**. The
+renderer is presentation and therefore inside the boundary; the *evaluation* it triggers
+is external capability invocation and therefore outside it. Running a learner's submitted
+program needs a sandbox, a runtime, a resource budget and a security boundary that
+survives hostile input — none of which a JSON Schema or a rule DSL can declare. It is a
+**platform feature gated by plan**, written by LearnStack, not a customization row. See
+[ADR-0018 Amendment (2026-08-08)](../decisions/0018-tenant-driven-customization-model.md)
+and [Platform Vision § Genericity boundary](01-platform-vision.md).
 
 ## 4. Schema versioning
 
@@ -284,14 +316,19 @@ sets the rule for page blocks; this document extends it to all customization sur
 
 ## 5. Custom fields on built-in entities
 
-A subset of built-in entities (`User`, `Course`, `Enrollment`, `LiveSession`, `Lesson`)
-accept tenant-defined custom fields:
+Tenant-defined custom fields attach to **tenant-owned** entities: `Membership`,
+`Course`, `Enrollment`, `LiveSession`, `Lesson`. `target_entity = "User"` resolves to
+`membership_profiles` — never to `users`, which is global, carries no `tenant_id`, and
+therefore has no query filter and no Row Level Security policy. A tenant-authored
+column on a global table is a cross-tenant read by construction
+([Phase 03 § Tenant Data Ownership](../roadmap/phase-03-identity-admin.md)).
 
 ```sql
 CREATE TABLE tenant_custom_field_defs (
     id              uuid PRIMARY KEY,
     tenant_id       uuid NOT NULL,
-    target_entity   text NOT NULL,    -- "User", "Course", "Enrollment", etc.
+    target_entity   text NOT NULL,    -- "Membership", "Course", "Enrollment", …; never "User"
+    pii_category    text NOT NULL,    -- PII-Identity | PII-Behaviour | PII-Sensitive | None; no default, see Phase 03
     key             text NOT NULL,    -- e.g. "preferred_practice_time"
     display_name    text NOT NULL,
     json_schema     jsonb NOT NULL,   -- field definition
@@ -305,8 +342,11 @@ CREATE TABLE tenant_custom_field_defs (
 Values stored on the entity as a JSONB column:
 
 ```sql
-ALTER TABLE users ADD COLUMN custom_fields jsonb NOT NULL DEFAULT '{}';
-ALTER TABLE courses ADD COLUMN custom_fields jsonb NOT NULL DEFAULT '{}';
+-- Values live on the tenant-owned row, never on a global one.
+ALTER TABLE membership_profiles ADD COLUMN custom_fields jsonb NOT NULL DEFAULT '{}';
+ALTER TABLE courses             ADD COLUMN custom_fields jsonb NOT NULL DEFAULT '{}';
+-- Every table above is [TenantOwned] and carries the canonical RLS policy from
+-- Database Standards; `users` is not in this list and never will be.
 -- etc.
 ```
 
@@ -360,7 +400,158 @@ expression: |
 
 Same sandbox engine as scoring rules (decision pending).
 
-## 8. What cannot be customized
+## 8. Runtime cost model
+
+Everything above describes what a tenant *can* declare. This section describes what it
+*costs* to serve, because a customization model without a cost model is an invitation to
+declare something the runtime cannot render inside a request budget. Every limit here is
+enforced at write time, so a tenant learns about it while authoring rather than a learner
+discovering it on a page load.
+
+### 8.1 Validation timing — write time, not read time
+
+| Validation | When | Failure mode |
+|---|---|---|
+| The `json_schema` is itself a valid JSON Schema (draft 2020-12), and every `x-renderer` / `x-taxonomy` / `x-language` extension resolves to a registry entry | **On saving the content type / block / lesson item type** | 400 with Problem Details naming the offending JSON pointer |
+| A content entry conforms to its content type's schema at its pinned `schema_version` | **On saving the entry** | 400; the entry is not persisted |
+| The declared limits in § 8.3 | **On saving the schema** | 400 |
+| Renderer resolution: does `renderer_key` exist in `COMPOSITE_RENDERERS`? | **On saving**, again on **server render** as a cheap dictionary lookup | Save is rejected; a stale reference renders a fallback block plus a logged warning, never an exception |
+
+**Nothing is schema-validated on the read path.** A published content entry has already
+been validated against its pinned schema version, and re-validating it on every page load
+would put a JSON Schema evaluation in the hot path of anonymous traffic for a result that
+cannot have changed. The consequence is stated plainly: **the schema is a write-time
+contract, and the read path trusts the database.** Anything that can write a content-entry
+row without going through the validating command path — a manual `INSERT`, a bad
+migration, a future bulk importer — breaks that trust for every subsequent read. Bulk
+import therefore goes through the same validator, at
+[Phase 04](../roadmap/phase-04-cms-media-pages.md).
+
+The one read-time check is **structural, not semantic**: the renderer walks the entry's
+JSON against the schema's field list and skips unknown fields. That is an O(fields) pass,
+not a validation.
+
+### 8.2 Cache strategy
+
+Customization definitions are read on nearly every request and written a handful of times
+per tenant per month. That ratio is the whole design.
+
+| What | Layer | Key | TTL | Invalidated by |
+|---|---|---|---|---|
+| `TenantContentType` set for a tenant | L1 + L2 | `cust:{tenant_id}:content-types:{generation}` | L1 60s, L2 15 min | Generation bump |
+| `TenantLevelTaxonomy` by key | L1 + L2 | `cust:{tenant_id}:taxonomy:{key}:{generation}` | same | Generation bump |
+| `TenantPageBlock` set | L1 + L2 | `cust:{tenant_id}:blocks:{generation}` | same | Generation bump |
+| Compiled JSON Schema validator | L1 only, per pod | `(tenant_id, content_type_key, schema_version)` | Process lifetime, bounded LRU | Immutable — a schema version never changes |
+
+Two rules make this safe:
+
+- **A generation counter, not prefix eviction.** Each tenant carries a
+  `customization_generation` integer, bumped in the same transaction as any customization
+  write. Cache keys embed it, so a write makes every stale key unreachable at once,
+  across every pod, without enumerating keys. This is deliberate: the published
+  `ICacheService.RemoveByPrefixAsync` contract cannot be honoured across instances by any
+  candidate backend, and it is removed or redesigned to exactly this pattern before
+  [Phase 02a Packet 5](../roadmap/phase-02a-kernel-tenancy.md) ships.
+- **Compiled validators are cached separately from definitions**, keyed by an immutable
+  `(key, schema_version)` tuple. Compiling a JSON Schema is the expensive part; because a
+  published schema version is immutable ([§ 4](#4-schema-versioning)), the compiled form
+  never needs invalidating — it only needs bounding, hence the LRU.
+
+Cache misses cost one indexed query per tenant per definition set. A cold pod serving its
+first request for a tenant performs at most four such queries, not one per entry.
+
+### 8.3 The N+1 problem, and the limits that bound it
+
+The guided-sequence example in [§ 3](#3-worked-example-three-tenants-same-modules) is a
+textbook N+1 and it is worth being explicit about, because it is the shape tenants will
+naturally author:
+
+```json
+"poses": { "type": "array", "items": { "$ref": "#/$defs/pose-ref" } }
+```
+
+Each `pose-ref` carries `{ content_type: "asana-pose", content_id: "<uuid>" }`. A naive
+renderer resolves each reference with its own query, so a 40-pose sequence issues 40
+round trips — and a lesson page containing three such sequences issues 120. At 2 ms per
+round trip that is a quarter-second of pure latency for a page that reads four rows'
+worth of actual information.
+
+**The resolution contract:**
+
+1. The renderer **collects every reference in the whole payload first**, walking the
+   entry's JSON once and gathering `(content_type, content_id)` pairs into a set.
+2. It issues **one batched query per content type** — `WHERE tenant_id = @t AND
+   content_type = @ct AND id = ANY(@ids)` — not one per reference. Duplicated references
+   to the same entry cost nothing extra.
+3. It hydrates the payload from the resulting dictionary.
+4. References that do not resolve render a placeholder and emit a warning. A dangling
+   reference is a data problem, never an exception on a public page.
+
+Total cost for any entry: **one query per distinct referenced content type**, regardless
+of reference count. Reference resolution is capped at **depth 2** — an entry may
+reference entries, and those may not reference further. Deeper composition is a
+[Phase 05](../roadmap/phase-05-education-learning-content.md) decision with its own
+batching design, not something a tenant can reach by nesting `$ref`s.
+
+The `Customization_Reference_Resolution_Is_Batched` integration test asserts the query
+count for a 40-reference entry is a small constant, not 40. Without a test that counts
+queries, this contract silently regresses the first time someone writes a convenient
+`foreach`.
+
+### 8.4 Declared limits
+
+Every limit is checked at write time and returns Problem Details naming the limit that
+was exceeded. They are deliberately generous — they exist to stop pathological documents,
+not to constrain reasonable authoring.
+
+| Limit | Value | Why this one |
+|---|---|---|
+| `$ref` / `$defs` nesting depth inside one schema | 5 | JSON Schema validators are recursive; unbounded depth is a stack-exhaustion vector on a tenant-authored document |
+| Reference resolution depth (entry → entry) | 2 | Bounds the batched-query fan-out at § 8.3 to a fixed small number of round trips |
+| Properties in one content type | 100 | Beyond this the authoring UI is unusable and the row is a schema smell |
+| Array `maxItems` where the schema omits it | 200 (applied as a default, not a rejection) | An unbounded array in a JSONB column is an unbounded render loop |
+| References in one content entry | 500 | Caps the `ANY(@ids)` parameter list and the hydration dictionary |
+| Block instances on one page | 100 | Each instance is a render subtree; the page is a document, not an application |
+| Serialised size of one content entry | 1 MB | PostgreSQL will happily TOAST more; the browser will not happily render it |
+| Content types per tenant | Plan-gated via `FeatureKeys` / `LimitKeys` | Unlimited content types is a Growth+ feature ([ADR-0021](../decisions/0021-feature-based-entitlement.md)) |
+
+A schema that violates a structural limit is rejected on save. An **existing** entry that
+would violate a newly tightened limit still renders — limits are enforced forward, and a
+tightening ships with the migration that reports which existing rows exceed it.
+
+### 8.5 The `embed-html` sanitisation contract
+
+`embed-html` is the one primitive that takes an **HTML sink authored by a lower-trust
+actor** and puts it in the tenant's page. Everything else in the primitive set renders
+structured data through React text nodes and is safe by construction. This one is not
+safe by construction; it is safe by contract, and the contract has to be written down —
+calling the primitive set "closed and safe" without stating it is precisely the gap that
+lets a reviewer approve an unsanitised path.
+
+**The threat model.** A tenant's content editor is not the tenant's security team. In a
+multi-branch business, an organization-level editor at one studio can author an
+`embed-html` block that renders on a page a learner from another organization loads. The
+actor is semi-trusted, the audience is not the actor, and the two may sit in different
+organizations of the same tenant.
+
+**The contract:**
+
+| Rule | Detail |
+|---|---|
+| Sanitise **on write and on render** | Write-time sanitisation gives the author immediate feedback and keeps the stored value clean. Render-time sanitisation is the one that actually protects the learner, because it is the only one that also covers rows written before the current allow-list |
+| Allow-list, never block-list | Elements: structural and text markup plus `iframe` (see below). Attributes: `class`, `id`, `href`, `src`, `alt`, `title`, `width`, `height`, `colspan`, `rowspan`. Everything else is stripped |
+| No script execution surface | `<script>`, `<style>`, `<object>`, `<embed>`, `<form>`, every `on*` handler attribute, and `javascript:` / `data:` / `vbscript:` URL schemes are stripped unconditionally |
+| `iframe` is allow-listed **by host** | An empty allow-list by default. A tenant admin — not a content editor — adds permitted embed hosts in Admin Studio; a frame whose `src` host is not listed is dropped. This is what makes "embed a YouTube video" possible without making "embed anything" possible |
+| Rendered `sandbox` on every surviving frame | `sandbox="allow-scripts allow-same-origin"` is **not** used together; a frame gets `allow-scripts` **or** `allow-same-origin`, never both, because the combination lets the framed document remove its own sandbox |
+| Never `dangerouslySetInnerHTML` on unsanitised input | The primitive is the **only** component in `apps/web` permitted to call it, and it does so exclusively on the sanitiser's output. `Only_SanitizedHtmlPrimitive_Uses_DangerouslySetInnerHtml` enforces the rule as a lint |
+| CSP is the backstop, not the mechanism | The page's Content-Security-Policy forbids inline script regardless. A sanitiser bug is then a rendering defect rather than a stored-XSS incident |
+| Plan-gated and audited | Authoring an `embed-html` block is a `MUST`-class audit operation: it is a content-injection surface, and "who added this frame" is the first question in any incident |
+
+The sanitiser's allow-list lives in one module with a CODEOWNERS rule, alongside the
+primitive registry. Widening it is a LearnStack release and a security review, not a
+configuration change.
+
+## 9. What cannot be customized
 
 LearnStack core owns:
 
@@ -376,7 +567,24 @@ LearnStack core owns:
   closed (no `eval`, no HTTP, no file I/O).
 - **Tenant isolation** — RLS / EF filters / architecture tests are not bypassable.
 
-## 9. Admin Studio surface
+Two further categories sit outside the model for a reason worth stating rather than
+discovering, per
+[ADR-0018 Amendment (2026-08-08)](../decisions/0018-tenant-driven-customization-model.md):
+
+- **Stateful entitlement** — a ten-session credit pack, a "three make-up classes per
+  term" allowance, a per-learner session quota. These need a balance that is decremented,
+  refunded, expired and reconstructible in a dispute. A JSON Schema declares a shape; it
+  cannot declare a ledger.
+- **External capability invocation** — running a learner's submitted program, scoring
+  pronunciation from an audio clip, automated proctoring. These need a sandbox, a
+  runtime, a resource budget and a security boundary that survives hostile input. A rule
+  DSL evaluates; it does not execute arbitrary programs.
+
+Both are **platform features written by LearnStack and gated by plan** — generically
+named, offered to every tenant, never per-vertical code. A tenant needing either needs a
+LearnStack release or a provider integration, not a customization row.
+
+## 10. Admin Studio surface
 
 A tenant admin defines customization data via Admin Studio screens:
 
@@ -406,45 +614,81 @@ Admin Studio
     └── Compliance           ← view-only summary of operator-set caps (ADR-0019)
 ```
 
-Phase 06+ ships visual schema editors; Phase 04-05 ships JSON form editors first.
+[Phase 04](../roadmap/phase-04-cms-media-pages.md) and
+[Phase 05](../roadmap/phase-05-education-learning-content.md) ship JSON form editors
+first; [Phase 06](../roadmap/phase-06-renderer-admin-studio.md) replaces them with the
+visual schema editor and preview pane. The screen tree above is the target; each row
+arrives with the aggregate it edits, per [§ 12](#12-phasing).
 
-## 10. Hard architectural invariants
+## 11. Hard architectural invariants
 
 Architecture tests enforce:
 
 1. **No domain-specific names in LearnStack modules.** `Cefr`, `Asana`, `CodeChallenge`,
-   `English*`, `Yoga*`, `Coding*` — none appear in any LearnStack module type / namespace
-   / file. Static analyser fails the build on violation.
-2. **No `LearnStack.Verticals.*` source folder.** Architecture test asserts the folder
-   doesn't exist.
+   `English*`, `Yoga*`, `Coding*` — none appear in any LearnStack module type, namespace,
+   file, renderer key, or feature key. `Core_Modules_HaveNo_DomainSpecific_Names`
+   enforces it from
+   [Phase 02a Packet 10](../roadmap/phase-02a-kernel-tenancy.md); it is the mechanical
+   guarantee behind the platform's entire premise, and the rename in
+   [§ 3](#3-worked-example-three-tenants-same-modules) exists because the old names would
+   have failed it.
+2. **No `LearnStack.Verticals.*` source folder.** `No_Source_Folder_Named_Verticals`
+   asserts the folder doesn't exist.
 3. **Primitive renderer set is closed.** Adding to `PRIMITIVE_RENDERERS` requires
    CODEOWNERS approval (LearnStack team only).
 4. **Composite renderer set is closed.** Same as primitives.
-5. **`tenant_*` customization tables have RLS.** Migration scan asserts the policy is
-   present on every customization table.
-6. **`tenant_*` customization keys are scoped to tenant.** `UNIQUE (tenant_id, key)` on
-   every customization table.
+5. **`tenant_*` customization tables have RLS**, built from the canonical template in
+   [Database Standards](../standards/05-database.md) — one `AND`-ed policy, `ENABLE`
+   **and** `FORCE`, explicit `WITH CHECK`. A migration scan asserts the policy is present
+   on every customization table; the binding proof is the isolation suite running as
+   `learnstack_app`.
+6. **`tenant_*` customization keys are scoped to tenant and versioned.**
+   `UNIQUE (tenant_id, key, schema_version)` identifies one immutable revision;
+   `UNIQUE (tenant_id, key) WHERE status = 'active'` (a partial index) keeps at most one
+   live definition per concept. `UNIQUE (tenant_id, key)` alone would reject the second
+   revision of any key and make the first breaking change ADR-0013 requires impossible —
+   see [§ 4](#4-schema-versioning) and
+   [Phase 04 § Customization Key Shape and Immutable Schema Versions](../roadmap/phase-04-cms-media-pages.md).
 7. **Scoring rule + completion rule expressions evaluate inside the sandbox.** Integration
    test asserts that an expression attempting to call `System.IO.File.ReadAllText` (or
    equivalent) is rejected at evaluation time.
+8. **Reference resolution is batched.** `Customization_Reference_Resolution_Is_Batched`
+   asserts a constant query count for a many-reference entry — see [§ 8.3](#83-the-n1-problem-and-the-limits-that-bound-it).
+9. **Only the sanitised-HTML primitive may call `dangerouslySetInnerHTML`.**
+   `Only_SanitizedHtmlPrimitive_Uses_DangerouslySetInnerHtml` is a frontend lint, and it
+   is the rule that keeps [§ 8.5](#85-the-embed-html-sanitisation-contract)'s contract from being bypassed by
+   a convenient one-off.
+
+## 12. Phasing
 
-## 11. Phasing
+The set was reduced in the 2026-08-08 restructure: two aggregates ship in Phase 02a
+because [Phase 02d](../roadmap/phase-02d-walking-skeleton.md) needs them to render two
+tenants; the rest land with their consumers, so no aggregate ships years before anything
+reads it.
 
 | Phase | Deliverable |
 |-------|-------------|
-| 02 | Customization tables created (empty); primitive renderer set scaffolded; `IModule.RegisterCustomizationSurface` interface for default seeds. |
-| 04 | CMS / Page Builder: page blocks as data; first composite renderers; JSON form editor for content types. |
-| 05 | Catalog / Learning Content: lesson item types as data; lesson player composites. |
-| 06 | Admin Studio polish: visual schema editor (drag-and-drop field builder); preview pane. |
-| 08a | Assessment: scoring rule DSL + sandbox; level taxonomies; completion rules. |
-| 12 (opt) | Content template marketplace: pre-built JSON Schema + scoring rule + level taxonomy bundles tenants can install with one click (data sharing only, no code). |
+| [02a Packet 8](../roadmap/phase-02a-kernel-tenancy.md) | `LearnStack.Modules.Customization` with **two** aggregates: `TenantContentType` and `TenantLevelTaxonomy`. Scoring and completion rule bodies stored as **opaque `text` with a `dialect` discriminator** — the engine is chosen in ADR-0025 and the three candidates do not share a column type. Primitive renderer set scaffolded; a small built-in seed (`default-card`, a stock `Plain` taxonomy). |
+| [02d](../roadmap/phase-02d-walking-skeleton.md) | Both seed tenants render their own taxonomy and content shape from these two aggregates. First proof that the model works. |
+| [03](../roadmap/phase-03-identity-admin.md) | `TenantCustomFieldDef`, with its mandatory `pii_category` and the `Membership` target. `users` gains no column. |
+| [04](../roadmap/phase-04-cms-media-pages.md) | `TenantPageBlock`; CMS / Page Builder; JSON form editor for content types; validating bulk import. |
+| [05](../roadmap/phase-05-education-learning-content.md) | **ADR-0025** picks the rule-evaluation engine; `TenantLessonItemType`; `TenantScoringRule` / `TenantCompletionRule` aggregates + evaluation; the reference-resolution batching and limits in [§ 8](#8-runtime-cost-model) get their integration tests. |
+| [06](../roadmap/phase-06-renderer-admin-studio.md) | Admin Studio polish: visual schema editor, preview pane. |
+| [08a](../roadmap/phase-08a-assessment-notifications.md) | `TenantTemplateLibrary`; assessment surfaces over the rule engine. |
+| [12 (optional)](../roadmap/phase-12-hub-marketplace.md) | Content template marketplace: pre-built schema + rule + taxonomy bundles installable in one click (data sharing only, no code). |
 
 ## References
 
-- ADR-0018 — Tenant-Driven Customization Model (supersedes ADR-0011).
+- ADR-0018 — Tenant-Driven Customization Model (supersedes ADR-0011). The 2026-08-08
+  **Amendment** draws the genericity boundary and requires the domain-neutral renaming in
+  [§ 3](#3-worked-example-three-tenants-same-modules).
 - ADR-0013 — Page Block Schema Versioning.
 - ADR-0017 — Tenant + Organization Hierarchy (custom fields can be org-scoped or
   tenant-wide).
 - ADR-0021 — Feature-Based Entitlement (some customization surfaces gated by plan tier).
+- [ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md) — the
+  RLS template every `tenant_*` table is built from.
+- [Platform Vision § Genericity boundary](01-platform-vision.md) — the product-facing
+  statement of what is data and what is a platform feature.
 - [06-extension-model.md](06-extension-model.md) — rewritten to reflect this document.
 - [02-domain-model.md](02-domain-model.md) — customization aggregates added.
diff --git a/docs/architecture/33-cross-cutting-concerns.md b/docs/architecture/33-cross-cutting-concerns.md
index c0dab00..d3c9c65 100644
--- a/docs/architecture/33-cross-cutting-concerns.md
+++ b/docs/architecture/33-cross-cutting-concerns.md
@@ -88,7 +88,7 @@ Request
                                 }
   ▼
 [4] TenantContextBehavior    ←  assert ITenantContext.IsResolved;
-                                set RLS GUCs via DbConnectionInterceptor
+                                carry tenant + organization forward (touches no connection)
   ▼
 [5] AuthorizationBehavior    ←  IAuthorizationService.AuthorizeAsync;
                                 Result.Fail(forbidden) on deny
@@ -118,9 +118,14 @@ Why this order:
   already lives here, and the L1 `IExceptionHandler` is the final catch site.
 - **Tenant context just inside audit.** Audit needs `actor`, `tenant_id`,
   `organization_id` to build a row; those must be resolved before the audit
-  snapshot runs. The behavior validates the context (asserts the middleware
-  populated it) and sets PostgreSQL session variables via the
-  `DbConnectionInterceptor` so RLS policies see the right values.
+  snapshot runs. The behavior *only* validates the context — it asserts the
+  middleware populated it. It does **not** set the PostgreSQL session variables:
+  `SET LOCAL` is transaction-local and step 4 runs before any transaction exists,
+  so the variables are issued by `TransactionBehavior` at step 6 as the first
+  statement inside the transaction. A `DbConnectionInterceptor` cannot do it
+  either — it fires at connection open, not at transaction start. See
+  [Security Standards § Tenant Context](../standards/11-security.md), the single
+  authority for this placement.
 - **Authorization after tenant.** A permission decision usually keys on
   `(tenant_id, user_id, resource)` — those must be ambient first.
 - **Transaction after authorization.** No transaction is opened for a
@@ -323,13 +328,26 @@ table extends with two new rows from this architecture:
 | Error tracking | `NoOpErrorTracker` | `SentryErrorTracker` | `SentryErrorTracker` | `SentryErrorTracker` (optional) | `LocalFileErrorTracker` |
 | OTLP exporter target | local OTel Collector (dev compose) | central Collector | central Collector | customer-managed Collector | local file `/var/learnstack/otel/` |
 
-Air-gapped Self-Hosted is the load-bearing case here: every backend (Sentry,
-the central Collector, possibly even DNS) is unreachable. The
-`LocalFileErrorTracker` writes structured-JSON error records to a configured
-directory; an operator's runbook explains how to ship those off-network later
-if the customer ever wants them. The OTLP exporter can be configured to
-write to a file sink instead of a network endpoint via the standard OTel
-file-exporter.
+The `IErrorTrackingProvider` abstraction earns its place on the ordinary grounds: it
+keeps a vendor SDK out of every module assembly, which is the same reason every other
+provider sits behind a port.
+
+Air-gapped Self-Hosted is the *most demanding* configuration of that abstraction —
+every backend (Sentry, the central Collector, possibly even DNS) is unreachable — but
+it is deliberately **not** the justification for it. Per
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md) and
+[Engineering Principles](../standards/00-principles.md), a deployment mode without a
+signed contract cannot be the deciding factor in a technical choice; it may only break
+a tie between otherwise-equal alternatives. `SelfHostedAirGapped` ships no earlier than
+[Phase 11](../roadmap/phase-11-production-hardening.md), and the same abstraction is
+justified without it.
+
+`LocalFileErrorTracker` writes structured-JSON error records to a configured directory;
+an operator's runbook explains how to ship those off-network later if the customer ever
+wants them. The OTLP exporter can be configured to write to a file sink instead of a
+network endpoint via the standard OTel file exporter; that file target itself lands in
+[Phase 11](../roadmap/phase-11-production-hardening.md), alongside a test asserting no
+network telemetry exporter is ever wired under `SelfHostedAirGapped`.
 
 Modules **never** branch on `DeploymentMode`. The composition root selects
 the adapter at startup; the architecture test
diff --git a/docs/decisions/0003-tenant-isolation-defense-in-depth.md b/docs/decisions/0003-tenant-isolation-defense-in-depth.md
index 979b991..3b818f6 100644
--- a/docs/decisions/0003-tenant-isolation-defense-in-depth.md
+++ b/docs/decisions/0003-tenant-isolation-defense-in-depth.md
@@ -2,7 +2,9 @@
 
 ## Status
 
-Accepted (Amendment 1: 2026-05-18 — adds Organization scope; see bottom of document)
+Accepted (Amendment 1: 2026-05-18 — adds Organization scope; Amendment 2: 2026-05-19 —
+identity row terminology; **Amendment 3: 2026-08-08 — corrects the RLS policy template
+and adds the database role model**; see bottom of document)
 
 ## Decision
 
@@ -48,16 +50,11 @@ table without altering the tenant-level guarantees.
 | Jobs (Hangfire) | Job payload carries `TenantId` (mandatory) + `OrganizationId?` (when applicable) |
 | Audit | Every audit row carries `tenant_id` (mandatory) + `organization_id?` (when applicable) — ADR-0016 |
 
-**RLS policy template for org-scoped tables:**
-
-```sql
-CREATE POLICY <table>_organization_isolation ON <table>
-    USING (
-        organization_id IS NULL
-        OR organization_id = current_setting('app.organization_id', true)::uuid
-        OR current_setting('app.scope', true) = 'tenant'
-    );
-```
+**RLS policy template for org-scoped tables:** superseded by
+[Amendment 3](#amendment-3--rls-policy-template-correction-and-database-role-model-2026-08-08).
+The template originally published here created a **second permissive policy**, which
+PostgreSQL combines with `OR`. The canonical template now lives in exactly one place:
+[Database Standards § Tenant-Owned and Organization-Scoped Tables](../standards/05-database.md).
 
 **Org-scope opt-in.** A tenant-owned entity may be **tenant-wide** (no `organization_id`)
 or **org-scoped** (`organization_id` populated). Entities mark themselves via
@@ -87,3 +84,186 @@ reflects the corrected wording.
 
 This is a documentation clarification; the Decision is unchanged.
 
+---
+
+## Amendment 3 — RLS policy template correction and database role model (2026-08-08)
+
+Amendment 1 published an RLS template that **does not deliver the isolation this ADR
+decides**. This amendment corrects the mechanism. The Decision — defense in depth with
+PostgreSQL RLS as one of its layers — is unchanged; what changes is the SQL that
+implements it, plus two layers that were never specified at all.
+
+### What was wrong
+
+`CREATE POLICY` produces a **permissive** policy by default, and PostgreSQL combines
+multiple permissive policies for the same command with `OR`. Only `AS RESTRICTIVE`
+policies are combined with `AND`.
+
+Amendment 1's template created a separate `<table>_organization_isolation` policy
+alongside `<table>_tenant_isolation`. The intended predicate was:
+
+```text
+tenant matches AND (organization matches OR row is tenant-wide)
+```
+
+The predicate PostgreSQL actually evaluated was:
+
+```text
+tenant matches OR organization matches OR row is tenant-wide OR scope = 'tenant'
+```
+
+`organization_id IS NULL` satisfies the organization policy on its own — and per
+[ADR-0017](0017-tenant-organization-hierarchy.md), a null `organization_id` is the
+**defined representation of a tenant-wide row**. Every tenant-wide row in an
+org-scoped table was therefore readable by **every tenant**.
+
+Three further gaps compounded it:
+
+- **No `FORCE ROW LEVEL SECURITY`.** A table's owner bypasses that table's policies
+  unless the table forces them. The default Entity Framework Core setup — migrations
+  and the application connecting as the same role — puts the application in exactly
+  that position, so the RLS layer could have shipped inert.
+- **No `WITH CHECK`.** A `USING` clause constrains reads. Without an explicit
+  `WITH CHECK`, writes are unconstrained for the commands where the two differ.
+- **No database role model.** No document named the role the application connects as,
+  so nothing prevented it from being the owner or from holding `BYPASSRLS`.
+
+### The correction
+
+The canonical, corrected template lives in exactly one place —
+[Database Standards § Tenant-Owned and Organization-Scoped Tables](../standards/05-database.md).
+[Tenant Isolation](../architecture/09-tenant-isolation.md) and
+[ADR-0017](0017-tenant-organization-hierarchy.md) link to it instead of repeating it.
+Its binding properties:
+
+1. **One permissive policy per table, one `AND`-ed predicate.** Tenant and organization
+   scope are evaluated in a single policy. Splitting them across two permissive policies
+   is what caused the defect; a second policy may only be added `AS RESTRICTIVE`, which
+   combines with `AND` and therefore cannot widen.
+2. **Two `AS RESTRICTIVE` write guards on org-scoped tables**, one `FOR UPDATE` and one
+   `FOR DELETE`. The `app.scope = 'tenant'` term is a *read* hatch, but `USING` also
+   selects which rows an `UPDATE` may target, and for `DELETE` it is the only gate —
+   PostgreSQL has no `WITH CHECK` for `DELETE`. Without the guards a tenant-scope
+   reporting session can delete another organization's rows or reassign them to itself.
+3. **`ENABLE` *and* `FORCE` row level security** on every tenant-owned table.
+4. **An explicit `WITH CHECK`** that constrains writes to the caller's tenant, and to
+   either the caller's organization or a tenant-wide row.
+5. **Every `current_setting` read wrapped in `NULLIF(..., '')`.** A dotted GUC becomes a
+   session placeholder the first time it is assigned and its reset value is the empty
+   string, not "undefined" — so on a pooled connection whose previous transaction set
+   the value and whose next one does not, `''::uuid` *raises* instead of filtering.
+   `NULLIF` turns that into `NULL`, and a `NULL` policy result is false for both
+   `USING` and `WITH CHECK`. This is what makes
+   `Unsetting_tenant_context_returns_zero_rows_through_RLS` able to pass at all.
+6. **Composite foreign keys on `tenant_id` between tenant-owned tables.** PostgreSQL
+   evaluates referential integrity with Row Level Security bypassed, so a single-column
+   foreign key lets a row in one tenant reference a row in another — invisibly, because
+   no policy runs. See
+   [Database Standards § Foreign keys between tenant-owned tables](../standards/05-database.md). The `app.scope = 'tenant'`
+   escape hatch applies to reads only — a tenant-scope reporting query may read across
+   organizations, but no query may write outside its organization.
+
+### Which tables the template applies to
+
+The corrected template governs **tenant-owned** tables. Two classes sit outside it, and
+both are enumerated rather than left to judgement:
+
+| Class | Rule | Tables |
+|---|---|---|
+| Tenant-owned | The corrected template | every domain table; of the Phase 02a tenancy set: `organizations`, `tenant_domains`, `tenant_locales`, `tenant_settings`, `tenant_feature_flags`, `platform_entitlement_cache`, `outbox_messages` |
+| Tenant-owned, self-keyed | The corrected template with the tenant term keyed on `id`, because the primary key *is* the tenant id | `tenants` |
+| Platform-scoped | `ENABLE` + `FORCE`, role-qualified per-command policies; the read is widened by an explicitly declared non-tenant predicate, writes stay tenant-keyed | `platform_host_to_tenant` |
+
+**A table is platform-scoped only when it is read before the tenant is known.** Exactly
+one table meets that test: `IHostToTenantResolver` reads `platform_host_to_tenant` in
+order to *determine* the tenant, so under a tenant-keyed predicate it would return zero
+rows and no tenant could ever resolve. Its read policy is keyed on a GUC the resolver
+declares (`app.resolving_host`) or on `app.tenant_id` for a tenant listing its own hosts;
+its writes stay tenant-keyed, because every writer knows its tenant. Row security is
+never *disabled* on any of these tables — a table without `ENABLE ROW LEVEL SECURITY` is
+indistinguishable from one nobody thought about.
+
+`platform_entitlement_cache` is **not** platform-scoped despite its name. Every read
+goes through `IFeatureFlags`, which resolves the tenant from `ITenantContext` and throws
+when there is none; every write goes through `IEntitlementProvider.RefreshAsync`, driven
+by `PUT /api/internal/tenants/{id}/entitlements`, which carries the tenant id in its
+path. It keeps the tenant-owned template.
+
+No statement of the form "writes are reserved to the migration and provisioning path" is
+an implementable control: PostgreSQL grants privileges to **roles**, and every handler in
+the API process runs as the same role. Grants are stated as a role × table × privilege
+matrix; code-path confinement is a separate layer carried by architecture tests. The
+matrix and the tests both live in
+[Database Standards § Database roles](../standards/05-database.md).
+
+### Database role model
+
+Four roles, four **separate login credentials**, four connection strings. The model is
+closed; a fifth role requires a new ADR.
+
+| Role | Connection string | Used by | RLS posture |
+|-------|---|---------|-------------|
+| `learnstack_migration` | `ConnectionStrings:Migration`, present only in the deploy job | EF Core migrations. **Owns** every table. | `NOBYPASSRLS`; `FORCE ROW LEVEL SECURITY` means ownership grants no bypass |
+| `learnstack_app` | `ConnectionStrings:Default` | The application's runtime connection. Not an owner. | `NOBYPASSRLS` |
+| `learnstack_platform` | `ConnectionStrings:PlatformAdmin` | Cross-tenant platform-admin operations, entered only through the audited `EnterPlatformAdminScope(reason)` path | `BYPASSRLS` |
+| `learnstack_outbox_admin` | `ConnectionStrings:OutboxDispatcher` | The outbox dispatcher, per [Events and Outbox](../architecture/15-event-and-outbox.md) | `BYPASSRLS` |
+
+`BYPASSRLS` bypasses **policies, not `GRANT`s**. Grant scope is therefore the only thing
+bounding the two bypass roles, which is why no privilege is granted to `PUBLIC` and no
+`ALTER DEFAULT PRIVILEGES` grant exists.
+
+**`EnterPlatformAdminScope(reason)` reaches `learnstack_platform` by a second connection,
+not by `SET ROLE`.** `learnstack_app` is not a member of `learnstack_platform`. A
+membership grant would make the bypass a standing capability of the application role,
+reachable from any code path that emits raw SQL; a plain `SET ROLE` survives `COMMIT` and
+would persist on a PgBouncer transaction-pooled server connection into the next tenant's
+request; and per-role settings such as `statement_timeout` are applied at login and do
+not follow a `SET ROLE`, which would defeat the per-role timeout split
+[Phase 11](../roadmap/phase-11-production-hardening.md) builds. The composition root owns
+a second, separately-credentialed data source that only
+`LearnStack.Infrastructure.MultiTenancy.PlatformAdminScope` may resolve.
+
+### Session-variable placement
+
+The RLS predicates read `app.tenant_id` and `app.organization_id`, set with
+`set_config(..., true)` / `SET LOCAL`. Both are **transaction-local**: they are
+discarded when the transaction ends. They must therefore be set **inside the ambient
+transaction**, after it opens — not in a MediatR behavior that runs before the
+transaction begins, and not in a connection interceptor, which fires when the
+connection opens rather than when the transaction starts.
+[Security Standards § Tenant Context](../standards/11-security.md) is the authority
+for this placement.
+
+### Test requirement
+
+Isolation tests connect as **`learnstack_app`**. A test that connects as the owner or
+as a `BYPASSRLS` role passes even when every policy is inert, and therefore proves
+nothing. The suite must include, at minimum:
+
+- a tenant-wide (`organization_id IS NULL`) row of tenant B is invisible to tenant A —
+  the exact case Amendment 1's template leaked;
+- an organization-scoped row of organization Y is invisible inside organization X of
+  the same tenant;
+- clearing the tenant context returns zero rows rather than all rows;
+- a write carrying a foreign `tenant_id` is rejected by `WITH CHECK`.
+
+### Where this lands
+
+The corrected template **and the four-role model** are applied by the **first
+migration**, in [Phase 02a Packet 6](../roadmap/phase-02a-kernel-tenancy.md). They are
+one deliverable, not two: the runtime grants to `learnstack_app` are DDL in the same
+migration as the policies, and `FORCE ROW LEVEL SECURITY` has no effect worth having
+while the connecting role is still the owner. No `ALTER TABLE … OWNER TO` appears in a
+migration — migrations connect **as** `learnstack_migration`, so every table they create
+is already owned by it, and an explicit `OWNER TO` is a sign the migration is running as
+the wrong role ([Database Standards § Database roles](../standards/05-database.md)).
+
+The transaction-local session variables (`SET LOCAL` inside the ambient transaction)
+and the isolation suite land in **Packet 7**, with `TenantResolverMiddleware`. Between
+the two packets no tenant-owned table is read on a request path: with the policies
+live and `app.tenant_id` unset, every predicate evaluates to `NULL` and every query
+correctly returns zero rows. Any seeding Packet 6 performs runs inside a transaction
+that sets `app.tenant_id` for the tenant being created.
+
+No migration may be written against the superseded template.
+
diff --git a/docs/decisions/0014-adopt-dapr.md b/docs/decisions/0014-adopt-dapr.md
index 890ba41..7e9dcd1 100644
--- a/docs/decisions/0014-adopt-dapr.md
+++ b/docs/decisions/0014-adopt-dapr.md
@@ -243,6 +243,35 @@ Three architecture tests enforce the abstraction boundary (added in Phase 02):
 The full deployment topology, component examples, and operational runbook live in
 [29-dapr-integration.md](../architecture/29-dapr-integration.md).
 
+## Amendments
+
+### 2026-08-08 — Schedule moved to Phase 11; the Decision is unchanged
+
+The Decision stands: when LearnStack needs a cross-process event bus, a distributed cache
+or a secret store, it uses Dapr for all three, and application code reaches them only
+through `IEventBus` / `ICacheService` / `ISecretProvider`. This amendment does not
+withdraw that choice.
+
+What moved is **when**. Per [ADR-0035](0035-demand-gated-infrastructure.md) Dapr is
+additive under the one-way-door test, so the three adapters are demand-gated:
+
+| Adapter | Registered until then | Lands in | Trigger |
+|---|---|---|---|
+| `DaprEventBus` | `InProcessEventBus` | [Phase 11](../roadmap/phase-11-production-hardening.md) | A second process must consume an integration event |
+| `DaprCacheService` | `InMemoryCacheService` | [Phase 11](../roadmap/phase-11-production-hardening.md) | More than one application instance runs concurrently |
+| `DaprSecretProvider` | `ConfigurationSecretProvider` | [Phase 11](../roadmap/phase-11-production-hardening.md) | A production secret must rotate without a redeploy, or more than one operator needs access to production secrets |
+
+The Implementation-notes bullet reading "Phase 02 — Platform kernel" and the
+Architecture-tests preamble reading "added in Phase 02" both mean Phase 11 under
+ADR-0035. The three architecture tests are already scheduled to Phase 11 in
+[21-architecture-tests-catalogue.md](../standards/21-architecture-tests-catalogue.md);
+they cannot run before the SDK is referenced.
+
+The default secret provider that shipped in Phase 02a Packet 3 is named
+`ConfigurationSecretProvider`, not `EnvironmentSecretProvider`, and reads
+`IConfiguration` — which already merges environment variables, user secrets and
+`appsettings.{env}.json` — rather than process environment variables alone.
+
 ## References
 
 - ADR-0006 — Events and Outbox (status: Accepted after this ADR; previously Proposed).
diff --git a/docs/decisions/0015-api-gateway-apisix.md b/docs/decisions/0015-api-gateway-apisix.md
index 1aba5c4..48501d5 100644
--- a/docs/decisions/0015-api-gateway-apisix.md
+++ b/docs/decisions/0015-api-gateway-apisix.md
@@ -268,7 +268,11 @@ trusts the gateway alone.
 
 - Phase 01 — Repository tooling: APISIX in `docker-compose.yml`; `infra/apisix/` with
   `config.yaml` (deployment mode) and `apisix.yaml` (routes).
-- Phase 02a — Platform kernel: APISIX route table covers all known endpoints; CORS
+- Phase 11 — Production hardening (moved from Phase 02a by
+  [ADR-0035](0035-demand-gated-infrastructure.md); the gateway is demand-gated on
+  "a non-dev deployment needs edge rate limiting, host routing, or JWT
+  pre-validation", and ASP.NET middleware carries those responsibilities until
+  then): APISIX route table covers all known endpoints; CORS
   allow-list for `localhost:3000` (web) and `localhost:3001` (studio); the
   mTLS-guarded route set for `/api/internal/*` is reserved as a separate APISIX route
   group (endpoints arrive in Phase 02c).
diff --git a/docs/decisions/0016-audit-log-subsystem.md b/docs/decisions/0016-audit-log-subsystem.md
index 313680a..dda4607 100644
--- a/docs/decisions/0016-audit-log-subsystem.md
+++ b/docs/decisions/0016-audit-log-subsystem.md
@@ -2,7 +2,32 @@
 
 ## Status
 
-Accepted
+Superseded by [ADR-0033](0033-audit-durability-model.md) (2026-08-08)
+
+> **What changed.** ADR-0033 keeps this ADR's subsystem design — a central Audit module
+> owning `AuditEntry`, capture through the MediatR pipeline, modules never touching
+> `audit_log` directly — and replaces its **durability contract**. This ADR's "audit
+> never blocks business logic" applied uniformly; under ADR-0033 it applies to
+> SHOULD/MAY-class audit only. MUST-class audit is written as a durable intent inside
+> the business transaction and **fails closed**, which is what
+> [Audit Coverage Standards](../standards/18-audit-coverage.md) always required and
+> what PostgreSQL Row Level Security requires once
+> [ADR-0003 Amendment 3](0003-tenant-isolation-defense-in-depth.md) lands.
+>
+> ADR-0033 also corrects the `audit_log` DDL below, which declares a primary key twice
+> — once inline on `id` and once as a table constraint on `(id, timestamp)` — and is
+> therefore rejected by PostgreSQL.
+>
+> That DDL's `-- Platform admin role bypasses RLS via SET role audit_admin` comment names
+> a role that no longer exists and a mechanism the corpus now forbids. The model has
+> exactly four roles, none of them an audit admin, and `learnstack_app` is not a member
+> of any bypass role — so the bypass is reached by a separate credentialed connection
+> through `EnterPlatformAdminScope(reason)`, never by `SET ROLE`. See
+> [ADR-0003 Amendment 3](0003-tenant-isolation-defense-in-depth.md) and
+> [Database Standards § Database roles](../standards/05-database.md).
+>
+> Read this ADR for the subsystem's context and rationale; read ADR-0033 for the
+> binding rules.
 
 ## Date
 
@@ -224,7 +249,11 @@ CREATE INDEX ix_audit_log_actor_timestamp
 CREATE INDEX ix_audit_log_correlation
     ON audit_log (correlation_id) WHERE correlation_id IS NOT NULL;
 
--- RLS
+-- RLS  ⚠ superseded shape — see the banner at the top of this ADR.
+-- The binding template is Standards 05 (one AND-ed policy, FORCE ROW LEVEL
+-- SECURITY, explicit WITH CHECK); the DDL above additionally declares a
+-- primary key twice, which PostgreSQL rejects. ADR-0033 carries the corrected
+-- table definition.
 ALTER TABLE audit_log ENABLE ROW LEVEL SECURITY;
 CREATE POLICY audit_log_tenant_isolation ON audit_log
     USING (tenant_id = current_setting('app.tenant_id', true)::uuid);
diff --git a/docs/decisions/0017-tenant-organization-hierarchy.md b/docs/decisions/0017-tenant-organization-hierarchy.md
index 261ad0a..56d4fb1 100644
--- a/docs/decisions/0017-tenant-organization-hierarchy.md
+++ b/docs/decisions/0017-tenant-organization-hierarchy.md
@@ -184,19 +184,18 @@ public OrganizationId? OrganizationId { get; private set; }   // null = tenant-w
 
 ### RLS policy template
 
-```sql
-ALTER TABLE <tenant_owned_table> ENABLE ROW LEVEL SECURITY;
-
-CREATE POLICY <table>_tenant_isolation ON <table>
-    USING (tenant_id = current_setting('app.tenant_id', true)::uuid);
-
-CREATE POLICY <table>_organization_isolation ON <table>
-    USING (
-        organization_id IS NULL                                                   -- tenant-wide row, visible to all orgs in tenant
-        OR organization_id = current_setting('app.organization_id', true)::uuid   -- org-scoped row, only matching org
-        OR current_setting('app.scope', true) = 'tenant'                          -- tenant-scope operation (admin, reporting) sees all orgs
-    );
-```
+> **Corrected 2026-08-08.** The template originally published in this section created
+> two *permissive* policies, which PostgreSQL combines with `OR` — leaking every
+> tenant-wide row across tenants. See
+> [ADR-0003 Amendment 3](0003-tenant-isolation-defense-in-depth.md) for the analysis.
+> The canonical template now lives in exactly one place:
+> [Database Standards § Tenant-Owned and Organization-Scoped Tables](../standards/05-database.md).
+> It is one policy with an `AND`-ed predicate, plus `FORCE ROW LEVEL SECURITY`, plus an
+> explicit `WITH CHECK`, plus the four-role model.
+>
+> This correction changes the SQL that implements the decision below; the decision
+> itself — a two-level Tenant + Organization hierarchy enforced at the database layer —
+> is unchanged.
 
 ### Permission scope extension
 
diff --git a/docs/decisions/0018-tenant-driven-customization-model.md b/docs/decisions/0018-tenant-driven-customization-model.md
index da74290..1916152 100644
--- a/docs/decisions/0018-tenant-driven-customization-model.md
+++ b/docs/decisions/0018-tenant-driven-customization-model.md
@@ -454,6 +454,49 @@ Three blocker-level architecture tests added in Phase 02:
 The full data model, ER diagram, schema versioning rules, and Admin Studio screens live
 in [32-tenant-customization-model.md](../architecture/32-tenant-customization-model.md).
 
+## Amendments
+
+### 2026-08-08 — Genericity boundary
+
+This ADR is read across the corpus as an unlimited claim: that any education domain can
+be expressed as tenant customization data. Stress-testing the model against three
+concrete tenants shows where that claim holds and where it breaks, and the boundary
+belongs in the decision record rather than in a reader's head.
+
+**Inside the boundary — tenant data, no code change:**
+
+| Dimension | Example |
+|---|---|
+| Content shape | A vocabulary card, an asana pose, a grammar topic — declared as a `TenantContentType` JSON Schema |
+| Presentation | Which blocks compose a page, which fields a card renders, what the level taxonomy is called |
+| Pure rule evaluation | A placement test's answer map mapped to a recommended level; a lesson's completion predicate over already-recorded facts |
+
+The discriminating property is that all three are **pure functions of tenant data and
+already-recorded state**. Nothing in this column needs to hold new state or reach
+outside the process.
+
+**Outside the boundary — platform features, written by LearnStack and gated by plan:**
+
+| Dimension | Example | Why it cannot be data |
+|---|---|---|
+| Stateful entitlement | A yoga studio's ten-session credit pack; a "three make-up classes per term" allowance | Requires a balance that is decremented, refunded, expired and audited. A JSON Schema declares shape; it cannot declare a ledger |
+| External capability invocation | Running a learner's submitted code; scoring pronunciation from an audio clip | Requires a sandbox, a runtime, a resource budget and a security boundary. A rule DSL evaluates; it does not execute arbitrary programs |
+
+A tenant that needs something in the second column needs a **LearnStack release**, or an
+integration with an external provider through an adapter. It does not need — and cannot
+have — a customization row.
+
+**Consequences for the corpus.** Identifiers in the core that name a specific domain
+(`code-challenge-shell`, `FeatureKeys.CodeChallengeRunner`) are renamed to describe the
+capability rather than the domain, per the hard rule that no module carries
+domain-specific names. The narrowed claim is stated in
+[Platform Vision § Genericity boundary](../architecture/01-platform-vision.md); the two
+outside-the-boundary dimensions are named there as platform capabilities rather than
+quietly implied to be customization.
+
+The Decision above is unchanged: domain-specific shapes remain tenant customization
+data, and there is no `Verticals/` folder.
+
 ## References
 
 - **Supersedes** ADR-0011 (Extension Points).
diff --git a/docs/decisions/0019-learnstack-hub.md b/docs/decisions/0019-learnstack-hub.md
index aec7c26..d006769 100644
--- a/docs/decisions/0019-learnstack-hub.md
+++ b/docs/decisions/0019-learnstack-hub.md
@@ -2,7 +2,41 @@
 
 ## Status
 
-Accepted
+Accepted — **amended by [ADR-0034](0034-hub-contract-surface-invariant.md) (2026-08-08)**
+
+> **What ADR-0034 changed.** The separate-repository decision, the Hub → LearnStack
+> mTLS + RS256 JWT + HMAC auth chain, and the "Hub holds tenant metadata, never tenant
+> content" rule all stand unchanged. What ADR-0034 replaces is the **"closed at four
+> endpoints"** framing that a later amendment to this ADR introduced, and the
+> **LearnStack → Hub API key** below (§ Inter-system contracts, and the Decision
+> section's `learnstack/hub/api-key` + 100 req/min rows): that direction now carries the
+> same three-layer chain as the other one. See
+> [ADR-0034 § One auth chain, both directions](0034-hub-contract-surface-invariant.md).
+> A bearer key on a path returning a tenant's whole entitlement set has no replay
+> protection and no per-request integrity, and the two directions holding different
+> postures produced a live self-contradiction in
+> [24-learnstack-hub.md](../architecture/24-learnstack-hub.md) — both spellings, twenty
+> lines apart.
+>
+> That framing was never accurate: the Decision section below enumerates **six** paths
+> and does not use the word "four". Protecting the number then damaged the design —
+> [ADR-0022](0022-custom-domain-tls.md) Amendment 1 routes host mappings *and TLS
+> private keys* through the entitlement-push payload specifically to avoid declaring a
+> fifth endpoint.
+>
+> The Decision section below names the operator portal's app `learnstack-hub-web`. That
+> is the name it had when this ADR was accepted; the app is now `operator-portal`
+> (`frontend/apps/operator-portal`, asserted by the Hub's
+> `Frontend_Has_Only_The_OperatorPortal_App` test). The Decision text is left as written —
+> an Accepted ADR is a record of what was decided, and a rename is not a decision this ADR
+> made. `learnstack-hub-web` survives as the Keycloak OIDC **client id**, which is a
+> different identifier and does not change.
+>
+> ADR-0034 replaces the count with two enforceable invariants: **the Hub stores no
+> tenant content**, and **every LearnStack↔Hub crossing goes through a named adapter**
+> (`IEntitlementProvider` / `IUsageReporter` / `IHubTenantSync`). Adding an endpoint
+> still requires an ADR — the surface is a cross-repository contract. Read ADR-0034 for
+> the enumerated endpoint set.
 
 ## Date
 
diff --git a/docs/decisions/0022-custom-domain-tls.md b/docs/decisions/0022-custom-domain-tls.md
index 6e7c477..e4388da 100644
--- a/docs/decisions/0022-custom-domain-tls.md
+++ b/docs/decisions/0022-custom-domain-tls.md
@@ -2,7 +2,39 @@
 
 ## Status
 
-Accepted
+Accepted — **the certificate-delivery mechanism in Amendment 1 (steps 3 and 4) and in
+the 2026-05-19 Option B amendment is superseded by
+[ADR-0034](0034-hub-contract-surface-invariant.md) (2026-08-08)**
+
+> **What ADR-0034 changed.** The lifecycle decided here is unchanged: Hub owns
+> custom-domain administration, DNS-01 and HTTP-01 challenges, Let's Encrypt issuance
+> behind `ITlsCertificateProvider`, and Hub never holds Kubernetes credentials on the
+> LearnStack cluster.
+>
+> What changed is **how the result reaches LearnStack**. Amendment 1 routes the
+> host → tenant mapping *and replicates the certificate, including its private key*
+> through `PUT /api/internal/tenants/{id}/entitlements`, explicitly "to keep the
+> four-endpoint surface closed". That payload is cached in
+> `platform_entitlement_cache`, logged, audited and mirrored — tunnelling a private key
+> through it is strictly worse than declaring another endpoint.
+>
+> Under ADR-0034: host mappings travel over a dedicated
+> `PUT /api/internal/tenants/{id}/host-mappings` carrying the host → tenant tuple only,
+> and certificate material moves by secret-store replication, referenced from that
+> payload **by path, not by value**.
+>
+> Wherever an amendment below routes certificate material through
+> `PUT /api/internal/tenants/{id}/entitlements`, or asserts that the four-endpoint
+> surface is or remains closed, read it as superseded. That applies to Amendment 1
+> steps 3 and 4 and to the Option B amendment's `SelfHostedOnline` / `SaaS` /
+> `Dedicated` bullet. All three now mean: host mappings over
+> `PUT /api/internal/tenants/{id}/host-mappings`, certificate material by secret-store
+> replication, referenced by path.
+>
+> Separately, [Custom Domain + TLS](../architecture/27-custom-domain-tls.md)'s
+> `CachedHostToTenantResolver` calls `IHubClient.LookupHostAsync` on cache miss, which
+> puts the Hub on the hot path of anonymous public page loads. That call is deleted;
+> `platform_host_to_tenant` is the sole authority for host resolution.
 
 ## Date
 
diff --git a/docs/decisions/0024-api-versioning-policy.md b/docs/decisions/0024-api-versioning-policy.md
index faf64f0..afc711a 100644
--- a/docs/decisions/0024-api-versioning-policy.md
+++ b/docs/decisions/0024-api-versioning-policy.md
@@ -26,7 +26,8 @@ Accepted
   exact header set, OpenAPI marking, SDK-generation implications, the
   breaking/non-breaking rule.
 - **Tenant-facing SDK consumers are the constraint.** The Hub HTTPS contract
-  ([ADR-0019](0019-learnstack-hub.md)) is internal mTLS at four endpoints — its
+  ([ADR-0019](0019-learnstack-hub.md)) is the internal mTLS surface enumerated in
+  [ADR-0034 § The endpoint set](0034-hub-contract-surface-invariant.md) — its
   versioning is governed by the Hub repo's own ADR set, not this one. The
   externally-exposed contract is the *tenant-facing* `/api/v1/*` surface, hit by
   the typed SDK generated from OpenAPI, by tenant-side integrations, by webhook
diff --git a/docs/decisions/0028-audit-log-partition-management.md b/docs/decisions/0028-audit-log-partition-management.md
index da0f29c..4db1f8d 100644
--- a/docs/decisions/0028-audit-log-partition-management.md
+++ b/docs/decisions/0028-audit-log-partition-management.md
@@ -2,7 +2,7 @@
 
 ## Status
 
-Accepted
+Accepted — **amended 2026-08-08** (see [Amendments](#amendments))
 
 **Date:** 2026-05-20
 **Deciders:** @platform
@@ -32,7 +32,7 @@ Accepted
 - **A Hangfire job runner already exists.** The audit retention purge is already
   committed to Hangfire ([Standards 18](../standards/18-audit-coverage.md)
   § Retention; [architecture/31-audit-subsystem.md
-  § 8 Retention](../architecture/31-audit-subsystem.md)). Partition
+  § 9 Retention](../architecture/31-audit-subsystem.md)). Partition
   management can ride the same `LearnStackJob`-shaped surface instead of
   introducing a second mechanism.
 - **PostgreSQL 18** ([ADR-0031](0031-postgresql-major-version.md)) ships with
@@ -242,7 +242,35 @@ The architecture splits responsibilities:
 
 ## Amendments
 
-_(none yet)_
+### 2026-08-08 — Schedule moved to Phase 11; the `pg_partman` rejection is re-opened for review
+
+Two clarifications. Neither changes the Decision.
+
+**Schedule.** Partition management is no longer a Phase 02a deliverable. Per
+[ADR-0035](0035-demand-gated-infrastructure.md), Phase 02a Packet 9 ships `audit_log`
+as a single correct table and the partitioning plus retention job land in
+[Phase 11](../roadmap/phase-11-production-hardening.md), triggered by measured
+`audit_log` growth. Audit *correctness* cannot be retrofitted; audit *scale* can, and
+fixing a partition strategy before any volume exists fixes it against a guess. The
+choice made here — a Hangfire recurring job rather than a PostgreSQL extension — is
+unchanged.
+
+**The `pg_partman` rejection warrants re-review.** This ADR's Context concedes that
+`pg_partman` is technically the stronger option and rejects it primarily to keep the
+`SelfHostedAirGapped` story extension-free. `SelfHostedAirGapped` has no signed
+contract and ships no earlier than Phase 11, and
+[Engineering Principles](../standards/00-principles.md) now states that a deployment
+mode or customer segment without a signed contract cannot be the deciding factor in a
+technical choice — it may only break a tie between otherwise-equal alternatives. Here
+the alternatives were **not** equal by this ADR's own assessment.
+
+The decision stands until it is re-examined. When Phase 11 implements partitioning, the
+implementer re-runs the comparison against the deployment modes that actually exist by
+then. If `pg_partman` wins, that is a new ADR superseding this one — not an edit here.
+
+**Corrected DDL.** The `audit_log` DDL this ADR's partition strategy assumes is the one
+in [ADR-0033](0033-audit-durability-model.md), not the one in ADR-0016, which declares
+a primary key twice and is rejected by PostgreSQL.
 
 ## References
 
@@ -258,7 +286,7 @@ _(none yet)_
 - [Standards 18 § Retention](../standards/18-audit-coverage.md) — the per-class
   retention table that scopes the row-level purge job; partition drops use the
   platform max only.
-- [architecture/31 § 8 Retention](../architecture/31-audit-subsystem.md) —
+- [architecture/31 § 9 Retention](../architecture/31-audit-subsystem.md) —
   the canonical job-name catalogue the recurring-job id slots into.
 - [pg_partman](https://github.com/pgpartman/pg_partman) — rejected alternative;
   link kept for future revisit.
diff --git a/docs/decisions/0030-redis-compatible-store-valkey.md b/docs/decisions/0030-redis-compatible-store-valkey.md
index 808c83b..eac449b 100644
--- a/docs/decisions/0030-redis-compatible-store-valkey.md
+++ b/docs/decisions/0030-redis-compatible-store-valkey.md
@@ -163,9 +163,13 @@ table entirely.
 - **This commit** (Phase 01 packet 6 cleanup): dev compose service swap;
   Dapr component `redisHost` update; doc + standards sweep; `.gitignore`
   volume name update.
-- **Phase 02a** (Cache adapter): `LearnStack.Infrastructure.Caching.Dapr`
-  consumes `state.redis` component against Valkey — no code-level
-  awareness of the backend vendor.
+- **Phase 02a** (Cache port): `ICacheService` ships with `InMemoryCacheService`
+  as the only registered implementation.
+- **Phase 11** (Cache adapter — moved from Phase 02a by
+  [ADR-0035](0035-demand-gated-infrastructure.md), demand-gated on "more than one
+  application instance runs concurrently"): `LearnStack.Infrastructure.Caching.Dapr`
+  consumes the `state.redis` component against Valkey — no code-level awareness of
+  the backend vendor.
 - **Phase 11** (production hardening): production sizing + Valkey HA
   topology decision (Sentinel vs Cluster mode) lives in its own ADR if
   it diverges from the default.
diff --git a/docs/decisions/0032-exception-handling-logging-and-observability.md b/docs/decisions/0032-exception-handling-logging-and-observability.md
index a1b3f51..3206108 100644
--- a/docs/decisions/0032-exception-handling-logging-and-observability.md
+++ b/docs/decisions/0032-exception-handling-logging-and-observability.md
@@ -9,6 +9,46 @@ Accepted
 
 ## Amendments
 
+### Amendment 2 — Three corrections from the 2026-08-08 restructure
+
+None of the three changes a sub-decision; all three correct text that would mislead an implementer.
+
+1. **The `IProviderResilience<TPort>` registration example does not compile.**
+   Sub-decision 5 shows `services.Decorate<TPort, ResilientProviderAdapter<TPort>>()`;
+   C# forbids using a type parameter as a base type, so `ResilientProviderAdapter<TPort>`
+   cannot satisfy `: TPort`. The **shipped** registration in
+   `LearnStack.Infrastructure.Resilience` is correct — it registers
+   `IProviderResilience<TPort>` as a singleton that adapters take as a collaborator
+   rather than decorating the port itself. Read the code, not the example.
+2. **The "Hub HTTPS contract is closed at four endpoints" decision driver is
+   superseded** by [ADR-0034](0034-hub-contract-surface-invariant.md), which replaces
+   the count with two invariants (the Hub stores no tenant content; every crossing goes
+   through a named adapter). The driver's substantive point is unaffected: inbound
+   `/api/internal/*` calls carry no tenant JWT, so their correlation comes from
+   `traceparent` plus the request envelope rather than from `ITenantContext`.
+3. **Sub-decision 2's diagram puts the Row Level Security session variables one step
+   too early.** The step-4 annotation reads
+   `TenantContextBehavior (assert resolved; set RLS GUC)`. `SET LOCAL` /
+   `set_config(…, true)` is transaction-local, and step 4 runs before
+   `TransactionBehavior` opens the transaction at step 6 — so a value set at step 4 is
+   discarded before the query it protects ever runs. Step 4 asserts the context and
+   carries it forward; step 6 issues the `SET LOCAL` pair as the first statement inside
+   the transaction. The pipeline **order** this ADR fixes is unchanged; only the
+   annotation was wrong.
+   [Security Standards § Tenant Context](../standards/11-security.md) is the single
+   authority for the placement.
+
+Separately, note that the **audit durability contract** referenced throughout this ADR
+now comes from [ADR-0033](0033-audit-durability-model.md), which supersedes ADR-0016.
+The pipeline order fixed by this ADR is unchanged. What changed is where durability comes
+from: `AuditLogBehavior` (step 3) classifies and declares a MUST-class intent on the way
+in; `TransactionBehavior` (step 6) writes the complete row on the ambient transaction
+immediately before `COMMIT` and then reports whether the commit succeeded; and
+`AuditLogBehavior` re-writes the row standalone on the way out whenever the transaction
+did not commit. The `AuditChangeTrackerInterceptor` captures ChangeTracker snapshots and
+writes nothing — an earlier draft of this amendment named it as the writer, which was
+never true of the component as specified.
+
 ### Amendment 1 — Roslyn diagnostic id + CI severity (2026-05-22)
 
 Sub-decision 4 and the Standards 21 naming convention referred to the
diff --git a/docs/decisions/0033-audit-durability-model.md b/docs/decisions/0033-audit-durability-model.md
new file mode 100644
index 0000000..f9c3ba2
--- /dev/null
+++ b/docs/decisions/0033-audit-durability-model.md
@@ -0,0 +1,288 @@
+# ADR-0033: Audit Durability Model
+
+## Status
+
+Accepted
+
+**Date:** 2026-08-08
+**Supersedes:** [ADR-0016](0016-audit-log-subsystem.md)
+
+## Decision Drivers
+
+- **ADR-0016 and Standards 18 contradict each other, and both are load-bearing.**
+  [Audit Coverage Standards](../standards/18-audit-coverage.md) requires a MUST-class
+  audit row to be written *in the same transaction* as the state change it records, and
+  forbids writing after the controlling transaction commits.
+  [ADR-0016](0016-audit-log-subsystem.md) requires that audit never blocks business
+  logic. Under the shipped pipeline both cannot hold.
+- **The shipped pipeline puts audit outside the transaction.** The canonical order
+  fixed in [ADR-0032](0032-exception-handling-logging-and-observability.md) and shipped
+  in Phase 02a Packet 3 is `Validation → Logging → AuditLog → TenantContext →
+  Authorization → Transaction → OutboxFlush → Handler`. `AuditLogBehavior` wraps
+  `TransactionBehavior` from the outside, so its write lands after the business
+  transaction has committed or rolled back.
+- **Row Level Security turns this from a durability gap into a silent failure.** Once
+  [ADR-0003 Amendment 3](0003-tenant-isolation-defense-in-depth.md) lands, the audit
+  insert runs outside the transaction that sets `app.tenant_id`. The policy's
+  `WITH CHECK` rejects the row, and the catch-and-log posture described in
+  [Audit Subsystem](../architecture/31-audit-subsystem.md) swallows the rejection. The
+  audit log would record nothing while reporting success.
+- **Compliance classes have different tolerances.** Losing an operational "course
+  updated" entry costs a support conversation. Losing "platform admin read tenant B's
+  learner records" costs an audit finding.
+- **Reordering the pipeline is more expensive than it looks.** The order is a global
+  property asserted by `MediatR_Pipeline_Order_Matches_Canonical_Sequence`, referenced
+  by ADR-0032's rationale chain, and already shipped. Changing it to fix audit would
+  also move `TenantContext` and `Authorization` relative to `Transaction`, each with
+  its own consequences.
+
+## Considered Options
+
+1. **Split the audit classes by durability, keep the pipeline order** (chosen).
+   MUST-class audit is written as a durable intent inside the business transaction;
+   enrichment and dispatch happen outside it. SHOULD/MAY-class stays best-effort.
+2. **Move `TransactionBehavior` outward so it wraps `AuditLogBehavior`** (rejected).
+   Fixes audit durability by making every audit write share the business transaction —
+   but also drags `TenantContext` and `Authorization` inside the transaction, opens the
+   transaction before validation has finished, and changes a shipped, test-asserted
+   global ordering to solve a problem that belongs to one behavior.
+3. **Accept best-effort auditing everywhere and weaken Standards 18** (rejected).
+   Honest, cheap, and wrong: the compliance classes this platform claims to support
+   (`actor.platformAdmin`, `actor.hubOperator`, permission changes, cross-tenant reads)
+   are exactly the ones a best-effort log may lose.
+4. **Write audit through the outbox** (rejected for MUST-class). The outbox is
+   at-least-once and asynchronous by design; an audit row that may arrive twice, or
+   late, is not what a compliance reviewer is asking for. The outbox remains correct
+   for audit *fan-out* to external sinks, which is a different problem.
+
+## Decision
+
+LearnStack splits audit writes into two durability classes and fixes **one component per
+step**, so no moment in the lifecycle is unowned. The shape is called
+**decide → write → reconcile**.
+
+| Step | Owner | Position | What it does |
+|---|---|---|---|
+| **Decide** | `AuditLogBehavior` | step 3 | Classifies `(module, operation)`, mints the `AuditEntryId`, parks a **pending intent** in the scoped `IAuditStateCapture`. Opens no transaction, touches no `DbContext`. |
+| **Write** | `TransactionBehavior` | step 6, immediately before `COMMIT` | Calls `IAuditStore.WritePendingAsync`, which issues one parameterised `INSERT INTO audit_log` on the **ambient transaction**, with `SET LOCAL app.tenant_id` already in force. A failure here rolls the business transaction back. |
+| **Reconcile** | `AuditLogBehavior` | step 3, on the way out | Reads the intent's final state. If it is anything other than `Committed`, writes the row **standalone**, in its own short transaction, carrying the real outcome. |
+
+**MUST-class audit** — security, compliance, and privileged-access events, as classified
+in [Audit Coverage Standards](../standards/18-audit-coverage.md) — commits **in the same
+transaction** as the state change it records, or it is written standalone with a
+non-success outcome. There is no third possibility and no window in which a committed
+state change has no audit row.
+
+**Durability is a property of the commit, not of the enrolment.** The write step marks
+the intent `WrittenInTransaction`, which is *not* durable — the transaction has not
+committed. `TransactionBehavior` therefore reports the commit boundary explicitly:
+`Committed` once `CommitAsync` returns, `RolledBack` after a rollback, and
+`Indeterminate` when `CommitAsync` throws in a way that leaves the server-side outcome
+unknown. The reconcile step keys off that signal and off nothing else. A row that was
+inserted and then rolled back is **not** consumed; it is re-written standalone with
+outcome `failed`. The common case this protects is not exotic: a handler that calls
+`SaveChanges` and then returns `Result.Fail(...)` rolls the audit row back on every
+business-rule rejection.
+
+**MUST-class audit with no business transaction** — a `denied` authorisation outcome at
+step 5, a read-sensitive query, a non-mutating security event — never reaches step 6. Its
+row is written by the reconcile step through `IAuditStore.WriteStandaloneAsync`, which
+opens its own short transaction and issues `SET LOCAL app.tenant_id` as its first
+statement so the `audit_log` `WITH CHECK` predicate is satisfied on its own terms. It
+runs on a connection that is not inside the business transaction, so a rollback there
+cannot take it.
+
+**SHOULD/MAY-class audit** — operational and diagnostic events — remains best-effort,
+written by the reconcile step outside any business transaction. Its accepted loss is
+written down in the module's coverage matrix rather than assumed.
+
+**The row is written once and never updated.** By the time `TransactionBehavior` is about
+to commit, every field is known — actor, correlation, before/after snapshots, outcome —
+so the write step composes the complete row. There is no second phase, no enrichment
+`UPDATE`, and `IAuditStore` has no update method.
+
+**Classification never reads the database on the request path.** The catalogue is
+in-process, registered at startup by `IModule.RegisterAuditDefaults()`. The tenant's
+`audit_config` overrides are read through `ICacheService`; on a miss the loader opens
+**its own** short transaction and sets `app.tenant_id` itself. This is not a
+refinement — at step 3 no transaction exists, `app.tenant_id` is unset, and `audit_config`
+is RLS-protected, so a lookup there returns **zero rows silently**, which reads exactly
+like "this tenant has no overrides" and never trips a fail-closed `catch`.
+
+**Fail-closed, stated precisely.** Two failures reject the operation: an operation the
+catalogue does not classify at all (`audit_unclassified_operation`), and a MUST-class row
+that cannot be written durably (`audit_unavailable`, HTTP 503). A failure to read a
+*tenant override* does **not**: the in-process catalogue still supplies the MUST floor, so
+the operation never proceeds unaudited — which is the property ADR-0016's
+`catch → continue` path lost — and rejecting every request platform-wide because a cache
+is unavailable is a worse compliance outcome than losing one tenant's voluntary
+SHOULD→MUST elevation. The failure is logged at `Error` and surfaced on the audit health
+check. A tenant `AuditConfig` override may narrow SHOULD/MAY coverage; it may never remove
+baseline MUST coverage.
+
+## Context
+
+### Why the durable-intent shape
+
+The pattern is the outbox pattern applied to audit, with one deliberate difference: the
+intent is written synchronously and its failure is fatal to the business operation,
+because for MUST-class events the audit *is* part of the operation's contract. What the
+intent buys is the separation of two concerns that ADR-0016 conflated:
+
+| Concern | Where it happens | Failure posture |
+|---|---|---|
+| Recording that the event occurred | Inside the business transaction | Fail closed — the operation is rejected |
+| Enriching, redacting, projecting, exporting | After commit, from the durable row | Best-effort, retried, never blocks |
+
+ADR-0016's "audit never blocks business logic" was written about the second column and
+applied to both. It is preserved for the second column and withdrawn for the first.
+
+### What was rejected and why it might come back
+
+Option 2 (reordering the pipeline) is not wrong in principle — a pipeline where the
+transaction is the outermost data-touching behavior is a defensible design. It was
+rejected because the cost of changing a shipped, test-asserted global ordering exceeds
+the cost of fixing the one behavior that needs fixing. If a later phase finds a second
+independent reason to move `TransactionBehavior`, this decision should be revisited
+together with that reason rather than piecemeal.
+
+### Corrected `audit_log` DDL
+
+ADR-0016's example DDL declares a primary key twice — once inline on `id` and once as a
+table constraint on `(id, timestamp)`. PostgreSQL rejects that table. The composite is
+the one to keep and the inline declaration is the error.
+
+The table below is what Phase 02a Packet 9 ships: a **plain, unpartitioned** table. The
+composite key is still the right key for it, for a forward-looking reason rather than a
+present one — a partitioned table must include every partition-key column in its primary
+key, so declaring `(id, timestamp)` now is what lets the Phase 11 conversion happen
+without a key migration, which is the expensive half of that operation.
+
+```sql
+CREATE TABLE audit_log (
+    id              uuid        NOT NULL,
+    tenant_id       uuid        NOT NULL,
+    organization_id uuid        NULL,
+    -- ... remaining columns unchanged from ADR-0016 ...
+    timestamp       timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT audit_log_pkey PRIMARY KEY (id, timestamp)
+);
+-- No PARTITION BY clause in Phase 02a. PostgreSQL has no in-place conversion —
+-- there is no ALTER TABLE ... PARTITION BY — so Phase 11 creates a partitioned
+-- parent, attaches this table to it, and recreates the indexes and the RLS policy
+-- on the parent, under a lock. The composite key above is what keeps that a data
+-- operation rather than a key migration.
+```
+
+Partitioning itself is **not** a Phase 02a concern. Phase 02a Packet 9 ships
+`audit_log` as a single correct table; monthly partitioning, the retention job, and the
+lifecycle policy from [ADR-0028](0028-audit-log-partition-management.md) ship in
+[Phase 11](../roadmap/phase-11-production-hardening.md) per
+[ADR-0035](0035-demand-gated-infrastructure.md). Audit correctness cannot be added
+later; audit scale can.
+
+### Retention schedule
+
+Three documents currently disagree on the retention job's cadence (daily in
+[Audit Coverage Standards](../standards/18-audit-coverage.md) and
+[ADR-0028](0028-audit-log-partition-management.md), weekly in
+[Audit Subsystem](../architecture/31-audit-subsystem.md)). The cadence is **daily**;
+the architecture document is the outlier and is corrected.
+
+## Consequences
+
+### Positive
+
+- MUST-class audit rows commit with the state change they describe, or the state change
+  does not happen. The guarantee Standards 18 always claimed is now true.
+- The audit insert executes inside the transaction that sets `app.tenant_id`, so Row
+  Level Security accepts it. The silent-failure mode that ADR-0003 Amendment 3 would
+  otherwise have introduced never exists.
+- The shipped pipeline order, its architecture test, and ADR-0032's rationale chain are
+  untouched.
+- Operational audit keeps its cheap path; the platform does not pay compliance-grade
+  cost for "a course was renamed".
+
+### Negative
+
+- A MUST-class command now has a failure mode it did not have: audit-store failure
+  rejects the operation. This is the point of the decision, but it is a real
+  availability trade-off and must be visible in the operational runbooks.
+- Every module's audit-coverage matrix must classify its operations before its commands
+  ship, rather than after — MUST/SHOULD/MAY is now a functional distinction, not a
+  documentation one.
+
+### Neutral
+
+- `AuditLogBehavior` keeps its position and its exception-handling responsibility; only
+  its durability contract changes.
+- Audit fan-out to external sinks still rides the outbox, unchanged.
+
+## Implementation Notes
+
+- **`IAuditStore`** — port in `LearnStack.SharedKernel.Abstractions.Audit`,
+  implementation `PostgresAuditStore` in `LearnStack.Infrastructure.Audit`. Exactly three
+  write methods and **no update method**:
+  - `WritePendingAsync(IUnitOfWork uow, CancellationToken ct)` — the in-transaction write;
+    a no-op when no MUST-class intent is pending; **throws** on failure so the caller
+    rolls back.
+  - `WriteStandaloneAsync(AuditEntryDraft entry, CancellationToken ct)` — its own short
+    transaction: `BEGIN; SET LOCAL app.tenant_id; INSERT; COMMIT`, on a connection that is
+    not inside the business transaction.
+  - `WriteBestEffortAsync(AuditEntryDraft entry, CancellationToken ct)` — same shape,
+    SHOULD/MAY only; the caller logs and drops failures.
+- **The row is written as parameterised SQL, not through an EF entity.** `AuditEntry`
+  stays the Audit module's aggregate and is the **read** model for the audit admin API.
+  The write path carries `AuditEntryDraft`, a `SharedKernel` record, and
+  `PostgresAuditStore` turns it into one `INSERT`. This is deliberate. Mapping
+  `AuditEntry` into every module's `DbContext` through a shared configuration in
+  `LearnStack.SharedKernel` would require SharedKernel to reference
+  `LearnStack.Modules.Audit.Domain` — a **circular project reference**, since that Domain
+  project already references SharedKernel — and would put hand-written EF Core mapping
+  code in SharedKernel, which
+  [Architecture Standards § Build-time-only exceptions](../standards/01-architecture-standards.md)
+  restricts to generated or marker shapes and gates behind an ADR. It would also make
+  every module's Infrastructure assembly reference `AuditEntry`, which is exactly what
+  [`Modules_Do_Not_Write_AuditLog_Directly`](../standards/21-architecture-tests-catalogue.md)
+  exists to prevent.
+- **Atomicity comes from the transaction, not from `SaveChanges`.** "The same
+  `DbContext.SaveChanges` as the business write" was the wrong formulation and is
+  withdrawn. The guarantee is "the same transaction", which is what a reader of
+  `audit_log` actually observes and which needs no cross-context machinery.
+- **`IUnitOfWork`** — the seam `TransactionBehavior` uses to open, commit and roll back
+  the ambient transaction without naming a module's `DbContext`, and through which
+  `IAuditStore` reaches the ambient connection. A
+  [Phase 02a Packet 6](../roadmap/phase-02a-kernel-tenancy.md) deliverable that
+  `TransactionBehavior`'s shipped shell already presumes; named here because the durable
+  audit write depends on it.
+- **`AuditConfig` overrides are a cached projection**, refreshed out of band and
+  invalidated by the tenant-configuration integration event — never a request-path query.
+  The loader sets its own `app.tenant_id`.
+- Modules never write `audit_log` directly — unchanged from ADR-0016.
+- Lands in [Phase 02a Packet 9](../roadmap/phase-02a-kernel-tenancy.md), together with
+  the `AuditChangeTrackerInterceptor` (snapshot capture only — it never constructs or
+  inserts an audit row), `IAuditStateCapture`, and the `audit_log_append_only_guard`
+  trigger.
+- Architecture tests, all registered in
+  [Architecture Tests Catalogue](../standards/21-architecture-tests-catalogue.md) by
+  Packet 9: `AuditEntry_Inherits_Entity_Not_AuditableEntity`,
+  `Every_TenantOwned_Command_HasAuditCoverage`,
+  `MustClass_Audit_Writes_Share_The_Business_Transaction`,
+  `Audit_Survives_Transaction_Rollback`,
+  `Audit_Classification_Does_Not_Read_The_Database_On_The_Request_Path`,
+  `AuditLog_Update_Is_Column_Restricted`.
+- The binding integration tests, all run as `learnstack_app` (`NOBYPASSRLS`): one
+  MUST-class command produces exactly one `audit_log` row; a command whose transaction is
+  forced to roll back at `COMMIT` produces **zero** business rows and **exactly one**
+  `audit_log` row with outcome `failed`; a command whose durable audit write is forced to
+  fail produces zero business rows and returns `503 audit_unavailable`.
+
+## References
+
+- [ADR-0016 Audit Log Subsystem](0016-audit-log-subsystem.md) (superseded by this ADR)
+- [ADR-0003 Tenant Isolation Defense in Depth](0003-tenant-isolation-defense-in-depth.md) (Amendment 3)
+- [ADR-0028 Audit Log Partition Management](0028-audit-log-partition-management.md)
+- [ADR-0032 Exception Handling, Logging, and Observability](0032-exception-handling-logging-and-observability.md)
+- [ADR-0035 Demand-Gated Infrastructure](0035-demand-gated-infrastructure.md)
+- [Audit Coverage Standards](../standards/18-audit-coverage.md)
+- [Audit Subsystem](../architecture/31-audit-subsystem.md)
diff --git a/docs/decisions/0034-hub-contract-surface-invariant.md b/docs/decisions/0034-hub-contract-surface-invariant.md
new file mode 100644
index 0000000..5871563
--- /dev/null
+++ b/docs/decisions/0034-hub-contract-surface-invariant.md
@@ -0,0 +1,225 @@
+# ADR-0034: Hub Contract Surface Invariant
+
+## Status
+
+Accepted
+
+**Date:** 2026-08-08
+**Amends:** [ADR-0019](0019-learnstack-hub.md) (the "closed at four endpoints" rule and
+the LearnStack → Hub API-key auth),
+[ADR-0022](0022-custom-domain-tls.md) (Amendment 1's entitlement-payload tunnelling)
+
+## Decision Drivers
+
+- **The "closed at four endpoints" rule is not true, and has not been true since it was
+  written.** [ADR-0019](0019-learnstack-hub.md)'s own Decision section enumerates six
+  paths and never uses the word "four"; its later amendment retroactively claims four.
+  [Architecture 24](../architecture/24-learnstack-hub.md) declares four canonical paths
+  and then adds four more it calls "auxiliary lifecycle endpoints" on the grounds that
+  they are specialisations of the canonical four. An HTTP endpoint is a path plus a
+  method. `DELETE /api/internal/tenants/{id}` is not `POST /api/internal/tenants`
+  because one is the inverse of the other.
+- **Protecting the number damaged the design.** To keep the count at four,
+  [ADR-0022 Amendment 1](0022-custom-domain-tls.md) routes host→tenant mappings **and
+  TLS certificate material, including private keys**, through
+  `PUT /api/internal/tenants/{id}/entitlements` — a payload that is cached in
+  `platform_entitlement_cache`, logged, audited, and mirrored. Tunnelling a private key
+  through a cached projection is strictly worse than declaring a fifth endpoint.
+- **A fifth caller appeared anyway.**
+  [Custom Domain + TLS](../architecture/27-custom-domain-tls.md) shows
+  `CachedHostToTenantResolver` calling `IHubClient.LookupHostAsync` on every cache
+  miss. That breaks three rules at once: it is an unrecorded endpoint, it is a Hub call
+  from outside the sanctioned adapters, and it places the Hub on the hot path of
+  anonymous public page loads — so a Hub outage takes tenant marketing sites down.
+- **The property everyone actually cares about is different from the count.** No
+  reviewer has ever needed the Hub contract to have exactly four endpoints. What they
+  need is that the Hub cannot reach tenant content, and that every crossing is
+  auditable and goes through a named adapter.
+
+## Considered Options
+
+1. **Replace the count with the invariant it was standing in for** (chosen). Enumerate
+   the real endpoint set, enforce "Hub stores no tenant data" and "every crossing goes
+   through a named adapter" mechanically, and let the set grow by ADR when the design
+   needs it.
+2. **Genuinely reduce the surface to four** (rejected). Would mean folding `status`,
+   `usage`, `delete` and `license/refresh` into the remaining four as mode flags —
+   which is how the certificate tunnelling happened in the first place. It optimises a
+   metric at the expense of the thing the metric was proxying for.
+3. **Leave the contradiction in place** (rejected). The corpus would keep saying "four"
+   while shipping eight, and the next designer under count pressure would tunnel the
+   next secret through the next payload.
+
+## Decision
+
+The Hub contract surface is governed by **two invariants**, not by a count:
+
+1. **The Hub stores no tenant content.** Courses, lessons, learners, enrollments,
+   classroom sessions, media and content entries live exclusively in LearnStack. The
+   Hub holds tenant *metadata* — plan, subscription, licence, custom domain, compliance
+   caps, aggregated usage.
+2. **Every LearnStack↔Hub crossing goes through a named adapter**:
+   `IEntitlementProvider`, `IUsageReporter`, `IHubTenantSync`. No other type in the
+   codebase may hold a Hub client. Nothing resolves a host by calling the Hub.
+
+Adding an endpoint still requires an ADR — not because the count is sacred, but because
+the surface is a cross-repository contract and both repositories have to agree.
+
+### The endpoint set
+
+**Hub → LearnStack** (`/api/internal/*`, internal listener only, mTLS + RS256 JWT +
+HMAC body signature):
+
+| Method | Path | Purpose |
+|---|---|---|
+| `POST` | `/api/internal/tenants` | Create tenant + default organization |
+| `PUT` | `/api/internal/tenants/{id}/entitlements` | Push the entitlement projection |
+| `PUT` | `/api/internal/tenants/{id}/status` | Suspend / activate / archive |
+| `DELETE` | `/api/internal/tenants/{id}` | Terminate |
+| `GET` | `/api/internal/tenants/{id}/usage` | Pull aggregated usage |
+| `PUT` | `/api/internal/tenants/{id}/host-mappings` | **New.** Push host → `(tenant_id, organization_id?)` mappings |
+
+**LearnStack → Hub** (same auth chain — see § One auth chain, both directions):
+
+| Method | Path | Purpose |
+|---|---|---|
+| `POST` | `/api/v1/internal/license/verify` | Verify / pull the entitlement projection |
+| `POST` | `/api/v1/internal/license/refresh` | Scheduled phone-home refresh |
+| `POST` | `/api/v1/usage/report` | Report a usage metric (idempotent) |
+| `POST` | `/api/v1/internal/tenants/{id}/custom-domains` | Submit a custom domain on behalf of a tenant admin. Handled by `IHubTenantSync`; the Admin Studio never calls the Hub directly, because a `learnstack` realm token is rejected there ([ADR-0004](0004-authentication-strategy.md)) |
+
+The Hub's own tenant-facing and operator-facing APIs (`/api/v1/tenants/*`,
+`/api/v1/subscriptions/*`, `/api/v1/webhooks/*`) are **not** part of this surface. They
+are the Hub's public API, governed by the Hub repository.
+
+### One auth chain, both directions
+
+The full three-layer chain — mTLS with a LearnStack-internal CA-signed client
+certificate, an RS256 JWT with `aud=learnstack-internal` and `exp ≤ 5 min`
+replay-protected on `jti`, and an HMAC-SHA256 body signature in `X-Signature` — applies
+to **every** endpoint in both tables above.
+
+This **extends** the chain to the LearnStack → Hub direction, which
+[ADR-0019](0019-learnstack-hub.md) § Inter-system contracts specified as a per-instance
+API key with a 100 req/min limit. That API key and its rate limit are superseded. A
+bearer key on a path that returns a tenant's whole entitlement set has no replay
+protection and no per-request integrity; and the two directions holding different
+postures is how a reviewer loses track of which one is which — the contradiction this
+subsection exists to close had both spellings twenty lines apart in the same
+architecture document. Rate limiting for the LearnStack → Hub direction is the Hub
+gateway's concern, not a property of the credential.
+
+A `SelfHostedOnline` instance therefore needs a client certificate. It is issued with
+the licence bundle and rotated on the same cadence — see
+[ADR-0020](0020-triple-deployment-hybrid-license.md) and the Hub repository's `P02c-6`.
+`SelfHostedAirGapped` makes no outbound call at all, so the question does not arise
+there.
+
+### Certificate material leaves the entitlement payload
+
+`PUT /api/internal/tenants/{id}/host-mappings` carries host → tenant mappings only. TLS
+certificates and private keys are **never** carried in an HTTP payload that LearnStack
+caches, logs, audits or mirrors. Cert material moves between the Hub-owned and
+LearnStack-owned secret stores by secret-store replication, referenced from the
+host-mapping payload by path rather than by value.
+[ADR-0022 Amendment 1](0022-custom-domain-tls.md)'s step 3 is superseded accordingly;
+its central guarantee — that the Hub never holds Kubernetes credentials on the
+LearnStack cluster — is unchanged.
+
+### Host resolution never calls the Hub
+
+`IHostToTenantResolver` reads `platform_host_to_tenant` and nothing else.
+`IHubClient.LookupHostAsync` is deleted.
+[Custom Domain + TLS](../architecture/27-custom-domain-tls.md) is corrected to match
+the rest of the corpus, which already makes `platform_host_to_tenant` the sole
+authority for host resolution. An anonymous page load must never depend on the Hub
+being reachable.
+
+### The entitlement read path
+
+`HubEntitlementProvider` resolves in this order, and the order is normative:
+
+```text
+L1 in-process cache
+  → L2 distributed cache (ICacheService)
+    → platform_entitlement_cache   (durable; carries valid_until and grace_until)
+      → Hub  (POST /api/v1/internal/license/verify)
+```
+
+A Hub outage on a cold cache falls through to `platform_entitlement_cache` and honours
+the grace window recorded there. It does not throw out of a feature-flag check. Each
+feature key class declares fail-open or fail-closed explicitly; the projection's wire
+shape is pinned by a checked-in `entitlement-v1.schema.json` and a snapshot test in
+both repositories.
+
+## Context
+
+### Why an invariant beats a count
+
+A count is easy to check and easy to satisfy dishonestly. The two invariants above are
+harder to state but can be enforced mechanically — one by scanning the Hub schema for
+tenant-content tables, the other by scanning for Hub client references outside the
+three adapters. Both already have architecture tests; neither had teeth while the count
+was the headline rule.
+
+### What we explicitly did not change
+
+[ADR-0019](0019-learnstack-hub.md)'s decision to run the Hub as a separate repository
+with an mTLS-guarded internal API stands. The Hub → LearnStack chain is unchanged; the
+LearnStack → Hub direction is the one this ADR strengthens, in § One auth chain, both
+directions.
+
+### When this reopens
+
+If the endpoint set grows past roughly a dozen, or if any endpoint starts carrying
+tenant content, the separation itself is the thing to re-examine — not the count.
+
+## Consequences
+
+### Positive
+
+- The corpus stops asserting something demonstrably false, so the rule regains
+  authority.
+- TLS private keys leave a cached, logged, audited payload.
+- Host resolution no longer depends on Hub availability; a Hub outage degrades billing
+  and provisioning, not public pages.
+- The entitlement read path finally honours the grace window that
+  [ADR-0021](0021-feature-based-entitlement.md) promised, instead of collapsing it into
+  a cache TTL.
+
+### Negative
+
+- Two repositories must agree on a longer endpoint list, and both snapshot tests must
+  be kept in step.
+- A new endpoint (`host-mappings`) and a secret-store replication path have to be
+  built; the tunnelled version, however unsound, was less work.
+
+### Neutral
+
+- "Adding an endpoint requires an ADR" survives verbatim; only its justification
+  changes.
+
+## Implementation Notes
+
+- LearnStack-side handlers and the `HubEntitlementProvider` / `IUsageReporter` adapters
+  land in [Phase 02c](../roadmap/phase-02c-hub-foundation.md); the Hub-side halves land
+  in the Hub repository's `P02c-2` and `P02c-5`.
+- `entitlement-v1.schema.json` is checked into both repositories and asserted by a
+  snapshot test in each.
+- Architecture tests: `Hub_NeverStores_TenantData`,
+  `LearnStack_Modules_DoNotReference_Hub`, `Internal_API_Endpoints_AreNot_Public`,
+  `IEntitlementProvider_Implementations_Are_Three`,
+  `NullEntitlementProvider_NotRegistered_OutsideDevelopment`, and a new
+  `Hub_Client_Referenced_Only_By_Named_Adapters`.
+- [Infrastructure Stack Standards § Hub HTTPS Contract Surface](../standards/20-infrastructure-stack.md)
+  is rewritten to state the invariants and carry the endpoint table.
+
+## References
+
+- [ADR-0019 LearnStack Hub](0019-learnstack-hub.md)
+- [ADR-0021 Feature-Based Entitlement](0021-feature-based-entitlement.md)
+- [ADR-0022 Custom Domain + TLS](0022-custom-domain-tls.md)
+- [ADR-0035 Demand-Gated Infrastructure](0035-demand-gated-infrastructure.md)
+- [Architecture 24 LearnStack Hub](../architecture/24-learnstack-hub.md)
+- [Custom Domain + TLS](../architecture/27-custom-domain-tls.md)
+- [Infrastructure Stack Standards](../standards/20-infrastructure-stack.md)
diff --git a/docs/decisions/0035-demand-gated-infrastructure.md b/docs/decisions/0035-demand-gated-infrastructure.md
new file mode 100644
index 0000000..a175227
--- /dev/null
+++ b/docs/decisions/0035-demand-gated-infrastructure.md
@@ -0,0 +1,217 @@
+# ADR-0035: Demand-Gated Infrastructure
+
+## Status
+
+Accepted
+
+**Date:** 2026-08-08
+
+## Decision Drivers
+
+- **The "Day-1 foundation" doctrine does not distinguish two very different kinds of
+  decision.** [Engineering Principles](../standards/00-principles.md) and `CLAUDE.md`
+  correctly insist that irreversible decisions be taken early. That instinct swept
+  additive, port-isolated technology choices into the same bucket as genuinely
+  irreversible schema and isolation decisions.
+- **The dev stack runs services the backend cannot call.**
+  `backend/Directory.Packages.props` declares no client library for Dapr, Kafka, Vault,
+  Valkey, Meilisearch, LiveKit or Hangfire. The local compose stack runs fourteen
+  services; the backend has a client for one of them. Infrastructure that cannot be
+  invoked is not a foundation — it is carrying cost. (The Phase 02a Packet 3
+  cross-cutting set — Serilog, OpenTelemetry, Polly and Sentry — *is* declared and wired,
+  and is not part of this ADR's gated set.)
+- **The ports are the cheap half, and they land before their first caller.**
+  `ISecretProvider` and `IProviderResilience<TPort>` already live in
+  `LearnStack.SharedKernel`; `IEventBus`, `ICacheService`, `IEntitlementProvider` and
+  `IHostToTenantResolver` land in
+  [Phase 02a Packet 5](../roadmap/phase-02a-kernel-tenancy.md), ahead of any consumer. A
+  port is three files and a registration. That asymmetry — a cheap, early interface
+  against an expensive, deferrable adapter — is what makes the deferral reversible:
+  swapping an implementation is a composition-root edit, while retrofitting an
+  abstraction is a refactor across every call site. The three concrete Dapr adapters live
+  in `LearnStack.Infrastructure.{Messaging,Caching,Secrets}`; see
+  [29-dapr-integration.md § 4](../architecture/29-dapr-integration.md).
+- **A hypothetical deployment mode has been steering unrelated decisions.**
+  `SelfHostedAirGapped` — which ships no earlier than
+  [Phase 11](../roadmap/phase-11-production-hardening.md) and has no contracted
+  customer — is already the first-listed justification for rejecting `pg_partman` in
+  [ADR-0028](0028-audit-log-partition-management.md) and the stated load-bearing case
+  for an abstraction in [Cross-Cutting Concerns](../architecture/33-cross-cutting-concerns.md).
+- **Deferral must be a written decision, not silence.** "We'll get to it" rots. A
+  deferred building block needs a named port, a named owning phase, and a written
+  trigger condition, or it is simply missing.
+
+## Considered Options
+
+1. **Demand-gate the additive building blocks behind their existing ports** (chosen).
+   The port and its default implementation ship now; the vendor adapter ships in a
+   named phase when a named trigger fires.
+2. **Ship every adapter in Phase 02a as originally planned** (rejected). Pays the full
+   operational and test-matrix cost of six technologies before a single tenant exists,
+   and blocks the first user-visible artefact behind work no user can see.
+3. **Delete the ports too and add abstractions when needed** (rejected). The ports are
+   the cheap half; they are what makes deferral reversible. Removing them would turn a
+   configuration change into a refactor.
+4. **Keep everything but stop running it locally** (rejected). Hides the cost rather
+   than removing it, and produces adapters that are never exercised.
+
+## Decision
+
+LearnStack classifies every infrastructure decision with the **one-way-door test**:
+
+> If I add this six months from now, will I have to touch code that is already written?
+
+- **Yes → one-way door.** Ship it now. Tenant and organization isolation, the
+  `outbox_messages` table and its ownership, strongly-typed identifiers, and the
+  localization schema are one-way doors: adding them later means touching every query,
+  every migration, and every job payload.
+- **No → additive.** Ship the **port** and a **default implementation** now; ship the
+  vendor adapter in the phase named below, when its trigger fires.
+
+A demand-gated building block is not "deferred". It has a port, a working default
+implementation, an owning phase, and a trigger condition — all four, written down, or
+it does not qualify.
+
+**A deployment mode or customer segment without a signed contract cannot be the
+deciding factor in a technical choice.** It may break a tie when the alternatives are
+otherwise equal. This rule is added to
+[Engineering Principles](../standards/00-principles.md).
+
+### The gated set
+
+| Building block | Port | Default implementation shipping now | Adapter lands in | Trigger |
+|---|---|---|---|---|
+| Dapr pub/sub | `IEventBus` | `InProcessEventBus` | [Phase 11](../roadmap/phase-11-production-hardening.md) | A second process needs to consume an integration event |
+| Kafka | (behind `IEventBus`) | `InProcessEventBus` | [Phase 11](../roadmap/phase-11-production-hardening.md) | Event volume, replay, or ordering across processes is required |
+| Dapr state / Valkey | `ICacheService` | `InMemoryCacheService` | [Phase 11](../roadmap/phase-11-production-hardening.md) | More than one application instance runs concurrently |
+| Vault | `ISecretProvider` | `ConfigurationSecretProvider` | [Phase 11](../roadmap/phase-11-production-hardening.md) | A production secret must rotate without a redeploy, **or** more than one operator needs access to production secrets |
+| APISIX | (composition root) | ASP.NET middleware | [Phase 11](../roadmap/phase-11-production-hardening.md) | A non-dev deployment needs edge rate limiting, host routing, or JWT pre-validation |
+| Hub entitlement | `IEntitlementProvider` | `NullEntitlementProvider` | [Phase 02c](../roadmap/phase-02c-hub-foundation.md) | A tenant must be billed or plan-gated |
+| Signed licence key | `IEntitlementProvider` | `NullEntitlementProvider` | [Phase 11](../roadmap/phase-11-production-hardening.md) | A Self-Hosted contract is signed |
+| Custom-domain TLS automation | `IHostToTenantResolver` + `ITlsCertificateProvider` | `platform_host_to_tenant` rows managed by configuration | [Phase 11](../roadmap/phase-11-production-hardening.md) | A tenant needs its own domain in production |
+| `audit_log` partitioning + retention job | — (schema-internal) | Single correct table | [Phase 11](../roadmap/phase-11-production-hardening.md) | Measured `audit_log` growth justifies partition maintenance |
+| Meilisearch | `ITenantSearch` | PostgreSQL full-text search | [Phase 09](../roadmap/phase-09-billing-integrations-analytics.md) | Search quality or scale exceeds PostgreSQL FTS |
+| LiveKit | `ILiveClassProvider` | — (scheduled, not gated — see the exception below) | [Phase 08c](../roadmap/phase-08c-classroom.md) | Live classes become a product requirement |
+| Managed video transcoding | `IVideoTranscoder` | ffmpeg-backed worker ([Phase 04](../roadmap/phase-04-cms-media-pages.md)) | [Phase 11](../roadmap/phase-11-production-hardening.md) | In-house transcode backlog or per-minute cost exceeds the managed alternative |
+
+**Two rows carry a deliberate exception to the four-element rule, named here so they read
+as decided rather than overlooked.** A **schema-internal** block — `audit_log`
+partitioning — has no port because there is no consumer to isolate: the correct
+un-partitioned table plays the default implementation's role, and the conversion is a
+migration, not a swap. A block whose absence is a **missing product feature rather than a
+missing implementation** — LiveKit — has no default, because there is nothing to default
+to before the feature exists; its trigger is the phase that introduces live classes, and
+that is the honest statement of it. It is listed here for completeness of the
+infrastructure picture, not because it is gated in the same sense as the rest. No third
+exception is added without amending this ADR.
+
+`DeploymentMode` keeps all five of its values and the composition root keeps branching
+on it. What changes is the **support claim**: only `Development` and `SaaS` are wired
+end to end before Phase 11. `Dedicated`, `SelfHostedOnline` and `SelfHostedAirGapped`
+are prepared seams, not supported deployments, until their integration suites exist.
+
+That makes `SaaS` a **non-development deployment running on
+`ConfigurationSecretProvider`**, which is why the Vault trigger above is written as a
+rotation and access condition rather than "a non-dev deployment exists" — the latter
+would be satisfied the moment SaaS ships, which is not what the row means. Reading
+secrets from `IConfiguration` is a bounded position, not a permanent one: it is
+defensible while one operator holds the deployment's secrets and a redeploy is an
+acceptable way to change them. The first production secret that must rotate without a
+redeploy, or the second operator needing access, fires the trigger — and that may well
+be before Phase 11's other work.
+
+## Context
+
+### Why this is not "defer everything"
+
+The platform-first instinct is right, and this ADR preserves it. Tenant isolation,
+module boundaries, the outbox table's ownership and the typed-identifier convention are
+all genuinely cheaper now than later, and all of them stay in Phase 02a. What this ADR
+removes from Phase 02a is the set of choices that will cost exactly the same in six
+months as they do today, because a port stands between them and every consumer.
+
+The distinction is mechanical, not a matter of taste: tenant isolation touches every
+query ever written, so its cost grows with the codebase. A Dapr adapter touches three
+classes at the composition root, so its cost does not.
+
+### What would reverse this decision
+
+Any of the trigger conditions above firing earlier than its phase. The triggers are
+written as observable conditions rather than dates precisely so that the roadmap can
+respond to reality — if a second process needs an integration event during Phase 05,
+the Dapr adapter moves to Phase 05 and this table is amended.
+
+### What this ADR does not do
+
+It does not withdraw [ADR-0014](0014-adopt-dapr.md),
+[ADR-0015](0015-api-gateway-apisix.md), [ADR-0019](0019-learnstack-hub.md),
+[ADR-0020](0020-triple-deployment-hybrid-license.md) or
+[ADR-0022](0022-custom-domain-tls.md). Those decisions stand: when LearnStack needs a
+cross-process event bus it uses Dapr, when it needs an edge gateway it uses APISIX, and
+when it needs a control plane it uses the Hub. This ADR decides **when** each arrives,
+not **whether**.
+
+## Consequences
+
+### Positive
+
+- The local development loop drops from fourteen services to roughly seven, and the
+  daily feedback cycle gets correspondingly faster.
+- The first browser-visible artefact — [Phase 02d](../roadmap/phase-02d-walking-skeleton.md)
+  — stops being blocked behind infrastructure no user can see.
+- The test matrix shrinks: two live deployment modes instead of five, one event
+  transport instead of two.
+- Every deferral is now legible. A reader can see what is missing, which port covers
+  it, which phase owns it, and what makes it urgent.
+
+### Negative
+
+- The adapters are written later, against a codebase that has more consumers. The ports
+  make this a bounded cost, but it is not zero.
+- `Phase 11` accumulates a substantial amount of previously-distributed work and must
+  be planned as a real phase rather than a hardening checklist.
+- Claiming five deployment modes and supporting two requires the marketing and
+  documentation surfaces to say so plainly.
+
+### Neutral
+
+- The `DeploymentMode` enum, the ports, and the composition-root branching are all
+  unchanged. Only the implementations behind three of the five values are absent.
+
+## Implementation Notes
+
+- `ISecretProvider` and its default `ConfigurationSecretProvider` already shipped in
+  [Phase 02a Packet 3](../roadmap/phase-02a-kernel-tenancy.md). The remaining defaults
+  (`InProcessEventBus`, `InMemoryCacheService`, `NullEntitlementProvider`) ship in
+  [Phase 02a Packet 5](../roadmap/phase-02a-kernel-tenancy.md). Together they are the
+  only registered implementations in every deployment mode until their own triggers
+  fire — which is Phase 11 for the event bus, the cache and secrets, but
+  [Phase 02c](../roadmap/phase-02c-hub-foundation.md) for `IEntitlementProvider`, whose
+  `NullEntitlementProvider` must not be registered outside `Development` once the
+  Hub-backed implementation exists.
+- `InProcessEventBus` is a first-class transport, not a stub: it uses the same
+  `IIntegrationEventHandler<T>` interface, the same `IInboxGuard`, the same
+  tenant-context restoration, and the same per-partition-key ordering (concurrent
+  across keys, sequential within one) as the durable path — see
+  [15-event-and-outbox.md](../architecture/15-event-and-outbox.md). A dev path that skips those is a dev
+  path that never exercises the isolation code.
+- `ICacheService.RemoveByPrefixAsync` is removed or redesigned before Packet 5 ships:
+  the current contract cannot be honoured across instances by any of the candidate
+  backends. See [Phase 02a Packet 5](../roadmap/phase-02a-kernel-tenancy.md).
+- `NullEntitlementProvider` must not be registered outside `Development` once
+  [Phase 02c](../roadmap/phase-02c-hub-foundation.md) lands
+  (`NullEntitlementProvider_NotRegistered_OutsideDevelopment`).
+- Architecture test `Modules_Do_Not_Reference_DeploymentMode` continues to hold — the
+  composition root branches once, modules never.
+
+## References
+
+- [ADR-0014 Adopt Dapr](0014-adopt-dapr.md)
+- [ADR-0015 API Gateway: APISIX](0015-api-gateway-apisix.md)
+- [ADR-0019 LearnStack Hub](0019-learnstack-hub.md)
+- [ADR-0020 Triple Deployment + Hybrid License](0020-triple-deployment-hybrid-license.md)
+- [ADR-0022 Custom Domain + TLS](0022-custom-domain-tls.md)
+- [ADR-0028 Audit Log Partition Management](0028-audit-log-partition-management.md)
+- [ADR-0033 Audit Durability Model](0033-audit-durability-model.md)
+- [Engineering Principles](../standards/00-principles.md)
+- [Infrastructure Stack Standards](../standards/20-infrastructure-stack.md)
diff --git a/docs/decisions/README.md b/docs/decisions/README.md
index 1253b85..78231ae 100644
--- a/docs/decisions/README.md
+++ b/docs/decisions/README.md
@@ -17,7 +17,7 @@ Accepted ADRs are not rewritten. A new decision is a new ADR, possibly supersedi
 |---|---|---|
 | 0001 | [Platform Name](0001-platform-name.md) | Name and naming conventions |
 | 0002 | [Initial Architecture](0002-initial-architecture.md) | .NET 10 + EF Core + PostgreSQL + Valkey + SeaweedFS + Next.js; modular monolith |
-| 0003 | [Tenant Isolation Defense in Depth](0003-tenant-isolation-defense-in-depth.md) | Query filters + RLS + audit + architecture tests (Amendment 1: Organization scope, 2026-05-18) |
+| 0003 | [Tenant Isolation Defense in Depth](0003-tenant-isolation-defense-in-depth.md) | Query filters + RLS + audit + architecture tests (Amendment 1: Organization scope, 2026-05-18; Amendment 2: identity row terminology, 2026-05-19; **Amendment 3: corrected RLS policy template + database role model, 2026-08-08**) |
 | 0004 | [Authentication Strategy](0004-authentication-strategy.md) | Off-the-shelf identity provider preferred over hand-rolled auth (Amendment 1: `learnstack-hub` realm, 2026-05-18) |
 | 0005 | [Live Classroom Media Stack](0005-live-classroom-media-stack.md) | LiveKit OSS self-hosted by default; LiveKit Cloud optional; no custom SFU |
 | 0006 | [Events and Outbox](0006-events-and-outbox.md) | Domain + integration events; outbox pattern; idempotent handlers (Amendment 1: Dapr pub/sub dispatch transport, 2026-05-18) |
@@ -30,9 +30,9 @@ Accepted ADRs are not rewritten. A new decision is a new ADR, possibly supersedi
 | 0013 | [Page Block Schema Versioning](0013-page-block-schema-versioning.md) | `(key, schemaVersion)` tuple; immutable schemas; lazy + bulk migration; placeholder on unknown version |
 | 0014 | [Adopt Dapr](0014-adopt-dapr.md) | Dapr building blocks for pub/sub (Kafka), state (Valkey), secrets (Vault); abstracted behind SharedKernel interfaces |
 | 0015 | [API Gateway with APISIX](0015-api-gateway-apisix.md) | APISIX standalone mode; JWT + rate limit + CORS + correlation-id at the edge; defense-in-depth |
-| 0016 | [Audit Log Subsystem](0016-audit-log-subsystem.md) | `LearnStack.Modules.Audit`; EF interceptor + `IAuditStateCapture` + `AuditLogBehavior`; partitioned `audit_log` table; retention |
+| 0016 | [Audit Log Subsystem](0016-audit-log-subsystem.md) | **Superseded by [ADR-0033](0033-audit-durability-model.md).** `LearnStack.Modules.Audit`; EF interceptor + `IAuditStateCapture` + `AuditLogBehavior`; partitioned `audit_log` table; retention. Read for context; ADR-0033 carries the binding durability rules |
 | 0017 | [Tenant + Organization Hierarchy](0017-tenant-organization-hierarchy.md) | Two-level: Tenant → Organization; permission scope Platform / Tenant / Organization |
-| 0018 | [Tenant-Driven Customization Model](0018-tenant-driven-customization-model.md) | Generic-only core; tenants define content types, page blocks, scoring rules as **data**, not code (supersedes ADR-0011) |
+| 0018 | [Tenant-Driven Customization Model](0018-tenant-driven-customization-model.md) | Generic-only core; tenants define content types, page blocks, scoring rules as **data**, not code (supersedes ADR-0011; Amendment 2026-08-08 draws the genericity boundary — stateful entitlement and external capability invocation are platform features, not customization) |
 | 0019 | [LearnStack Hub](0019-learnstack-hub.md) | Separate codebase `learnstack-hub`; tenant lifecycle, plans, entitlements, billing, custom domain admin; mTLS internal API |
 | 0020 | [Triple Deployment + Hybrid License](0020-triple-deployment-hybrid-license.md) | SaaS / Dedicated / Self-Hosted from one codebase; phone-home + RSA-signed key + 30-day grace |
 | 0021 | [Feature-Based Entitlement](0021-feature-based-entitlement.md) | Feature flags + numeric limits per plan; typed `FeatureKeys` / `LimitKeys` registries |
@@ -44,6 +44,9 @@ Accepted ADRs are not rewritten. A new decision is a new ADR, possibly supersedi
 | 0030 | [Redis-compatible Store — Valkey](0030-redis-compatible-store-valkey.md) | Valkey (Linux Foundation, BSD-3-Clause) for the cache + Dapr state-store backend; RESP-protocol drop-in; partially supersedes ADR-0002's Redis row |
 | 0031 | [PostgreSQL — Start on 18.x](0031-postgresql-major-version.md) | Pin primary RDBMS major version to PostgreSQL 18; native `gen_uuid_v7()` + async I/O + longest LTS runway; partially supersedes ADR-0002's PostgreSQL row |
 | 0032 | [Exception Handling, Logging, and Observability](0032-exception-handling-logging-and-observability.md) | `IExceptionHandler` + 8-step MediatR pipeline + `Result.Fail`-only validation + `DomainException`-is-bug discipline + `IProviderResilience<TPort>` (Polly v8) + Sentry vs OTel error capture boundary + Serilog primary + `TenantContextSpanProcessor` + `IErrorTrackingProvider` deployment-mode branching |
+| 0033 | [Audit Durability Model](0033-audit-durability-model.md) | **Supersedes ADR-0016.** MUST-class audit written as durable intent inside the business transaction (fails closed); SHOULD/MAY-class stays best-effort; corrected partitioned `audit_log` primary key; `AuditConfig` cannot remove baseline MUST coverage |
+| 0034 | [Hub Contract Surface Invariant](0034-hub-contract-surface-invariant.md) | Replaces "closed at four endpoints" with two enforceable invariants (Hub stores no tenant content; every crossing goes through a named adapter); enumerates the real endpoint set; TLS key material leaves the entitlement payload; host resolution never calls the Hub |
+| 0035 | [Demand-Gated Infrastructure](0035-demand-gated-infrastructure.md) | The one-way-door test; ports + default implementations ship now, vendor adapters ship on a named trigger in a named phase; uncontracted deployment modes may not decide technical choices |
 
 ## Superseded ADRs
 
@@ -52,6 +55,15 @@ Accepted ADRs are not rewritten. A new decision is a new ADR, possibly supersedi
   original file is retained in place (`0011-extension-points.md`) with a Superseded
   status banner and a "why superseded" section linking forward. Never implemented; no
   migration needed.
+- **ADR-0016 — Audit Log Subsystem** — superseded by [ADR-0033: Audit Durability
+  Model](0033-audit-durability-model.md) on 2026-08-08. The subsystem design survives
+  intact; the **durability contract** changed. ADR-0016 applied "audit never blocks
+  business logic" uniformly, which contradicted
+  [Audit Coverage Standards](../standards/18-audit-coverage.md)'s same-transaction
+  requirement and would have been silently defeated by Row Level Security once
+  [ADR-0003 Amendment 3](0003-tenant-isolation-defense-in-depth.md) landed. The
+  original file is retained in place with a Superseded banner. Not yet implemented; no
+  migration needed.
 
 ## Redirect ADRs
 
@@ -87,7 +99,10 @@ Decision lines reference this list.
 
 ## Authoring an ADR
 
-1. Pick the next available 4-digit number.
+1. Pick the number: if your topic is in § Open ADR Drafts above, use its reserved
+   number; otherwise take the next number **after the highest in the Active list**.
+   Never take a reserved number for an unrelated topic, and never reuse a superseded
+   one — see § Reservation rule.
 2. Use the template (see existing ADRs).
 3. Status starts as `Proposed`; flip to `Accepted` once team agrees.
 4. Link the ADR from the relevant architecture or standard document.
diff --git a/docs/glossary.md b/docs/glossary.md
index 8a0d051..845fcb4 100644
--- a/docs/glossary.md
+++ b/docs/glossary.md
@@ -12,7 +12,7 @@ This glossary defines LearnStack-specific terms. When a term is ambiguous across
 | **Organization** | A sub-unit within a tenant — a branch, campus, studio, department, or cohort. Two-level hierarchy strict (`Tenant → Organization`, no nesting) per [ADR-0017](decisions/0017-tenant-organization-hierarchy.md). Every tenant has at least one default organization. |
 | **Brand** | Synonym for Tenant in product-facing language. In code, prefer `Tenant`. |
 | **Platform Admin** | A LearnStack operator who manages tenants, plans, infrastructure-level settings. Authenticates against the `learnstack-hub` Keycloak realm. Operates above tenants. |
-| **Hub Operator** | A subset of Platform Admins who use the operator portal (`learnstack-hub-web`). Same Keycloak realm; finer-grained roles (`hub-platform-admin`, `hub-operator`, `hub-billing-viewer`). |
+| **Hub Operator** | A subset of Platform Admins who use the operator portal (`operator-portal`). Same Keycloak realm; finer-grained roles (`hub-platform-admin`, `hub-operator`, `hub-billing-viewer`). |
 | **Tenant Admin** | A user with administrative rights inside a single tenant. Authenticates against the `learnstack` Keycloak realm. Cannot see other tenants. |
 | **Org Admin** | A user with administrative rights inside a single organization within a tenant. |
 | **Deployment Mode** | One of `Development` / `SaaS` / `Dedicated` / `SelfHostedOnline` / `SelfHostedAirGapped` per [ADR-0020](decisions/0020-triple-deployment-hybrid-license.md). Selected at composition root; module code never branches on it. The two `SelfHosted*` variants differ on phone-home availability (entitlement source). |
@@ -26,7 +26,7 @@ This glossary defines LearnStack-specific terms. When a term is ambiguous across
 | **User** | A person known to LearnStack at the global level. Identified by a stable user id. |
 | **Membership** | The relationship between a user, a tenant, and (optionally) an organization. Triple-keyed `(user_id, tenant_id, organization_id)` per [ADR-0017](decisions/0017-tenant-organization-hierarchy.md). A user can have memberships in multiple tenants and multiple organizations within one tenant. |
 | **Role** | A named bundle of permissions. Scope: `Platform` / `Tenant` / `Organization`. Examples: `tenant-admin`, `editor`, `instructor`, `learner`, `org-admin`. |
-| **Permission** | A fine-grained capability `{module}.{resource}.{action}` with a scope (Platform / Tenant / Organization). Action set is closed: `read | write | delete | admin`. |
+| **Permission** | A fine-grained capability `{module}.{resource}.{action}` with a scope (Platform / Tenant / Organization). Action set is closed: `read \| write \| delete \| admin`. |
 | **Invitation** | A pending offer for a user to accept a membership in a tenant + organization. |
 
 ## Content & Pages
@@ -59,7 +59,7 @@ This glossary defines LearnStack-specific terms. When a term is ambiguous across
 | Term | Definition |
 |------|------------|
 | **Enrollment** | A learner's grant of access to a specific course (and specific course version). |
-| **Entitlement** | A user's right to access a paid or assigned capability. Enrollment is one source of entitlements; billing is another. |
+| **Course Access** | A *learner's* right to open a specific course, derived from an `Enrollment` (or from a tenant-side purchase, cohort membership, or admin grant). Evaluated inside the Enrollment module against tenant data. **Not an Entitlement** — see *Feature Flags & Entitlements*. The two words were used interchangeably in earlier drafts; they are different subjects (a learner versus a tenant), different owners (LearnStack versus Hub), and different lifecycles. |
 | **Cohort** | A group of learners progressing through the same course version on a shared timeline. Cohorts may have scheduled live sessions. |
 | **Progress** | The learner's recorded advancement against the structure of a course version. |
 
@@ -127,7 +127,8 @@ This glossary defines LearnStack-specific terms. When a term is ambiguous across
 | Term | Definition |
 |------|------------|
 | **Tenant Customization Aggregate** | One of `TenantContentType`, `TenantPageBlock`, `TenantLessonItemType`, `TenantLevelTaxonomy`, `TenantScoringRule`, `TenantCompletionRule`, `TenantCustomFieldDef`, `TenantTemplateLibrary`. Per [ADR-0018](decisions/0018-tenant-driven-customization-model.md), per-tenant domain shapes live here as data, not code. |
-| **Composite Renderer Key** | A reference from a `TenantPageBlock` / `TenantLessonItemType` to a built-in primitive renderer (`default-card`, `content-list`, `card-grid`, …) that the runtime resolves to a React component. Tenants compose; they do not bring code. |
+| **Genericity Boundary** | The stated edge of the claim "the domain is tenant data". **Inside** — content shape, presentation, and pure rule evaluation: all three are pure functions of tenant data and already-recorded state, so a JSON Schema plus an evaluator is a complete answer, and a tenant declares them without a LearnStack release. **Outside** — stateful entitlement (credit packs, session quotas: a schema declares a shape, it cannot declare a ledger) and external capability invocation (executing submitted programs, scoring audio: a rule DSL evaluates, it does not execute arbitrary programs). Outside-the-boundary needs are met by **generically named, plan-gated platform features** written by LearnStack — never by per-vertical code and never by a customization row. Per [ADR-0018 Amendment (2026-08-08)](decisions/0018-tenant-driven-customization-model.md); stated product-facing in [Platform Vision](architecture/01-platform-vision.md). |
+| **Composite Renderer Key** | A reference from a `TenantPageBlock` / `TenantLessonItemType` to a **built-in composite renderer** that the runtime resolves to a React component. The registry is closed and lives in [32-tenant-customization-model.md § 2](architecture/32-tenant-customization-model.md): `default-card`, `content-list`, `media-gallery`, `rich-page`, `lesson-shell`, `quiz-shell`, `placement-shell`, `live-shell`, `submission-shell`. Every key names a capability, never a domain. Tenants compose; they do not bring code. **Distinct from a *page block key*** (`hero`, `rich-text`, `card-grid`, …), which is the page-builder's own built-in set — the two registries are described in different documents and their reconciliation is owned by [Phase 06](roadmap/phase-06-renderer-admin-studio.md). |
 | **Provider Adapter** | A concrete implementation of an infrastructure-side interface (payment, live-class, search, storage, email, SMS, event bus, cache, secrets, entitlement source, host resolver). |
 | **Vertical (deprecated)** | Pre-2026-05-18 term for a domain-specific code module. Verticals as code no longer exist — see [ADR-0018](decisions/0018-tenant-driven-customization-model.md). Domain shapes live as tenant customization data. |
 
@@ -136,10 +137,13 @@ This glossary defines LearnStack-specific terms. When a term is ambiguous across
 | Term | Definition |
 |------|------------|
 | **Feature Flag (tenant-level)** | A typed capability toggle stored in `tenant_feature_flags` for experimental / rollout / opt-in features. Resolved through `IFeatureFlags`. Catalog is code-defined (`FeatureKeys`); per-tenant overrides are data. |
-| **Entitlement** | A Hub-projected fact about a tenant's plan: which features are enabled, which limits apply, which compliance caps. Mirrored from the Hub into `platform_entitlement_cache` per [ADR-0021](decisions/0021-feature-based-entitlement.md). |
-| **Feature Key / Limit Key** | A typed value object (`FeatureKey`, `LimitKey`) from the `FeatureKeys` / `LimitKeys` static catalogs. Free-form strings are forbidden. |
+| **Entitlement** | **The single definition.** The set of capabilities a **tenant** holds by virtue of its plan: which features are enabled, which numeric limits apply, which compliance caps are forced. Its subject is always a tenant, never a learner. It is **owned by the Hub** and **mirrored** into LearnStack; LearnStack reads it and never authors it. Per [ADR-0021](decisions/0021-feature-based-entitlement.md) and [ADR-0034](decisions/0034-hub-contract-surface-invariant.md). Three things in the corpus are frequently called "entitlement" and are distinguished by name below. |
+| **Entitlement Aggregate (Hub-side)** | The authoritative aggregate in the `learnstack-hub` repository, recomputed from `Plan` + `HubSubscription` + operator-set compliance caps. The **only** writer of an entitlement anywhere. |
+| **Entitlement Projection** | The read-only copy LearnStack holds, delivered by `PUT /api/internal/tenants/{id}/entitlements` or embedded in a signed licence key, stored durably in `platform_entitlement_cache` and served through `IEntitlementProvider`. Carries `expires_at`, `grace_until` and a monotonic `generation` on the wire; these persist to the `valid_until`, `grace_until` and `generation` columns of `platform_entitlement_cache`. Wire shape pinned by `entitlement-v1.schema.json` in both repositories. |
+| **Course Access** | *Not* an entitlement — a learner's right to open a course. See *Enrollment & Access*. |
+| **Feature Key / Limit Key** | A typed value object (`FeatureKey`, `LimitKey`) from the `FeatureKeys` / `LimitKeys` static catalogs. Free-form strings are forbidden. Canonical spelling is `{area}.{name}` with no `.enabled` suffix on features and no `limits.` prefix on limits — `classroom.recording`, `tenancy.max_learners`. See [26-hybrid-license-model.md § 0](architecture/26-hybrid-license-model.md). |
 | **Killswitch** | A `KillswitchKeys.*` flag whose default is "enabled" and gates an expensive or risky code path. Flipped off during an incident to disable the path platform-wide. Overlay wins over both plan projection and tenant flag. |
-| **Soft vs Hard Limit** | A `LimitKey` declares `LimitEnforcement = Soft | Hard`. Hard refuses the operation with `403 ProblemDetails`; Soft surfaces a banner and emits a Hub-side soft-limit alert. |
+| **Soft vs Hard Limit** | A `LimitKey` declares `LimitEnforcement = Soft \| Hard`. Hard refuses the operation with `403 ProblemDetails`; Soft surfaces a banner and emits a Hub-side soft-limit alert. |
 
 ## Search
 
@@ -200,12 +204,13 @@ This glossary defines LearnStack-specific terms. When a term is ambiguous across
 
 | Term | Definition |
 |------|------------|
-| **AuditEntry** | The append-only aggregate owned by `LearnStack.Modules.Audit`. Inherits `Entity<TId>`, **not** `AuditableEntity<T>` — append-only by design. See [ADR-0016](decisions/0016-audit-log-subsystem.md) and [31-audit-subsystem.md](architecture/31-audit-subsystem.md). |
+| **AuditEntry** | The append-only aggregate owned by `LearnStack.Modules.Audit`. Inherits `Entity<TId>`, **not** `AuditableEntity<T>` — append-only by design (`AuditEntry_Inherits_Entity_Not_AuditableEntity`). Persisted to `audit_log`, whose primary key is the composite `(id, timestamp)`. See [ADR-0033](decisions/0033-audit-durability-model.md) and [31-audit-subsystem.md](architecture/31-audit-subsystem.md). |
 | **Audit Operation Class** | One of `create`, `update`, `delete`, `read-sensitive`, `security-event`, `platform-admin`. Determines whether an action MUST, SHOULD, or MAY be audited. |
 | **Audit Coverage Matrix** | A per-module table mapping resources × operations to MUST / SHOULD / MAY / – classifications. Required for every module spec. |
-| **AuditConfig** | The per-tenant override of the catalog's MUST/SHOULD/MAY mapping (tenants can opt into stricter coverage but cannot relax MUST). |
+| **AuditConfig** | The per-tenant override of the catalog's MUST/SHOULD/MAY mapping. A tenant may opt into stricter coverage; it can never relax MUST — the classifier applies the override and then re-applies the catalogue's MUST floor. A failure to **read** the configuration **fails closed**: the operation is rejected rather than proceeding unaudited, so a config-store outage cannot silently switch off mandatory security auditing. Per [ADR-0033](decisions/0033-audit-durability-model.md). |
 | **Audit Capture Pipeline** | `AuditChangeTrackerInterceptor` (EF) → `IAuditStateCapture` (before/after/changes JSON) → `AuditLogBehavior` (MediatR) → `IAuditStore`. Modules never write `audit_log` directly. |
-| **Retention Class** | The retention floor for a category of audit entries (7y for security-event / platform-admin / financial; 2y for others). |
+| **Durable Audit Intent** | The MUST-class audit row, written by `IAuditStore.WritePendingAsync` on the **same transaction as the business write** — `AuditLogBehavior` classifies and parks the intent at pipeline step 3, `TransactionBehavior` writes it immediately before `COMMIT` — so it commits with that write or not at all, and so it executes while `app.tenant_id` is set and the Row Level Security `WITH CHECK` accepts it. "The same `SaveChanges`" was the earlier formulation and ADR-0033 withdraws it: the guarantee is the transaction, which needs no cross-`DbContext` machinery. If it cannot be written, the business operation **fails closed**. Enrichment, redaction, projection, and external fan-out happen after the commit, reading the durable row, and are best-effort. SHOULD/MAY-class audit is **not** a durable intent: it is written outside the transaction, and its accepted loss is written down rather than assumed. Per [ADR-0033](decisions/0033-audit-durability-model.md), which supersedes ADR-0016. |
+| **Retention Class** | The retention floor for a category of audit entries (7y for security-event / platform-admin / financial; 2y for others). Enforced by a **daily** Hangfire purge job from [Phase 11](roadmap/phase-11-production-hardening.md). |
 
 ## Permissions
 
@@ -239,7 +244,7 @@ This glossary defines LearnStack-specific terms. When a term is ambiguous across
 | **BFF (Backend-for-Frontend)** | The Next.js server-side proxy layer in `app/api/` that holds session cookies, refreshes Keycloak tokens silently, and forwards calls to the .NET API with `Authorization` and tenant + organization headers. The browser never sees refresh tokens. |
 | **Idempotency Key** | A client-supplied `Idempotency-Key` header on `POST` operations with external side effects (payments, webhook processing, notification sending, recording start/stop). The server stores `(idempotency_key, response)` for 24 hours and replays the stored response for duplicates. See [04-api-design.md § Idempotency](standards/04-api-design.md). |
 | **Problem Details** | RFC 7807 JSON error envelope (`type`, `title`, `status`, `code`, `detail`, `instance`, `correlationId`) used by every LearnStack error response. |
-| **Hub Contract Surface** | The closed set of four endpoints between LearnStack core and the Hub: `POST /api/internal/tenants`, `PUT /api/internal/tenants/{id}/entitlements`, `POST /api/v1/internal/license/verify`, `POST /api/v1/usage/report`. mTLS + signed JWT + HMAC. Adding a fifth requires a new ADR. |
+| **Hub Contract Surface** | The enumerated set of endpoints between LearnStack core and the Hub, governed by **two invariants** rather than by a count ([ADR-0034](decisions/0034-hub-contract-surface-invariant.md)): (1) the Hub stores no tenant content — only tenant metadata: plan, subscription, licence, custom domain, compliance caps, aggregated usage; (2) every crossing goes through a named adapter — `IEntitlementProvider`, `IUsageReporter`, `IHubTenantSync` — and no other type may hold a Hub client. All crossings carry mTLS + RS256 JWT + HMAC body signature. Adding an endpoint still requires an ADR, because the surface is a cross-repository contract. The superseded "closed at four endpoints" phrasing was never true, and protecting the number is what caused TLS private keys to be tunnelled through the entitlement payload. ADR-0034 § The endpoint set is the authoritative enumeration; this entry deliberately does not restate a count, because a count here is a second thing to keep in step. |
 
 ## Cross-Cutting Concerns
 
@@ -255,7 +260,7 @@ This glossary defines LearnStack-specific terms. When a term is ambiguous across
 | **`IDomainEvent`** | The marker interface (`: MediatR.INotification`) every in-process domain event implements. Raised from aggregate methods, collected by the unit of work, dispatched in-process by MediatR. The abstract `DomainEvent` base declares `EventId` and `OccurredAt` as `required init` so events are always stamped through `IGuidFactory` / `IClock` at the call site. Distinct from integration events, which cross module boundaries through the outbox + Dapr pub/sub per [ADR-0010](decisions/0010-cross-module-communication.md). |
 | **`CursorPagination` / `Page<T>` / `PageInfo`** | The cursor-first pagination triple in `LearnStack.SharedKernel.Pagination` matching Standards 04 § Pagination. `CursorPagination(Cursor, Limit)` is the request (default `Limit = 20`, max 100; ctor throws on `Limit <= 0` — kernel-level guard); `Page<T>(Items, PageInfo)` is the response; `PageInfo(NextCursor, PreviousCursor, HasNext, HasPrevious)` carries the opaque cursors the client never parses. |
 | **`LearnStackVogenDefaults.IdMask`** | The canonical `Conversions` mask every Vogen-emitted ID and value object opts into: `EfCoreValueConverter \| SystemTextJson \| TypeConverter`. Per [ADR-0023](decisions/0023-strongly-typed-id-source-generator.md) every aggregate-root ID writes `[ValueObject<Guid>(LearnStackVogenDefaults.IdMask)]`. |
-| **Pipeline Behavior** | A MediatR pipeline behavior — one of the eight canonical steps wrapping every command / query: `Validation → Logging → Audit → TenantContext → Authorization → Transaction → OutboxFlush → Handler`. The order is binding per [ADR-0032 § Sub-decision 2](decisions/0032-exception-handling-logging-and-observability.md); the architecture test `MediatR_Pipeline_Order_Matches_Canonical_Sequence` enforces it. |
+| **Pipeline Behavior** | A MediatR pipeline behavior — one of the eight canonical steps wrapping every command / query: `Validation → Logging → AuditLog → TenantContext → Authorization → Transaction → OutboxFlush → Handler`. The order is binding per [ADR-0032 § Sub-decision 2](decisions/0032-exception-handling-logging-and-observability.md); the architecture test `MediatR_Pipeline_Order_Matches_Canonical_Sequence` enforces it. |
 | **`IExceptionHandler` (LearnStack L1)** | The `.NET 8+` exception-handler interface; `LearnStackExceptionHandler : IExceptionHandler` is the final catch site for every unhandled exception. Maps to Problem Details, attaches `correlationId`, records the OTel span error, calls `IErrorTrackingProvider.CaptureAsync` when `ShouldCapture(ex)` is true. See [ADR-0032 § Sub-decision 1](decisions/0032-exception-handling-logging-and-observability.md). |
 | **Correlation ID** | The W3C `traceparent` value (or a derived UUID for fallback) that threads through every signal — logs, traces, audit rows, outbox rows, Hangfire payloads, Problem Details bodies — bound to a single user request or background operation. Same as `Activity.Current.TraceId` for HTTP requests; reconstructed from the outbox row / Hangfire payload / event envelope at consumer side. See [10-observability.md § Correlation](standards/10-observability.md). |
 | **Telemetry Signal** | One of the three OpenTelemetry signals — logs, traces, metrics. LearnStack emits all three through Microsoft.Extensions.Logging (Serilog implementation) + OTel SDK; errors additionally flow to `IErrorTrackingProvider`. |
@@ -270,14 +275,16 @@ This glossary defines LearnStack-specific terms. When a term is ambiguous across
 
 | Term | Definition |
 |------|------------|
-| **Dapr Building Blocks** | The three Dapr abstractions LearnStack uses: pub/sub (Kafka), state (Valkey), secrets (Vault) per [ADR-0014](decisions/0014-adopt-dapr.md). Service invocation, workflow, bindings, and actors are out of scope. |
-| **`IEventBus`** | Interface for publishing integration events. Backed by `DaprEventBus` (production) or `InProcessEventBus` (development). The `OutboxProcessor` is the only sanctioned caller. |
-| **`ICacheService`** | Interface for cache reads / writes. Backed by `DaprCacheService` (production, Valkey-backed) or `InMemoryCacheService` (development). Cache keys carry `{tenant_id}` prefix. |
-| **`ISecretProvider`** | Interface for secret reads. Backed by `DaprSecretProvider` (production, Vault) or `EnvironmentSecretProvider` (development). Secret namespace `learnstack/{deployment}/{module}/{key}`. |
-| **`IEntitlementProvider`** | Interface for the entitlement source. Implementations: `NullEntitlementProvider` (dev), `HubEntitlementProvider` (SaaS / Dedicated), `SignedLicenseKeyEntitlementProvider` (Self-Hosted). |
-| **`IHostToTenantResolver`** | Interface for host → `(tenant_id, organization_id?)` resolution. Backed by `platform_host_to_tenant`. |
-| **APISIX** | The gateway in standalone YAML-reload mode per [ADR-0015](decisions/0015-api-gateway-apisix.md). The only tenant-facing ingress. A separate route set guards `/api/internal/*` with mTLS. |
-| **`OutboxProcessor`** | The BackgroundService that polls `outbox_messages` with `FOR UPDATE SKIP LOCKED`, dispatches through `IEventBus`, and handles retry / dead-letter. |
+| **Demand-Gated Building Block** | An infrastructure choice that ships as a **port plus a working default implementation** now, and as a **vendor adapter later**, in a named phase, when a written trigger fires. It qualifies only when all four exist: the port, the default implementation, the owning phase, and the trigger condition. A block missing any of the four is not demand-gated — it is simply missing. Distinguished from a one-way door by the test below. The gated set and each trigger are tabulated in [ADR-0035](decisions/0035-demand-gated-infrastructure.md), which also names its own two exceptions — `audit_log` partitioning, which is schema-internal and so has no port, and LiveKit, which has no default because its absence is a missing product feature rather than a missing implementation. |
+| **One-Way Door** | A decision that gets more expensive with every week of delay, tested by the question: *if I add this six months from now, will I have to touch code that is already written?* **Yes → one-way door; ship it now** (tenant and organization isolation, the `outbox_messages` table and its ownership, strongly-typed identifiers, the localization schema — each touches every query, migration, or job payload ever written). **No → additive; ship the port now and the adapter on demand.** The test is mechanical, not a matter of taste: tenant isolation's cost grows with the codebase, a Dapr adapter's cost does not. A corollary rule: **a deployment mode or customer segment without a signed contract cannot be the deciding factor in a technical choice** — it may break a tie between otherwise-equal options, nothing more. Per [ADR-0035](decisions/0035-demand-gated-infrastructure.md) and [Engineering Principles](standards/00-principles.md). |
+| **Dapr Building Blocks** | The three Dapr abstractions LearnStack uses **when it uses Dapr**: pub/sub (Kafka), state (Valkey), secrets (Vault) per [ADR-0014](decisions/0014-adopt-dapr.md). Service invocation, workflow, bindings, and actors are out of scope. Demand-gated to [Phase 11](roadmap/phase-11-production-hardening.md); ADR-0014 decides *what*, [ADR-0035](decisions/0035-demand-gated-infrastructure.md) decides *when*. |
+| **`IEventBus`** | Interface for publishing integration events, taking an explicit `partitionKey`. `InProcessEventBus` is the only registered implementation until the Dapr adapter's trigger fires — and it is a **first-class transport, not a stub**: same `IIntegrationEventHandler<T>`, same `IInboxGuard`, same tenant-context restoration, same per-partition-key ordering as the durable path. The `OutboxProcessor` is the only sanctioned caller. |
+| **`ICacheService`** | Interface for cache reads / writes. `InMemoryCacheService` today; a Valkey-backed implementation when more than one instance runs concurrently. Cache keys carry a `{tenant_id}` prefix. `RemoveByPrefixAsync` is removed or redesigned to a **generation-key** pattern before Phase 02a Packet 5 ships — the published contract iterates an instance-local key set and cannot be honoured across instances by any candidate backend. |
+| **`ISecretProvider`** | Interface for secret reads. `ConfigurationSecretProvider` today; the Vault-backed implementation when secrets must rotate without a redeploy or a non-development deployment exists. Secret namespace `learnstack/{deployment}/{module}/{key}`. |
+| **`IEntitlementProvider`** | Interface for the Entitlement Projection source. Implementations: `NullEntitlementProvider` (Development only — all features enabled, no limits), `HubEntitlementProvider` (SaaS / Dedicated, from Phase 02c), `SignedLicenseKeyEntitlementProvider` (Self-Hosted; skeleton from Hub `P02c-6`, hardened in Phase 11). The Hub-backed provider resolves in the normative order `L1 → L2 → platform_entitlement_cache → Hub` and never throws out of a feature-flag check. |
+| **`IHostToTenantResolver`** | Interface for host → `(tenant_id, organization_id?)` resolution. Reads `platform_host_to_tenant` and **nothing else** — never the Hub, because an anonymous page load must not depend on a control plane being reachable ([ADR-0034](decisions/0034-hub-contract-surface-invariant.md)). |
+| **APISIX** | The gateway in standalone YAML-reload mode per [ADR-0015](decisions/0015-api-gateway-apisix.md). The intended tenant-facing ingress, demand-gated to [Phase 11](roadmap/phase-11-production-hardening.md); until then ASP.NET middleware carries the same responsibilities in-process. `/api/internal/*` is never proxied by it — that listener is mTLS-only inside the pod. |
+| **`OutboxProcessor`** | The BackgroundService that **claims** batches of `outbox_messages` by writing a lease (`locked_by` / `locked_until`) under `FOR UPDATE SKIP LOCKED`, dispatches each through `IEventBus`, and handles retry / dead-letter. The lease is written to the row rather than held in the transaction, because `FOR UPDATE` locks end when the transaction ends. Delivery is **at-least-once**; consumer-side `IInboxGuard` is what makes duplicates safe. See [15-event-and-outbox.md](architecture/15-event-and-outbox.md). |
 | **`IInboxGuard`** | The per-module inbox-deduplication helper. Every integration-event handler must call `IsAlreadyProcessedAsync` before business logic and `MarkAsProcessed` inside the same SaveChanges. |
 | **`DeploymentMode`** | Enum (`Development \| SaaS \| Dedicated \| SelfHostedOnline \| SelfHostedAirGapped`) read at the composition root to select provider implementations. Modules never read this enum. |
 
@@ -287,12 +294,11 @@ This glossary defines LearnStack-specific terms. When a term is ambiguous across
 |------|------------|
 | **Plan (Hub-side)** | The plan catalog entry owned by `learnstack-hub`. Carries default features, limits, compliance caps. |
 | **HubSubscription** | A per-tenant binding to a `Plan`. Has lifecycle state (trial / active / cancelled / grace / suspended). |
-| **Entitlement (Hub-side)** | The effective feature + limit + compliance set for a tenant — the snapshot Hub pushes to LearnStack core via `PUT /api/internal/tenants/{id}/entitlements`. |
 | **License Key** | An RSA-2048 signed `.lic` file issued by Hub for Self-Hosted deployments. Carries claims (`tenant_id`, `plan_code`, `features`, `limits`, `valid_until`, …) and a signature. See [ADR-0020](decisions/0020-triple-deployment-hybrid-license.md). |
 | **Phone-Home** | The 24h verify call a Self-Hosted instance makes against Hub's `POST /api/v1/internal/license/verify`. Optional; can be disabled for air-gapped operation. |
-| **Grace Period** | The 30-day window during which a Self-Hosted instance keeps operating after the last successful phone-home. |
-| **Platform Entitlement Cache** | The `platform_entitlement_cache` table in LearnStack core — the read-only mirror of Hub's `Entitlement`. 15-min TTL upper bound, eager-invalidated on `learnstack.hub.entitlement` Dapr event. |
-| **Operator Portal** | `learnstack-hub-web` — the separate Next.js app for Hub operators. Authenticates against the `learnstack-hub` Keycloak realm. |
+| **Grace Period** | The 30-day window during which an instance keeps operating after the last successful phone-home. Bounded by `grace_until` in the **durable** `platform_entitlement_cache` row — never by a cache TTL. Collapsing the two makes the advertised 30 days into 15 minutes; see [26-hybrid-license-model.md § 5](architecture/26-hybrid-license-model.md). |
+| **Platform Entitlement Cache** | The `platform_entitlement_cache` table in LearnStack core — the **durable** read-only mirror of the Hub-side Entitlement Aggregate, carrying `valid_until` and `grace_until`. Despite the name it is a projection store, not a cache: the volatile layers are L1 and L2 in front of it. Third in the normative read path `L1 → L2 → platform_entitlement_cache → Hub` ([ADR-0034](decisions/0034-hub-contract-surface-invariant.md)). Eager-invalidated on the entitlement-updated event; modules never read the table directly (`Modules_Do_Not_Read_Entitlement_Cache_Directly`). |
+| **Operator Portal** | `operator-portal` — the separate Next.js app for Hub operators. Authenticates against the `learnstack-hub` Keycloak realm. |
 
 ## Roadmap & Delivery
 
@@ -301,6 +307,7 @@ This glossary defines LearnStack-specific terms. When a term is ambiguous across
 | **Phase** | A roadmap-level milestone with its own `phase-NN-topic.md` file under `docs/roadmap/`. Phases are numbered, sometimes letter-suffixed (`02a` / `02b` / `02c`) when sub-streams ship in parallel or in sequence. Each phase doc carries its own `## Phase Exit Decision` section spelling out the gate that closes the phase. |
 | **Packet** | A dependency-ordered shipping slice **within** a phase, sized to be independently reviewable in one pull request. Packet numbering restarts per phase (`P02a-0`, `P02a-1`, …); the canonical reference shape is `P<PhaseId>-<PacketIndex>` (so the kickoff packet of Phase 02a is `P02a-0`). Commit and PR titles use the prose form (`feat(phase-02a): packet 0 — kickoff`). A packet may ship documentation only (e.g. a kickoff packet that defines the breakdown), decisions only (an ADR move from Draft to Accepted), code only, or any combination — but always one phase's worth of progress, no cross-phase bundling. Per-phase packet history lives in the phase doc's Status block (see [phase-01-repository-tooling.md](roadmap/phase-01-repository-tooling.md) for the canonical shape). |
 | **Kickoff Packet** | The first packet of a phase when that phase is large enough to need an explicit plan up front. A kickoff packet ships only the per-packet breakdown for its phase plus any glossary / cross-reference updates the breakdown depends on; no code. Phase 01 did not need one (packets fell out cleanly from the existing scaffold targets); Phase 02a does (the foundation surface is wide). |
+| **Walking Skeleton** | A **thin vertical slice through every layer** that produces a working, browser-visible artefact as early as the foundation allows — deliberately shallow in features and complete in path. LearnStack's is [Phase 02d](roadmap/phase-02d-walking-skeleton.md): two hosts, two tenants in unrelated domains, `Course` + `Lesson`, two read endpoints, two public pages, one binary, one database, one schema. Its purpose is evidence, not features: it moves the platform's single most testable claim — that the same code paths serve unrelated education domains — from an assertion five phases away to something a non-engineer can check in a browser. Each capability it touches is delivered shallowly there and completely in its owning phase, and each owning phase records what the skeleton already shipped so no work is claimed twice. The exit gate is a browser, not a feature set: a change that does not move a pixel on one of the two pages belongs to its owning phase. |
 
 ## Conventions
 
diff --git a/docs/roadmap/README.md b/docs/roadmap/README.md
index 0490551..5a01154 100644
--- a/docs/roadmap/README.md
+++ b/docs/roadmap/README.md
@@ -1,26 +1,51 @@
 # LearnStack Roadmap
 
 This roadmap describes how LearnStack evolves from an architecture concept into a
-multi-tenant core platform for building education products.
+white-label platform for multi-branch education businesses that teach live.
 
 LearnStack is not a single LMS implementation. It is an education-aware CMS, learning
 engine, and platform foundation that powers multiple brands, landing pages, catalogs,
-portals, and **domain-agnostic** education products — yoga studios, coding bootcamps,
-music schools, driving schools, and language platforms all run on the same code paths
-with different **tenant customization data** ([ADR-0018](../decisions/0018-tenant-driven-customization-model.md)).
+portals, and education products across domains — language schools, yoga studios, music
+schools, coding bootcamps — on the same code paths, differing only in **tenant
+customization data** ([ADR-0018](../decisions/0018-tenant-driven-customization-model.md)).
+That claim has a stated edge: see
+[Platform Vision § Genericity boundary](../architecture/01-platform-vision.md).
 
-The roadmap also includes the **`learnstack-hub`** companion (separate repository, see
-[ADR-0019](../decisions/0019-learnstack-hub.md)) that ships in parallel from Phase 02c
-onward and provides the SaaS / Dedicated control plane.
+The roadmap also references the **`learnstack-hub`** companion (separate repository, see
+[ADR-0019](../decisions/0019-learnstack-hub.md)). Hub's own plan lives in **its own
+repository** at `../LearnStack-Hub/docs/roadmap/`; the phases here cover only LearnStack's
+side of the boundary.
+
+## Sequencing principle
+
+Two kinds of decision, two treatments — the **one-way-door test** from
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md):
+
+> If I add this six months from now, will I have to touch code that is already written?
+
+**Yes → ship it now.** Tenant and organization isolation, the `outbox_messages` table
+and its ownership, strongly-typed identifiers, the localization schema. Adding these
+later means touching every query, every migration, every job payload.
+
+**No → ship the port now, the adapter on demand.** Dapr, Kafka, APISIX, Vault, the Hub
+integration, signed licence keys, custom-domain TLS automation, `audit_log`
+partitioning. Each has a port in `LearnStack.SharedKernel`, a working default
+implementation, an owning phase, and a written trigger condition. None of them blocks a
+user-visible artefact.
+
+The second consequence of that principle is **Phase 02d**: a two-tenant vertical slice
+that puts a working education site in a browser immediately after the kernel is sound,
+rather than five phases later. Genericity is proven continuously from Phase 02d onward,
+not deferred to the showcase phase.
 
 ## Phases
 
-- [Phase 00: Product Strategy and Architecture Definition](phase-00-product-architecture.md)
-- [Phase 01: Repository, Tooling, and Local Infrastructure](phase-01-repository-tooling.md)
-- [Phase 02a: Platform Kernel, Multi-Tenancy, Organization, and Foundation Sockets](phase-02a-kernel-tenancy.md)
-- [Phase 02b: Events, Outbox, and Identity Integration](phase-02b-events-auth.md)
-- [Phase 02c: LearnStack Hub Foundation (parallel track)](phase-02c-hub-foundation.md)
-- [Phase 03: Identity, Authorization, and Admin Foundation](phase-03-identity-admin.md)
+- [Phase 00: Product Strategy and Architecture Definition](phase-00-product-architecture.md) — **complete**
+- [Phase 01: Repository, Tooling, and Local Infrastructure](phase-01-repository-tooling.md) — **complete**
+- [Phase 02a: Platform Kernel, Multi-Tenancy, Organization, and Foundation Sockets](phase-02a-kernel-tenancy.md) — **in progress** (packets 0–3 shipped)
+- [Phase 02d: Two-Tenant Walking Skeleton](phase-02d-walking-skeleton.md)
+- [Phase 02b: Identity Integration, Session, and Events](phase-02b-events-auth.md)
+- [Phase 03: Identity Domain, Authorization, and Admin Foundation](phase-03-identity-admin.md)
 - [Phase 04: Headless CMS, Page Builder, and Media Library](phase-04-cms-media-pages.md)
 - [Phase 05: Education Catalog and Learning Content](phase-05-education-learning-content.md)
 - [Phase 06: Public Site Renderer and Admin Studio](phase-06-renderer-admin-studio.md)
@@ -29,101 +54,157 @@ onward and provides the SaaS / Dedicated control plane.
 - [Phase 08b: Scheduling and Booking](phase-08b-scheduling.md)
 - [Phase 08c: In-App Live Classroom](phase-08c-classroom.md)
 - [Phase 09: Billing, Integrations, and Analytics](phase-09-billing-integrations-analytics.md)
-- [Phase 09b: Hub Billing and Invoicing (parallel track)](phase-09b-hub-billing.md)
-- [Phase 10: First Tenant Customization Showcase (online English education)](phase-10-english-learning-mvp.md)
+- [Phase 10: Tenant Customization Showcase (online English education)](phase-10-english-learning-mvp.md)
 - [Phase 11: Production Hardening, Operations, and Scale](phase-11-production-hardening.md)
-- [Phase 12: Hub Marketplace (optional, post-MVP)](phase-12-hub-marketplace.md)
+
+**Hub-side tracks.** These phases hold LearnStack's side of the boundary and point at
+the Hub repository for the rest:
+
+- [Phase 02c: Hub Integration — LearnStack side](phase-02c-hub-foundation.md)
+- [Phase 09b: Hub Billing](phase-09b-hub-billing.md) — pointer; the plan lives in the Hub repository
+- [Phase 12: Hub Marketplace](phase-12-hub-marketplace.md) — pointer; post-MVP, optional
+
+> **Identifier note.** Phase identifiers are stable and load-bearing: they appear in
+> commit messages, branch names, pull requests, architecture-test registrations, and
+> across both repositories. `02d` was added after `02b` and `02c` already existed, so it
+> sorts last alphabetically while running **before** them in dependency order. The
+> dependency map below is authoritative for order; filename order is not.
 
 ## Phase Dependency Map
 
 ```mermaid
 flowchart TB
     p00[Phase 00<br/>Strategy]
-    p01[Phase 01<br/>Repo+Tooling]
-    p02a[Phase 02a<br/>Kernel+Tenancy+Org+Sockets]
-    p02b[Phase 02b<br/>Events+Auth]
-    p02c[Phase 02c<br/>Hub Foundation]
-    p03[Phase 03<br/>Identity Domain]
-    p04[Phase 04<br/>CMS+Media]
-    p05[Phase 05<br/>Catalog+Learning]
-    p06[Phase 06<br/>Renderer+Studio]
-    p07[Phase 07<br/>Enrollment+Portal]
-    p08a[Phase 08a<br/>Assessment+Notif]
+    p01[Phase 01<br/>Repo + Tooling]
+    p02a[Phase 02a<br/>Kernel + Tenancy + Org + Sockets]
+    p02d[Phase 02d<br/>Two-Tenant Walking Skeleton]
+    p02b[Phase 02b<br/>Identity Integration + Events]
+    p02c[Phase 02c<br/>Hub Integration]
+    p03[Phase 03<br/>Identity Domain + RBAC]
+    p04[Phase 04<br/>CMS + Media]
+    p05[Phase 05<br/>Catalog + Learning]
+    p06[Phase 06<br/>Renderer + Studio]
+    p07[Phase 07<br/>Enrollment + Portal]
+    p08a[Phase 08a<br/>Assessment + Notifications]
     p08b[Phase 08b<br/>Scheduling]
     p08c[Phase 08c<br/>Classroom]
-    p09[Phase 09<br/>Billing+Integrations]
-    p09b[Phase 09b<br/>Hub Billing]
+    p09[Phase 09<br/>Billing + Integrations]
     p10[Phase 10<br/>Tenant Showcase]
-    p11[Phase 11<br/>Production]
-    p12[Phase 12<br/>Hub Marketplace]
-
-    p00 --> p01 --> p02a
-    p02a --> p02b
-    p02a --> p02c
-    p02b --> p03
-    p02c -. parallel .-> p02b
-    p03 --> p04 --> p05 --> p06
-    p06 --> p07 --> p08a --> p08b --> p08c
-    p08c --> p09
-    p09 --> p10
-    p09 -. parallel .-> p09b
-    p10 --> p11
-    p11 -. optional .-> p12
+    p11[Phase 11<br/>Production + Demand-Gated Adapters]
+
+    p00 --> p01 --> p02a --> p02d --> p02b --> p03 --> p04 --> p05 --> p06
+    p06 --> p07 --> p08a --> p08b --> p08c --> p09 --> p10 --> p11
+    p02b -. unblocks .-> p02c
+    p02c -. parallel, non-blocking .-> p11
 ```
 
-## Parallel Tracks
+**Reading the map.** The spine is the critical path. Phase 02c hangs off it rather than
+sitting in it: LearnStack runs on `NullEntitlementProvider` until a tenant must be
+billed or plan-gated, which is the trigger condition
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md) records for it.
 
-| Track | Runs alongside | Why |
-|-------|----------------|-----|
-| Phase 02c (Hub Foundation) | Phase 02b | Both depend only on Phase 02a sockets. Splitting reduces calendar time. |
-| Phase 09b (Hub Billing) | Phase 09 | Hub-side billing aggregates evolve on their own cadence; LearnStack-side storefront billing is unblocked. |
-| Phase 12 (Hub Marketplace) | Post-MVP | Optional; not on the MVP critical path. |
+## Parallel and Demand-Gated Tracks
 
-## Roadmap Logic
+| Track | Relationship to the spine | Trigger |
+|---|---|---|
+| Phase 02c — Hub Integration | Parallel from Phase 02b onward; never blocks | A tenant must be billed or plan-gated |
+| Hub repository work (`P02c-*`) | Independent repository, own cadence | See `../LearnStack-Hub/docs/roadmap/` |
+| Phase 09b — Hub Billing | Pointer; the plan lives in the Hub repository | Commercial billing needed |
+| Phase 12 — Hub Marketplace | Pointer; post-MVP, optional | Product-market evidence |
+| Demand-gated adapters (Dapr, Kafka, APISIX, Vault, licence keys, custom-domain TLS, `audit_log` partitioning) | Land in Phase 11 unless their trigger fires earlier | Per the table in [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) |
+
+A demand-gated item is not "deferred". It has a port, a working default implementation,
+an owning phase, and a trigger condition — all four written down. If a trigger fires
+early, the item moves to the phase where it fired and ADR-0035's table is amended.
 
-The first goal is to build a reliable platform core:
+## Roadmap Logic
 
-- The tenant + organization + domain model must be correct from the beginning
-  ([ADR-0017](../decisions/0017-tenant-organization-hierarchy.md)).
-- The foundation building blocks (Dapr, APISIX, audit infrastructure, customization
-  runtime, entitlement socket, host resolver) ship Day 1, not as Phase-11 cleanup.
-- The modular monolith boundaries must remain clear; architecture tests enforce them
-  from Phase 02a.
-- CMS and education catalog capabilities must work together with tenant-defined
-  content types, blocks, lesson items, taxonomies, and scoring/completion rules
+The first goal is a platform core that is **correct where correctness is expensive to
+retrofit**, and **thin where it is not**:
+
+- The tenant + organization + domain model is correct from the beginning
+  ([ADR-0017](../decisions/0017-tenant-organization-hierarchy.md)), and its Row Level
+  Security implementation is the corrected template in
+  [ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md) —
+  one `AND`-ed policy, `FORCE ROW LEVEL SECURITY`, an explicit `WITH CHECK`, and a
+  non-owning application role. Isolation tests run as that role, because a test that
+  runs as the owner passes even when every policy is inert.
+- MUST-class audit is durable from the first command
+  ([ADR-0033](../decisions/0033-audit-durability-model.md)). Audit correctness cannot be
+  added later; audit *scale* can, and is.
+- Module boundaries stay clear; architecture tests enforce them from Phase 02a,
+  including `Core_Modules_HaveNo_DomainSpecific_Names` — the mechanical guarantee behind
+  the platform's entire premise.
+- CMS and education catalog capabilities work together against tenant-defined content
+  types, blocks, lesson items, taxonomies, and scoring / completion rules
   ([ADR-0018](../decisions/0018-tenant-driven-customization-model.md)).
-- Public site, admin studio, and learner portal experiences are powered by the same
-  core platform — and so are arbitrarily-domained tenants (yoga, coding, music, …)
-  without code changes.
-- Live online classes happen inside the product experience through a provider-agnostic
-  classroom layer.
-- **No vertical packs.** The "English learning vertical" is not a code module — it is
-  the first tenant customization data set, exercised in Phase 10 to prove the
-  substrate is generic.
-- The LearnStack Hub ships in parallel as a separate repository, providing SaaS /
-  Dedicated control-plane functionality and feeding the entitlement projection.
+- Public site, admin studio, and learner portal are powered by the same core — and so
+  are tenants in unrelated domains, without code changes. **Two tenants exist from
+  Phase 02a Packet 7 onward**, so every subsequent phase is tested against the
+  genericity claim rather than assuming it.
+- Live online classes happen inside the product through a provider-agnostic classroom
+  layer.
+- **No vertical packs.** The English-learning showcase is not a code module; it is the
+  first tenant customization data set, exercised in depth in Phase 10.
+- The control plane is a companion, not a prerequisite.
+
+## Phase Structure
+
+Every phase document carries the same six sections, with three declared exceptions
+noted below the table:
+
+| Section | What it answers |
+|---|---|
+| `## Goal` | Why this phase exists, in a few sentences |
+| `## Scope` | What is built, grouped by subsystem |
+| `## Deliverables` | What exists at the end that did not exist at the start |
+| `## Completion Criteria` | Observable statements a reviewer can check |
+| `## Risks` | What tends to go wrong here, and the mitigation |
+| `## Phase Exit Decision` | The gate: what must be true before the next phase begins |
+
+Three exceptions, all deliberate:
+
+- [Phase 09b](phase-09b-hub-billing.md) and [Phase 12](phase-12-hub-marketplace.md) are
+  **pointer documents** into the `learnstack-hub` repository, which owns their plan.
+  They carry Goal, Scope on the LearnStack side, Trigger and Phase Exit Decision only;
+  Deliverables, Completion Criteria and Risks live in the Hub's own roadmap. Restating
+  them here would duplicate a plan this repository does not own.
+- [Phase 01](phase-01-repository-tooling.md) predates the `## Phase Exit Decision`
+  convention and carries `## Technical Notes` instead. Its annotation block records
+  this; it is not a gap to fill.
+
+Phases in progress additionally carry a dated `> **Status**` block at the top, listing
+packets and their state. A **packet** is an independently reviewable, independently
+mergeable slice with its own pull request; see [Glossary](../glossary.md).
+
+The roadmap deliberately carries **no effort estimates, owners, or timeboxes**. It is a
+dependency and scope plan; sequencing decisions belong here, capacity decisions do not.
 
 ## Success Criteria
 
-At the end of this roadmap, LearnStack should be able to:
+At the end of this roadmap, LearnStack can:
 
-- Provision a new tenant (via Hub for SaaS / Dedicated, CLI for Self-Hosted) with at
-  least one default organization.
-- Load tenant customization data (content types, page blocks, lesson item types,
-  level taxonomy, scoring rules, completion rules, custom fields, templates) and
-  render the tenant's product entirely from that data.
-- Publish tenant-specific landing pages, navigation, course catalogs, and course
-  detail pages.
+- Provision a tenant with at least one default organization — through the Hub for
+  SaaS / Dedicated, through the CLI for Self-Hosted.
+- Load tenant customization data (content types, page blocks, lesson item types, level
+  taxonomy, scoring rules, completion rules, custom fields, templates) and render the
+  tenant's product entirely from that data.
+- Publish tenant-specific landing pages, navigation, course catalogs, and course detail
+  pages.
 - Manage courses, modules, lessons, and learning materials.
-- Grant learner access to courses (Enrollment-side entitlement) gated by the tenant's
-  Hub-side plan entitlement.
-- Track learner progress (with completion semantics defined by the tenant's
-  `TenantCompletionRule`).
+- Grant learner access to courses, gated by the tenant's plan entitlement where a plan
+  exists.
+- Track learner progress, with completion semantics defined by the tenant's
+  `TenantCompletionRule`.
 - Run quiz and placement-test flows scored by the tenant's `TenantScoringRule`.
 - Run in-app live online classes with scheduling, attendance, classroom events,
   recording consent, and recording metadata.
-- Extend payment, notifications, search, storage, analytics, and live classroom
+- Extend payment, notifications, search, storage, analytics, and live-classroom
   providers through adapters.
 - Run with `NullEntitlementProvider` (no Hub), `HubEntitlementProvider` (SaaS /
   Dedicated), or `SignedLicenseKeyEntitlementProvider` (Self-Hosted, air-gappable)
-  without code changes — only `DeploymentMode` configuration.
+  without code changes — only `DeploymentMode` configuration. `Development` and `SaaS`
+  are wired end to end **today**; `Dedicated`, `SelfHostedOnline` and
+  `SelfHostedAirGapped` are **prepared seams, not supported deployments**, until
+  [Phase 11](phase-11-production-hardening.md) builds their adapters and integration
+  suites ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)).
diff --git a/docs/roadmap/phase-00-product-architecture.md b/docs/roadmap/phase-00-product-architecture.md
index 0fa8772..75029ec 100644
--- a/docs/roadmap/phase-00-product-architecture.md
+++ b/docs/roadmap/phase-00-product-architecture.md
@@ -8,6 +8,22 @@
 > **tenant customization data**. Read "vertical product" as "tenant" throughout this
 > document. The deliverables list is accurate; the rationale is preserved for
 > historical context.
+>
+> **Two later corrections (2026-08-08).** Neither reopens this phase.
+>
+> - § Key Questions says a second non-English tenant "runs in parallel" with Phase 10.
+>   It does not — it moved forward. The second tenant (a **yoga studio**) is seeded in
+>   [Phase 02a Packet 7](phase-02a-kernel-tenancy.md) and rendered in a browser from
+>   [Phase 02d](phase-02d-walking-skeleton.md), so the substrate-genericity claim is
+>   tested continuously rather than at MVP exit.
+>   [Phase 10](phase-10-english-learning-mvp.md) is now a **depth** showcase: it
+>   exercises every customization aggregate against one real tenant.
+> - § Risks lists "code-challenge" among the domain shapes that must not be hardcoded.
+>   That instinct was right and the boundary is now explicit: per
+>   [ADR-0018's genericity-boundary amendment](../decisions/0018-tenant-driven-customization-model.md),
+>   running a learner's submitted code is **not** expressible as tenant data at all —
+>   external capability invocation is a plan-gated platform feature LearnStack writes.
+>   See [Platform Vision § Genericity boundary](../architecture/01-platform-vision.md).
 
 ## Goal
 
diff --git a/docs/roadmap/phase-01-repository-tooling.md b/docs/roadmap/phase-01-repository-tooling.md
index 6a7d20c..dc87849 100644
--- a/docs/roadmap/phase-01-repository-tooling.md
+++ b/docs/roadmap/phase-01-repository-tooling.md
@@ -86,6 +86,65 @@
 > (required-check names, approval count, signed-commits posture) live in
 > `.github/CONTRIBUTING.md` so GitHub Settings matches the corpus.
 
+> ---
+>
+> ## What changed after this phase closed (2026-08-08)
+>
+> **This phase is complete and its record above is unchanged.** The notes below
+> exist because a four-audit review on 2026-08-08 restructured the roadmap, and
+> several statements in this document were true when written but are no longer
+> the plan. Read this block before acting on anything below it.
+>
+> Nothing here reopens Phase 01. Every item names the packet or phase that owns
+> it now.
+>
+> ### Claims in this document that are no longer accurate
+>
+> | Where | What it says | What is true now |
+> |---|---|---|
+> | § Frontend Scaffold | The operator portal is `learnstack-hub-web` | The app is **`operator-portal`** (`frontend/apps/operator-portal` in the Hub repository, asserted by its `Frontend_Has_Only_The_OperatorPortal_App` test). The name was renamed corpus-wide; this line is left as the historical record |
+> | § Deliverables | "`make seed` populating two demo tenants + one platform admin user" | `scripts/seed.sh` seeds **Keycloak identity only**. Application-level tenant seeding was always a documented drop-in for Phase 02a, and now lands in [Packet 7](phase-02a-kernel-tenancy.md) with two tenants — an English school and a **yoga studio** |
+> | § Completion Criteria | "CI passes on `main`" | True, but the frontend job passes with **zero tests** (`vitest run --passWithNoTests` against no test files). [Packet 3b](phase-02a-kernel-tenancy.md) makes a zero test count a failure; the first real tests arrive with [Phase 02d](phase-02d-walking-skeleton.md) |
+> | § Local Infrastructure | The 14-service compose stack is the development environment | Per [ADR-0035](../decisions/0035-demand-gated-infrastructure.md), **Dapr, Kafka, APISIX and Vault move behind a non-default compose profile** in [Packet 5](phase-02a-kernel-tenancy.md). Their ports ship with in-process defaults; the adapters land in [Phase 11](phase-11-production-hardening.md) against written triggers. The daily loop runs roughly seven services |
+> | § CI Baseline | OpenAPI diff activates in Phase 03; Lighthouse in Phase 04 | Both move earlier: [Phase 02d](phase-02d-walking-skeleton.md) ships the first real `/api/v1/*` endpoints **and** the first content-bearing public pages |
+> | § CI Baseline | Integration tests activate "in Phase 02a" | More precisely: [Packet 7](phase-02a-kernel-tenancy.md), when the first cross-tenant isolation test lands. The `if: false` placeholder is removed there |
+>
+> ### Known defects this phase shipped with, and where they are fixed
+>
+> All of these are remediated in **[Phase 02a Packet 3b](phase-02a-kernel-tenancy.md)**,
+> which exists precisely so that Phase 01's record does not have to be rewritten:
+>
+> - `make seed`'s health gate requires every compose service to report healthy, but
+>   `coturn`, `dapr-placement` and `dapr-sidecar-api` declare no healthcheck — so the
+>   gate times out and the script exits non-zero on **every** run. This is step three of
+>   the quickstart.
+> - `infra/compose/e2e.yml` leaves Valkey on its named volume, so cache and rate-limit
+>   state leaks between runs; and its `volumes: !reset []` discards the PostgreSQL init
+>   script and the SeaweedFS S3 identity file.
+> - `infra/dapr/components/secretstore-vault.yaml` sets `vaultKVPrefix: secret`, which
+>   resolves reads to `secret/data/secret/<key>` rather than the documented
+>   `secret/learnstack/<area>` layout.
+> - Every published port in `infra/compose/dev.yml` binds `0.0.0.0` with committed
+>   development credentials, and `MEILI_MASTER_KEY` is hardcoded rather than read from
+>   the environment.
+> - Branch protection requires four checks but **zero approvals** and does not enforce
+>   for administrators, which does not match
+>   [Git Workflow Standards](../standards/14-git-workflow.md). The setting and the
+>   standard must agree; a security rule that differs from the live platform setting
+>   makes a green build look stronger than it is.
+>
+> ### Conventions introduced after this phase
+>
+> - Every phase document now carries a **`## Phase Exit Decision`** section. This
+>   document predates that convention and does not have one; its exit was the Status
+>   block above. Do not treat its absence as an omission to fix here.
+> - The phase order changed. [Phase 02d](phase-02d-walking-skeleton.md) — a two-tenant
+>   walking skeleton — now follows Phase 02a and precedes Phase 02b. The
+>   [roadmap README](README.md) dependency map is authoritative for order; filename
+>   order is not.
+>
+> ---
+
 ## Goal
 
 Create a development environment that is repeatable, maintainable, and ready to grow. This phase establishes the project structure, local infrastructure, CI, and engineering workflow. It does not focus on product features.
diff --git a/docs/roadmap/phase-02a-kernel-tenancy.md b/docs/roadmap/phase-02a-kernel-tenancy.md
index 15ea4c0..519ffcf 100644
--- a/docs/roadmap/phase-02a-kernel-tenancy.md
+++ b/docs/roadmap/phase-02a-kernel-tenancy.md
@@ -1,571 +1,492 @@
 # Phase 02a: Platform Kernel, Multi-Tenancy, Organization, and Foundation Sockets
 
-> **Status (2026-05-20).** Phase 02a in progress. Packet 0 (kickoff) ships the
-> breakdown plan; subsequent packets ship the foundation incrementally. Each
-> packet is independently reviewable in its own commit, matching the
-> [Phase 01 cadence](phase-01-repository-tooling.md).
+> **Status (2026-08-09).** Phase 02a in progress. Packets 0–3 shipped; the 2026-08-08
+> restructure re-scoped packets 4–10 and added packet 3b. Each packet is independently
+> reviewable in its own commit, matching the
+> [Phase 01 cadence](phase-01-repository-tooling.md). The order is dependency-driven: a
+> later packet may consume any earlier packet's deliverables, never the reverse.
 >
-> The packet order is dependency-driven: a later packet may consume any earlier
-> packet's deliverables, but never the reverse. Packets land sequentially on
-> `main` via their own pull request.
+> | Packet | Title | State |
+> |---|---|---|
+> | 0 | Kickoff | ✅ [record](#delivery-record-packets-03) |
+> | 1 | Foundation decisions | ✅ [record](#delivery-record-packets-03) |
+> | 2 | Shared Kernel core | ✅ [record](#delivery-record-packets-03) |
+> | 3 | Cross-cutting foundation | ✅ [record](#delivery-record-packets-03) |
+> | 3b | Decision repair | ⏳ [scope](#packet-sequence) |
+> | 4 | API conventions | ⏳ [scope](#packet-sequence) |
+> | 5 | Foundation ports and default implementations | ⏳ [scope](#packet-sequence) |
+> | 6 | Tenancy schema and the corrected RLS template | ⏳ [scope](#packet-sequence) |
+> | 7 | Tenant and organization resolution, isolation, two tenants | ⏳ [scope](#packet-sequence) |
+> | 8 | Tenant Customization foundation | ⏳ [scope](#packet-sequence) |
+> | 9 | Audit infrastructure and the entitlement socket | ⏳ [scope](#packet-sequence) |
+> | 10 | Architecture tests green and phase exit | ⏳ [scope](#packet-sequence) |
 >
-> **Packet 0 — Kickoff ✅ (this commit)**
-> Phase 02a packet breakdown captured in this Status block. Glossary
-> entries for "Phase", "Packet", and "Kickoff Packet" added under a new
-> *Roadmap & Delivery* group so the terms are defined in exactly one
-> place. No code, no ADR state changes — Packet 0 is a planning slice
-> that unblocks the rest of the phase by fixing the order.
->
-> **Packet 1 — Foundation decisions ✅**
-> The three Phase-02a-blocking ADRs are now Accepted:
-> [ADR-0023](../decisions/0023-strongly-typed-id-source-generator.md)
-> picks **Vogen** as the source generator for both IDs and value objects;
-> [ADR-0024](../decisions/0024-api-versioning-policy.md) codifies
-> URL-based versioning with a **6-month deprecation window** + RFC 8594
-> `Sunset` / `Deprecation` headers + OpenAPI `x-sunset` extensions;
-> [ADR-0028](../decisions/0028-audit-log-partition-management.md) picks
-> a **Hangfire recurring job** (`learnstack:audit:partition-management`)
-> over `pg_partman` to keep the SelfHostedAirGapped story extension-free.
-> Decision-only; no code. Standards 02 § Strongly-Typed Identifiers and
-> Standards 04 § Versioning cross-link to the new ADRs.
->
-> **Packet 2 — Shared Kernel core ✅**
-> `IClock` + `SystemClock` / `FixedClock`, `IRandom` + `SystemRandom` /
-> `FixedRandom`, `IGuidFactory` + `SystemGuidFactory` / `FixedGuidFactory`
-> (deterministic-test abstractions per Standards 02 § Time);
-> `LocalizedMessage` carrying the `lockey_` prefix invariant at the
-> constructor (used by every `Result.Fail` and success-message payload);
-> `Error` refactored to wrap `LocalizedMessage` with a `Code` projection
-> over `Message.Key`; `Result<T>` extended with `IResultBase`, success-message
-> overload, and the static `Result.FailFor<T>(error)` factory ADR-0032's
-> `ValidationBehavior` consumes; `Entity<TId>` (append-only / audit
-> aggregate base) + `AuditableEntity<TId>` (mutable aggregate base with
-> `CreatedAt` / `CreatedBy` / `UpdatedAt` / `UpdatedBy` / `DeletedAt` /
-> `DeletedBy` / `Version` plus the `IsDeleted` projection);
-> `ISoftDelete` + `IOptimisticConcurrency` marker interfaces;
-> `IDomainEvent : INotification` + `DomainEvent` base + `IHasDomainEvents`
-> aggregate-side collector; cursor-first pagination
-> (`CursorPagination` / `Page<T>` / `PageInfo` matching Standards 04
-> § Pagination). Vogen 7.0.0 wired per ADR-0023 with
-> `LearnStackVogenDefaults.IdMask` carrying the canonical
-> `EfCoreValueConverter | SystemTextJson | TypeConverter` mask;
-> `IAggregateRoot<TId>` / `IHasId<TId>` interfaces require `TId :
-> IStronglyTypedId<Guid>` so future module aggregates inherit the
-> constraint. Unit / architecture / contract suites all green in CI; the
-> `VogenIdEmissionTests` smoke test asserts the emitter pipeline
-> (Vogen `[ValueObject<Guid>]` → `IStronglyTypedId.Value` → JSON
-> round-trip → `TypeConverter` round-trip) end-to-end via a synthetic
-> `TestId` in the test project.
-> Review pass folded in (commit `7c9133a`): `Entity<TId>` equality carries
-> transient + cross-runtime-type guards; `Result.FailFor<TResponse>` returns
-> the concrete `TResponse` via reflection (not `Result<TResponse>`);
-> `Error.Code` is the unprefixed stable identifier projected from
-> `Message.Key`; `Error.Details` flows `LocalizedMessage` lists so the prefix
-> invariant covers field-level errors; `Result<T>.Ok` rejects null;
-> `UserId` is a SharedKernel-level Vogen value object used by
-> `AuditableEntity<TId>` instead of raw `Guid`; `DomainEvent.EventId` /
-> `OccurredAt` are `required init`; `MarkCreated` throws on second call;
-> `SoftDelete` bumps `UpdatedAt` for monotonic last-touched;
-> `CursorPagination` validates `Limit > 0` at the ctor. Standards 01
-> § Dependency Direction grows a "Build-time-only exceptions" sub-section
-> for the EF Core + MediatR references SharedKernel requires. Unit /
-> architecture / contract suites all green in CI.
->
-> **Packet 3 — Cross-cutting foundation ✅**
-> The [ADR-0032](../decisions/0032-exception-handling-logging-and-observability.md)
-> surface is wired end to end via the
-> [wire-cross-cutting-foundation](../../.claude/skills/wire-cross-cutting-foundation/SKILL.md)
-> skill. Shipped:
->
-> - L1 `LearnStackExceptionHandler : IExceptionHandler` registered through
->   `services.AddExceptionHandler<T>()` + `app.UseExceptionHandler()`;
->   `ShouldCapture(ex)` switch drives the Sentry-vs-OTel boundary per
->   Standards 09 (`OperationCanceledException` + client-error
->   `ProviderException` skip capture).
-> - Eight-step MediatR pipeline in `LearnStack.Application/Pipeline/`:
->   `Validation` + `Logging` are full implementations; `AuditLog` ships the
->   try / `ExceptionDispatchInfo` rethrow shell (audit-write lights up in
->   Packet 9 when `IAuditStore` lands); `TenantContext` shell short-circuits
->   with `Result.Fail(tenant_mismatch)` until the resolver middleware arrives
->   in Packet 7; `Authorization` / `Transaction` / `OutboxFlush` pass-through
->   shells whose registration order is the binding part. Order encoded in
->   `MediatRPipelineRegistration.CanonicalBehaviorOrder` and asserted by the
->   `MediatR_Pipeline_Order_Matches_Canonical_Sequence` architecture test.
-> - `Result<T>.ToActionResult()` extension in `LearnStack.Api.Common`
->   alongside `ProblemDetailsFactory` + `HttpStatusMap`; explicit at every
->   future controller endpoint per Standards 09.
-> - `LearnStackException` hierarchy in `LearnStack.SharedKernel/Errors/`:
->   `DomainException`, `InfrastructureException`, `ProviderException` (with
->   `IsClientError` flag), `TenantContextMissingException`.
->   `LearnStackException-DomainExceptionThrow` Roslyn analyzer under
->   `backend/analyzers/LearnStack.Analyzers/` flags `throw new DomainException`
->   in `Domain` + `Application` (warning class in Phase 02a, escalates to
->   error after Phase 03 exit per ADR-0032 § Sub-decision 4).
-> - `IProviderResilience<TPort>` socket in
->   `LearnStack.SharedKernel/Resilience/` + Polly v8
->   `ResiliencePipeline` builder in
->   `LearnStack.Infrastructure.Resilience/`. Pipeline = retry (only
->   `InfrastructureException` + non-client `ProviderException`) → circuit
->   breaker → timeout → bulkhead. Configuration shape:
->   `appsettings.Resilience:<portName>:` (sample lit up under
->   `liveclass`, `payment`, `storage`, `search`). Per-adapter decoration is
->   the adapter's responsibility — the socket is what adapters consume in
->   Phase 02b+ via the [add-provider-adapter](../../.claude/skills/add-provider-adapter/SKILL.md)
->   skill. Hub HTTP clients excluded per Sub-decision 5.
-> - Serilog primary logger wired in `LearnStack.Api/Composition/CrossCuttingFoundationExtensions.cs`
->   with `WriteTo.Console(RenderedCompactJsonFormatter)` +
->   `WriteTo.OpenTelemetry(OTLP gRPC)`. The OTel `LoggerProvider` is
->   intentionally **not** registered alongside per ADR-0032 § Sub-decision 8.
-> - OpenTelemetry SDK with `AspNetCore` + `HttpClient` +
->   `EntityFrameworkCore` instrumentations + the OTLP exporter, plus the
->   singleton `TenantContextSpanProcessor` from
->   `LearnStack.Infrastructure.Observability/` that enriches every span
->   with `tenant.id` / `organization.id` / `user.id` / `correlation.id` /
->   `module` from the singleton
->   `ITenantContextAccessor` (`AsyncLocal<ITenantContext?>`-backed).
-> - `IErrorTrackingProvider` socket in `LearnStack.SharedKernel/Observability/`
->   with three implementations in `LearnStack.Infrastructure.ErrorTracking/`:
->   `NoOpErrorTracker` (Development), `SentryErrorTracker` (SaaS / Dedicated /
->   SelfHostedOnline-with-DSN), `LocalFileErrorTracker`
->   (SelfHostedAirGapped, writes JSON envelopes to a configured directory).
->   Composition-root branching by `DeploymentMode` per Standards 20 table.
->   Sentry SDK is referenced only by the ErrorTracking project — enforced
->   by the `Modules_Do_Not_Reference_Sentry_SDK_Directly` architecture test.
-> - Architecture tests green (`backend/tests/LearnStack.Tests.Architecture/CrossCuttingFoundationTests.cs`):
->   `MediatR_Pipeline_Order_Matches_Canonical_Sequence`,
->   `IExceptionHandler_Registered_AtStartup`,
->   `OTel_Pipeline_Includes_TenantContextSpanProcessor`,
->   `Logging_Goes_Through_Microsoft_Extensions_Logging`,
->   `Modules_Do_Not_Reference_Sentry_SDK_Directly`,
->   `Adapters_Wrap_Provider_Exceptions`,
->   `IErrorTrackingProvider_Is_Singleton`. Unit tests green for
->   `ValidationBehavior` (returns `Result.Fail(validation_failed)`,
->   never throws `ValidationException`), `AuditLogBehavior` (preserves
->   stack via `ExceptionDispatchInfo`), `TenantContextBehavior`
->   (short-circuits unresolved context), `TenantContextSpanProcessor`
->   (`OnStart` is null-safe and enriches resolved spans),
->   `ProviderResilience<TPort>` (retries non-client failures, skips
->   client-error retries), `HttpStatusMap` (mirrors Standards 09 table),
->   `ResultExtensions.ToActionResult()` (Problem Details shape),
->   `LocalFileErrorTracker` (writes the JSON envelope).
-> - Initial validation (pre-review): `LearnStack.Tests.Unit` 111/111,
->   `LearnStack.Tests.Architecture` 25/25, `LearnStack.Tests.Contract` 1/1,
->   `LearnStack.Tests.Integration` 5/5 green under `CI=true`. Superseded by
->   the post-review-3/4 counts below.
->
-> Review fixes (commit `<follow-up>`):
->
-> - **B1** — Sentry DSN now reads via the new `ISecretProvider` socket
->   (`LearnStack.SharedKernel/Secrets/`) with `ConfigurationSecretProvider`
->   as the Phase 02a default; Packet 5 swaps in `DaprSecretProvider` for
->   Vault. ADR-0032 § Sub-decision 9 contract honoured.
-> - **B2** — Serilog pipeline gains `CorrelationContextEnricher`
->   (copies tenant / org / user / correlation / module from
->   `ITenantContextAccessor` onto every log event) +
->   `RedactSensitiveFieldsEnricher` (scrubs password / token / secret /
->   DSN / JWT / authorization / SSN / TCKN / card-number tokens before
->   the formatter touches them). `LocalFileErrorTracker` redacts the
->   same token set on `CapturedContext.AdditionalTags`.
-> - **M1** — `ProblemDetailsFactory.For(Exception)` routes status through
->   `HttpStatusMap.For(Exception)` so `ProviderException(IsClientError:true)`
->   returns 400 instead of falling through to 503 via the carried Error's
->   default code.
-> - **M2** — L1 handler now skips `Activity.AddException` for
->   `ProviderException(IsClientError:true)` per Standards 09 § Sentry vs
->   OpenTelemetry table — `SetStatus(Error)` only, no exception event.
-> - **M3** — All 14 module Domain + Application csproj files now reference
->   `LearnStack.Analyzers` via `OutputItemType="Analyzer"`. Future
->   `throw new DomainException(...)` in any module fails the analyzer.
-> - **M4** — Polly `IProviderResilience<TPort>` pipeline now consumes
->   `BulkheadOptions` via `Polly.RateLimiting`'s
->   `AddRateLimiter(ConcurrencyLimiterOptions)`; the silent-dead config
->   gap is closed.
-> - **N1** — `ProblemDetailsFactory` projects nested
->   FluentValidation property paths (`Address.Street`) and acronyms
->   (`URLValue`) to the right camelCase shape via
->   `JsonNamingPolicy.CamelCase`.
-> - **N2** — `ToActionResult()` returns `ProblemDetailsActionResult`
->   which builds the body inside `ExecuteResultAsync(ActionContext)`, so
->   the sanctioned `(await Send(...)).ToActionResult()` shape populates
->   `Instance` + `correlationId` without the caller threading
->   `HttpContext`.
-> - **N3 / A6** — `LocalFileErrorTracker` file names suffix a Guid for
->   guaranteed uniqueness in same-millisecond bursts; `stackalloc` is
->   capped at 128 chars so a multi-KB inbound `traceparent` cannot blow
->   the stack.
-> - **A5** — `AuditLogBehavior` catch filter excludes
->   `OperationCanceledException` so client disconnects no longer churn
->   warning logs / future audit rows.
-> - **A7** — `MediatRPipelineRegistration.CanonicalBehaviorOrder`
->   documentation explicitly notes "7 behaviors + the handler at the
->   innermost position = the 8 canonical steps".
-> - **A8** — `ProblemDetailsFactory` strips the `_failed` suffix from
->   the Problem `type` URL (matches the Standards 09 § API Surface
->   example: `/validation`, not `/validation_failed`).
-> - **A11** — New HTTP-level integration tests in
->   `LearnStack.Tests.Integration/CrossCuttingFoundationHttpTests` exercise
->   the L1 handler + ValidationBehavior end-to-end via
->   `WebApplicationFactory<Program>` and a synthetic test controller. The
->   Standards 21 catalogue row for
->   `ValidationBehavior_DoesNotThrow_ValidationException` is updated to
->   "unit + integration".
-> - **A12** — `LearnStackExceptionHandler` is `internal sealed` — only
->   the framework's `AddExceptionHandler<T>()` instantiates it; tests
->   reach the type via `InternalsVisibleTo`.
-> - **A13** — `TenantContextSpanProcessor` stringifies Guid tags
->   (`tenant.id` / `organization.id` / `user.id`) so the wire format is
->   stable across exporters.
-> - **S1** — `MediatR_Pipeline_Order_Matches_Canonical_Sequence` test
->   asserts a hardcoded behavior-type sequence, not the production
->   `CanonicalBehaviorOrder` list, so an accidental list reorder cannot
->   sneak past.
-> - **SU1** — L1 handler skips the body write on
->   `OperationCanceledException` / cancelled `CancellationToken`; the
->   client has already disconnected.
-> - **SU4** — `TenantContextBehavior.AllowsUnresolvedContext` predicate
->   carries a TODO documenting the Packet 7 marker-attribute seam
->   (`[AllowsUnresolvedTenantContext]`).
-> - New architecture test `Modules_Do_Not_Reference_DeploymentMode` lit
->   up — catalogue entry existed since ADR-0020 but had no implementation
->   until now.
->
-> Review-2 fixes:
->
-> - **N4** — `CrossCuttingFoundationExtensions.SelectSecretProvider`
->   becomes the single composition-root site that picks the
->   `ISecretProvider` implementation per `DeploymentMode`. Both the DI
->   registration and the local `AddLearnStackErrorTracking` argument
->   read the same instance. Packet 5's `DaprSecretProvider` swap now
->   touches one line, not two.
-> - **SU5** — `SensitiveTokenCatalog` in
->   `LearnStack.SharedKernel/Secrets/` is the single source of truth for
->   the sensitive-property-name token list. Both
->   `RedactSensitiveFieldsEnricher` and
->   `LocalFileErrorTracker.RedactSensitiveTags` consume
->   `SensitiveTokenCatalog.IsSensitive(...)` so the two redaction
->   surfaces cannot drift. The catalogue now includes `vkn` (Vergi
->   Kimlik Numarası — Turkish corporate tax number, common for
->   instructor-owned sole proprietorships) alongside `tckn`.
-> - **SU6** — `RedactSensitiveFieldsEnricher` remarks carry a dated
->   TODO naming the Packet 7+ Roslyn analyzer that should extend
->   `LearnStack.Analyzers` to flag string-interpolated
->   `throw new ...Exception($"...{token}...")` patterns in `Domain` +
->   `Application` projects. Runtime redaction covers logs / OTLP / Sentry
->   tags; the analyzer closes the last gap (secrets in exception
->   messages) at compile time.
-> - **SU7** — `HttpStatusMap.For(Exception)` carries a rationale comment
->   for the non-IETF `499` "client closed request" status: matches
->   Nginx / IIS / Envoy / APISIX behaviour, keeps client disconnects
->   off the error-budget axis, and points at the L1 handler's skip-body
->   contract. If a future ADR pins a different code, the one comment
->   block is the seam to change.
->
-> Review-3/4 fixes:
->
-> - **H1 (blocker)** — the `DomainExceptionThrow` analyzer used a hyphenated
->   Roslyn diagnostic id, which Roslyn rejects (`AD0001` crash at report
->   time → CI build break under `TreatWarningsAsErrors` the first time a
->   `DomainException` is thrown). Fixed: diagnostic id is now `LS0001`
->   (valid identifier); `LearnStackException-DomainExceptionThrow` is
->   retained as the human-readable rule name. `LS0001` is listed in
->   `WarningsNotAsErrors` until the Phase 03 escalation so a legitimate
->   aggregate-invariant throw does not break CI. New
->   `DomainExceptionThrowAnalyzerTests` (`LearnStack.Tests.Unit`) run the
->   analyzer over synthetic compilations and assert `LS0001` is emitted
->   (no `AD0001`). Recorded as [ADR-0032 Amendment 1](../decisions/0032-exception-handling-logging-and-observability.md);
->   Standards 21 naming convention + analyzer entry updated.
-> - **Provider error body/status consistency** — `HttpStatusMap.For(Exception)`
->   now derives the HTTP status from the carried `Error.Code` for every
->   `LearnStackException`, instead of special-casing
->   `ProviderException.IsClientError → 400`. `IsClientError` is purely an
->   observability concern (it gates Sentry capture), so a bare provider
->   failure is `dependency_unavailable` → 503 and an adapter surfacing a
->   provider 4xx passes an explicit `Error` (e.g. `validation_failed` → 400);
->   either way body code and status agree. Tests updated to assert both.
-> - **Redaction over-match + nesting** — `SensitiveTokenCatalog.IsSensitive`
->   now matches on word-segment boundaries (camelCase / `_ . -`) instead of
->   raw substrings, so `ClassName` / `BusinessName` are no longer redacted
->   by the `ssn` token while `Password` / `ApiKey` / `SSNToken` still are.
->   `RedactSensitiveFieldsEnricher` recurses into destructured objects,
->   dictionaries, and sequences so a sensitive field nested in a
->   non-sensitive top-level property (`User.Password`) is scrubbed; lazy
->   reconstruction keeps clean events allocation-free. New
->   `SensitiveTokenCatalogTests` + `RedactSensitiveFieldsEnricherTests`.
-> - **OTel naming + air-gapped** — the manual `AddSource` / `AddMeter`
->   filters use the documented lowercase `learnstack.*` convention (matching
->   the `learnstack.mediatr` ActivitySource without relying on
->   case-insensitive wildcard matching). `WireSerilog` / `WireOpenTelemetry`
->   now take `DeploymentMode`; `SelfHostedAirGapped` never wires the network
->   OTLP exporters (no-egress contract), with a dated TODO for the
->   `/var/learnstack/otel/` file target deferred to Phase 11 ops.
-> - **M1** — new `Handlers_Return_Result` architecture test asserts every
->   `IRequestHandler<,TResponse>` has `TResponse : IResultBase`, so a
->   raw-DTO handler can't silently bypass the pipeline (validation / audit /
->   tenant-context + RLS). Vacuous today, active when handlers land.
-> - **L4** — the Serilog enrichers are resolved from DI (the singletons
->   registered in `AddLearnStackObservabilityServices`) instead of being
->   `new()`'d in the pipeline, so there are no dead registrations.
-> - **Docs** — `Domain_Methods_Do_Not_Throw_For_Expected_Cases` marked
->   **deferred** in Standards 21 (the `LS0001` analyzer already enforces the
->   rule at build time; the report-walking architecture test lands with
->   module domain code in Packet 6+). LoggingBehavior activity-name doc,
->   `correlationId`-as-full-traceparent in Standards 09/10, and the
->   `IMeterFactory.Create("learnstack.<module>")` example in architecture 33
->   reconciled with the code.
-> - **Skipped (with reason)** — the resilience pipeline order
->   (retry → breaker → timeout → bulkhead) is left as-is: it is faithful to
->   ADR-0032 § Sub-decision 5's stated order. Whether the concurrency
->   limiter should sit outermost (to cap total in-flight including retries,
->   per the `Microsoft.Extensions.Resilience` standard handler) is an
->   ADR-level question for a future amendment, not a code defect in this
->   packet.
->
-> Validation after review-3/4: `dotnet build LearnStack.slnx` (CI=true)
-> clean; `LearnStack.Tests.Unit` 154/154, `LearnStack.Tests.Architecture`
-> 26/26, `LearnStack.Tests.Integration` 5/5, `LearnStack.Tests.Contract`
-> 1/1 green. (CI's `dotnet format --verify-no-changes` step also gates the
-> backend job — run `dotnet format LearnStack.slnx --verify-no-changes`
-> locally before pushing.)
->
-> **Deferred follow-ups carried out of Packet 3** (each is recorded in its
-> owning packet/phase below so it does not slip; no separate issue tracker
-> needed — the roadmap is the backlog):
->
-> - **Strongly-typed IDs for `ITenantContext` + `CapturedContext`** →
->   **Packet 7** (after the `TenantId` / `OrganizationId` Vogen value
->   objects land in Packet 6). Both contracts use raw `Guid` in Packet 3
->   because those VOs don't exist yet (only `UserId` does); they convert
->   together in one pass to avoid a half-typed intermediate.
-> - **`[AllowsUnresolvedTenantContext]` marker attribute** for the
->   `TenantContextBehavior` opt-out (tenant-provisioning / platform-admin
->   commands) → **Packet 7**.
-> - **`TransactionBehavior` / `OutboxFlushBehavior` shells light up** →
->   **Packet 6** (UoW transaction, per-module `DbContext`) and **Phase 02b**
->   (outbox enrolment) respectively.
-> - **`AuthorizationBehavior` shell lights up** + **`LS0001` analyzer
->   severity escalates Warning → Error** (and is removed from
->   `WarningsNotAsErrors`) → **Phase 03 exit**.
-> - **`Domain_Methods_Do_Not_Throw_For_Expected_Cases`** report-walking
->   architecture test → **Packet 10** (needs module domain code to walk;
->   until then the `LS0001` analyzer only does partial detection — it
->   reports every direct `throw new DomainException(...)` in `Domain` /
->   `Application` as a build-time Warning, non-blocking under
->   `WarningsNotAsErrors` until the Phase 03 exit escalation above, and does
->   not replace the broader report-walking test).
-> - **Air-gapped OTLP file target** (`/var/learnstack/otel/`) → **Phase 11**
->   ops (the no-egress branch already prevents network export in
->   `SelfHostedAirGapped`; the file sink needs an exporter-package decision,
->   the operational controls in
->   [phase-11-production-hardening.md](phase-11-production-hardening.md#observability),
->   and a test asserting no network telemetry exporter is ever wired under
->   `SelfHostedAirGapped`).
-> - **"No secrets in exception messages" Roslyn analyzer** (compile-time
->   complement to the runtime redactor) → **Phase 02b or later** (code TODO
->   in `RedactSensitiveFieldsEnricher`).
-> - **Resilience pipeline order** (should the concurrency limiter sit
->   outermost to cap total in-flight incl. retries?) → **future ADR-0032
->   amendment**; the current order is faithful to ADR-0032 § Sub-decision 5.
->
-> **Packet 4 — API conventions ⏳**
-> REST + URL versioning (`/v1/...` per ADR-0024), Problem Details (RFC 7807)
-> shape on every error, cursor pagination, idempotency keys for write
-> endpoints with external side effects, ETag concurrency, correlation IDs
-> in headers and logs, OpenAPI generation from code + SDK generation
-> scaffolding, tenant + organization header binding (`X-Tenant-Id`,
-> `X-Organization-Id`).
->
-> **Packet 5 — Dapr building blocks + APISIX config ⏳**
-> `IEventBus` / `ICacheService` / `ISecretProvider` interfaces in
-> `LearnStack.SharedKernel` + `InProcessEventBus` / `InMemoryCacheService` /
-> `EnvironmentSecretProvider` defaults + `DaprEventBus` / `DaprCacheService` /
-> `DaprSecretProvider` adapters in `LearnStack.Infrastructure`. Composition-root
-> branching by `DeploymentMode` (Development / SaaS / Dedicated /
-> SelfHostedOnline / SelfHostedAirGapped). APISIX `config.yaml` finalised
-> with the documented plugin chain
-> (`cors` → `jwt-auth` → `limit-req` → `proxy-rewrite` → `prometheus`) and
-> the `/api/internal/*` SSL-object + `ip-restriction` stub reserved for the
-> Phase 02c Hub egress. `Dapr_PubSub_TopicNames_FollowConvention`
-> architecture test goes green.
->
-> **Packet 6 — Tenancy schema foundations ⏳**
-> Migrations + EF configurations for `tenants`, `organizations` (per
-> [ADR-0017](../decisions/0017-tenant-organization-hierarchy.md)),
-> `tenant_domains`, `tenant_locales` (per
-> [ADR-0008](../decisions/0008-localization-schema.md)), `tenant_settings`
-> (with nullable `organization_id` for org-scoped settings),
-> `tenant_feature_flags` (tenant-flag-level only — plan-level features
-> arrive via the entitlement projection), `platform_entitlement_cache`,
-> `platform_host_to_tenant`. Default-organization seeding at tenant
-> creation. No business logic yet; later packets light up CRUD.
->
-> Carries two Packet 3 follow-ups: (1) introduces the `TenantId` /
-> `OrganizationId` Vogen value objects in `LearnStack.SharedKernel`
-> alongside the schema (the kernel-level IDs that Packet 7 then threads
-> through `ITenantContext` / `CapturedContext`); (2) the Packet 3
-> `TransactionBehavior` shell lights up here once the per-module
-> `DbContext` exists — UoW begin / commit-on-success-`Result` /
-> rollback-on-failure, preserving the `ExceptionDispatchInfo` rethrow
-> `AuditLogBehavior` owns one frame out.
->
-> **Packet 7 — Tenant + Organization resolution + isolation
-> (defense-in-depth) ⏳**
-> `IHostToTenantResolver` (Postgres-backed default reading
-> `platform_host_to_tenant`), `TenantResolverMiddleware`, request-scoped
-> `ITenantContext` (`TenantId`, `OrganizationId?`, `UserId?`), singleton
-> `ITenantContextAccessor` (`AsyncLocal<ITenantContext?>`-backed) populated
-> at scope start by `TenantResolverMiddleware` (HTTP),
-> `HubCorrelationMiddleware` (`/api/internal/*` — stub for 02c), Hangfire
-> `JobActivator` (background jobs), and the outbox / inbox handler scope
-> (integration events). `[TenantOwned]` and `[OrganizationScoped]` marker
-> attributes. EF global query filters on every entity implementing
-> `ITenantOwned` / `IOrganizationScoped`. PostgreSQL RLS policies on every
-> tenant-owned table, with `app.tenant_id` and `app.organization_id`
-> session variables set per connection lease via a
-> `DbConnectionInterceptor` (transaction-local `set_config(..., true)`).
-> Explicit, scoped, audited `EnterPlatformAdminScope(reason)` for the
-> narrow cross-tenant access path. Cross-tenant + cross-org isolation
-> integration tests for at least two seed tenants × two organizations each
-> (`Tenant_A_cannot_read_Tenant_B_data`,
-> `Org_X_cannot_read_Org_Y_within_TenantA`,
-> `Unsetting_tenant_context_returns_zero_rows_through_RLS`). Picks up the
-> application-level seed drop-in deferred from
-> [Phase 01 Packet 8](phase-01-repository-tooling.md) — two demo tenants
-> + platform admin user, wired through the new Tenancy module
-> `DbContext` instead of the placeholder `scripts/seed.sh`.
->
-> Carries two Packet 3 follow-ups: (1) converts `ITenantContext` **and**
-> `CapturedContext` (`LearnStack.SharedKernel.Observability`) from raw
-> `Guid` / `Guid?` to the strongly-typed `TenantId` / `OrganizationId`
-> value objects (created in Packet 6) in a single pass — Packet 3 used raw
-> `Guid` only because those VOs did not exist yet, and the two contracts
-> convert together to avoid a half-typed intermediate; (2) replaces the
-> `TenantContextBehavior.AllowsUnresolvedContext` stub with a real
-> `[AllowsUnresolvedTenantContext]` marker-attribute discriminator (for
-> tenant-provisioning / `EnterPlatformAdminScope` commands that legitimately
-> run before a tenant is resolved), backed by an architecture test that the
-> attribute lives only on that narrow command set.
->
-> **Packet 8 — Tenant Customization foundation ⏳**
-> `LearnStack.Modules.Customization` with `TenantContentType`,
-> `TenantPageBlock`, `TenantLessonItemType`, `TenantLevelTaxonomy`,
-> `TenantScoringRule`, `TenantCompletionRule`, `TenantCustomFieldDef`,
-> `TenantTemplateLibrary` aggregates and their schema tables (per
-> [ADR-0018](../decisions/0018-tenant-driven-customization-model.md)).
-> Runtime read paths — JSON Schema validators and sandboxed DSL stub —
-> ship now; the Admin Studio editors land in Phase 06. A small built-in
-> seed (a `default-card` page-block composite, a stock `Plain` level
-> taxonomy) lets early phases exercise the customization runtime without
-> a real tenant data set. The full DSL engine is gated on ADR-0025
-> (Phase 05); Packet 8 ships only the stub.
->
-> **Packet 9 — Audit infrastructure + Entitlement socket ⏳**
-> `LearnStack.Infrastructure.Audit` with `AuditChangeTrackerInterceptor`
-> (EF SaveChanges interceptor), `IAuditStateCapture` (before / after /
-> changes JSON capture), `AuditLogBehavior` (MediatR behavior — already
-> scaffolded as a shell in Packet 3; now lights up).
-> `LearnStack.Modules.Audit` with `AuditEntry` aggregate (inheriting
-> `Entity<TId>`, **not** `AuditableEntity<T>` — guarded by the
-> `AuditEntry_Inherits_Entity_Not_AuditableEntity` architecture test) and
-> `AuditConfig`. `audit_log` table partitioned by month from Day 1 per
-> ADR-0028's chosen implementation; retention job (Hangfire) ships now
-> with the policy from
-> [18-audit-coverage.md](../standards/18-audit-coverage.md). MUST-class
-> coverage is enabled for every command and security event the seed
-> modules declare; modules added in later phases extend the catalog, not
-> the infrastructure. `IEntitlementProvider` socket declared with
-> `NullEntitlementProvider` as the default (returns "all features
-> enabled, no limits"); Hub-backed and signed-license-key implementations
-> land in Phase 02c.
->
-> **Packet 10 — Architecture tests catalogue green + phase exit ⏳**
-> Every Phase 02a architecture test in
-> [21-architecture-tests-catalogue.md](../standards/21-architecture-tests-catalogue.md)
-> goes green in CI. The catalogue is the canonical name registry; the
-> identifiers below either already exist there (the ADR-0032 batch) or
-> land in their owning packet and are registered then. Tests grouped by
-> introducing packet:
->
-> - From the cross-cutting ADR-0032 batch already in the catalogue
->   (introduced by Packet 3):
->   - `IExceptionHandler_Registered_AtStartup`
->   - `MediatR_Pipeline_Order_Matches_Canonical_Sequence`
->   - `ValidationBehavior_DoesNotThrow_ValidationException`
->   - `Domain_Methods_Do_Not_Throw_For_Expected_Cases` (Roslyn analyzer
->     report) — **deferred to this packet from Packet 3**: the report-walking
->     test needs module domain code to walk, which does not exist until
->     Packet 6+. The underlying rule is already enforced from Packet 3 by the
->     `LS0001` analyzer running in every module's `Domain` + `Application`
->     build (+ `DomainExceptionThrowAnalyzerTests`); this packet adds the
->     report-walking architecture test once there is code to assert against.
->   - `Adapters_Wrap_Provider_Exceptions`
->   - `Modules_Do_Not_Reference_Sentry_SDK_Directly`
->   - `Logging_Goes_Through_Microsoft_Extensions_Logging`
->   - `OTel_Pipeline_Includes_TenantContextSpanProcessor`
->   - `TenantContextSpanProcessor_DoesNotThrow_When_Context_Missing`
-> - From the module-dependency arm (introduced by Packet 2 / closed by
->   this packet):
->   - The Application + Infrastructure full matrix extending the
->     existing Phase-01 Packet 1 `ModuleDependencyTests` TODO at
->     [backend/tests/LearnStack.Tests.Architecture/ModuleDependencyTests.cs:17-21](../../backend/tests/LearnStack.Tests.Architecture/ModuleDependencyTests.cs#L17-L21)
->   - `LearnStack_Modules_DoNotReference_Hub`
->   - `Modules_Do_Not_Inject_Valkey_Directly`
->   - `Modules_Do_Not_Read_Entitlement_Cache_Directly`
->   - `Modules_Do_Not_Write_AuditLog_Directly`
->   - `Modules_Do_Not_Reference_DeploymentMode`
->   - `Core_Modules_HaveNo_DomainSpecific_Names`
->   - `No_Source_Folder_Named_Verticals` (already green from Phase 01)
-> - From the tenancy + isolation arm (introduced by Packet 7 — canonical
->   identifiers land in the catalogue when the tests do):
->   - `Every_OrgScoped_Entity_HasOrgIdAndFilter`
->   - An `Every_TenantOwned_Entity_HasFilterAndRlsPolicy`-shaped pair
->     for the tenant dimension (final name TBD in Packet 7's catalogue
->     entry)
->   - "No `IgnoreQueryFilters()` outside the platform-admin scope" rule
->     (final identifier TBD in Packet 7's catalogue entry)
-> - From the audit arm (introduced by Packet 9):
->   - `AuditEntry_Inherits_Entity_Not_AuditableEntity`
->   - `Every_TenantOwned_Command_HasAuditCoverage`
->   - "Audit-coverage matrix file exists per module" rule (final
->     identifier TBD in Packet 9's catalogue entry)
-> - From the Dapr arm (introduced by Packet 5):
->   - `Dapr_PubSub_TopicNames_FollowConvention`
->
-> The `if: false` CI placeholder for integration tests
-> ([phase-01-repository-tooling.md § Packet 8](phase-01-repository-tooling.md))
-> is removed once the first integration test from Packet 7 is green.
-> Closes the architecture-test arm of the
-> [Phase Exit Decision](#phase-exit-decision) checklist; the remaining
-> exit gates (tenant + organization resolution, isolation tests, audit
-> pipeline, customization runtime read paths, API conventions, the three
-> blocking ADRs) close as their owning packets ship.
+> **[`## Packet Sequence`](#packet-sequence) says which packet lands which part, in what
+> order, and what gates it. [`## Scope`](#scope) says the same work grouped by subsystem —
+> read it when you want the shape of a subsystem, read the sequence when you want the
+> order. The shipped Packet 0–3 records are at the end of this document under
+> [`## Delivery Record (Packets 0–3)`](#delivery-record-packets-03) and are not
+> rewritten.**
 
 ## Goal
 
-Build the runtime foundation everything else stands on: shared kernel conventions,
-tenant + organization resolution, tenant + organization isolation defense-in-depth,
-database conventions, API conventions, **Dapr building blocks**, **APISIX gateway**,
-**audit infrastructure**, **Tenant Customization aggregates**, **entitlement projection
-socket**, **host-to-tenant resolver socket**, and architecture tests. This is the half
-of the foundation that is least sensitive to identity provider and outbox wiring.
+Build the runtime foundation everything else stands on — and **only** that.
+
+Shared kernel conventions, cross-cutting concerns, API conventions, tenant +
+organization resolution, tenant + organization isolation defense-in-depth, the
+customization runtime read paths, durable audit, and the foundation **ports** with
+their default implementations. Two seed tenants in unrelated domains, so that every
+later phase is tested against the genericity claim rather than assuming it.
 
-Phase 02b (events, outbox, identity integration) follows; Phase 02c (LearnStack Hub
-Foundation in the separate `learnstack-hub` repo) runs in **parallel** with 02b. The
-phases were split to reduce single-point-of-failure risk and keep each half
-independently mergeable.
+What this phase deliberately does **not** build: the Dapr, Kafka, APISIX and Vault
+adapters, the Hub integration, signed licence keys, custom-domain TLS automation, and
+`audit_log` partitioning. Each of those sits behind a port that ships here, has a
+working default implementation that ships here, and has an owning phase and a written
+trigger condition in
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md). The discriminator is the
+one-way-door test: isolation, schema ownership and typed identifiers get more expensive
+to add every week; a Dapr adapter does not.
+
+[Phase 02d](phase-02d-walking-skeleton.md) follows immediately and renders both seed
+tenants in a browser. [Phase 02b](phase-02b-events-auth.md) then adds identity and the
+durable event path; [Phase 02c](phase-02c-hub-foundation.md) hangs off the spine rather
+than sitting in it.
 
 The decisions made in this phase are the ones that are most painful to reverse later.
 They are codified in:
 
 - [ADR-0003 Tenant Isolation Defense in Depth](../decisions/0003-tenant-isolation-defense-in-depth.md)
-  (Amendment 1: Organization Scope)
-- [ADR-0014 Adopt Dapr](../decisions/0014-adopt-dapr.md)
-- [ADR-0015 API Gateway: APISIX](../decisions/0015-api-gateway-apisix.md)
-- [ADR-0016 Audit Log Subsystem](../decisions/0016-audit-log-subsystem.md)
+  (Amendment 1: Organization scope; **Amendment 3: corrected RLS template + database
+  role model**)
 - [ADR-0017 Tenant + Organization Hierarchy](../decisions/0017-tenant-organization-hierarchy.md)
 - [ADR-0018 Tenant-Driven Customization Model](../decisions/0018-tenant-driven-customization-model.md)
-- [ADR-0020 Triple Deployment + Hybrid License](../decisions/0020-triple-deployment-hybrid-license.md)
+  (Amendment: genericity boundary)
 - [ADR-0021 Feature-Based Entitlement](../decisions/0021-feature-based-entitlement.md)
 - [ADR-0032 Exception Handling, Logging, and Observability Architecture](../decisions/0032-exception-handling-logging-and-observability.md)
+- [ADR-0033 Audit Durability Model](../decisions/0033-audit-durability-model.md)
+  (supersedes ADR-0016)
+- [ADR-0035 Demand-Gated Infrastructure](../decisions/0035-demand-gated-infrastructure.md)
+
+[ADR-0014 (Dapr)](../decisions/0014-adopt-dapr.md) and
+[ADR-0015 (APISIX)](../decisions/0015-api-gateway-apisix.md) remain accepted decisions
+about **what** LearnStack uses; ADR-0035 decides **when** each arrives, and the answer
+is not this phase.
+
+## Packet Sequence
+
+The forward plan for packets 3b–10. Each entry states what the packet lands, what it
+depends on, and what gates it. The subsystem view of the same work is [`## Scope`](#scope);
+where the two overlap, Scope is the authority on shape and this section on order.
+
+**Packet 3b — Decision repair ⏳**
+A repair slice. Packets 0–3 are shipped and their records stand — see
+[`## Delivery Record`](#delivery-record-packets-03) at the end of this document; what
+they left behind lands here rather than being edited into their history. This
+packet exists so that no migration, no module and no adapter is written on top
+of a defect that is currently one constant or one attribute wide.
+
+Suffix lettering follows the precedent already in this roadmap (`02a`/`02b`/`02c`,
+`08a`/`08b`/`08c`) and keeps every existing cross-reference intact — including
+the Hub repository's "blocked on P02a-5/6/7/9" table, which renumbering would
+orphan.
+
+**Shared Kernel repairs** (carried out of Packet 2):
+
+- `Results.Unit` collides with `MediatR.Unit`. Any handler file that imports
+  both namespaces gets an ambiguous reference, and every handler file will
+  import both. Rename before the first handler exists —
+  [Phase 02d](phase-02d-walking-skeleton.md) writes it.
+- `Result<T>` carries no `[MemberNotNullWhen]` annotations, so the compiler
+  cannot prove `Value` is non-null after an `IsSuccess` check. Without them
+  every consumer writes `!` or a justification comment, in every module, for
+  the lifetime of the codebase.
+- `Entity<TId>` overrides `Equals(object?)` but implements neither
+  `IEquatable<Entity<TId>>` nor `operator ==`. Every equality comparison boxes,
+  and the EF change tracker compares constantly.
+
+**Corpus repairs:**
+
+- [ADR-0032](../decisions/0032-exception-handling-logging-and-observability.md)'s
+  `IProviderResilience<TPort>` example shows
+  `services.Decorate<TPort, ResilientProviderAdapter<TPort>>()`, which does not
+  compile — C# forbids using a type parameter as a base type. The **shipped**
+  registration is correct (`AddSingleton<IProviderResilience<TPort>>` with an
+  injected collaborator); only the ADR text is wrong. Documentation fix, not a
+  design change.
+- **Nine shipped source comments** schedule the Dapr-backed `ISecretProvider` to
+  "Packet 5", across four files: `CrossCuttingFoundationExtensions.cs` (five sites,
+  including the `TODO(2026-05-21, @platform)`), `ErrorTrackingRegistration.cs` (two),
+  `LearnStack.SharedKernel.csproj` (one) and `ISecretProvider.cs` (one).
+  `ConfigurationSecretProvider.cs` carried a tenth and is **already corrected** — the
+  restructure fixed it while sweeping the provider's name, so it is not part of this
+  packet's work. [ADR-0035](../decisions/0035-demand-gated-infrastructure.md)
+  moved every Dapr adapter to [Phase 11](phase-11-production-hardening.md)
+  against a written trigger, so those comments now point at a packet that will
+  not ship them. The seam they describe is correct and unchanged — only the
+  phase pointer is stale. Comment-only edit; no behaviour change.
+- The Packet 3 `TenantContextBehavior` TODO names a `DbConnectionInterceptor`
+  as the mechanism for setting the Row Level Security session variables.
+  Interceptors fire when the connection opens, not when the transaction starts,
+  and `set_config(..., true)` is transaction-local — so the value would be gone
+  before the query it protects. The TODO is corrected to point at
+  [Security Standards § Tenant Context](../standards/11-security.md) and at
+  Packet 7, which implements it.
+
+**Development-loop and CI repairs.** [Phase 01](phase-01-repository-tooling.md)
+is complete and its record stands; the gaps it shipped with are remediated
+here:
+
+- `make seed`'s health gate requires every compose service to report healthy,
+  but `coturn`, `dapr-placement` and `dapr-sidecar-api` declare no healthcheck —
+  so the gate times out and the script exits non-zero on **every** run. This is
+  step three of the quickstart.
+- `infra/compose/e2e.yml` resets PostgreSQL, SeaweedFS, Meilisearch and Kafka to
+  `tmpfs` but leaves Valkey on its named volume, so cache and rate-limit state
+  leaks between end-to-end runs. Its `volumes: !reset []` additionally discards
+  the PostgreSQL init script and the SeaweedFS S3 identity file — which breaks
+  the moment [Phase 06](phase-06-renderer-admin-studio.md) starts running
+  browser tests against it.
+- `frontend/apps/web` runs `vitest run --passWithNoTests` against zero test
+  files, so the frontend CI check is green without asserting anything. The
+  tolerance is removed **together with the first test that satisfies it** — one
+  render test over the existing `(public)/page.tsx` placeholder is enough — so the
+  required `frontend` check never sits red across a packet boundary. The
+  substantive frontend suite still arrives with
+  [Phase 02d](phase-02d-walking-skeleton.md).
+- Branch protection requires four checks but zero approvals and does not enforce
+  for administrators, which contradicts
+  [Git Workflow Standards](../standards/14-git-workflow.md). Either the setting
+  or the standard changes — a security rule that differs from the live platform
+  setting makes a green build look stronger than it is.
+- `infra/dapr/components/secretstore-vault.yaml` sets `vaultKVPrefix: secret`,
+  resolving reads to `secret/data/secret/<key>` instead of the documented
+  `secret/learnstack/<area>` layout.
+- Every published port in `infra/compose/dev.yml` binds `0.0.0.0` with committed
+  development credentials, and `MEILI_MASTER_KEY` is hardcoded rather than read
+  from the environment. Bind to loopback; read from `.env`.
+
+**Packet 4 — API conventions ⏳**
+REST + URL versioning (`/api/v1/...` per
+[ADR-0024](../decisions/0024-api-versioning-policy.md)), Problem Details
+(RFC 7807) on every error, cursor pagination, idempotency keys for write
+endpoints with external side effects, ETag concurrency, correlation IDs in
+headers and logs, OpenAPI generated from code, tenant + organization header
+binding (`X-Tenant-Id`, `X-Organization-Id`).
+
+Carries one correctness fix: `CursorPagination`'s constructor validation
+currently surfaces as an unhandled `ArgumentOutOfRangeException` during model
+binding, producing a 500 where a malformed cursor is a client error. Binding
+failures return **400** with Problem Details.
+
+SDK generation ships as a wired-but-empty scaffold — there are no endpoints to
+generate from until [Phase 02d](phase-02d-walking-skeleton.md).
+
+**Packet 5 — Foundation ports and default implementations ⏳**
+`IEventBus` / `ICacheService` / `ISecretProvider` in
+`LearnStack.SharedKernel`, with `InProcessEventBus` / `InMemoryCacheService` in
+`LearnStack.Infrastructure` — `ISecretProvider` and `ConfigurationSecretProvider`
+already shipped in Packet 3 — as the **only
+registered implementations**. Composition-root branching on `DeploymentMode`
+is present and exercised, with `Development` and `SaaS` wired; the remaining
+three values resolve to the same defaults until
+[Phase 11](phase-11-production-hardening.md) builds their adapters and
+integration suites, per
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md).
+
+`InProcessEventBus` is a **first-class transport, not a stub**: same
+`IIntegrationEventHandler<T>` interface, same `IInboxGuard`, same
+tenant-context restoration as the durable path. A development path that skips
+those is a development path that never exercises the isolation code, and every
+consumer would end up with two implementations.
+
+`ICacheService.RemoveByPrefixAsync` is **removed or redesigned** before this
+packet ships. The published implementation iterates an instance-local key set,
+so keys written by another instance are never evicted — the contract cannot be
+honoured by any candidate backend. Either the method leaves the interface, or
+it is replaced by a generation-key pattern whose guarantee is achievable.
+
+The Dapr sidecar, Kafka, APISIX and Vault adapters are **not** in this packet.
+They are demand-gated with written triggers in
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md); the local compose
+stack moves them behind a non-default profile so the daily loop runs the
+services the backend can actually call.
+
+**Packet 6 — Tenancy schema and the corrected RLS template ⏳**
+Migrations and EF configurations for `tenants`, `organizations` (per
+[ADR-0017](../decisions/0017-tenant-organization-hierarchy.md)),
+`tenant_domains`, `tenant_locales` (per
+[ADR-0008](../decisions/0008-localization-schema.md)), `tenant_settings` (with
+nullable `organization_id` for org-scoped settings), `tenant_feature_flags`
+(tenant-flag level only — plan-level features arrive through the entitlement
+projection), `platform_entitlement_cache`, `platform_host_to_tenant`, and
+`outbox_messages`. Default-organization seeding at tenant creation.
+
+The `outbox_messages` table ships here even though nothing dispatches from it
+until [Phase 02b](phase-02b-events-auth.md): the table's schema and its
+ownership by LearnStack are a one-way door, and that ownership is precisely
+what makes the dispatch transport swappable later.
+
+**The first migration is written against the corrected template**, not the one
+that was published in four documents before
+[ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md):
+one policy per table with an `AND`-ed predicate, `ENABLE` **and** `FORCE ROW
+LEVEL SECURITY`, an explicit `WITH CHECK`, and the four-role model
+(`learnstack_migration` owns, `learnstack_app` connects with `NOBYPASSRLS`,
+`learnstack_platform` and `learnstack_outbox_admin` hold audited bypasses). The
+canonical SQL lives in exactly one place:
+[Database Standards § Tenant-Owned and Organization-Scoped Tables](../standards/05-database.md).
+
+The migration also declares each table's **class** — tenant-owned, tenant-owned
+self-keyed (`tenants`), or platform-scoped (`platform_host_to_tenant`) — because
+two of the nine cannot take the template verbatim: `tenants` has no `tenant_id`
+column, and `platform_host_to_tenant` is read in order to determine the tenant, so
+a tenant-keyed predicate would make host resolution return zero rows forever. See
+[Database Standards § Table classes](../standards/05-database.md). Every table's
+`GRANT`s are written in this migration too; there are no `ALTER DEFAULT PRIVILEGES`
+grants, so a table nobody granted fails loudly rather than inheriting DML — and can
+never silently widen a `BYPASSRLS` role. Row security is enabled and forced on all
+nine, so the structural scan needs no exception list.
+
+Introduces the `TenantId` / `OrganizationId` Vogen value objects in
+`LearnStack.SharedKernel` alongside the schema — the kernel-level identifiers
+Packet 7 threads through `ITenantContext` and `CapturedContext`. The Packet 3
+`TransactionBehavior` shell lights up here once the per-module `DbContext`
+exists: unit-of-work begin, commit on success-`Result`, rollback on failure,
+preserving the `ExceptionDispatchInfo` rethrow `AuditLogBehavior` owns one
+frame out.
+
+**Packet 7 — Tenant and organization resolution, isolation, two tenants ⏳**
+`IHostToTenantResolver` backed by `platform_host_to_tenant` and **nothing
+else** — never the Hub, per
+[ADR-0034](../decisions/0034-hub-contract-surface-invariant.md); an anonymous
+page load must not depend on a control plane being reachable.
+`TenantResolverMiddleware`, request-scoped `ITenantContext` (`TenantId`,
+`OrganizationId?`, `UserId?`), singleton `ITenantContextAccessor`
+(`AsyncLocal<ITenantContext?>`-backed) populated at scope start by
+`TenantResolverMiddleware` (HTTP), `HubCorrelationMiddleware`
+(`/api/internal/*`), the Hangfire `JobActivator` (background jobs), and the
+outbox / inbox handler scope (integration events). `[TenantOwned]` and
+`[OrganizationScoped]` marker attributes. EF global query filters on every
+entity implementing `ITenantOwned` / `IOrganizationScoped`.
+
+**The RLS session variables are set with `SET LOCAL` inside the ambient
+transaction**, after it opens. `set_config(..., true)` is transaction-local: set
+from a MediatR behavior that runs before `TransactionBehavior`, or from a
+connection interceptor that fires at connection open, it is discarded before the
+query it is meant to protect ever runs. The corpus previously described all
+three placements; [Security Standards § Tenant Context](../standards/11-security.md)
+is now the single authority, and the Packet 3 `TenantContextBehavior` TODO —
+which names the connection-interceptor option — is corrected here.
+
+Explicit, scoped, audited `EnterPlatformAdminScope(reason)` for the narrow
+cross-tenant access path. It reaches `learnstack_platform` through a **second,
+separately-credentialed connection** (`ConnectionStrings:PlatformAdmin`), never
+through `SET ROLE`: `learnstack_app` is not a member of `learnstack_platform`,
+because membership would make `BYPASSRLS` a standing capability of the application
+role, a plain `SET ROLE` survives `COMMIT` and would persist on a PgBouncer
+transaction-pooled connection into the next tenant's request, and per-role settings
+such as `statement_timeout` are applied at login and do not follow a role switch.
+The composition root registers the platform data source as a keyed singleton that
+only `PlatformAdminScope` may resolve
+(`Platform_DataSource_Resolved_Only_By_PlatformAdminScope`).
+
+The scope's **audit obligation is declared here and satisfied in Packet 9**, which is
+where `audit_log` and `IAuditStore` land. Until then `EnterPlatformAdminScope(reason)`
+records the entry through `ILogger` at `Warning` with the `reason`, the caller and the
+sentinel platform tenant id, and Packet 9 replaces that with a `SecurityEvent` audit row
+written as `learnstack_platform` **before** the operation runs — so an operation that
+later fails is still recorded. Packet 7 must not claim a durable audit trail it has no
+table for; a log line that is honestly a log line is better than an audit row that does
+not exist.
+
+`IHostToTenantResolver` sets `SET LOCAL app.resolving_host` inside its own short
+read-only transaction before the lookup, because `SET LOCAL` outside a transaction
+block has no effect and a session-level setting would leak across a pooled
+connection. `app.resolving_host` is the fourth and last canonical session variable.
+
+**Two seed tenants in unrelated domains**, each with two organizations: an
+English school and a **yoga studio**. This is the artefact that tests the
+genericity claim, and it moves here from
+[Phase 10](phase-10-english-learning-mvp.md) because Packet 7 already needs two
+tenants for isolation testing — the marginal cost is the second tenant's
+customization data, and the marginal benefit is that every phase from
+[Phase 02d](phase-02d-walking-skeleton.md) onward is tested against two shapes
+instead of one. Picks up the application-level seed drop-in deferred from
+[Phase 01 Packet 8](phase-01-repository-tooling.md), wired through the Tenancy
+module `DbContext` rather than the placeholder `scripts/seed.sh`.
+
+Cross-tenant and cross-organization isolation integration tests **run as
+`learnstack_app`**. A test that connects as the table owner or as a `BYPASSRLS`
+role passes even when every policy is inert, and therefore proves nothing. The
+suite includes at minimum:
+
+- `Tenant_A_cannot_read_Tenant_B_data`
+- `Org_X_cannot_read_Org_Y_within_TenantA`
+- `TenantWide_Row_Of_TenantB_Is_Invisible_To_TenantA` — the exact case the
+  superseded template leaked
+- `Unsetting_tenant_context_returns_zero_rows_through_RLS`
+- `Write_With_Foreign_TenantId_Is_Rejected_By_WithCheck`
+
+Carries two Packet 3 follow-ups: converting `ITenantContext` **and**
+`CapturedContext` from raw `Guid` / `Guid?` to the strongly-typed `TenantId` /
+`OrganizationId` value objects created in Packet 6, in a single pass to avoid a
+half-typed intermediate; and replacing the `TenantContextBehavior.AllowsUnresolvedContext`
+stub with a real `[AllowsUnresolvedTenantContext]` marker attribute for
+tenant-provisioning and platform-admin commands that legitimately run before a
+tenant is resolved, backed by an architecture test that the attribute appears
+only on that narrow command set.
+
+**Packet 8 — Tenant Customization foundation ⏳**
+`LearnStack.Modules.Customization` with **two** aggregates:
+`TenantContentType` (JSON Schema declaring a content shape) and
+`TenantLevelTaxonomy` (the tenant's level or difficulty vocabulary). These are
+the two the runtime needs before [Phase 02d](phase-02d-walking-skeleton.md) can
+render two different tenants; the rest have no consumer for several phases.
+
+Both tables ship the versioned key shape —
+`UNIQUE (tenant_id, key, schema_version)` plus the partial index
+`UNIQUE (tenant_id, key) WHERE status = 'active'`. Not `UNIQUE (tenant_id, key)`:
+that rejects the second revision of any key. See
+[`## Scope` § Tenant Customization Foundation](#tenant-customization-foundation).
+
+This packet also **fixes the storage shape** for scoring and completion rule bodies
+without creating their tables: **opaque `text` with a `dialect` discriminator**. The
+aggregates and their migrations land with their first consumer in
+[Phase 05](phase-05-education-learning-content.md); the column type is settled here
+because it is the part that cannot be changed later without a migration. The
+evaluation engine is not chosen yet — ADR-0025
+decides between CEL, a restricted Lua, and a custom AST in
+[Phase 05](phase-05-education-learning-content.md), and the three candidates do
+not share a column type. Storing the body opaquely lets tenants author rules
+before the engine exists without committing the schema to a choice not yet
+made.
+
+The remaining aggregates land with their consumers:
+
+| Aggregate | Owning phase |
+|---|---|
+| `TenantPageBlock` | [Phase 04](phase-04-cms-media-pages.md) |
+| `TenantCustomFieldDef` | [Phase 03](phase-03-identity-admin.md) |
+| `TenantLessonItemType` | [Phase 05](phase-05-education-learning-content.md) |
+| `TenantScoringRule` / `TenantCompletionRule` — aggregates, tables and evaluation | [Phase 05](phase-05-education-learning-content.md) |
+| `TenantTemplateLibrary` | [Phase 08a](phase-08a-assessment-notifications.md) |
+
+A small built-in seed — one `default-card` composite renderer and a stock
+`Plain` level taxonomy — lets early phases exercise the customization runtime
+before a tenant data set exists. Admin Studio editors land with their consuming
+phases — the `TenantContentType` editor in [Phase 04](phase-04-cms-media-pages.md), the
+`TenantLevelTaxonomy` editor in [Phase 05](phase-05-education-learning-content.md);
+[Phase 06](phase-06-renderer-admin-studio.md) consolidates them into one editing idiom,
+and its Studio screen ownership table is the single ownership record.
+
+**Packet 9 — Audit infrastructure and the entitlement socket ⏳**
+`LearnStack.Infrastructure.Audit` with `AuditChangeTrackerInterceptor` (an EF
+`SaveChanges` interceptor), `IAuditStateCapture` (before / after / changes JSON
+capture), and the Packet 3 `AuditLogBehavior` shell lit up per
+[ADR-0033](../decisions/0033-audit-durability-model.md): **MUST-class audit
+rows are written on the same transaction as the business write** —
+`AuditLogBehavior` classifies and parks the intent, `TransactionBehavior` writes
+it immediately before `COMMIT` — so they commit with it or not at all, and so
+they execute while `app.tenant_id` is set and Row Level Security accepts them. SHOULD/MAY-class audit stays best-effort,
+with its accepted loss written down. `AuditConfig` may narrow SHOULD/MAY
+coverage but never removes baseline MUST coverage. Exactly two failures reject the
+operation — an unclassified operation, and a MUST-class row that cannot be written
+durably; a tenant-override read failure falls back to the in-process catalogue instead
+([ADR-0033 § Fail-closed, stated precisely](../decisions/0033-audit-durability-model.md)).
+
+`LearnStack.Modules.Audit` with the `AuditEntry` aggregate — inheriting
+`Entity<TId>`, **not** `AuditableEntity<T>`, guarded by
+`AuditEntry_Inherits_Entity_Not_AuditableEntity` — and `AuditConfig`.
+`audit_log` ships as a **single correct table** with the composite primary key
+`(id, timestamp)`; the DDL in the superseded ADR-0016 declares a primary key
+twice and PostgreSQL rejects it. Monthly partitioning, the retention job and
+the lifecycle policy from
+[ADR-0028](../decisions/0028-audit-log-partition-management.md) move to
+[Phase 11](phase-11-production-hardening.md) per
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md) — audit
+correctness cannot be added later, audit scale can.
+
+`IEntitlementProvider` is declared with `NullEntitlementProvider` (all features
+enabled, no limits) as the **only** implementation. The Hub-backed and
+signed-licence implementations land in
+[Phase 02c](phase-02c-hub-foundation.md) and
+[Phase 11](phase-11-production-hardening.md) respectively, against the triggers
+in [ADR-0035](../decisions/0035-demand-gated-infrastructure.md).
+
+**Packet 10 — Architecture tests green and phase exit ⏳**
+Every Phase 02a rule in
+[Architecture Tests Catalogue](../standards/21-architecture-tests-catalogue.md)
+green in CI, under reconciled canonical names — the catalogue currently carries
+six spellings of the tenant-isolation rule and five of the organization-scope
+rule, drift it exists specifically to prevent. Reconciling now is a
+find-and-replace in Markdown; reconciling after the tests exist is a refactor
+across a dozen files.
+
+Implements `Core_Modules_HaveNo_DomainSpecific_Names` — the mechanical
+guarantee behind the platform's entire premise, and currently unimplemented
+while its far weaker sibling `No_Source_Folder_Named_Verticals` is green.
+
+One rule is restated rather than renamed. The catalogue's
+`Every_TenantOwned_Table_HasRls_With_AppTenantId` asserts that a policy
+**exists** and mentions `app.tenant_id`. The superseded template satisfied that
+assertion perfectly while leaking every tenant-wide row across tenants — a
+structure-shaped test that passes against a broken policy is worse than no test,
+because it converts an open question into a false answer. Structural assertions
+stay, but the binding proof is the Packet 7 integration suite running as
+`learnstack_app`: isolation is a runtime property and only a runtime test can
+observe it.
+
+Tests grouped by introducing packet:
+
+- From the cross-cutting [ADR-0032](../decisions/0032-exception-handling-logging-and-observability.md)
+  batch (introduced by Packet 3, already green):
+  `IExceptionHandler_Registered_AtStartup`,
+  `MediatR_Pipeline_Order_Matches_Canonical_Sequence`,
+  `ValidationBehavior_DoesNotThrow_ValidationException`,
+  `Adapters_Wrap_Provider_Exceptions`,
+  `Modules_Do_Not_Reference_Sentry_SDK_Directly`,
+  `Logging_Goes_Through_Microsoft_Extensions_Logging`,
+  `OTel_Pipeline_Includes_TenantContextSpanProcessor`,
+  `TenantContextSpanProcessor_DoesNotThrow_When_Context_Missing`,
+  `IErrorTrackingProvider_Is_Singleton`, `Handlers_Return_Result`.
+  `Domain_Methods_Do_Not_Throw_For_Expected_Cases` — the report-walking test —
+  lands here, because it needs module domain code to walk and none existed
+  until Packet 6. The underlying rule is enforced from Packet 3 by the `LS0001`
+  analyzer.
+- From the module-dependency arm (introduced by Packet 2, closed here): the
+  Application + Infrastructure matrix extending
+  [`ModuleDependencyTests`](../../backend/tests/LearnStack.Tests.Architecture/ModuleDependencyTests.cs),
+  `LearnStack_Modules_DoNotReference_Hub`,
+  `Modules_Do_Not_Inject_Valkey_Directly`,
+  `Modules_Do_Not_Read_Entitlement_Cache_Directly`,
+  `Modules_Do_Not_Write_AuditLog_Directly`,
+  `Modules_Do_Not_Reference_DeploymentMode`,
+  **`Core_Modules_HaveNo_DomainSpecific_Names`**,
+  `No_Source_Folder_Named_Verticals` (green since Phase 01).
+- From the tenancy and isolation arm (introduced by Packet 7):
+  `Every_TenantOwned_Entity_HasFilterAndRlsPolicy`,
+  `Every_OrgScoped_Entity_HasOrgIdAndFilter`,
+  `No_IgnoreQueryFilters_Outside_PlatformAdminScope`,
+  `AllowsUnresolvedTenantContext_Only_On_Provisioning_Commands`.
+- From the audit arm (introduced by Packet 9):
+  `AuditEntry_Inherits_Entity_Not_AuditableEntity`,
+  `Every_TenantOwned_Command_HasAuditCoverage`,
+  `MustClass_Audit_Writes_Share_The_Business_Transaction`,
+  `Every_Module_Has_An_AuditCoverage_Matrix`.
+
+Every standard in [the standards corpus](../standards/README.md) is
+re-stated against reality: a standard with no implementing code moves from
+`Active` to `Adopted`. All twenty-two currently claim `Active`, which makes the
+three-state model decorative.
+
+The deferred `backend-integration` CI job
+([Phase 01 Packet 8](phase-01-repository-tooling.md)) activates once Packet 7's first
+isolation test is green — `vars.ENABLE_BACKEND_INTEGRATION` set, the placeholder step
+replaced, and the job renamed and re-required per
+[`.github/CONTRIBUTING.md`](../../.github/CONTRIBUTING.md). Closes the architecture-test arm of the
+[Phase Exit Decision](#phase-exit-decision); the remaining gates close as their
+owning packets ship.
+
 
 ## Scope
 
@@ -584,41 +505,47 @@ They are codified in:
   invariant).
 - Pagination model (cursor-first).
 - `IClock`, `IRandom`, `IGuidFactory` for deterministic tests.
-- **`IEventBus`, `ICacheService`, `ISecretProvider`** interfaces declared in
-  `LearnStack.SharedKernel`. Default implementations: `InProcessEventBus`,
-  `InMemoryCacheService`, `EnvironmentSecretProvider`. The Dapr-backed implementations
-  ship in this phase too but are selected by `DeploymentMode` at composition root.
-- **`IEntitlementProvider`** interface declared; `NullEntitlementProvider` ships as
-  the default (returns "all features enabled, no limits"). The Hub-backed and
-  signed-license-key implementations land in Phase 02c.
-- **`IHostToTenantResolver`** interface declared with a Postgres-backed default that
-  reads from `platform_host_to_tenant`.
-
-### Dapr Building Blocks (Day 1)
-
-Per [ADR-0014](../decisions/0014-adopt-dapr.md):
-
-- Dapr sidecar runs in dev `docker-compose.yml`. Pub/sub component → Kafka. State
-  component → Valkey. Secrets component → Vault (dev mode).
-- `DaprEventBus`, `DaprCacheService`, `DaprSecretProvider` implementations ship in
-  `LearnStack.Infrastructure`.
-- Topic naming convention enforced by `Dapr_PubSub_TopicNames_FollowConvention`
-  architecture test.
-- Service invocation, workflow, bindings, actors are explicitly **out of scope**
-  (ADR-0014 non-goals).
-
-### APISIX Gateway (Day 1)
-
-Per [ADR-0015](../decisions/0015-api-gateway-apisix.md):
-
-- APISIX runs in standalone YAML-reload mode in dev `docker-compose.yml`.
-- `infra/apisix/config.yaml` ships with the plugin chain wired:
-  `cors` → `jwt-auth` → `limit-req` → `proxy-rewrite` → `prometheus`.
-- A second route set bound to a dedicated SSL object (mTLS in APISIX is SSL-object
-  config — `client.ca` / `client.depth` — not a route plugin) plus an `ip-restriction`
-  on the Hub egress range, reserved Day 1 for the future `/api/internal/*` endpoints
-  (the endpoints themselves arrive in 02c). The commented stub at the bottom of
-  `infra/apisix/apisix.yaml` documents the canonical shape.
+- **`IEventBus`, `ICacheService`, `ISecretProvider`, `IEntitlementProvider`,
+  `IHostToTenantResolver`** interfaces declared in `LearnStack.SharedKernel`. Their
+  default implementations, and the reason the vendor-backed ones are not here, are in
+  [§ Foundation Ports and Default Implementations](#foundation-ports-and-default-implementations)
+  below.
+
+### Foundation Ports and Default Implementations
+
+Per [ADR-0035](../decisions/0035-demand-gated-infrastructure.md), the **ports** ship
+here with **working default implementations**; the vendor adapters ship on a trigger.
+
+- `IEventBus` with `InProcessEventBus` — a first-class transport, not a stub. Same
+  `IIntegrationEventHandler<T>` interface, same `IInboxGuard`, same tenant-context
+  restoration as the durable path, so development exercises the isolation code and no
+  consumer needs two implementations.
+- `ICacheService` with `InMemoryCacheService`. `RemoveByPrefixAsync` is removed from
+  the interface or redesigned to a generation-key pattern before Packet 5 ships — the
+  published contract iterates an instance-local key set and cannot be honoured across
+  instances by any candidate backend.
+- `ISecretProvider` with `ConfigurationSecretProvider`.
+- `IEntitlementProvider` with `NullEntitlementProvider` (all features enabled, no
+  limits).
+- `IHostToTenantResolver` with a PostgreSQL-backed implementation reading
+  `platform_host_to_tenant` — and **nothing else**. Host resolution never calls the
+  Hub; an anonymous page load must not depend on a control plane being reachable
+  ([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)).
+
+Composition-root branching on `DeploymentMode` is present and exercised, with
+`Development` and `SaaS` wired end to end. `Dedicated`, `SelfHostedOnline` and
+`SelfHostedAirGapped` resolve to the same defaults and are **prepared seams, not
+supported deployments**, until [Phase 11](phase-11-production-hardening.md) builds
+their adapters and integration suites. Modules never read `DeploymentMode`
+(`Modules_Do_Not_Reference_DeploymentMode`).
+
+**Not in this phase**, per ADR-0035's trigger table: the Dapr sidecar and its pub/sub,
+state and secret components; Kafka; APISIX; Vault. [ADR-0014](../decisions/0014-adopt-dapr.md)
+and [ADR-0015](../decisions/0015-api-gateway-apisix.md) stand as decisions about what
+LearnStack uses when it needs a cross-process event bus and an edge gateway; neither is
+needed by a single-process platform with no integration events and no non-development
+deployment. The local compose stack moves them behind a non-default profile so the
+daily loop runs the services the backend can actually call.
 
 ### Tenancy Schema Foundations
 
@@ -629,8 +556,13 @@ have to retrofit:
 - `organizations` — sub-unit within a tenant per
   [ADR-0017](../decisions/0017-tenant-organization-hierarchy.md). Every tenant has at
   least one default organization seeded at creation.
-- `tenant_domains` — host → tenant mapping (lifecycle/verification UI lands in
-  Phase 04 / Phase 06; the **Hub-owned** custom-domain admin lands in 02c).
+- `tenant_domains` — the tenant's **own** domain lifecycle and verification state
+  (requested / verifying / verified / failed), read and written under tenant context
+  (lifecycle + verification UI lands in Phase 04 / Phase 06; the **Hub-owned**
+  custom-domain admin lands in 02c). It is **not** the resolution index — that is
+  `platform_host_to_tenant` below, which is read before any tenant context exists. The
+  two differ in *when* they are read, which is exactly why they cannot share one Row
+  Level Security rule.
 - `tenant_locales` — default + enabled locales (see
   [ADR-0008](../decisions/0008-localization-schema.md)). Required before any
   tenant-owned content table ships.
@@ -645,20 +577,75 @@ have to retrofit:
 - `platform_host_to_tenant` — host → `(tenant_id, organization_id?)` mapping
   (Hub-populated for SaaS / Dedicated, config-populated for SelfHosted; the table
   ships now).
+- `outbox_messages` — the outbox table. Nothing dispatches from it until
+  [Phase 02b](phase-02b-events-auth.md), but its schema and LearnStack's ownership of
+  it are a one-way door — and that ownership is exactly what makes the dispatch
+  transport swappable later
+  ([ADR-0006](../decisions/0006-events-and-outbox.md)).
+
+All nine tables ship with `ENABLE` **and** `FORCE ROW LEVEL SECURITY` and an explicit
+`WITH CHECK`. They do **not** all take the same policy, and saying they do produces a
+migration that cannot run: the corrected template's predicate names a `tenant_id`
+column, which `tenants` does not have, and it would deadlock host resolution, which
+reads `platform_host_to_tenant` in order to *determine* the tenant. Three classes, per
+[ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md) and
+[Database Standards § Table classes](../standards/05-database.md):
+
+| Class | Tables | Policy |
+|---|---|---|
+| Tenant-owned | `organizations`, `tenant_domains`, `tenant_locales`, `tenant_settings` (the one org-scoped table — it also takes the two `AS RESTRICTIVE` write guards), `tenant_feature_flags`, `platform_entitlement_cache`, `outbox_messages` | the corrected template verbatim |
+| Tenant-owned, self-keyed | `tenants` | the corrected template with the tenant term keyed on `id`, because the primary key *is* the tenant id |
+| Platform-scoped | `platform_host_to_tenant` | `ENABLE` + `FORCE` with role-qualified per-command policies: reads keyed on the declared `app.resolving_host` (pre-context, single row) or on `app.tenant_id` (a tenant listing its own hosts); writes keyed on `app.tenant_id` only |
+
+Packet 6 also ships `infra/compose/postgres-init/02-create-roles.sql` and splits the
+development connection strings — `learnstack_migration` for `dotnet ef`, `learnstack_app`
+for the API, plus the two bypass roles' own credentials. Until it lands,
+`infra/compose/dev.yml` runs everything as one `POSTGRES_USER` superuser, which owns
+every table and therefore bypasses every policy: the isolation layer is inert in local
+development and every isolation test would pass against it. The script also grants
+`CREATE ON SCHEMA public` to `learnstack_migration` — since PostgreSQL 15 the public
+schema no longer grants it to `PUBLIC`, so without it the first migration fails with
+`permission denied for schema public`, and the tempting fix (make the role a superuser)
+recreates exactly the ownership arrangement `FORCE ROW LEVEL SECURITY` exists to defeat.
 
-### Audit Infrastructure (Day 1)
+`platform_entitlement_cache` is tenant-owned despite its name — every read resolves the
+tenant from `ITenantContext` first and every write arrives on
+`PUT /api/internal/tenants/{id}/entitlements`, so nothing about it is pre-context and
+the application role never gets a table-wide read of every tenant's plan. Row security
+is never *disabled* on any of the nine; the grant matrix that goes with the policies is
+in [Database Standards § Database roles](../standards/05-database.md). The canonical SQL
+lives in exactly one place because the template that preceded it was copied into four
+documents and drifted in all of them.
 
-Per [ADR-0016](../decisions/0016-audit-log-subsystem.md):
+### Audit Infrastructure
 
-- `LearnStack.Infrastructure.Audit` ships with `AuditChangeTrackerInterceptor` (EF
-  SaveChanges interceptor), `IAuditStateCapture` (before/after/changes JSON capture),
-  and `AuditLogBehavior` (MediatR pipeline behavior).
-- `LearnStack.Modules.Audit` ships with `AuditEntry` aggregate (inheriting
+Per [ADR-0033](../decisions/0033-audit-durability-model.md), which supersedes ADR-0016:
+
+- `LearnStack.Infrastructure.Audit` ships with `AuditChangeTrackerInterceptor` (an EF
+  `SaveChanges` interceptor), `IAuditStateCapture` (before / after / changes JSON
+  capture), and the Packet 3 `AuditLogBehavior` shell lit up.
+- **MUST-class audit rows are written on the same transaction as the business
+  write** — parked by `AuditLogBehavior`, written by `TransactionBehavior` immediately
+  before `COMMIT`. They commit with the state change or not at all, and they execute while the
+  transaction-local `app.tenant_id` is set — which is what stops the corrected Row
+  Level Security policy from rejecting every audit insert and the documented
+  catch-and-log posture from swallowing the rejection.
+- SHOULD/MAY-class audit stays best-effort, with its accepted loss written down rather
+  than assumed.
+- `AuditConfig` may narrow SHOULD/MAY coverage but never removes baseline MUST
+  coverage. Exactly two failures reject the operation — an unclassified operation and a
+  MUST-class row that cannot be written durably; a tenant-override read failure falls
+  back to the in-process catalogue, which carries the same MUST floor.
+- `LearnStack.Modules.Audit` ships with the `AuditEntry` aggregate (inheriting
   `Entity<TId>`, **not** `AuditableEntity<T>`) and `AuditConfig`.
-- `audit_log` table partitioned by month from Day 1; retention job (Hangfire)
-  ships now with the policy from [18-audit-coverage.md](../standards/18-audit-coverage.md).
+- `audit_log` ships as a **single correct table** with the composite primary key
+  `(id, timestamp)`. Monthly partitioning, the retention job, and the lifecycle policy
+  from [ADR-0028](../decisions/0028-audit-log-partition-management.md) land in
+  [Phase 11](phase-11-production-hardening.md) per
+  [ADR-0035](../decisions/0035-demand-gated-infrastructure.md). Audit correctness
+  cannot be retrofitted; audit scale can.
 - MUST-class coverage is enabled for every command and security event the modules
-  declare; modules added in later phases extend the catalog, not the infrastructure.
+  declare; modules added in later phases extend the catalogue, not the infrastructure.
 
 ### Cross-cutting Concerns (Day 1)
 
@@ -671,9 +658,13 @@ Per [ADR-0032](../decisions/0032-exception-handling-logging-and-observability.md
 - **MediatR pipeline behaviors (eight-step canonical order).**
   `ValidationBehavior` (returns `Result.Fail(validation_failed)` — never
   throws), `LoggingBehavior` (opens the 8-field `ILogger` scope + manual
-  `Activity` + latency histogram), `AuditLogBehavior` (per ADR-0016 — wraps
-  inner pipeline with try/catch + audit-fail entry + ExceptionDispatchInfo
-  rethrow), `TenantContextBehavior` (asserts resolved + sets RLS GUCs),
+  `Activity` + latency histogram), `AuditLogBehavior` (per
+  [ADR-0033](../decisions/0033-audit-durability-model.md), which supersedes ADR-0016 —
+  keeps its shipped pipeline position and its try/catch + audit-fail entry +
+  `ExceptionDispatchInfo` rethrow; MUST-class rows are written on the ambient
+  transaction by `TransactionBehavior` immediately before `COMMIT`, so they commit
+  with the state change or not at all), `TenantContextBehavior` (asserts resolved; does **not** set the RLS
+  GUCs — see [Security Standards § Tenant Context](../standards/11-security.md)),
   `AuthorizationBehavior` (returns `Result.Fail(forbidden)` on deny),
   `TransactionBehavior` (UoW), `OutboxFlushBehavior` (enrols outbox writes
   in current tx).
@@ -721,19 +712,44 @@ Per [ADR-0032](../decisions/0032-exception-handling-logging-and-observability.md
   Composition root branches on `DeploymentMode`. DSN comes from
   `ISecretProvider`. Modules never reference `Sentry.SentrySdk`.
 
-### Tenant Customization Foundation (Day 1)
+### Tenant Customization Foundation
 
 Per [ADR-0018](../decisions/0018-tenant-driven-customization-model.md):
 
-- `LearnStack.Modules.Customization` ships with `TenantContentType`,
-  `TenantPageBlock`, `TenantLessonItemType`, `TenantLevelTaxonomy`,
-  `TenantScoringRule`, `TenantCompletionRule`, `TenantCustomFieldDef`,
-  `TenantTemplateLibrary` aggregates and their schema tables.
-- The runtime read paths (JSON Schema validators, sandboxed DSL stub) ship now; the
-  Admin Studio editors land in Phase 06.
-- A small built-in seed (a `default-card` page-block composite, a stock `Plain` level
-  taxonomy) lets early phases exercise the customization runtime without depending on
-  a real tenant data set.
+- `LearnStack.Modules.Customization` ships with **two** aggregates —
+  `TenantContentType` (a JSON Schema declaring a content shape) and
+  `TenantLevelTaxonomy` (the tenant's level or difficulty vocabulary) — plus their
+  schema tables and runtime read paths.
+- These are the two the runtime needs before
+  [Phase 02d](phase-02d-walking-skeleton.md) can render two tenants that genuinely
+  differ. The remaining aggregates ship with their consumers:
+  `TenantCustomFieldDef` in [Phase 03](phase-03-identity-admin.md),
+  `TenantPageBlock` in [Phase 04](phase-04-cms-media-pages.md),
+  `TenantLessonItemType` and the `TenantScoringRule` / `TenantCompletionRule` runtime
+  in [Phase 05](phase-05-education-learning-content.md), and
+  `TenantTemplateLibrary` in [Phase 08a](phase-08a-assessment-notifications.md).
+- Both aggregates carry the versioned key shape from their first migration:
+  `UNIQUE (tenant_id, key, schema_version)` for the revision, plus the partial index
+  `UNIQUE (tenant_id, key) WHERE status = 'active'` for the live definition.
+  [Phase 04](phase-04-cms-media-pages.md) § Customization Key Shape and Immutable Schema
+  Versions is the authority; the constraint ships here because this is the table's first
+  migration and ADR-0013's version history cannot be retrofitted onto
+  `UNIQUE (tenant_id, key)`.
+- The **storage shape** — not the tables — for scoring and completion rule bodies is
+  fixed here; the aggregates and their migrations land in
+  [Phase 05](phase-05-education-learning-content.md) with their first consumer. Rule
+  bodies are stored as **opaque `text` with a `dialect` discriminator**. The evaluation engine is not chosen yet — ADR-0025 decides
+  between CEL, a restricted Lua and a custom AST in
+  [Phase 05](phase-05-education-learning-content.md), and the three candidates do not
+  share a column type. Storing the body opaquely lets rules be authored before the
+  engine exists without committing the schema to a choice not yet made.
+- A small built-in seed (a `default-card` composite renderer, a stock `Plain` level
+  taxonomy) lets early phases exercise the customization runtime without depending on a
+  real tenant data set. Admin Studio editors land with their consuming phases — the
+  `TenantContentType` editor in [Phase 04](phase-04-cms-media-pages.md), the
+  `TenantLevelTaxonomy` editor in [Phase 05](phase-05-education-learning-content.md);
+  [Phase 06](phase-06-renderer-admin-studio.md) consolidates them into one editing
+  idiom, and its Studio screen ownership table is the single ownership record.
 
 ### Tenant + Organization Resolution
 
@@ -759,19 +775,35 @@ Implementation:
 
 ### Tenant + Organization Isolation — Defense in Depth
 
-Implemented **from day one**, not deferred to hardening. Two enforcement layers, both
+Implemented **from day one**, not deferred to hardening. Three enforcement layers, all
 required, applied to both dimensions where the entity is org-scoped:
 
 1. **EF Core global query filters** on every entity implementing `ITenantOwned` and
    `IOrganizationScoped`.
-2. **PostgreSQL Row Level Security** policies on every tenant-owned table, with
-   `app.tenant_id` and (where applicable) `app.organization_id` session variables set
-   per connection lease via a `DbConnectionInterceptor`. Transaction-local
-   `set_config(..., true)` is the primitive.
+2. **PostgreSQL Row Level Security** on every tenant-owned table, built from the
+   canonical template in [Database Standards](../standards/05-database.md): one policy
+   with an `AND`-ed predicate, `ENABLE` **and** `FORCE ROW LEVEL SECURITY`, and an
+   explicit `WITH CHECK`. The `app.tenant_id` and `app.organization_id` session
+   variables are set with `SET LOCAL` **inside the ambient transaction**, after it
+   opens. `set_config(..., true)` is transaction-local: set from a pipeline behavior
+   that runs before the transaction, or from a connection interceptor that fires at
+   connection open, the value is discarded before the query it protects executes.
+   [Security Standards § Tenant Context](../standards/11-security.md) is the single
+   authority for this placement.
+3. **A non-owning application role.** The runtime connects as `learnstack_app`
+   (`NOBYPASSRLS`, not the table owner); migrations run as `learnstack_migration`,
+   which owns the tables and is denied any bypass by `FORCE ROW LEVEL SECURITY`. See
+   [ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md).
 
 Platform-admin cross-tenant access is explicit, scoped, audited
-(`EnterPlatformAdminScope(reason)`). See
-[Tenant Isolation](../architecture/09-tenant-isolation.md).
+(`EnterPlatformAdminScope(reason)`), and uses the separate `learnstack_platform` role.
+See [Tenant Isolation](../architecture/09-tenant-isolation.md).
+
+**Isolation tests connect as `learnstack_app`.** A test that connects as the owner or
+as a `BYPASSRLS` role passes even when every policy is inert. This is not a
+hypothetical: the template that preceded ADR-0003 Amendment 3 satisfied every
+structural assertion in the architecture-test catalogue while leaking every tenant-wide
+row across tenants. Isolation is a runtime property; only a runtime test observes it.
 
 ### Database Conventions
 
@@ -788,7 +820,7 @@ Platform-admin cross-tenant access is explicit, scoped, audited
 
 Per [API Standards](../standards/04-api-design.md):
 
-- REST + URL versioning (`/v1/...`).
+- REST + URL versioning (`/api/v1/...`).
 - Problem Details (RFC 7807) for errors.
 - Cursor pagination.
 - Idempotency keys for write endpoints with external side effects.
@@ -800,28 +832,39 @@ Per [API Standards](../standards/04-api-design.md):
 
 ### Configuration
 
-- Strongly typed options bound from `ISecretProvider` (Vault) + env vars +
-  `appsettings.*.json`. Vault wins.
+- Strongly typed options bound from `ISecretProvider` + environment variables +
+  `appsettings.*.json`, in that precedence order. The default `ISecretProvider` reads
+  the environment; the Vault-backed implementation is demand-gated per
+  [ADR-0035](../decisions/0035-demand-gated-infrastructure.md).
 - Environment-based configuration (dev / staging / prod) and
   **`DeploymentMode`-based composition** (Development / SaaS / Dedicated /
   SelfHostedOnline / SelfHostedAirGapped) per
-  [ADR-0020](../decisions/0020-triple-deployment-hybrid-license.md).
+  [ADR-0020](../decisions/0020-triple-deployment-hybrid-license.md). All five values
+  exist and the composition root branches on all five; `Development` and `SaaS` are
+  wired end to end, and the remaining three are prepared seams until
+  [Phase 11](phase-11-production-hardening.md).
 - Secret handling — never in source.
 - Tenant-level + organization-level settings model with a typed accessor.
 
-### Architecture Tests (Day 1)
+### Architecture Tests
 
-The architecture test project starts going green during this phase. Phase 02a covers:
+The architecture test project goes fully green during this phase, under the canonical
+identifiers registered in
+[Architecture Tests Catalogue](../standards/21-architecture-tests-catalogue.md). Phase
+02a covers:
 
 - Module dependency direction.
 - No cross-module Domain/Infrastructure references.
-- Every `[TenantOwned]` entity has filter and RLS policy.
+- Every `[TenantOwned]` entity has filter and RLS policy — **structurally**. The
+  binding proof that isolation actually holds is the Packet 7 integration suite running
+  as `learnstack_app`; a structural assertion passes against a policy that leaks.
 - Every `[OrganizationScoped]` entity has org filter + RLS
   (`Every_OrgScoped_Entity_HasOrgIdAndFilter`).
 - No `IgnoreQueryFilters()` outside platform-admin module.
 - Audit-coverage matrix file exists per module.
-- `Dapr_PubSub_TopicNames_FollowConvention`.
 - `AuditEntry_Inherits_Entity_Not_AuditableEntity`.
+- `MustClass_Audit_Writes_Share_The_Business_Transaction` — per
+  [ADR-0033](../decisions/0033-audit-durability-model.md).
 - `LearnStack_Modules_DoNotReference_Hub`.
 - `Modules_Do_Not_Inject_Valkey_Directly`, `Modules_Do_Not_Read_Entitlement_Cache_Directly`,
   `Modules_Do_Not_Write_AuditLog_Directly`.
@@ -859,16 +902,22 @@ land in Phase 02b.
 ## Deliverables
 
 - Shared kernel package with `IEventBus` / `ICacheService` / `ISecretProvider` /
-  `IEntitlementProvider` / `IHostToTenantResolver` interfaces and dev-mode defaults.
-- Dapr sidecar + Kafka + Vault wired in dev compose; pub/sub component, state
-  component, secrets component all functional.
-- APISIX standalone gateway running in dev compose with the documented plugin chain.
-- Tenant-aware + organization-aware API foundation with both EF filters and
-  PostgreSQL RLS active for both dimensions.
-- `LearnStack.Modules.Customization` aggregates + runtime read paths.
-- `LearnStack.Modules.Audit` aggregates + `LearnStack.Infrastructure.Audit` pipeline +
-  partitioned `audit_log` table + retention job.
-- `platform_entitlement_cache` and `platform_host_to_tenant` tables + read paths.
+  `IEntitlementProvider` / `IHostToTenantResolver` interfaces and their default
+  implementations — `InProcessEventBus`, `InMemoryCacheService`,
+  `ConfigurationSecretProvider`, `NullEntitlementProvider`, and a PostgreSQL-backed host
+  resolver — registered as the only implementations.
+- Tenant-aware + organization-aware API foundation with EF filters, the corrected
+  PostgreSQL Row Level Security template, and the four-role database model active for
+  both dimensions.
+- **Two seed tenants in unrelated domains** (an English school and a yoga studio), each
+  with two organizations, seeded through the Tenancy module's `DbContext`.
+- `LearnStack.Modules.Customization` with `TenantContentType` and
+  `TenantLevelTaxonomy` plus their runtime read paths.
+- `LearnStack.Modules.Audit` aggregates + `LearnStack.Infrastructure.Audit` pipeline
+  writing MUST-class rows inside the business transaction, on a single correct
+  `audit_log` table.
+- `platform_entitlement_cache`, `platform_host_to_tenant` and `outbox_messages` tables
+  + read paths.
 - Cross-cutting foundation (per
   [ADR-0032](../decisions/0032-exception-handling-logging-and-observability.md)):
   `LearnStackExceptionHandler`, 8-step MediatR pipeline, `Result.ToActionResult`
@@ -880,48 +929,97 @@ land in Phase 02b.
 - Database conventions implemented and enforced.
 - API conventions wired (versioning, Problem Details, cursor pagination, idempotency,
   ETag).
-- Architecture test project running with the Phase-02a rules.
-- Tenant + organization context tests passing for at least two seed tenants, each
-  with at least two organizations.
+- Architecture test project fully green on the Phase-02a rules, including
+  `Core_Modules_HaveNo_DomainSpecific_Names`.
+- The `backend-integration` CI job active, running the isolation suite against
+  Testcontainers.
+- A local development loop that boots, seeds and tests on a clean checkout without
+  manual intervention.
 
 ## Completion Criteria
 
 - A request reliably resolves its tenant **and** organization.
 - Unknown hosts return 404 (no platform disclosure).
-- Tenant-owned queries cannot leak across tenants — verified by integration test pair
-  (`Tenant_A_cannot_read_Tenant_B_data`, `Unsetting_tenant_context_returns_zero_rows_through_RLS`).
+- Tenant-owned queries cannot leak across tenants — verified by an integration suite
+  **running as `learnstack_app`**, including
+  `Tenant_A_cannot_read_Tenant_B_data`,
+  `TenantWide_Row_Of_TenantB_Is_Invisible_To_TenantA` and
+  `Unsetting_tenant_context_returns_zero_rows_through_RLS`.
 - Org-scoped queries cannot leak across organizations within the same tenant —
   verified by `Org_X_cannot_read_Org_Y_within_TenantA`.
-- API errors use Problem Details consistently.
-- Platform-admin scope writes an audit event via `AuditLogBehavior`; the
-  `AuditChangeTrackerInterceptor` captures EF state changes; both flow into
-  `audit_log` and survive a manual retention-job dry run.
+- A write carrying a foreign `tenant_id` is rejected by `WITH CHECK`, verified by
+  `Write_With_Foreign_TenantId_Is_Rejected_By_WithCheck`.
+- API errors use Problem Details consistently, and a malformed cursor returns 400
+  rather than 500.
+- A MUST-class audit row commits in the same transaction as the state change it
+  records; forcing the audit write to fail leaves **zero** business rows.
 - A MUST-audit operation written through any seed module produces an entry with
   `before` and `after` snapshots.
 - `IFeatureFlags.IsEnabledAsync(FeatureKey)` reads the `NullEntitlementProvider`'s
-  default of "all enabled"; flipping `DeploymentMode = SelfHosted` and pointing at a
-  signed-license-key file produces the limited feature set without code change.
-- `IHostToTenantResolver` resolves a seed custom-domain row.
-- Architecture tests for tenant + org ownership, RLS, module-boundary direction,
-  audit pipeline, and Dapr conventions are not skippable.
+  default of "all enabled". Swapping the registered `IEntitlementProvider`
+  implementation changes the answer without touching module code.
+- `IHostToTenantResolver` resolves a seed custom-domain row from
+  `platform_host_to_tenant`, with no network call, **as `learnstack_app` with
+  `app.tenant_id` unset** — the row that determines the tenant is readable before any
+  tenant context exists, and only that row is
+  (`Host_Resolves_With_No_Tenant_Context_Under_Rls`).
+- The same connection with neither `app.resolving_host` nor `app.tenant_id` set reads
+  **zero** rows from `platform_host_to_tenant` and **zero** rows from `tenants`: the
+  application role can neither enumerate the host map nor enumerate the customer list
+  (`App_Role_Cannot_Enumerate_Host_Map`, `App_Role_Cannot_Enumerate_Tenants`).
+- Tenant A cannot repoint tenant B's host even though the resolver policy can see it —
+  the `UPDATE` affects zero rows and an `INSERT` naming tenant B is rejected by
+  `WITH CHECK` (`Tenant_A_Cannot_Repoint_Tenant_B_Host`).
+- All nine tenancy tables report `relrowsecurity` **and** `relforcerowsecurity` true in
+  `pg_class`, with no exception list.
+- `make dev`, `make seed` and `make test` succeed on a clean checkout — `make seed`
+  currently exits non-zero on every run, and that is a completion blocker, not a
+  nuisance.
+- Architecture tests for tenant + org ownership, RLS structure, module-boundary
+  direction, domain-neutral module naming, and the audit pipeline are not skippable.
 
 ## Risks
 
-- Leaving tenant or organization enforcement to developer discipline; mitigated by
-  RLS + architecture tests.
+- **A structural test standing in for a behavioural one.** The superseded RLS template
+  satisfied every "does a policy exist" assertion in the catalogue while leaking every
+  tenant-wide row across tenants. A test that converts an open question into a false
+  answer is worse than no test. Mitigated by making the Packet 7 integration suite —
+  running as `learnstack_app` — the binding proof, and by keeping the structural
+  assertions as a cheap complement rather than the guarantee.
+- **Isolation tests that connect as the wrong role.** Running them as the table owner
+  or a `BYPASSRLS` role produces a green suite against inert policies. Mitigated by
+  pinning the test connection string to `learnstack_app` in the integration fixture.
+- Leaving tenant or organization enforcement to developer discipline; mitigated by RLS
+  + architecture tests + EF global filters, all three.
 - Treating RLS as optional "later" hardening — explicitly rejected by ADR-0003.
-- Premature event/outbox work before tenant isolation is stable — moved to Phase 02b
-  on purpose.
-- Audit pipeline overhead on hot paths — mitigated by `AuditConfig` MAY-class skip and
-  by partitioned-table inserts; budget reviewed in Phase 11.
+- **The deferrals being read as cancellations.** Dapr, Kafka, APISIX, Vault, the Hub
+  and licence keys are demand-gated with written triggers in
+  [ADR-0035](../decisions/0035-demand-gated-infrastructure.md), not dropped. Mitigated
+  by the trigger table being normative and by every port shipping in this phase.
+- **The phase growing back.** Eleven packets with no user-visible output was the
+  original shape, and every removed item has a plausible argument for return.
+  Mitigated by [Phase 02d](phase-02d-walking-skeleton.md) sitting immediately after
+  this phase: anything that does not move the walking skeleton closer belongs to a
+  later phase.
+- Audit pipeline overhead on hot paths — mitigated by `AuditConfig` narrowing
+  SHOULD/MAY coverage per tenant; MUST-class overhead is not negotiable, and the
+  budget is reviewed in [Phase 11](phase-11-production-hardening.md) when partitioning
+  lands.
 
 ## Phase Exit Decision
 
-Phase 02b can begin when tenant + organization resolution, isolation tests, audit
-pipeline, customization runtime read paths, API conventions, and the architecture
-test gate are stable and green in CI. Phase 02c (Hub Foundation in the separate
-`learnstack-hub` repo) may start **in parallel** with 02b — both consume the sockets
-already in place from 02a.
+[Phase 02d](phase-02d-walking-skeleton.md) can begin when a reviewer, on a clean
+checkout, can run `make test` and see: the architecture-test assembly green with zero
+skips; the Packet 7 isolation suite green **connected as `learnstack_app`**, including a
+case that reads with `app.tenant_id` reset rather than merely unset; a MUST-class command
+whose audit store is unavailable rejected rather than committed; and two seed tenants in
+unrelated domains, two organizations each, resolvable by host and returning
+tenant-specific customization data through the runtime read paths.
+
+[Phase 02c](phase-02c-hub-foundation.md) is not gated on this phase's exit in the
+ordinary sense: it hangs off the spine and starts when its trigger fires (a tenant must
+be billed or plan-gated), consuming the `IEntitlementProvider` and
+`IHostToTenantResolver` sockets this phase ships.
 
 ### ADR commitments that must land in this phase
 
@@ -932,8 +1030,439 @@ Three ADRs targeted Phase 02a as exit blockers; all three are now Accepted
 |---|---|---|---|
 | [ADR-0023](../decisions/0023-strongly-typed-id-source-generator.md) | Strongly-typed ID source generator | **Accepted** (2026-05-20) | Vogen as the emitter for both IDs and value objects |
 | [ADR-0024](../decisions/0024-api-versioning-policy.md) | API versioning policy | **Accepted** (2026-05-20) | URL `/v{N}/`, 6-month deprecation window, RFC 8594 `Sunset` + `Deprecation` headers, OpenAPI `x-sunset` extensions |
-| [ADR-0028](../decisions/0028-audit-log-partition-management.md) | `audit_log` monthly partition management | **Accepted** (2026-05-20) | Daily Hangfire recurring job (`learnstack:audit:partition-management`); no `pg_partman` runtime dependency |
+| [ADR-0028](../decisions/0028-audit-log-partition-management.md) | `audit_log` monthly partition management | **Accepted** (2026-05-20) | Daily Hangfire recurring job (`learnstack:audit:partition-management`); no `pg_partman` runtime dependency. Its *implementation* moves to [Phase 11](phase-11-production-hardening.md) per [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) — the decision stands, the schedule changed |
+
+Four further decisions were taken during the phase and are Accepted:
+
+| # | Topic | Status | Decision |
+|---|---|---|---|
+| [ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md) | RLS policy template + database role model | **Accepted** (2026-08-08) | One `AND`-ed policy, `FORCE ROW LEVEL SECURITY`, explicit `WITH CHECK`, four-role model; canonical template in Standards 05 only |
+| [ADR-0033](../decisions/0033-audit-durability-model.md) | Audit durability | **Accepted** (2026-08-08) | Supersedes ADR-0016. MUST-class audit is a durable intent inside the business transaction and fails closed; SHOULD/MAY stays best-effort |
+| [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md) | Hub contract surface | **Accepted** (2026-08-08) | Two invariants replace the endpoint count; host resolution never calls the Hub |
+| [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) | Demand-gated infrastructure | **Accepted** (2026-08-08) | The one-way-door test; ports ship now, adapters ship on a named trigger |
+
+The remaining exit gates (tenant + organization resolution, isolation tests running as
+`learnstack_app`, the durable audit pipeline, customization runtime read paths, API
+conventions, two seed tenants, architecture-test catalogue green) close as Packets
+3b–10 ship.
 
-The remaining exit gates (tenant + organization resolution, isolation tests,
-audit pipeline, customization runtime read paths, API conventions, architecture-
-test catalogue green) close as Packets 2–10 ship.
+
+
+## Delivery Record (Packets 0–3)
+
+Shipped history, kept verbatim. Packets 0–3 and the 2026-08-08 restructure annotation
+are frozen: read them, do not edit them. They were written when they sat at the top of
+this file, so where they say "below" and "above" they mean the original layout — the
+forward plan they point at is [`## Packet Sequence`](#packet-sequence), now above them.
+Nothing in them was reworded when they moved.
+
+> **Packet 0 — Kickoff ✅ (this commit)**
+> Phase 02a packet breakdown captured in this Status block. Glossary
+> entries for "Phase", "Packet", and "Kickoff Packet" added under a new
+> *Roadmap & Delivery* group so the terms are defined in exactly one
+> place. No code, no ADR state changes — Packet 0 is a planning slice
+> that unblocks the rest of the phase by fixing the order.
+>
+> **Packet 1 — Foundation decisions ✅**
+> The three Phase-02a-blocking ADRs are now Accepted:
+> [ADR-0023](../decisions/0023-strongly-typed-id-source-generator.md)
+> picks **Vogen** as the source generator for both IDs and value objects;
+> [ADR-0024](../decisions/0024-api-versioning-policy.md) codifies
+> URL-based versioning with a **6-month deprecation window** + RFC 8594
+> `Sunset` / `Deprecation` headers + OpenAPI `x-sunset` extensions;
+> [ADR-0028](../decisions/0028-audit-log-partition-management.md) picks
+> a **Hangfire recurring job** (`learnstack:audit:partition-management`)
+> over `pg_partman` to keep the SelfHostedAirGapped story extension-free.
+> Decision-only; no code. Standards 02 § Strongly-Typed Identifiers and
+> Standards 04 § Versioning cross-link to the new ADRs.
+>
+> **Packet 2 — Shared Kernel core ✅**
+> `IClock` + `SystemClock` / `FixedClock`, `IRandom` + `SystemRandom` /
+> `FixedRandom`, `IGuidFactory` + `SystemGuidFactory` / `FixedGuidFactory`
+> (deterministic-test abstractions per Standards 02 § Time);
+> `LocalizedMessage` carrying the `lockey_` prefix invariant at the
+> constructor (used by every `Result.Fail` and success-message payload);
+> `Error` refactored to wrap `LocalizedMessage` with a `Code` projection
+> over `Message.Key`; `Result<T>` extended with `IResultBase`, success-message
+> overload, and the static `Result.FailFor<T>(error)` factory ADR-0032's
+> `ValidationBehavior` consumes; `Entity<TId>` (append-only / audit
+> aggregate base) + `AuditableEntity<TId>` (mutable aggregate base with
+> `CreatedAt` / `CreatedBy` / `UpdatedAt` / `UpdatedBy` / `DeletedAt` /
+> `DeletedBy` / `Version` plus the `IsDeleted` projection);
+> `ISoftDelete` + `IOptimisticConcurrency` marker interfaces;
+> `IDomainEvent : INotification` + `DomainEvent` base + `IHasDomainEvents`
+> aggregate-side collector; cursor-first pagination
+> (`CursorPagination` / `Page<T>` / `PageInfo` matching Standards 04
+> § Pagination). Vogen 7.0.0 wired per ADR-0023 with
+> `LearnStackVogenDefaults.IdMask` carrying the canonical
+> `EfCoreValueConverter | SystemTextJson | TypeConverter` mask;
+> `IAggregateRoot<TId>` / `IHasId<TId>` interfaces require `TId :
+> IStronglyTypedId<Guid>` so future module aggregates inherit the
+> constraint. Unit / architecture / contract suites all green in CI; the
+> `VogenIdEmissionTests` smoke test asserts the emitter pipeline
+> (Vogen `[ValueObject<Guid>]` → `IStronglyTypedId.Value` → JSON
+> round-trip → `TypeConverter` round-trip) end-to-end via a synthetic
+> `TestId` in the test project.
+> Review pass folded in (commit `7c9133a`): `Entity<TId>` equality carries
+> transient + cross-runtime-type guards; `Result.FailFor<TResponse>` returns
+> the concrete `TResponse` via reflection (not `Result<TResponse>`);
+> `Error.Code` is the unprefixed stable identifier projected from
+> `Message.Key`; `Error.Details` flows `LocalizedMessage` lists so the prefix
+> invariant covers field-level errors; `Result<T>.Ok` rejects null;
+> `UserId` is a SharedKernel-level Vogen value object used by
+> `AuditableEntity<TId>` instead of raw `Guid`; `DomainEvent.EventId` /
+> `OccurredAt` are `required init`; `MarkCreated` throws on second call;
+> `SoftDelete` bumps `UpdatedAt` for monotonic last-touched;
+> `CursorPagination` validates `Limit > 0` at the ctor. Standards 01
+> § Dependency Direction grows a "Build-time-only exceptions" sub-section
+> for the EF Core + MediatR references SharedKernel requires. Unit /
+> architecture / contract suites all green in CI.
+>
+> **Packet 3 — Cross-cutting foundation ✅**
+> The [ADR-0032](../decisions/0032-exception-handling-logging-and-observability.md)
+> surface is wired end to end via the
+> [wire-cross-cutting-foundation](../../.claude/skills/wire-cross-cutting-foundation/SKILL.md)
+> skill. Shipped:
+>
+> - L1 `LearnStackExceptionHandler : IExceptionHandler` registered through
+>   `services.AddExceptionHandler<T>()` + `app.UseExceptionHandler()`;
+>   `ShouldCapture(ex)` switch drives the Sentry-vs-OTel boundary per
+>   Standards 09 (`OperationCanceledException` + client-error
+>   `ProviderException` skip capture).
+> - Eight-step MediatR pipeline in `LearnStack.Application/Pipeline/`:
+>   `Validation` + `Logging` are full implementations; `AuditLog` ships the
+>   try / `ExceptionDispatchInfo` rethrow shell (audit-write lights up in
+>   Packet 9 when `IAuditStore` lands); `TenantContext` shell short-circuits
+>   with `Result.Fail(tenant_mismatch)` until the resolver middleware arrives
+>   in Packet 7; `Authorization` / `Transaction` / `OutboxFlush` pass-through
+>   shells whose registration order is the binding part. Order encoded in
+>   `MediatRPipelineRegistration.CanonicalBehaviorOrder` and asserted by the
+>   `MediatR_Pipeline_Order_Matches_Canonical_Sequence` architecture test.
+> - `Result<T>.ToActionResult()` extension in `LearnStack.Api.Common`
+>   alongside `ProblemDetailsFactory` + `HttpStatusMap`; explicit at every
+>   future controller endpoint per Standards 09.
+> - `LearnStackException` hierarchy in `LearnStack.SharedKernel/Errors/`:
+>   `DomainException`, `InfrastructureException`, `ProviderException` (with
+>   `IsClientError` flag), `TenantContextMissingException`.
+>   `LearnStackException-DomainExceptionThrow` Roslyn analyzer under
+>   `backend/analyzers/LearnStack.Analyzers/` flags `throw new DomainException`
+>   in `Domain` + `Application` (warning class in Phase 02a, escalates to
+>   error after Phase 03 exit per ADR-0032 § Sub-decision 4).
+> - `IProviderResilience<TPort>` socket in
+>   `LearnStack.SharedKernel/Resilience/` + Polly v8
+>   `ResiliencePipeline` builder in
+>   `LearnStack.Infrastructure.Resilience/`. Pipeline = retry (only
+>   `InfrastructureException` + non-client `ProviderException`) → circuit
+>   breaker → timeout → bulkhead. Configuration shape:
+>   `appsettings.Resilience:<portName>:` (sample lit up under
+>   `liveclass`, `payment`, `storage`, `search`). Per-adapter decoration is
+>   the adapter's responsibility — the socket is what adapters consume in
+>   Phase 02b+ via the [add-provider-adapter](../../.claude/skills/add-provider-adapter/SKILL.md)
+>   skill. Hub HTTP clients excluded per Sub-decision 5.
+> - Serilog primary logger wired in `LearnStack.Api/Composition/CrossCuttingFoundationExtensions.cs`
+>   with `WriteTo.Console(RenderedCompactJsonFormatter)` +
+>   `WriteTo.OpenTelemetry(OTLP gRPC)`. The OTel `LoggerProvider` is
+>   intentionally **not** registered alongside per ADR-0032 § Sub-decision 8.
+> - OpenTelemetry SDK with `AspNetCore` + `HttpClient` +
+>   `EntityFrameworkCore` instrumentations + the OTLP exporter, plus the
+>   singleton `TenantContextSpanProcessor` from
+>   `LearnStack.Infrastructure.Observability/` that enriches every span
+>   with `tenant.id` / `organization.id` / `user.id` / `correlation.id` /
+>   `module` from the singleton
+>   `ITenantContextAccessor` (`AsyncLocal<ITenantContext?>`-backed).
+> - `IErrorTrackingProvider` socket in `LearnStack.SharedKernel/Observability/`
+>   with three implementations in `LearnStack.Infrastructure.ErrorTracking/`:
+>   `NoOpErrorTracker` (Development), `SentryErrorTracker` (SaaS / Dedicated /
+>   SelfHostedOnline-with-DSN), `LocalFileErrorTracker`
+>   (SelfHostedAirGapped, writes JSON envelopes to a configured directory).
+>   Composition-root branching by `DeploymentMode` per Standards 20 table.
+>   Sentry SDK is referenced only by the ErrorTracking project — enforced
+>   by the `Modules_Do_Not_Reference_Sentry_SDK_Directly` architecture test.
+> - Architecture tests green (`backend/tests/LearnStack.Tests.Architecture/CrossCuttingFoundationTests.cs`):
+>   `MediatR_Pipeline_Order_Matches_Canonical_Sequence`,
+>   `IExceptionHandler_Registered_AtStartup`,
+>   `OTel_Pipeline_Includes_TenantContextSpanProcessor`,
+>   `Logging_Goes_Through_Microsoft_Extensions_Logging`,
+>   `Modules_Do_Not_Reference_Sentry_SDK_Directly`,
+>   `Adapters_Wrap_Provider_Exceptions`,
+>   `IErrorTrackingProvider_Is_Singleton`. Unit tests green for
+>   `ValidationBehavior` (returns `Result.Fail(validation_failed)`,
+>   never throws `ValidationException`), `AuditLogBehavior` (preserves
+>   stack via `ExceptionDispatchInfo`), `TenantContextBehavior`
+>   (short-circuits unresolved context), `TenantContextSpanProcessor`
+>   (`OnStart` is null-safe and enriches resolved spans),
+>   `ProviderResilience<TPort>` (retries non-client failures, skips
+>   client-error retries), `HttpStatusMap` (mirrors Standards 09 table),
+>   `ResultExtensions.ToActionResult()` (Problem Details shape),
+>   `LocalFileErrorTracker` (writes the JSON envelope).
+> - Initial validation (pre-review): `LearnStack.Tests.Unit` 111/111,
+>   `LearnStack.Tests.Architecture` 25/25, `LearnStack.Tests.Contract` 1/1,
+>   `LearnStack.Tests.Integration` 5/5 green under `CI=true`. Superseded by
+>   the post-review-3/4 counts below.
+>
+> Review fixes (commit `<follow-up>`):
+>
+> - **B1** — Sentry DSN now reads via the new `ISecretProvider` socket
+>   (`LearnStack.SharedKernel/Secrets/`) with `ConfigurationSecretProvider`
+>   as the Phase 02a default; Packet 5 swaps in `DaprSecretProvider` for
+>   Vault. ADR-0032 § Sub-decision 9 contract honoured.
+> - **B2** — Serilog pipeline gains `CorrelationContextEnricher`
+>   (copies tenant / org / user / correlation / module from
+>   `ITenantContextAccessor` onto every log event) +
+>   `RedactSensitiveFieldsEnricher` (scrubs password / token / secret /
+>   DSN / JWT / authorization / SSN / TCKN / card-number tokens before
+>   the formatter touches them). `LocalFileErrorTracker` redacts the
+>   same token set on `CapturedContext.AdditionalTags`.
+> - **M1** — `ProblemDetailsFactory.For(Exception)` routes status through
+>   `HttpStatusMap.For(Exception)` so `ProviderException(IsClientError:true)`
+>   returns 400 instead of falling through to 503 via the carried Error's
+>   default code.
+> - **M2** — L1 handler now skips `Activity.AddException` for
+>   `ProviderException(IsClientError:true)` per Standards 09 § Sentry vs
+>   OpenTelemetry table — `SetStatus(Error)` only, no exception event.
+> - **M3** — All 14 module Domain + Application csproj files now reference
+>   `LearnStack.Analyzers` via `OutputItemType="Analyzer"`. Future
+>   `throw new DomainException(...)` in any module fails the analyzer.
+> - **M4** — Polly `IProviderResilience<TPort>` pipeline now consumes
+>   `BulkheadOptions` via `Polly.RateLimiting`'s
+>   `AddRateLimiter(ConcurrencyLimiterOptions)`; the silent-dead config
+>   gap is closed.
+> - **N1** — `ProblemDetailsFactory` projects nested
+>   FluentValidation property paths (`Address.Street`) and acronyms
+>   (`URLValue`) to the right camelCase shape via
+>   `JsonNamingPolicy.CamelCase`.
+> - **N2** — `ToActionResult()` returns `ProblemDetailsActionResult`
+>   which builds the body inside `ExecuteResultAsync(ActionContext)`, so
+>   the sanctioned `(await Send(...)).ToActionResult()` shape populates
+>   `Instance` + `correlationId` without the caller threading
+>   `HttpContext`.
+> - **N3 / A6** — `LocalFileErrorTracker` file names suffix a Guid for
+>   guaranteed uniqueness in same-millisecond bursts; `stackalloc` is
+>   capped at 128 chars so a multi-KB inbound `traceparent` cannot blow
+>   the stack.
+> - **A5** — `AuditLogBehavior` catch filter excludes
+>   `OperationCanceledException` so client disconnects no longer churn
+>   warning logs / future audit rows.
+> - **A7** — `MediatRPipelineRegistration.CanonicalBehaviorOrder`
+>   documentation explicitly notes "7 behaviors + the handler at the
+>   innermost position = the 8 canonical steps".
+> - **A8** — `ProblemDetailsFactory` strips the `_failed` suffix from
+>   the Problem `type` URL (matches the Standards 09 § API Surface
+>   example: `/validation`, not `/validation_failed`).
+> - **A11** — New HTTP-level integration tests in
+>   `LearnStack.Tests.Integration/CrossCuttingFoundationHttpTests` exercise
+>   the L1 handler + ValidationBehavior end-to-end via
+>   `WebApplicationFactory<Program>` and a synthetic test controller. The
+>   Standards 21 catalogue row for
+>   `ValidationBehavior_DoesNotThrow_ValidationException` is updated to
+>   "unit + integration".
+> - **A12** — `LearnStackExceptionHandler` is `internal sealed` — only
+>   the framework's `AddExceptionHandler<T>()` instantiates it; tests
+>   reach the type via `InternalsVisibleTo`.
+> - **A13** — `TenantContextSpanProcessor` stringifies Guid tags
+>   (`tenant.id` / `organization.id` / `user.id`) so the wire format is
+>   stable across exporters.
+> - **S1** — `MediatR_Pipeline_Order_Matches_Canonical_Sequence` test
+>   asserts a hardcoded behavior-type sequence, not the production
+>   `CanonicalBehaviorOrder` list, so an accidental list reorder cannot
+>   sneak past.
+> - **SU1** — L1 handler skips the body write on
+>   `OperationCanceledException` / cancelled `CancellationToken`; the
+>   client has already disconnected.
+> - **SU4** — `TenantContextBehavior.AllowsUnresolvedContext` predicate
+>   carries a TODO documenting the Packet 7 marker-attribute seam
+>   (`[AllowsUnresolvedTenantContext]`).
+> - New architecture test `Modules_Do_Not_Reference_DeploymentMode` lit
+>   up — catalogue entry existed since ADR-0020 but had no implementation
+>   until now.
+>
+> Review-2 fixes:
+>
+> - **N4** — `CrossCuttingFoundationExtensions.SelectSecretProvider`
+>   becomes the single composition-root site that picks the
+>   `ISecretProvider` implementation per `DeploymentMode`. Both the DI
+>   registration and the local `AddLearnStackErrorTracking` argument
+>   read the same instance. Packet 5's `DaprSecretProvider` swap now
+>   touches one line, not two.
+> - **SU5** — `SensitiveTokenCatalog` in
+>   `LearnStack.SharedKernel/Secrets/` is the single source of truth for
+>   the sensitive-property-name token list. Both
+>   `RedactSensitiveFieldsEnricher` and
+>   `LocalFileErrorTracker.RedactSensitiveTags` consume
+>   `SensitiveTokenCatalog.IsSensitive(...)` so the two redaction
+>   surfaces cannot drift. The catalogue now includes `vkn` (Vergi
+>   Kimlik Numarası — Turkish corporate tax number, common for
+>   instructor-owned sole proprietorships) alongside `tckn`.
+> - **SU6** — `RedactSensitiveFieldsEnricher` remarks carry a dated
+>   TODO naming the Packet 7+ Roslyn analyzer that should extend
+>   `LearnStack.Analyzers` to flag string-interpolated
+>   `throw new ...Exception($"...{token}...")` patterns in `Domain` +
+>   `Application` projects. Runtime redaction covers logs / OTLP / Sentry
+>   tags; the analyzer closes the last gap (secrets in exception
+>   messages) at compile time.
+> - **SU7** — `HttpStatusMap.For(Exception)` carries a rationale comment
+>   for the non-IETF `499` "client closed request" status: matches
+>   Nginx / IIS / Envoy / APISIX behaviour, keeps client disconnects
+>   off the error-budget axis, and points at the L1 handler's skip-body
+>   contract. If a future ADR pins a different code, the one comment
+>   block is the seam to change.
+>
+> Review-3/4 fixes:
+>
+> - **H1 (blocker)** — the `DomainExceptionThrow` analyzer used a hyphenated
+>   Roslyn diagnostic id, which Roslyn rejects (`AD0001` crash at report
+>   time → CI build break under `TreatWarningsAsErrors` the first time a
+>   `DomainException` is thrown). Fixed: diagnostic id is now `LS0001`
+>   (valid identifier); `LearnStackException-DomainExceptionThrow` is
+>   retained as the human-readable rule name. `LS0001` is listed in
+>   `WarningsNotAsErrors` until the Phase 03 escalation so a legitimate
+>   aggregate-invariant throw does not break CI. New
+>   `DomainExceptionThrowAnalyzerTests` (`LearnStack.Tests.Unit`) run the
+>   analyzer over synthetic compilations and assert `LS0001` is emitted
+>   (no `AD0001`). Recorded as [ADR-0032 Amendment 1](../decisions/0032-exception-handling-logging-and-observability.md);
+>   Standards 21 naming convention + analyzer entry updated.
+> - **Provider error body/status consistency** — `HttpStatusMap.For(Exception)`
+>   now derives the HTTP status from the carried `Error.Code` for every
+>   `LearnStackException`, instead of special-casing
+>   `ProviderException.IsClientError → 400`. `IsClientError` is purely an
+>   observability concern (it gates Sentry capture), so a bare provider
+>   failure is `dependency_unavailable` → 503 and an adapter surfacing a
+>   provider 4xx passes an explicit `Error` (e.g. `validation_failed` → 400);
+>   either way body code and status agree. Tests updated to assert both.
+> - **Redaction over-match + nesting** — `SensitiveTokenCatalog.IsSensitive`
+>   now matches on word-segment boundaries (camelCase / `_ . -`) instead of
+>   raw substrings, so `ClassName` / `BusinessName` are no longer redacted
+>   by the `ssn` token while `Password` / `ApiKey` / `SSNToken` still are.
+>   `RedactSensitiveFieldsEnricher` recurses into destructured objects,
+>   dictionaries, and sequences so a sensitive field nested in a
+>   non-sensitive top-level property (`User.Password`) is scrubbed; lazy
+>   reconstruction keeps clean events allocation-free. New
+>   `SensitiveTokenCatalogTests` + `RedactSensitiveFieldsEnricherTests`.
+> - **OTel naming + air-gapped** — the manual `AddSource` / `AddMeter`
+>   filters use the documented lowercase `learnstack.*` convention (matching
+>   the `learnstack.mediatr` ActivitySource without relying on
+>   case-insensitive wildcard matching). `WireSerilog` / `WireOpenTelemetry`
+>   now take `DeploymentMode`; `SelfHostedAirGapped` never wires the network
+>   OTLP exporters (no-egress contract), with a dated TODO for the
+>   `/var/learnstack/otel/` file target deferred to Phase 11 ops.
+> - **M1** — new `Handlers_Return_Result` architecture test asserts every
+>   `IRequestHandler<,TResponse>` has `TResponse : IResultBase`, so a
+>   raw-DTO handler can't silently bypass the pipeline (validation / audit /
+>   tenant-context + RLS). Vacuous today, active when handlers land.
+> - **L4** — the Serilog enrichers are resolved from DI (the singletons
+>   registered in `AddLearnStackObservabilityServices`) instead of being
+>   `new()`'d in the pipeline, so there are no dead registrations.
+> - **Docs** — `Domain_Methods_Do_Not_Throw_For_Expected_Cases` marked
+>   **deferred** in Standards 21 (the `LS0001` analyzer already enforces the
+>   rule at build time; the report-walking architecture test lands with
+>   module domain code in Packet 6+). LoggingBehavior activity-name doc,
+>   `correlationId`-as-full-traceparent in Standards 09/10, and the
+>   `IMeterFactory.Create("learnstack.<module>")` example in architecture 33
+>   reconciled with the code.
+> - **Skipped (with reason)** — the resilience pipeline order
+>   (retry → breaker → timeout → bulkhead) is left as-is: it is faithful to
+>   ADR-0032 § Sub-decision 5's stated order. Whether the concurrency
+>   limiter should sit outermost (to cap total in-flight including retries,
+>   per the `Microsoft.Extensions.Resilience` standard handler) is an
+>   ADR-level question for a future amendment, not a code defect in this
+>   packet.
+>
+> Validation after review-3/4: `dotnet build LearnStack.slnx` (CI=true)
+> clean; `LearnStack.Tests.Unit` 154/154, `LearnStack.Tests.Architecture`
+> 26/26, `LearnStack.Tests.Integration` 5/5, `LearnStack.Tests.Contract`
+> 1/1 green. (CI's `dotnet format --verify-no-changes` step also gates the
+> backend job — run `dotnet format LearnStack.slnx --verify-no-changes`
+> locally before pushing.)
+>
+> **Deferred follow-ups carried out of Packet 3** (each is recorded in its
+> owning packet/phase below so it does not slip; no separate issue tracker
+> needed — the roadmap is the backlog):
+>
+> - **Strongly-typed IDs for `ITenantContext` + `CapturedContext`** →
+>   **Packet 7** (after the `TenantId` / `OrganizationId` Vogen value
+>   objects land in Packet 6). Both contracts use raw `Guid` in Packet 3
+>   because those VOs don't exist yet (only `UserId` does); they convert
+>   together in one pass to avoid a half-typed intermediate.
+> - **`[AllowsUnresolvedTenantContext]` marker attribute** for the
+>   `TenantContextBehavior` opt-out (tenant-provisioning / platform-admin
+>   commands) → **Packet 7**.
+> - **`TransactionBehavior` / `OutboxFlushBehavior` shells light up** →
+>   **Packet 6** (UoW transaction, per-module `DbContext`) and **Phase 02b**
+>   (outbox enrolment) respectively.
+> - **`AuthorizationBehavior` shell lights up** + **`LS0001` analyzer
+>   severity escalates Warning → Error** (and is removed from
+>   `WarningsNotAsErrors`) → **Phase 03 exit**.
+> - **`Domain_Methods_Do_Not_Throw_For_Expected_Cases`** report-walking
+>   architecture test → **Packet 10** (needs module domain code to walk;
+>   until then the `LS0001` analyzer only does partial detection — it
+>   reports every direct `throw new DomainException(...)` in `Domain` /
+>   `Application` as a build-time Warning, non-blocking under
+>   `WarningsNotAsErrors` until the Phase 03 exit escalation above, and does
+>   not replace the broader report-walking test).
+> - **Air-gapped OTLP file target** (`/var/learnstack/otel/`) → **Phase 11**
+>   ops (the no-egress branch already prevents network export in
+>   `SelfHostedAirGapped`; the file sink needs an exporter-package decision,
+>   the operational controls in
+>   [phase-11-production-hardening.md](phase-11-production-hardening.md#observability),
+>   and a test asserting no network telemetry exporter is ever wired under
+>   `SelfHostedAirGapped`).
+> - **"No secrets in exception messages" Roslyn analyzer** (compile-time
+>   complement to the runtime redactor) → **Phase 02b or later** (code TODO
+>   in `RedactSensitiveFieldsEnricher`).
+> - **Resilience pipeline order** (should the concurrency limiter sit
+>   outermost to cap total in-flight incl. retries?) → **future ADR-0032
+>   amendment**; the current order is faithful to ADR-0032 § Sub-decision 5.
+>
+> ---
+>
+> **Restructure (2026-08-08).** Packets 4–10 below were re-scoped after a
+> four-report audit of the corpus. Packets 0–3 are shipped and their records
+> above are unchanged.
+>
+> **Two things in the Packet 2 and Packet 3 records above are now known to be
+> wrong. Do not act on them; Packet 3b corrects both:**
+>
+> - The Packet 3 `TenantContextBehavior` TODO names a `DbConnectionInterceptor`
+>   as the mechanism for setting the Row Level Security session variables. That
+>   is the wrong option. Interceptors fire when the connection opens, not when
+>   the transaction starts, and `set_config(..., true)` is transaction-local —
+>   so the value would be discarded before the query it protects ever runs. The
+>   GUCs are set with `SET LOCAL` **inside the ambient transaction**, per
+>   [Security Standards § Tenant Context](../standards/11-security.md), and
+>   Packet 7 implements it.
+> - The Packet 2 Shared Kernel shipped three defects that get more expensive
+>   with every consumer: `Results.Unit` collides with `MediatR.Unit`,
+>   `Result<T>` carries no `[MemberNotNullWhen]`, and `Entity<TId>` implements
+>   neither `IEquatable<>` nor `operator ==` so every comparison boxes. All
+>   three are repaired in Packet 3b, before the first handler exists.
+>
+> Separately, [ADR-0032](../decisions/0032-exception-handling-logging-and-observability.md)'s
+> `IProviderResilience<TPort>` registration **example** does not compile, but
+> the code Packet 3 actually shipped is correct — read the code, not the ADR
+> snippet. ADR-0032 Amendment 2 records this.
+>
+> Three things moved:
+>
+> - **Correctness moved earlier.** The Row Level Security template published in
+>   [ADR-0003](../decisions/0003-tenant-isolation-defense-in-depth.md) Amendment 1 and
+>   copied into three further documents created two *permissive* policies, which
+>   PostgreSQL combines with `OR` — making every tenant-wide row visible across
+>   tenants. [ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md)
+>   corrects it, and Packet 6 is now the packet that must not be written against
+>   the old template. Audit durability moved with it:
+>   [ADR-0033](../decisions/0033-audit-durability-model.md) makes MUST-class
+>   audit a durable intent inside the business transaction, which is also what
+>   stops the corrected RLS policy from silently rejecting every audit insert.
+> - **Additive infrastructure moved later.** Per
+>   [ADR-0035](../decisions/0035-demand-gated-infrastructure.md), Packet 5 now
+>   ships the foundation **ports and their default implementations**; the Dapr,
+>   Kafka, APISIX and Vault adapters land in
+>   [Phase 11](phase-11-production-hardening.md) against written trigger
+>   conditions. Packet 8 drops from eight customization aggregates to two, and
+>   Packet 9's `audit_log` partitioning moves to Phase 11.
+> - **Proof moved earlier.** The second tenant — the artefact that tests the
+>   genericity claim — moves from [Phase 10](phase-10-english-learning-mvp.md)
+>   into Packet 7, where two seed tenants already exist for isolation testing.
+>   [Phase 02d](phase-02d-walking-skeleton.md) then renders both of them in a
+>   browser.
+>
diff --git a/docs/roadmap/phase-02b-events-auth.md b/docs/roadmap/phase-02b-events-auth.md
index 257c066..76fcaff 100644
--- a/docs/roadmap/phase-02b-events-auth.md
+++ b/docs/roadmap/phase-02b-events-auth.md
@@ -1,177 +1,414 @@
-# Phase 02b: Events, Outbox, and Identity Integration
+# Phase 02b: Identity Integration, Session, and Events
 
 ## Goal
 
-Wire the **outbox dispatcher** and **identity integration** on top of the Phase 02a
-foundation. Phase 02a already shipped `IEventBus`, `ICacheService`, `ISecretProvider`,
-the Dapr sidecar in dev compose, and the audit infrastructure; this phase delivers the
-durable outbox pattern (write → poll → dispatch via `IEventBus` to Dapr pub/sub →
-Kafka), the per-module inbox guard, Hangfire background job conventions, and Keycloak
-OIDC integration sufficient for admin login from the studio.
+Give the platform a signed-in user and a durable cross-module event path.
 
-Phase 02c (LearnStack Hub Foundation, separate `learnstack-hub` repo) runs in
-**parallel** with this phase — both depend only on the 02a sockets and do not block
-each other.
+[Phase 02d](phase-02d-walking-skeleton.md) already put two tenants' public sites in a
+browser without either. That is why it runs first: an anonymous read path needs a host
+resolver, tenant context and Row Level Security — not an identity provider. Everything
+after it needs to know who is asking, and needs a state change in one module to reach
+another module without a shared table.
 
-Decisions made in this phase:
+Phase 02b delivers three things and corrects four defects that would otherwise be built
+on top of:
+
+- **Identity integration** — Keycloak OIDC for the `learnstack` realm, JWKS validation,
+  and a BFF cookie session, so that the request pipeline can carry a `UserId` and the
+  `AuthorizationBehavior` shell has something to authorize in
+  [Phase 03](phase-03-identity-admin.md).
+- **The durable outbox dispatcher** over `outbox_messages` — the table itself shipped in
+  [Phase 02a Packet 6](phase-02a-kernel-tenancy.md), where its schema and its ownership
+  by LearnStack were the one-way door. Dispatch is the additive half, and it lands here.
+- **Hangfire background jobs** with a tenant-aware `JobActivator`, so that work outside
+  an HTTP request still runs inside a tenant context.
+
+### What this phase is not
+
+**It is not the phase where a transport is chosen.** `IEventBus` and `InProcessEventBus`
+shipped in [Phase 02a Packet 5](phase-02a-kernel-tenancy.md) as a **first-class
+transport** — the same `IIntegrationEventHandler<T>`, the same `IInboxGuard`, the same
+tenant-context restoration as any durable path. Phase 02b adds *durability and
+redelivery* on top of that transport; it does not add a second one.
+
+The Dapr pub/sub and Kafka adapters are **not in this phase**. They are demand-gated to
+[Phase 11](phase-11-production-hardening.md) by
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md), whose trigger is "a second
+process needs to consume an integration event". Until that is true, a cross-process
+broker moves an event from one thread to another thread in the same process, through two
+network hops and a serialization boundary, and adds a fourteenth service to the
+development loop. [ADR-0006 Amendment 1](../decisions/0006-events-and-outbox.md) and
+[ADR-0014](../decisions/0014-adopt-dapr.md) remain the decision about **which** transport
+LearnStack uses when it needs one; ADR-0035 decides **when**, and the answer is not this
+phase.
+
+Because the transport is swappable, everything this phase builds — the outbox row shape,
+the claim protocol, the partition key, the inbox guard, the dead-letter contract — is
+written against `IEventBus`, not against Dapr. Swapping the implementation later changes
+one composition-root registration.
+
+Decisions made or referenced in this phase:
 
 - [ADR-0004 Authentication Strategy](../decisions/0004-authentication-strategy.md)
-  (Accepted: self-hosted Keycloak; Amendment 1 adds the `learnstack-hub` realm — that
-  realm itself ships in Phase 02c)
-- [ADR-0006 Events and Outbox](../decisions/0006-events-and-outbox.md) (Accepted;
-  Amendment 1: Dapr pub/sub as the dispatch transport)
+  (Accepted: self-hosted Keycloak. Amendment 1 adds the `learnstack-hub` realm; that
+  realm belongs to the Hub repository and is not built here.)
+- [ADR-0006 Events and Outbox](../decisions/0006-events-and-outbox.md)
 - [ADR-0010 Cross-Module Communication](../decisions/0010-cross-module-communication.md)
-  (Amendment 1: outbox dispatch target is Dapr pub/sub)
-- [ADR-0014 Adopt Dapr](../decisions/0014-adopt-dapr.md) (sidecar wired in 02a; the
-  dispatch path lands here)
 - [ADR-0032 Exception Handling, Logging, and Observability Architecture](../decisions/0032-exception-handling-logging-and-observability.md)
-  (outbox / Hangfire correlation propagation; Hub HTTPS surface correlation
-  middleware)
+- [ADR-0033 Audit Durability Model](../decisions/0033-audit-durability-model.md)
+  (supersedes ADR-0016)
+- [ADR-0035 Demand-Gated Infrastructure](../decisions/0035-demand-gated-infrastructure.md)
 
 ## Scope
 
-### Event Infrastructure
-
-- Domain event publishing (in-process, MediatR-style, internal to the module).
-- Integration event publishing via outbox; **`OutboxProcessor`** (BackgroundService)
-  polls every 200ms with `FOR UPDATE SKIP LOCKED` and dispatches through `IEventBus`
-  (which wraps Dapr pub/sub → Kafka in non-dev modes, in-process publisher in dev).
-- **Lights up the Phase 02a Packet 3 `OutboxFlushBehavior` shell** — on a
-  success-`Result` the behavior enrols `IOutbox` messages in the current
-  unit-of-work transaction so they ship after commit (per
-  [ADR-0006](../decisions/0006-events-and-outbox.md) +
-  [ADR-0032 § Sub-decision 12](../decisions/0032-exception-handling-logging-and-observability.md)).
-- Retry with exponential backoff (1s, 5s, 30s, 5min, 1h); dead-letter after max
-  attempts (5). Dead-letter visible via the `OutboxStatusEndpoints` admin API.
-- Outbox row attaches `tenant_id`, `organization_id?`, `correlation_id`, `event_id`,
-  `occurred_at`, versioned `type` to every event (per
-  [ADR-0032 § Sub-decision 12](../decisions/0032-exception-handling-logging-and-observability.md)).
-  The `correlation_id` column is the **full W3C `traceparent` header string**
-  (`00-<32-hex trace-id>-<16-hex parent-span-id>-<2-hex flags>`), not a
-  bare UUID — so the consumer can rehydrate the trace with one call:
-  `ActivityContext.TryParse(row.CorrelationId, traceState: null, out var parentCtx)`
-  then `_activitySource.StartActivity(name, kind, parentCtx)`. Storing the
-  full string keeps the deserialisation deterministic and avoids any
-  "how do we map a UUID back to a trace-id?" ambiguity. Consumer handler
-  also restores `ITenantContext` from the envelope before the inner
-  pipeline runs, so end-to-end trace + tenant context stay continuous.
-- Versioned integration event types in `<Module>.Application.Contracts`, inheriting
-  `IntegrationEventBase`.
-- Per-module **`inbox_messages`** table + `IInboxGuard`. Every
-  `IIntegrationEventHandler<T>` invokes `IsAlreadyProcessedAsync` before business
-  logic and `MarkAsProcessed` inside the same `DbContext` SaveChanges as the business
-  write.
-- Tenant + organization context restored in every event handler scope from the event
-  envelope.
-- A worked sample flow (e.g., synthetic `PlatformPingedV1`) demonstrates end-to-end
-  dispatch + idempotent consumption.
-- Cross-instance L1 cache invalidation rides on `learnstack.cache.invalidation` topic
-  (modules with their own L1 caches subscribe here).
-
-Outbox table schema, dispatcher behaviour, and dead-letter handling:
-[Events and Outbox](../architecture/15-event-and-outbox.md), enforced by
-[Architecture Standards](../standards/01-architecture-standards.md) and
-[Infrastructure Stack Standards](../standards/20-infrastructure-stack.md).
-
-### Background Jobs
-
-- Hangfire wired with Postgres storage; queue naming policy.
-- Job activator restores tenant context from the payload before any work runs.
-- Job payloads without `TenantId` fail at enqueue time (architecture test enforces).
-- Dead-letter handling for poisoned jobs.
-- Outbox dispatcher runs as a recurring job; pending count and dispatch latency are surfaced as metrics.
-
-### Identity Integration
-
-LearnStack identity domain (`Membership`, `Role`, `Permission`, `Invitation`) lands in
-Phase 03. Phase 02b delivers the **authentication** plumbing for the `learnstack`
-realm (the `learnstack-hub` realm is a separate concern that ships in Phase 02c):
-
-- Keycloak realm configuration for `learnstack`.
-- OIDC PKCE flow integration with the .NET API (JWT validation against Keycloak JWKS,
-  key caching + rotation handling).
-- BFF callback handler in the Next.js app for the cookie session (HttpOnly + Secure +
-  SameSite=Lax).
-- Silent refresh through the BFF; the frontend never holds a refresh token.
-- Seed users for development (platform admin + 2 tenant admins per tenant, each tenant
-  with 2 organizations, idempotent on `make seed`).
-- Active access-token TTL ≤ 1 hour; refresh flow tested end to end.
-- Tenant + organization claim cross-check: a request whose host-derived
-  `(tenant_id, organization_id)` disagrees with the JWT claims returns 404.
-
-LearnStack does not implement password hashing, password reset rendering, MFA
-enrolment flows, or refresh-token rotation. Those live in Keycloak; see
-[13-identity-and-auth.md](../architecture/13-identity-and-auth.md) for the split.
-
-### Audit Coverage Wiring
-
-The cross-cutting audit pipeline lit up in Phase 02a; Phase 02b now adds the
-**event-stream consumers** to it: outbox dead-letter entries write through it,
-Keycloak-mirrored events (`user.created`, `password.reset.requested`) flow as
-`learnstack.identity.user` Dapr events into the audit module's consumers, and
-platform-admin scope entries from auth-related operations get the same treatment.
-The `AuditEntry` aggregate is owned by the **Audit module** ([ADR-0016](../decisions/0016-audit-log-subsystem.md))
-and shipped in Phase 02a — Phase 03 plugs Identity's events into it, not the other
-way around.
-
-See [18-audit-coverage.md](../standards/18-audit-coverage.md).
-
-### Architecture Tests (event + identity layer)
-
-In addition to Phase 02a's rules, this phase adds:
-
-- Integration event types are JSON-serialisable records inheriting
-  `IntegrationEventBase` (`Integration_Events_Inherit_From_IntegrationEventBase`).
+### Durable outbox dispatch
+
+The producer side already exists: a handler calls `IOutbox.EnqueueAsync`, the row is
+written in the same `SaveChanges` as the aggregate change, and the Phase 02a Packet 3
+`OutboxFlushBehavior` shell lights up here to enrol those messages on a success-`Result`.
+What lands in this phase is the consumer side.
+
+- **`OutboxProcessor`** as a `BackgroundService` polling `outbox_messages` with
+  `FOR UPDATE SKIP LOCKED`, dispatching each message through `IEventBus`, and marking it
+  processed.
+- **Retry with exponential backoff** — 1s, 5s, 30s, 5min, 1h — driven by
+  `available_after`, with `attempts` and `last_error` recorded on the row.
+- **Per-module `inbox_messages` table and `IInboxGuard`.** Every
+  `IIntegrationEventHandler<T>` calls `IsAlreadyProcessedAsync` before business logic and
+  `MarkAsProcessed` inside the same `SaveChanges` as the business write. Dispatch is
+  at-least-once; the inbox is what makes consumption effectively once.
+- **Tenant and organization context restored from the envelope** in every handler scope,
+  before the inner pipeline runs. A consumer that runs without tenant context writes
+  rows that Row Level Security rejects, or worse, does not.
+- **Versioned integration event types** in `<Module>.Application.Contracts`, inheriting
+  `IntegrationEventBase`, carrying `EventId`, `TenantId`, `OccurredAt` and
+  `CorrelationId`. The `correlation_id` column holds the **full W3C `traceparent`
+  string**, not a bare UUID, so a consumer rehydrates the trace with
+  `ActivityContext.TryParse(row.CorrelationId, traceState: null, out var parentCtx)` and
+  starts its activity from `parentCtx`
+  ([ADR-0032 § Sub-decision 12](../decisions/0032-exception-handling-logging-and-observability.md)).
+- **A worked sample flow** — a synthetic `PlatformPingedV1` published by one module and
+  consumed idempotently by another — so the path is exercised before a real consumer
+  depends on it.
+
+#### Correction: the dispatcher's claim is released before the work is done
+
+The dispatcher published in
+[Events and Outbox](../architecture/15-event-and-outbox.md) opens a transaction, selects
+a batch with `FOR UPDATE SKIP LOCKED`, and then **commits that transaction immediately to
+release the row locks** before publishing anything. `SKIP LOCKED` only skips rows that are
+locked *right now*. The instant the claiming transaction commits, those rows are unlocked
+and still have `processed_at IS NULL`, so a second `OutboxProcessor` — the horizontal
+scaling the same document advertises — selects the same batch and publishes every message
+a second time.
+
+The document states the opposite as an invariant: *"multiple OutboxProcessor instances
+across pods can run concurrently without double-dispatch."* That claim is false as
+written, and it is the kind of false claim that is expensive later: consumers are built
+against it, and the duplicates only appear under the load that makes them hardest to
+diagnose.
+
+This phase fixes the mechanism and deletes the claim. Two implementations are acceptable
+and the packet picks one:
+
+- **Hold the claim across the batch.** The selecting transaction stays open until every
+  message in the batch is dispatched and marked. Simple and correct; the cost is that a
+  long batch holds locks and a crashed processor's rows wait for the transaction to be
+  reaped.
+- **Add a lease column.** The claim is a durable `UPDATE` that stamps
+  `locked_by` / `locked_until` inside a short transaction; dispatch runs outside it, and
+  a sweeper reclaims expired leases. More moving parts, but a crash releases work in
+  bounded time rather than at connection teardown.
+
+Either way, the guarantee LearnStack states is **at-least-once dispatch with
+consumer-side idempotency**, not "exactly once". `IInboxGuard` is not an optimisation
+around a rare duplicate — it is the correctness mechanism, and the dispatcher must not
+claim to make it redundant.
+
+#### Correction: ordering is promised through partition keys that nothing sets
+
+[Events and Outbox](../architecture/15-event-and-outbox.md) states that per-partition
+ordering is preserved "by partition-keying on the aggregate id when ordering is
+required". No integration event carries a partition key, `IntegrationEventBase` declares
+none, and no publish path sets one. The promise is unenforceable, and a consumer that
+depends on seeing `Created` before `Updated` gets whichever order the transport happens
+to produce.
+
+This phase specifies it:
+
+- `IntegrationEventBase` exposes a **`PartitionKey`** derived from the aggregate
+  identifier, defaulting to `TenantId` when an event is not aggregate-scoped. A tenant's
+  events therefore never interleave with another tenant's on a shared partition.
+- `IEventBus.PublishAsync` passes the key to the transport. `InProcessEventBus` uses it
+  to serialize handler invocation per key; the Phase 11 Kafka adapter maps it to the
+  message key.
+- An architecture test asserts every `IIntegrationEvent` resolves a non-null partition
+  key, so a new event cannot silently opt out of ordering.
+
+#### Correction: nothing says what happens to a subscriber that exhausts its retries
+
+The corpus describes the **producer** dead-letter path — max attempts, terminal state,
+manual review through the `OutboxStatusEndpoints` admin API. It says nothing about the
+**consumer** side: a handler that throws on every delivery. Without a written fate, the
+default is an infinite redelivery loop that consumes the dispatcher and hides the
+failure in log noise.
+
+The subscriber-side contract lands here:
+
+- A handler failure is retried on the same backoff schedule as a dispatch failure, with
+  the attempt count tracked **per (event, consumer)** in `inbox_messages` — not per
+  event, because one poisoned consumer must not dead-letter an event that four other
+  consumers handled cleanly.
+- After the maximum attempts, the `(event, consumer)` pair moves to a terminal
+  `dead_lettered` state with the last exception recorded. Redelivery stops.
+- Dead-lettering emits a metric and writes a MUST-class audit entry through
+  [ADR-0033](../decisions/0033-audit-durability-model.md)'s durable path — a silently
+  dropped integration event is a data-integrity event, not a log line.
+- Replay is an explicit operator action through the admin API, and it re-enters the
+  normal inbox-guarded path.
+
+#### Observability
+
+- `learnstack_outbox_pending_count{tenant_id}` (gauge) and dispatch-latency histogram.
+- `learnstack_outbox_dispatch_failed_total{event_type}` and
+  `learnstack_inbox_dead_lettered_total{module, event_type}` (counters).
+- The dispatcher runs as a recurring job with its pending count and lag surfaced as
+  metrics, so a stalled dispatcher is visible without reading the table.
+
+Cross-instance L1 cache invalidation (`learnstack.cache.invalidation`) is **declared as a
+topic and consumed in-process** here, but it has no cross-instance effect until more than
+one application instance runs — which is precisely
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md)'s trigger for the
+distributed `ICacheService` adapter in [Phase 11](phase-11-production-hardening.md).
+Wiring the subscription now means the Phase 11 adapter has a consumer waiting rather than
+a code path to invent.
+
+### Background jobs
+
+- Hangfire wired against PostgreSQL storage, with a queue-naming policy.
+- A tenant-aware `JobActivator` that restores `ITenantContext` from the payload before
+  any work runs, populating the same singleton `ITenantContextAccessor` the HTTP path
+  uses.
+- Job payloads without `tenant_id` and `correlation_id` **fail at enqueue time**, not at
+  activation. The failure is loud and belongs to the caller who can fix it.
+- Poisoned-job handling matches the outbox dead-letter contract above: bounded retries,
+  a terminal state, a metric, and an operator-initiated replay.
+- The `OutboxProcessor` runs under this scheduler rather than as a bare loop, so its
+  liveness is observable through the same surface as every other recurring job.
+
+### Identity integration — the `learnstack` realm
+
+The LearnStack identity **domain** (`User`, `Membership`, `Role`, `Permission`,
+`Invitation`) lands in [Phase 03](phase-03-identity-admin.md). This phase delivers only
+the authentication plumbing, for the tenant-facing `learnstack` realm. The
+`learnstack-hub` operator realm belongs to the Hub repository and is referenced from
+[Phase 02c](phase-02c-hub-foundation.md).
+
+- Keycloak realm configuration for `learnstack`, with the seed users a development
+  environment needs: a platform admin plus two tenant admins per seed tenant, across both
+  organizations of each tenant, idempotent under `make seed`.
+- OIDC Authorization Code flow with PKCE against the .NET API: JWT validation against the
+  Keycloak JWKS endpoint, with key caching and rotation handling.
+- A BFF callback handler in `frontend/apps/web` establishing the cookie session
+  (`HttpOnly`, `Secure`, `SameSite=Lax`). Silent refresh runs through the BFF; the
+  browser never holds a refresh token.
+- Access-token TTL capped at one hour, with the refresh path tested end to end.
+- **Tenant and organization claim cross-check.** A request whose host-derived
+  `(tenant_id, organization_id)` disagrees with the JWT claims returns 404 — not 403,
+  which would confirm the resource exists — and writes an audit entry.
+
+LearnStack does not implement password hashing, password-reset rendering, MFA enrolment,
+or refresh-token rotation. Those live in Keycloak; the split is described in
+[Identity and Auth](../architecture/13-identity-and-auth.md).
+
+#### Correction: the realm emits no `tenant_id` claim at all
+
+The cross-check above is the **first** layer of tenant defense-in-depth
+([ADR-0003](../decisions/0003-tenant-isolation-defense-in-depth.md)), and today it cannot
+run. `infra/keycloak/realms/learnstack.json` stores `tenant_id` as a **user attribute**
+and declares **zero protocol mappers**. Keycloak does not put user attributes into tokens
+unless a mapper says so, so every issued JWT reaches the API with no `tenant_id` claim.
+Any code that reads one reads `null`, and a cross-check against `null` either fails every
+request or — the likelier outcome under delivery pressure — is written to skip when the
+claim is absent, which turns the whole layer off.
+
+Two changes, both in the realm import:
+
+- Add an **`oidc-usermodel-attribute-mapper`** on the `learnstack-api` client (or on a
+  dedicated client scope shared by `learnstack-api` and `learnstack-web`) that projects
+  the `tenant_id` user attribute into the access token and the ID token, with
+  `access.token.claim` and `id.token.claim` both enabled, typed as `String`. The same
+  treatment applies to `organization_id` once memberships exist in
+  [Phase 03](phase-03-identity-admin.md).
+- Change the seeded value from the slug `"tenant-a"` to the seed tenant's **UUID**. The
+  claim is consumed as a `TenantId` — a Vogen value object over `Guid` introduced in
+  [Phase 02a Packet 6](phase-02a-kernel-tenancy.md) — so a slug cannot be parsed and the
+  cross-check throws instead of comparing. The seed script and the realm import read the
+  same identifiers, so the two cannot drift.
+
+An integration test asserts the shape rather than the configuration file: a token issued
+by the dev realm for a seed user carries a `tenant_id` claim that parses to the seed
+tenant's `TenantId`. A realm export that loses the mapper fails the test.
+
+### Audit coverage wiring
+
+The audit pipeline itself lit up in [Phase 02a Packet 9](phase-02a-kernel-tenancy.md)
+under [ADR-0033](../decisions/0033-audit-durability-model.md). This phase adds its
+event-stream feeds:
+
+- Outbox and inbox dead-letter transitions write through `IAuditStore`.
+- Keycloak-mirrored identity events (`user.created`, `password.reset.requested`) arrive
+  as `learnstack.identity.user` integration events and are consumed by the Audit module's
+  handlers.
+- Platform-admin scope entries opened by authentication-related operations get the same
+  treatment.
+
+The `AuditEntry` aggregate is owned by the **Audit** module and shipped in Phase 02a;
+[Phase 03](phase-03-identity-admin.md) plugs the Identity domain into it, not the reverse.
+See [Audit Coverage Standards](../standards/18-audit-coverage.md).
+
+### Compile-time secret leakage (carried out of Phase 02a Packet 3)
+
+Packet 3 shipped runtime redaction — `RedactSensitiveFieldsEnricher` scrubs sensitive
+tokens from log events, and `LocalFileErrorTracker` scrubs the same set from error
+envelopes, both through the single `SensitiveTokenCatalog`. Runtime redaction covers
+logs, OTLP and error-tracker tags. It does not cover an exception **message**, because
+by the time the string exists the secret is already inside it, and a Problem Details
+response can carry it to a client.
+
+This phase adds the compile-time complement: a second diagnostic in
+`LearnStack.Analyzers`, id **`LS0002`**, that flags interpolated or concatenated
+`throw new …Exception($"…{token}…")` patterns in `Domain` and `Application` where the
+interpolated symbol's name matches `SensitiveTokenCatalog`. It ships as a Warning listed
+in `WarningsNotAsErrors`, escalating to Error alongside `LS0001` at the
+[Phase 03](phase-03-identity-admin.md) exit — the same cadence, for the same reason:
+a rule that breaks the build before its violations are cleaned up gets suppressed rather
+than obeyed.
+
+The analyzer's own tests run it over synthetic compilations and assert that `LS0002` is
+reported and no `AD0001` crash occurs — the failure mode
+[ADR-0032 Amendment 1](../decisions/0032-exception-handling-logging-and-observability.md)
+records for `LS0001`.
+
+### Architecture tests
+
+New rules this phase introduces, in addition to the Phase 02a set:
+
+- `Integration_Events_Inherit_From_IntegrationEventBase` — every `IIntegrationEvent` is a
+  JSON-serialisable record extending the base.
+- `Integration_Event_Handlers_Use_InboxGuard` — every consumer calls
+  `IInboxGuard.IsAlreadyProcessedAsync` before business logic.
+- `Integration_Event_Handler_Restores_Tenant_Context` — the handler scope has
+  `ITenantContext.IsResolved == true` before the inner pipeline runs.
+- `Outbox_Row_Carries_Correlation_Context` — every persisted row has non-null `tenant_id`
+  and `correlation_id`.
+- `OutboxProcessor_NeverBlocks_OnSingleMessageFailure` — one poisoned message does not
+  prevent the rest of its batch from processing.
+- `Outbox_Claim_IsHeld_Until_Dispatch_Completes` — **new.** Two concurrent processors over
+  one pending batch dispatch each message exactly once. This is the test that would have
+  caught the defect above, and its absence is why the false invariant survived review.
+- `Integration_Event_Declares_PartitionKey` — **new.** Every `IIntegrationEvent` resolves
+  a non-null partition key.
+- `Hangfire_Job_Payloads_Include_TenantId` — enqueue rejects payloads missing `tenant_id`
+  or `correlation_id`.
 - Read-model tables follow the `public_<module>_<concept>` naming.
-- Hangfire job payloads include `tenant_id` (and `organization_id?` where the job
-  touches org-scoped state).
-- Provider SDK types (LiveKit, Stripe, Keycloak, Kafka, Vault) are not imported in
+- Provider SDK types (Keycloak, Kafka, Vault, LiveKit, Stripe) are not imported in
   `Domain` or `Application`.
-- Outbox writes happen inside the same transaction as the originating domain change
-  (interceptor-instrumented).
-- `Integration_Event_Handlers_Use_InboxGuard` — every consumer invokes the inbox
-  guard before processing.
-- `OutboxProcessor_NeverBlocks_OnSingleMessageFailure` — integration test asserts one
-  poisoned message doesn't prevent others in the batch from processing.
-- `Outbox_Row_Carries_Correlation_Context` — every persisted outbox row has
-  non-null `tenant_id` and `correlation_id` per
-  [ADR-0032 § Sub-decision 12](../decisions/0032-exception-handling-logging-and-observability.md).
-- `Hangfire_Job_Payloads_Include_TenantId` — enqueue-time guard rejects
-  payloads missing `tenant_id` or `correlation_id`.
-- `Integration_Event_Handler_Restores_Tenant_Context` — handler scope has
-  `ITenantContext.IsResolved == true` before the inner pipeline runs.
+- Outbox writes happen inside the same transaction as the originating domain change.
+
+`Dapr_PubSub_TopicNames_FollowConvention` applies in this phase to the topic-name
+resolver that `IEventBus` uses; its `[Topic]`-attribute scan activates with the Dapr
+adapter in [Phase 11](phase-11-production-hardening.md). The topic naming convention
+`learnstack.{module}.{aggregate}` is transport-independent and is enforced from here.
 
-The three identifiers above are catalogued (assertion, type, source) in
-[21-architecture-tests-catalogue.md § Cross-cutting: error handling, logging, observability](../standards/21-architecture-tests-catalogue.md);
-the catalogue is the canonical reference, this list is a Phase 02b
-shipping checklist.
+The catalogue in
+[Architecture Tests Catalogue](../standards/21-architecture-tests-catalogue.md) is the
+canonical reference for every identifier above, including the two new rows; this list is
+a Phase 02b shipping checklist.
 
 ## Deliverables
 
-- Domain and integration event infrastructure with a sample flow.
-- Outbox dispatcher with retry, backoff, dead-letter, and dashboards.
-- Hangfire wired with tenant-aware job activator.
-- Keycloak OIDC integration sufficient for admin login from the studio.
-- BFF session cookie established; silent refresh works.
-- Audit pipeline accepts entries from platform-admin scope and from Keycloak-mirrored events.
-- Full architecture test suite green.
+- A durable `OutboxProcessor` with a claim protocol that survives two concurrent
+  instances, exponential backoff, and a producer-side dead-letter state.
+- A subscriber-side dead-letter contract: per-`(event, consumer)` attempt tracking, a
+  terminal state, an audit entry, a metric, and operator-initiated replay.
+- `PartitionKey` on `IntegrationEventBase`, threaded through `IEventBus` and honoured by
+  `InProcessEventBus`.
+- Per-module `inbox_messages` tables and `IInboxGuard`, with tenant-context restoration
+  in every handler scope.
+- A worked end-to-end sample flow: publish → outbox → dispatch → idempotent consumption.
+- Hangfire on PostgreSQL storage with a tenant-aware `JobActivator` and an enqueue-time
+  guard.
+- Keycloak `learnstack` realm with a working `oidc-usermodel-attribute-mapper` for
+  `tenant_id`, UUID-valued seed attributes, and idempotent seed users.
+- OIDC PKCE login through the BFF, JWKS validation with rotation handling, cookie session,
+  and silent refresh.
+- Host-vs-JWT tenant cross-check returning 404 and writing an audit entry.
+- `LS0002` analyzer shipping as a Warning, with its own analyzer tests.
+- Corrections landed in [Events and Outbox](../architecture/15-event-and-outbox.md): the
+  false "no double dispatch" invariant deleted, the claim protocol described as
+  implemented, the partition-key requirement made concrete, and the subscriber dead-letter
+  fate written down.
 
 ## Completion Criteria
 
-- Domain + integration event infrastructure works with at least one sample flow end to end (publish → outbox → dispatch → idempotent consumer).
-- A failed dispatch retries with backoff and dead-letters cleanly after the max attempt.
-- A background job rejects payloads without a tenant id.
-- A login flow against Keycloak completes in dev with the seed admin user; the JWT validates against JWKS; refresh works through the BFF.
-- A request with mismatched host tenant vs JWT tenant returns 404 and writes an audit entry.
+- A sample integration event travels publish → outbox → dispatch → consumer and is
+  handled exactly once, with the consumer's business write and its inbox marker committing
+  together.
+- Two `OutboxProcessor` instances running against one pending batch dispatch every message
+  exactly once; the test that proves it is in CI.
+- Two events for the same aggregate arrive at their consumer in publish order.
+- A handler that throws on every delivery reaches a terminal `dead_lettered` state for
+  that consumer only, leaves other consumers of the same event unaffected, emits a metric,
+  and produces an audit entry.
+- A failed dispatch retries on the documented backoff and dead-letters cleanly at the
+  maximum attempt.
+- A background job enqueued without a tenant id fails at enqueue time.
+- A login against the dev Keycloak realm with a seed user completes through the BFF; the
+  JWT validates against JWKS; refresh works; and the token **carries a `tenant_id` claim
+  that parses to the seed tenant's `TenantId`**.
+- A request whose host-derived tenant disagrees with its JWT tenant returns 404 and writes
+  an audit entry.
+- `LS0002` reports on a synthetic violation and produces no `AD0001`.
 - The full architecture test suite is green and not skippable.
 
 ## Risks
 
-- Forgetting tenant context in background jobs; mitigated by the job activator + enqueue guard.
-- Treating outbox as an optional layer ("we'll add it for module X later"); mitigated by architecture test requiring same-transaction writes.
-- Mixing Keycloak claims with LearnStack-side authorization decisions — see [13-identity-and-auth.md](../architecture/13-identity-and-auth.md) for the strict split.
-- Keycloak as a sign-in bottleneck; mitigated by HA from the start with PostgreSQL as Keycloak's store and JWKS caching.
+- **The claim fix is treated as a detail.** Both candidate implementations are a few
+  dozen lines, which makes them easy to defer past a green build — single-instance
+  development never reproduces the failure. The concurrency test is the mitigation, and
+  it lands with the fix, not after it.
+- **The partition key is added but never meaningful.** A key derived from the event's own
+  `EventId`, or one defaulted per event type, satisfies the architecture test and orders
+  nothing. Reviewers check that the key is the aggregate identifier.
+- **Dead-lettering becomes invisible.** A terminal state that only appears in a database
+  column is a silent data loss. The metric and the MUST-class audit entry are part of the
+  deliverable, not follow-up work.
+- **The Keycloak mapper regresses on the next realm export.** Realm JSON is regenerated by
+  hand and by the Keycloak admin console, and a mapper is easy to lose. The integration
+  test asserts the issued token, not the file.
+- **Tenant context is forgotten in background jobs.** Mitigated by the `JobActivator` plus
+  the enqueue-time guard, and by the architecture test that covers both.
+- **The outbox is treated as optional** — "module X will adopt it later". Mitigated by the
+  architecture test requiring same-transaction outbox writes, which fails the moment a
+  module publishes outside its unit of work.
+- **Keycloak becomes a sign-in bottleneck.** Mitigated by PostgreSQL-backed Keycloak
+  storage and JWKS caching from the start.
+- **Keycloak claims leak into authorization decisions.** Keycloak authenticates;
+  LearnStack authorizes. The split is in
+  [Identity and Auth](../architecture/13-identity-and-auth.md), and
+  [Phase 03](phase-03-identity-admin.md) is where the LearnStack side is built.
 
 ## Phase Exit Decision
 
-Phase 03 (Identity domain, RBAC, Admin Foundation) can begin when the event/outbox baseline, background-job tenant context, and Keycloak login are stable and green in CI.
+[Phase 03](phase-03-identity-admin.md) begins when a seed user can sign in through the
+BFF against the dev realm with a `tenant_id` claim that resolves to a real `TenantId`;
+when the sample integration event flows publish → outbox → dispatch → idempotent
+consumption under two concurrent dispatchers with no duplicate handling; when a poisoned
+consumer dead-letters visibly instead of looping; and when the background-job tenant
+guard and the full architecture suite are green in CI.
+
+[Phase 02c](phase-02c-hub-foundation.md) is unblocked by this phase but does not gate it.
+Phase 02c hangs off the spine and starts only when its own trigger fires — a tenant that
+must be billed or plan-gated
+([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)).
diff --git a/docs/roadmap/phase-02c-hub-foundation.md b/docs/roadmap/phase-02c-hub-foundation.md
index 61d14d9..86e62db 100644
--- a/docs/roadmap/phase-02c-hub-foundation.md
+++ b/docs/roadmap/phase-02c-hub-foundation.md
@@ -1,264 +1,378 @@
-# Phase 02c: LearnStack Hub Foundation (parallel track)
-
-> **Status (2026-05-21).** Phase 02c in progress.
->
-> **P02c-0 — Repository bootstrap ✅**
-> Sibling `learnstack-hub` git repository created (GitHub:
-> https://github.com/cemililik/LearnStack-Hub). Backend solution
-> (`LearnStack.Hub.slnx`) with 7 core projects + 4 test projects builds
-> green (0 warnings, 0 errors); 4 architecture tests + 1 smoke test pass.
-> Frontend pnpm monorepo (`apps/operator-portal` + `packages/{config,sdk,ui}`)
-> typechecks, lints, and builds. Hub-side compose stack
-> (Dapr placement + sidecar on 50006 / 3501 / 50002, APISIX on 9180,
-> Postgres init for the `learnstack_hub` database) declared; shares
-> LearnStack core's Postgres / Valkey / Vault / Kafka / Keycloak / Mailpit
-> via `host.docker.internal`. Hub CI workflow (backend + frontend + meta
-> + secret-scan) mirrors LearnStack core's shape. Documentation skeleton
-> in place: `docs/architecture/contract-with-learnstack.md` points to
-> LearnStack-side authority for the four-endpoint contract surface;
-> `docs/decisions/` reserves the `HUB-NNNN` Hub-internal ADR series;
-> `docs/glossary.md` covers Hub-specific terms. No Hub domain code yet —
-> that lands in P02c-1.
->
-> **P02c-1 — Hub Domain Core ⏳ Next**
-> `LearnStackTenant` (mirror), `Plan`, `HubSubscription`, `Entitlement`
-> aggregates + per-module DbContexts + initial EF migrations; Hub-side
-> equivalent of LearnStack core P02a-2 (SharedKernel: `Result<T>`,
-> `Entity<TId>`, `IClock`, Vogen) + P02a-3 (cross-cutting foundation).
-> `Hub_NeverStores_TenantData` and
-> `Hub_Modules_DoNotReference_LearnStack_Internals` architecture tests
-> become real once modules land.
->
-> **P02c-2 — Hub-side Internal API + Outbound `LearnStackApiClient` ⏳**
-> `POST /api/v1/internal/license/verify` + `POST /api/v1/usage/report`
-> handlers, mTLS + signed JWT + HMAC body-signature chain, Hub OpenAPI
-> spec generation + frontend SDK generation.
->
-> **P02c-3 — LearnStack core PR ⏳ blocked on LearnStack P02a-5/6/7/9**
-> `HubEntitlementProvider` (production-complete) + `IUsageReporter`
-> adapter on the LearnStack side; APISIX `/api/internal/*` stub activation;
-> `POST /api/internal/tenants` + `PUT /api/internal/tenants/{id}/entitlements`
-> handlers; Dapr `learnstack.hub.entitlement` consumer; architecture test
-> catalogue migration of `LearnStack_Modules_DoNotReference_Hub` +
-> `IEntitlementProvider_Implementations_Are_Three` +
-> `NullEntitlementProvider_NotRegistered_OutsideDevelopment`.
+# Phase 02c: Hub Integration — LearnStack side
+
+> **Status (2026-05-21).** **P02c-0 — Repository bootstrap ✅**
+> The sibling `learnstack-hub` git repository exists
+> (GitHub: https://github.com/HodeTech/LearnStack-Hub). Backend solution
+> (`LearnStack.Hub.slnx`, 7 core projects + 4 test projects) builds green;
+> frontend pnpm monorepo (`apps/operator-portal` + `packages/{config,sdk,ui}`)
+> typechecks, lints and builds; Hub CI (backend + frontend + meta + secret-scan)
+> mirrors LearnStack's shape; documentation skeleton in place, including the
+> `HUB-NNNN` Hub-internal ADR series. No Hub domain code.
 >
-> **P02c-4 — Operator Portal MVP ⏳**
-> Keycloak `learnstack-hub` realm OIDC + PKCE BFF login, tenant list
-> (filterable), tenant detail (entitlement read-only viewer), plan list
-> (read-only), dashboard stub. MFA enforced.
+> **Status (2026-08-08).** The Hub plan moved to the Hub repository. `P02c-1`
+> through `P02c-7` — Hub domain core, Hub-side internal API, operator portal,
+> custom-domain lifecycle, licence keys and the Hub exit gate — are now planned,
+> tracked and shipped in `../LearnStack-Hub/docs/roadmap/`, one document per packet.
+> The `P02c-N` identifiers are unchanged; they are load-bearing across both
+> repositories. This document is no longer a status mirror. It carries **only the
+> LearnStack-side work**, which is the half that lands in this repository.
 >
-> **P02c-5 — Custom Domain Lifecycle ⏳**
-> `CustomDomain` aggregate + state machine, DNS-01 / HTTP-01 challenge
-> runner, Let's Encrypt provider adapter,
-> `learnstack.hub.custom-domain.activated/.deactivated/.renewed` event
-> publish; LearnStack-side `platform_host_to_tenant` mirror handler per
-> ADR-0022 Amendment 1 (Hub never writes LearnStack K8s state).
+> **`P02c-1` on the Hub side shipped on 2026-08-09**, after a review against the
+> restructured corpus found that its domain code conflicts with none of
+> ADR-0033/0034/0035 — its entitlement wire shape already carries `grace_until`
+> and `generation`, it hosts no endpoint, and its audit behavior is a shell.
 >
-> **P02c-6 — License Key (functional skeleton) ⏳**
-> `LicenseKey` aggregate + RSA-2048 keypair + `.lic` file format
-> (JWT-style claims); LearnStack-side `SignedLicenseKeyEntitlementProvider`
-> skeleton.
->
-> **P02c-7 — End-to-End Exit Gate ⏳**
-> Full SaaS scenario + Self-Hosted bootstrap rehearsal; Hub + LearnStack
-> architecture suites green.
+> **The Hub track is frozen from `P02c-2` onward**, on this phase's trigger — see
+> [Goal](#goal). That is where the contract surface ADR-0034 redrew actually gets
+> built, so it is the packet the freeze protects; holding P02c-1's merged artefact
+> would have bought nothing and cost a SharedKernel reconciliation that grows with
+> every packet on top. The Hub repository's `p02c-1-hub-domain-core.md` records
+> the same state.
 
 ## Goal
 
-Bootstrap the **separate `learnstack-hub` repository** and stand up the foundation
-surface that gates SaaS / Dedicated deployments and feeds the entitlement projection
-in LearnStack core. This phase runs **in parallel with Phase 02b**: both depend only
-on the 02a sockets (`IEntitlementProvider`, `IHostToTenantResolver`,
-`platform_entitlement_cache`, `platform_host_to_tenant`) and do not block each other.
-
-Phase 02c does **not** complete the Hub. Billing, invoicing, marketplace, and richer
-operator UI ship in Phase 09b (Hub Billing) and the optional Phase 12 (Hub
-Marketplace). Phase 02c delivers the **minimum viable Hub** — enough to provision a
-tenant, push an entitlement projection, register a custom domain, and verify a
-license — so that the SaaS deployment mode is exercisable end-to-end before MVP exit.
-
-Decisions made / referenced in this phase:
-
-- [ADR-0004 Authentication Strategy](../decisions/0004-authentication-strategy.md)
-  Amendment 1 — `learnstack-hub` Keycloak realm.
-- [ADR-0019 LearnStack Hub](../decisions/0019-learnstack-hub.md) — separate
-  repository, mTLS internal API, operator portal.
+Build LearnStack's side of the LearnStack ↔ Hub boundary: the adapters that read
+entitlement from a control plane, the internal-API handlers that a control plane calls,
+and the projection tables both write into.
+
+**This phase hangs off the spine; it never sits in it.** LearnStack runs on
+`NullEntitlementProvider` — every feature enabled, no limits — from
+[Phase 02a Packet 9](phase-02a-kernel-tenancy.md) onward, and every phase from
+[Phase 02d](phase-02d-walking-skeleton.md) through [Phase 11](phase-11-production-hardening.md)
+works without a Hub. Nothing in the product spine waits on this document.
+
+**The trigger is written down.**
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md) gates the Hub-backed
+`IEntitlementProvider` on a single observable condition:
+
+> **A tenant must be billed or plan-gated.**
+
+Until that is true, a control plane adds a second repository, a second deployment, an
+mTLS certificate chain, and a network dependency in front of a feature-flag read — in
+exchange for gating features that nobody is paying differently for. When it becomes true,
+this phase starts, and the frozen Hub track resumes at `P02c-2`.
+
+Everything Hub-side — `Plan`, `HubSubscription`, `Entitlement`, `LicenseKey`,
+`CustomDomain`, `CompliancePolicy`, the `learnstack-hub` Keycloak realm, the operator
+portal, the DNS/ACME challenge runner, and Hub's own observability — is planned and built
+in the Hub repository under `../LearnStack-Hub/docs/roadmap/`. Do not restate it here; a
+second copy of a plan is a plan that will be wrong.
+
+Decisions this phase implements:
+
+- [ADR-0034 Hub Contract Surface Invariant](../decisions/0034-hub-contract-surface-invariant.md)
+  — the two invariants, the real endpoint set, the normative entitlement read path, and
+  the rule that host resolution never calls the Hub. **This ADR carries the endpoint
+  table; it is not repeated below.**
+- [ADR-0035 Demand-Gated Infrastructure](../decisions/0035-demand-gated-infrastructure.md)
+  — the trigger above, and the reason APISIX and Dapr are not prerequisites for it.
+- [ADR-0019 LearnStack Hub](../decisions/0019-learnstack-hub.md) — separate repository,
+  mTLS-guarded internal API. Its "closed at four endpoints" rule is replaced by ADR-0034.
+- [ADR-0021 Feature-Based Entitlement](../decisions/0021-feature-based-entitlement.md) —
+  the projection contract and the grace window.
 - [ADR-0020 Triple Deployment + Hybrid License](../decisions/0020-triple-deployment-hybrid-license.md)
-  — `Plan`, `HubSubscription`, license-key issuance.
-- [ADR-0021 Feature-Based Entitlement](../decisions/0021-feature-based-entitlement.md)
-  — entitlement projection contract.
-- [ADR-0022 Custom Domain + TLS](../decisions/0022-custom-domain-tls.md) — DNS-01 /
-  HTTP-01 issuance, APISIX hot-reload contract.
+  — the three `IEntitlementProvider` implementations.
+- [ADR-0022 Custom Domain + TLS](../decisions/0022-custom-domain-tls.md), as amended by
+  ADR-0034: certificate material leaves the entitlement payload.
 
 ## Scope
 
-### Repository Bootstrap (`learnstack-hub`)
-
-- New repo, modular monolith layout mirroring LearnStack core:
-  `backend/`, `frontend/`, `docs/`, `infra/`.
-- .NET 10 + ASP.NET Core API + EF Core + PostgreSQL + Hangfire stack.
-- Next.js 16 App Router for the operator portal (`learnstack-hub-web`).
-- Independent CI/CD pipeline; independent versioning. Build-time-only dependency on a
-  later-extracted `packages/ui` design system (not required Day 1 — duplicate
-  primitives if needed).
-
-### Hub-Side Aggregates
-
-Per [ADR-0019](../decisions/0019-learnstack-hub.md) and
-[24-learnstack-hub.md](../architecture/24-learnstack-hub.md):
-
-- `Plan` (catalog of plans + their feature / limit / compliance defaults).
-- `HubSubscription` (per-tenant plan binding + lifecycle state).
-- `Entitlement` (snapshot of the tenant's effective feature + limit + compliance set;
-  the source of truth for the projection LearnStack core mirrors into
-  `platform_entitlement_cache`).
-- `LicenseKey` (RSA-2048 signed `.lic` file metadata for Self-Hosted).
-- `CustomDomain` (per-tenant host + DNS / TLS validation state).
-- `CompliancePolicy` (per-plan cap set: regions, retention, audit retention floor).
-- `Tenant` mirror (a thin Hub-side view of the LearnStack-side `Tenant` aggregate;
-  Hub is the authoritative source for *plan-related* fields, LearnStack is the
-  authoritative source for *operational* fields).
-
-### Internal API Surface (mTLS + signed JWT + HMAC)
-
-The four-endpoint surface per
-[ADR-0019](../decisions/0019-learnstack-hub.md) and
-[20-infrastructure-stack.md § Hub HTTPS Contract Surface](../standards/20-infrastructure-stack.md):
-
-- `POST /api/internal/tenants` — Hub → LearnStack: create tenant + default organization.
-- `PUT /api/internal/tenants/{id}/entitlements` — Hub → LearnStack: push entitlement
-  projection (replaces `platform_entitlement_cache` row + invalidates cache via
-  `learnstack.hub.entitlement` Dapr event).
-- `POST /api/v1/internal/license/verify` — LearnStack → Hub: phone-home verification
-  for SaaS / Dedicated.
-- `POST /api/v1/usage/report` — LearnStack → Hub: usage telemetry (concurrent
-  classroom sessions, monthly minutes, storage GB, etc.).
-
-The endpoint set is **closed at four**; adding a fifth requires a new ADR.
-
-All four:
-- mTLS with LearnStack-internal CA-signed client certs.
-- Signed JWT (RS256), `aud=learnstack-internal`, `exp ≤ 5min`, replay-protected via
-  short-TTL inbox on `jti`.
-- HMAC-SHA256 body signature in `X-Signature` with per-deployment shared secret.
-
-### Keycloak Realm: `learnstack-hub`
-
-- Separate realm from `learnstack` (different user pool, different domain).
-- Operator role hierarchy (`hub-platform-admin`, `hub-operator`, `hub-billing-viewer`).
-- MFA required for every operator account.
-- The realm is **never** trusted by the LearnStack tenant-facing API; the tenant-facing
-  gateway rejects `learnstack-hub` realm tokens.
-
-### Operator Portal (`learnstack-hub-web`)
-
-- Tenant list with filters (plan, status, region).
-- Tenant detail: plan, entitlement projection, custom-domain status, license-key
-  state, usage chart.
-- Plan editor (CRUD on `Plan` and its feature / limit / compliance defaults).
-- Per-tenant entitlement override editor (operators can grant a feature outside the
-  plan default for support cases; every override is audited).
-- Custom-domain admin (register, trigger DNS / HTTP-01 challenge, view validation
-  state).
-- License-key issuance for Self-Hosted tenants (signed `.lic` file download).
-- Operator audit log (every operator action against a tenant resource is audited
-  with `actor.hubOperator = true`).
-
-### Custom-Domain Lifecycle
-
-Per [ADR-0022](../decisions/0022-custom-domain-tls.md):
-
-- DNS-01 challenge for wildcard subdomain certs; HTTP-01 for single-host customs.
-- Let's Encrypt provider adapter (`ITlsCertificateProvider`); pluggable to ZeroSSL /
-  enterprise CA.
-- Successful issuance pushes the host → `(tenant_id, organization_id?)` row to
-  LearnStack core via the internal API, which mirrors into `platform_host_to_tenant`
-  and hot-reloads APISIX's route table.
-
-### License-Key Issuance (Self-Hosted)
-
-Per [ADR-0020](../decisions/0020-triple-deployment-hybrid-license.md):
-
-- RSA-2048 key pair (Hub holds the private key; Self-Hosted instances ship with the
-  public key).
-- Operator issues a `.lic` file with claims: `tenant_id`, `plan_code`, `features`,
-  `limits`, `compliance`, `valid_from`, `valid_until`, `issued_at`, `signature`.
-- Phone-home contract: Self-Hosted instance attempts a verify call every 24h;
-  cached projection survives **30 days** of failed verifications before refusing
-  to operate (the "grace period").
-- Fully air-gapped operation supported: an instance configured with
-  `phone_home_enabled = false` runs purely on the `.lic` file; the operator manually
-  re-issues yearly.
-
-### Hub-Side Observability
-
-- OpenTelemetry stack mirrored from LearnStack core (Tempo / Prometheus / Loki /
-  Grafana).
-- A grafana dashboard for operator portal: tenant count by plan, custom-domain
-  pipeline state, license-verify success rate, entitlement projection push lag.
+Everything below lands in **this** repository. Each item has a Hub-side counterpart
+tracked in `../LearnStack-Hub/docs/roadmap/`.
+
+### `HubEntitlementProvider`
+
+The Hub-backed implementation of `IEntitlementProvider`, in
+`LearnStack.Infrastructure.Hub`. Its read path is **normative** and fixed by
+[ADR-0034](../decisions/0034-hub-contract-surface-invariant.md):
+
+```text
+L1 in-process cache
+  → L2 distributed cache (ICacheService)
+    → platform_entitlement_cache   (durable; carries valid_until and grace_until)
+      → Hub  (POST /api/v1/internal/license/verify)
+```
+
+The ordering is the design, not an optimisation:
+
+- **`platform_entitlement_cache` sits between the caches and the network.** It is durable
+  and it carries `grace_until`, so a Hub outage on a cold cache degrades to the last known
+  projection within its grace window instead of reaching the network on every feature
+  check. Collapsing the grace window into a cache TTL — which is what the corpus described
+  before ADR-0034 — means a process restart during a Hub outage loses the grace period
+  entirely.
+- **Cold start has a defined answer.** A brand-new instance with empty L1 and L2 and no
+  cached row for the tenant does not throw out of a feature-flag check and does not block
+  the request. It resolves against the per-key-class policy below and records the
+  degradation.
+- **Each feature-key class declares fail-open or fail-closed explicitly**, in the key
+  registry, not at the call site. Presentation and convenience keys fail open — a
+  temporarily visible tab is cheaper than a broken page. Keys that gate paid capacity,
+  data retention, or compliance behaviour fail closed. A key with no declared class does
+  not compile.
+- **Writes go through `IEntitlementProvider.RefreshAsync` only.** No module reads or
+  writes `platform_entitlement_cache` directly
+  (`Modules_Do_Not_Read_Entitlement_Cache_Directly`).
+
+`NullEntitlementProvider` stops being registrable outside `Development` once this phase
+lands (`NullEntitlementProvider_NotRegistered_OutsideDevelopment`).
+
+### `entitlement-v1.schema.json`
+
+The projection's wire shape is pinned by a **checked-in JSON Schema** in this repository,
+with an identical copy in the Hub repository, and a **snapshot test in each**. Two
+services that agree on a payload only in prose disagree on it within one release; the
+schema is the artefact that makes a breaking change fail a build instead of a production
+tenant.
+
+- The schema covers the feature set, the limit set, the compliance caps, `expires_at`,
+  `grace_until` and the monotonic `generation`. On the wire the fields are `tier` and
+  `expires_at`; they persist to the `plan_code` and `valid_until` columns of
+  `platform_entitlement_cache` ([21-feature-flags.md](../architecture/21-feature-flags.md)).
+- The LearnStack-side snapshot test asserts that the serialized shape the handler accepts
+  still matches the schema, and that every declared feature key resolves to a registered
+  `FeatureKey` / `LimitKey`.
+- Versioning is in the filename. `entitlement-v2.schema.json` is a new file and a new
+  ADR-gated contract change, not an edit.
+
+### `IUsageReporter`
+
+The outbound adapter for `POST /api/v1/usage/report`. Usage reporting is idempotent and
+best-effort: a dropped usage report is a billing-accuracy problem the Hub reconciles,
+never a reason to fail a tenant's request.
+
+- Reports are enqueued through the outbox path built in
+  [Phase 02b](phase-02b-events-auth.md) rather than sent inline, so a Hub outage produces
+  a dispatch backlog instead of latency on the operation being metered.
+- The adapter is the **only** type holding a usage-reporting Hub client
+  (`Hub_Client_Referenced_Only_By_Named_Adapters`).
+
+### Internal-API handlers LearnStack hosts
+
+LearnStack implements the **Hub → LearnStack** half of the endpoint set enumerated in
+[ADR-0034 § The endpoint set](../decisions/0034-hub-contract-surface-invariant.md) —
+tenant create, entitlement push, status change, termination, usage pull, and host-mapping
+push. The table lives in the ADR and is not duplicated here; both repositories read the
+same list.
+
+Each handler:
+
+- Runs on the **internal listener only** and is unreachable from the public surface
+  (`Internal_API_Endpoints_AreNot_Public`).
+- Enforces the full auth chain unchanged from
+  [ADR-0019](../decisions/0019-learnstack-hub.md): mTLS with a LearnStack-internal CA,
+  an RS256 JWT with `aud=learnstack-internal` and a five-minute expiry, an HMAC-SHA256
+  body signature, and replay protection on `jti`. Failing any one layer is a rejection.
+- Rejects `learnstack` realm tokens outright. The tenant-facing surface likewise rejects
+  `learnstack-hub` realm tokens. The two realms never cross.
+- Runs under `HubCorrelationMiddleware`, which populates `ITenantContextAccessor` for the
+  request so that audit, tracing and Row Level Security behave exactly as they do on the
+  tenant-facing path.
+- Writes a MUST-class audit entry through
+  [ADR-0033](../decisions/0033-audit-durability-model.md)'s durable path. An operator
+  action against a tenant is precisely the class of event that must not be lost.
+
+### The internal route, and why APISIX is not a prerequisite
+
+[ADR-0015](../decisions/0015-api-gateway-apisix.md) stands: when LearnStack needs an edge
+gateway it uses APISIX. [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) gates
+the adapter on a non-development deployment needing edge rate limiting, host routing, or
+JWT pre-validation — and lands it in [Phase 11](phase-11-production-hardening.md).
+
+Until then the internal API is exposed as a **separate ASP.NET Core listener binding** —
+its own port, its own certificate requirement, its own endpoint filter — rather than an
+APISIX route. The security properties are the same and they are enforced in code, which
+is where `Internal_API_Endpoints_AreNot_Public` can see them. When APISIX arrives, the
+route configuration is added in front of a listener that already refuses anything the
+route would have refused.
+
+Two corrections land with the route configuration when it is written, both recorded in
+[API Gateway](../architecture/30-api-gateway.md): the internal route carries no
+`client_secret_ref`, and the route-priority ordering must not let a public route fall
+through to the authenticated catch-all.
+
+### Entitlement invalidation
+
+The Hub publishes `learnstack.hub.entitlement` when a tenant's projection changes, so a
+plan flip reaches `IFeatureFlags.IsEnabledAsync` in seconds rather than at the next TTL
+expiry.
+
+- The **consumer** ships here, as an `IIntegrationEventHandler<T>` using the same inbox
+  guard and tenant-context restoration as every other consumer
+  ([Phase 02b](phase-02b-events-auth.md)).
+- The **transport** is in-process until [Phase 11](phase-11-production-hardening.md), per
+  [ADR-0035](../decisions/0035-demand-gated-infrastructure.md). Cross-process delivery
+  through Dapr and Kafka arrives with the same trigger as everything else on that path —
+  a second process needing to consume an integration event, which a Hub in a separate
+  deployment is.
+- Until the cross-process transport exists, an entitlement push arrives through the HTTP
+  handler (`PUT /api/internal/tenants/{id}/entitlements`), which calls `RefreshAsync`
+  directly. The eager-invalidation event is the optimisation; the HTTP push is the
+  contract.
+- The TTLs are the safety net, not the refresh mechanism: L1 60s, L2 15 minutes as an
+  upper bound.
+
+### `platform_host_to_tenant` mirroring
+
+Host mappings arrive on their own endpoint, `PUT /api/internal/tenants/{id}/host-mappings`,
+and are mirrored into `platform_host_to_tenant`.
+
+One row is **not** pushed: the tenant's own platform subdomain.
+`POST /api/internal/tenants` seeds `{slug}.{platform-domain}` into
+`platform_host_to_tenant` in the same transaction as the tenant row and the default
+organization. It needs no DNS verification and rides the platform wildcard
+certificate, so making it wait on the custom-domain path would leave every
+Hub-provisioned tenant unreachable at the URL the Hub redirects it to — and
+[Standards 20](../standards/20-infrastructure-stack.md) makes an unknown host a 404,
+not a Hub lookup.
+
+Two rules from [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md) are
+load-bearing here:
+
+- **TLS certificate material never travels in this payload, or in the entitlement
+  payload.** The entitlement projection is cached, logged, audited and mirrored; a private
+  key in it is a private key in all four. Certificates move between the Hub-owned and
+  LearnStack-owned secret stores by secret-store replication, and the host-mapping payload
+  references them **by path, not by value**.
+- **Host resolution never calls the Hub.** `IHostToTenantResolver` reads
+  `platform_host_to_tenant` and nothing else; `IHubClient.LookupHostAsync` does not exist.
+  An anonymous page load on a tenant's marketing site must not depend on a control plane
+  being reachable, and the resolver shipped in
+  [Phase 02a Packet 7](phase-02a-kernel-tenancy.md) is already written this way.
+
+### Architecture tests
+
+- `LearnStack_Modules_DoNotReference_Hub` — no module assembly holds a Hub client or URL.
+- `Hub_Client_Referenced_Only_By_Named_Adapters` — only `IEntitlementProvider`,
+  `IUsageReporter` and `IHubTenantSync` implementations may.
+- `Internal_API_Endpoints_AreNot_Public` — `/api/internal/*` is not reachable from the
+  tenant-facing surface.
+- `IEntitlementProvider_Implementations_Are_Three` — Null, Hub-backed, signed licence key;
+  no fourth appears without an ADR.
+- `NullEntitlementProvider_NotRegistered_OutsideDevelopment` — becomes enforceable the
+  moment the Hub-backed implementation exists.
+- `Modules_Do_Not_Read_Entitlement_Cache_Directly` — `platform_entitlement_cache` is
+  read-only to modules, through `IFeatureFlags`.
+
+`Hub_NeverStores_TenantData` is the Hub-side invariant and is asserted in the Hub
+repository, against the Hub schema. Its LearnStack-side counterpart is this list.
+
+### Explicitly not in this phase
+
+| Capability | Owner |
+|---|---|
+| `Plan`, `HubSubscription`, `Entitlement`, `LicenseKey`, `CustomDomain`, `CompliancePolicy` aggregates | Hub repository, `P02c-1` |
+| Hub-side internal API and outbound `LearnStackApiClient` | Hub repository, `P02c-2` |
+| `learnstack-hub` Keycloak realm, operator portal, operator MFA | Hub repository, `P02c-4` |
+| DNS-01 / HTTP-01 challenge runner, ACME provider adapter | Hub repository, `P02c-5` |
+| Licence-key issuance and the `.lic` file format | Hub repository, `P02c-6` |
+| `SignedLicenseKeyEntitlementProvider` (LearnStack side) | Skeleton: Hub repository `P02c-6`, as a coordinated pull request into this repository. Operational hardening: [Phase 11](phase-11-production-hardening.md), on a signed Self-Hosted contract ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)) |
+| APISIX internal route configuration | [Phase 11](phase-11-production-hardening.md) |
+| Dapr / Kafka transport for `learnstack.hub.entitlement` | [Phase 11](phase-11-production-hardening.md) |
+| Custom-domain TLS automation end to end | [Phase 11](phase-11-production-hardening.md) |
+| Hub billing, invoicing, dunning | [Phase 09b](phase-09b-hub-billing.md) → Hub repository |
+| Hub marketplace | [Phase 12](phase-12-hub-marketplace.md) → Hub repository |
 
 ## Deliverables
 
-- Independent `learnstack-hub` repo with CI / CD pipeline.
-- Hub-side aggregates + EF + Postgres schema + Hangfire jobs (DNS validation, license
-  verify, periodic re-push).
-- `learnstack-hub` Keycloak realm with operator role hierarchy.
-- Operator portal (Next.js) deployed at `hub.learnstack.dev` (or equivalent).
-- Internal API on a dedicated APISIX route guarded by mTLS + signed JWT + HMAC.
-- Custom-domain lifecycle: DNS / HTTP-01 challenge runner, Let's Encrypt adapter,
-  push to LearnStack core.
-- License-key issuance UI + signed `.lic` download.
-- LearnStack core's `HubEntitlementProvider` is **production-complete** here
-  (in the LearnStack repo, not the Hub repo — Phase 02c PRs into the LearnStack
-  core).
-- LearnStack core's `SignedLicenseKeyEntitlementProvider` lands here as a
-  **functional skeleton** — RSA signature verification, payload parsing, file-watch
-  reload. The production-hardening pieces (key rotation procedure, signed
-  revocation list distribution, SIGHUP hot-reload runbook, multi-day grace-period
-  load testing) ship in **Phase 11**, per
-  [ADR-0020 Phase 11](../decisions/0020-triple-deployment-hybrid-license.md) and
-  [26-hybrid-license-model.md § 11](../architecture/26-hybrid-license-model.md).
-- End-to-end SaaS scenario rehearsable: operator creates a tenant in Hub → tenant
-  appears in LearnStack core with default organization + projection mirrored → tenant
-  admin can log in and see their plan's feature set in Studio.
+- `HubEntitlementProvider` implementing the ADR-0034 read path, with cold-start fallback
+  and per-key-class fail-open / fail-closed policy resolved from the key registry.
+- `IUsageReporter` adapter dispatching through the outbox.
+- The Hub → LearnStack internal-API handlers, on an internal-only listener, behind the
+  full mTLS + RS256 JWT + HMAC + replay-protection chain.
+- `entitlement-v1.schema.json` checked in, with a snapshot test asserting the accepted
+  payload shape and that every key resolves in the registry.
+- An `IIntegrationEventHandler<T>` for `learnstack.hub.entitlement`, in-process until
+  Phase 11.
+- `IHubTenantSync` — the `PUT /api/internal/tenants/{id}/host-mappings` handler and its
+  `platform_host_to_tenant` mirroring, with certificate material referenced by
+  secret-store path rather than carried by value.
+- Audit coverage for every internal-API handler, MUST-class and durable.
+- The six architecture tests above, green in CI.
+- A `Development`-mode integration suite that runs the whole path against a Hub test
+  double, so the LearnStack side is testable without a Hub deployment.
 
 ## Completion Criteria
 
-- An operator can create a tenant on Hub; within seconds, the tenant exists in
-  LearnStack core with its default organization and the entitlement projection
-  populated.
-- Flipping a feature on the tenant's plan on Hub propagates to the tenant's
-  `IFeatureFlags.IsEnabledAsync` reads within seconds (eager invalidation via Dapr
-  pub/sub).
-- A Self-Hosted instance bootstrapped with a signed `.lic` file runs without phone
-  home; flipping `phone_home_enabled = true` produces successful verify calls.
-- A custom-domain registration on Hub completes the DNS challenge, issues the cert,
-  and the host resolves to the right tenant on LearnStack core through APISIX —
-  end-to-end.
-- The internal API rejects requests missing any of the three security layers
-  (mTLS / JWT / HMAC).
-- The operator portal is unreachable via the `learnstack` realm token; the tenant
-  surface is unreachable via the `learnstack-hub` realm token.
-- The Hub-side architecture test suite is green; the LearnStack-side architecture
-  test `LearnStack_Modules_DoNotReference_Hub` continues to hold.
+- A tenant created through `POST /api/internal/tenants` exists in LearnStack with its
+  default organization, resolves at `{slug}.{platform-domain}` through
+  `platform_host_to_tenant`, and its entitlement projection is populated.
+- An entitlement push through `PUT /api/internal/tenants/{id}/entitlements` changes what
+  `IFeatureFlags.IsEnabledAsync` returns for that tenant within seconds.
+- With the Hub unreachable and L1 and L2 cold, a feature check resolves from
+  `platform_entitlement_cache` inside its `grace_until` window, returns a value, and does
+  not throw.
+- Past `grace_until` with the Hub still unreachable, fail-open keys stay enabled and
+  fail-closed keys are refused — each according to its declared class, and each recorded.
+- A request missing any one of mTLS, the signed JWT, or the HMAC body signature is
+  rejected, and a replayed `jti` is rejected.
+- An `/api/internal/*` request bearing a `learnstack` realm token is rejected; a
+  tenant-facing request bearing a `learnstack-hub` realm token is rejected.
+- A host-mapping push resolves the new host to the right tenant through
+  `platform_host_to_tenant`, with the Hub then taken offline — host resolution is
+  unaffected.
+- No TLS private key appears in `platform_entitlement_cache`, in any log line, or in any
+  audit row. The schema makes this checkable rather than a matter of trust.
+- The `entitlement-v1.schema.json` snapshot tests are green in **both** repositories at
+  the same commit pair.
+- Every architecture test listed above is green.
 
 ## Risks
 
-- **Two-repo coordination drift.** Mitigated by the closed four-endpoint contract;
-  changes to the contract are ADR-gated.
-- **Hub becomes a single point of failure for SaaS tenants.** Mitigated by the
-  15-minute TTL cache on `platform_entitlement_cache` + the cached-projection grace
-  period that lets LearnStack core continue operating during a Hub outage.
-- **mTLS cert / HMAC secret rotation outages.** Mitigated by yearly rotation cadence
-  + dual-key support window during rotation.
-- **Operator portal abuse.** Mitigated by mandatory MFA + every action audited with
-  `actor.hubOperator = true` + rate limit on the internal API.
+- **Two-repository contract drift.** Two teams, two release cadences, one payload.
+  Mitigated by the checked-in schema and the paired snapshot tests, by ADR-0034 as the
+  single endpoint authority for both repositories, and by the coordination protocol below.
+- **The Hub creeps onto the hot path.** The failure this phase most needs to prevent is a
+  Hub outage taking anonymous tenant pages down. Mitigated structurally: host resolution
+  never calls the Hub, and the entitlement read path reaches the network only after a
+  durable local row has been consulted.
+- **Grace collapses into a TTL.** A cache TTL and a grace window look interchangeable
+  until a process restarts during an outage. `platform_entitlement_cache` is durable and
+  carries `grace_until` for exactly that case; a review that lets grace live only in L2 has
+  reintroduced the defect ADR-0034 removed.
+- **Fail-open by default.** A key whose class was never declared behaves as whatever the
+  first implementation happened to do. The registry rejects an undeclared class at compile
+  time; reviewers check that paid capacity and compliance keys are on the closed side.
+- **~~The frozen Hub branch rots.~~ Discharged 2026-08-09 by merging it.**
+  `feat/phase-02c-packet-1-hub-domain-core` was 221 files against a moving base. The
+  review that preceded the merge found the rot was the only certain cost: the code
+  conflicts with none of ADR-0033/0034/0035, so holding it bought no safety. What it did
+  leave is a SharedKernel reconciliation against
+  [Packet 3b](phase-02a-kernel-tenancy.md), tracked on the Hub side, which does grow with
+  every packet built on top.
+- **mTLS certificate and HMAC secret rotation.** Mitigated by a dual-key window during
+  rotation and a documented cadence; both are Phase 11 operational work and are named
+  there.
+- **Operator abuse.** Mitigated on the Hub side by mandatory MFA, and on this side by
+  auditing every internal-API mutation with the operator as actor.
+
+### Cross-repository PR coordination
+
+A contract change is two pull requests in two repositories, and the order is not
+negotiable:
+
+1. **The Hub PR merges first**, carrying the Hub-side handler or client and the updated
+   `entitlement-v1.schema.json`.
+2. **The LearnStack PR references that Hub commit SHA** in its description, carries the
+   identical schema file, and merges after it.
+3. **Both snapshot tests are green at the resulting commit pair** before either side is
+   deployed. A red snapshot on either side blocks the deployment of both.
+
+A contract change that reaches only one repository is an outage waiting for the next
+deploy. The Hub repository's `p02c-3-learnstack-integration.md` states the same protocol
+from the other side; the two documents are deliberately symmetric.
 
 ## Phase Exit Decision
 
-Phase 02c is complete when SaaS deployment mode is exercisable end-to-end (operator
-creates tenant → LearnStack core picks up the projection → tenant admin logs in)
-and Self-Hosted deployment mode is exercisable end-to-end (signed `.lic` issued →
-Self-Hosted instance boots with the projection). The completion does not block
-Phase 03 (Identity domain in LearnStack core) — they can finish in either order.
+Phase 02c is complete when the SaaS deployment mode is exercisable end to end — an
+operator creates a tenant on the Hub, the tenant appears in LearnStack with its default
+organization and entitlement projection, a plan change reaches the tenant's feature flags,
+a host mapping resolves, and a Hub outage degrades billing and provisioning without
+touching public pages.
+
+This phase gates nothing else. [Phase 03](phase-03-identity-admin.md) and everything after
+it proceed on `NullEntitlementProvider` regardless of when Phase 02c starts or finishes.
+The Self-Hosted mode's exit — signed `.lic` issuance and
+`SignedLicenseKeyEntitlementProvider` — belongs to
+[Phase 11](phase-11-production-hardening.md) and its own trigger, a signed Self-Hosted
+contract.
diff --git a/docs/roadmap/phase-02d-walking-skeleton.md b/docs/roadmap/phase-02d-walking-skeleton.md
new file mode 100644
index 0000000..c9cd8af
--- /dev/null
+++ b/docs/roadmap/phase-02d-walking-skeleton.md
@@ -0,0 +1,289 @@
+# Phase 02d: Two-Tenant Walking Skeleton
+
+## Goal
+
+Put a working education site in a browser — twice, on two hosts, for two tenants in
+unrelated domains, served by one binary and one database.
+
+This is the first phase whose output someone who does not read C# can evaluate. It
+exists because the alternative — reaching a visible artefact only after Phases 03
+through 06 — puts the project's single most testable claim (the same code paths serve
+unrelated education domains) five phases away from any evidence, and puts the first
+piece of user-facing value even further.
+
+Phase 02d is a **thin vertical slice through later phases**, not a replacement for
+them. Every capability it touches is delivered shallowly here and completely in its
+owning phase. Phases 04 through 07 keep their full scope; each records what 02d already
+shipped so the two never claim the same work twice.
+
+Depends on [Phase 02a](phase-02a-kernel-tenancy.md) — specifically the corrected Row
+Level Security template, tenant + organization resolution, the two seed tenants, and
+the customization runtime read paths. Runs **before**
+[Phase 02b](phase-02b-events-auth.md): the skeleton is deliberately anonymous, so it
+needs no identity provider.
+
+## Scope
+
+### Education content — minimum viable
+
+From [Phase 05](phase-05-education-learning-content.md), the two aggregates without
+which there is nothing to render:
+
+- `Course` — tenant-owned, optionally organization-scoped, with a published / draft state
+  and an ordered lesson list. Its title, summary and per-locale slug live in
+  `course_translations`, not on the parent — see § Localization schema below. No
+  versioning, no programs, no cohorts.
+- `Lesson` — ordered within a course, with a body rendered from a single built-in content
+  primitive; its title and per-locale slug likewise live in `lesson_translations`. Which
+  fields that primitive renders is driven by the tenant's own `TenantContentType`, so the
+  two tenants' lesson pages differ in **shape**, not only in copy — no `ContentEntry`
+  aggregate and no authoring surface, which are
+  [Phase 04](phase-04-cms-media-pages.md); the lesson body carries its field values
+  inline and validates against the declared schema on write. No
+  lesson items, no lesson item types, no completion semantics. Its foreign key to
+  `Course` is **composite on `tenant_id`**
+  (`FOREIGN KEY (tenant_id, course_id) REFERENCES courses (tenant_id, id)`): PostgreSQL
+  evaluates referential integrity with Row Level Security bypassed, so a single-column
+  key would let one tenant's lesson reference another tenant's course, invisibly. The
+  same rule applies to each translation satellite's key back to its parent. See
+  [Database Standards § Foreign keys between tenant-owned tables](../standards/05-database.md).
+
+Both carry `[TenantOwned]`, an EF global query filter, and the Row Level Security
+policy set from the canonical template in
+[Database Standards](../standards/05-database.md) — the permissive isolation policy plus,
+where the table is org-scoped, the two `AS RESTRICTIVE` write guards. The isolation
+machinery is exercised by real domain tables here, not only by fixtures. This is the
+first time the template is applied to anything, so it is also the first chance to find
+out that it is wrong: treat a surprising query result as a template bug, not a data bug.
+
+### Localization schema — the one-way door this phase walks through
+
+[ADR-0008](../decisions/0008-localization-schema.md) is Accepted, it names `Course` and
+`Lesson` explicitly among the side-translation-table entities, and its Consequences say
+plainly: *"Slugs are stored on the translation row, not on the parent."* Phase 02d creates
+the first real tenant-owned content tables in the whole roadmap, so it is the phase that
+either honours that decision or spends [Phase 04](phase-04-cms-media-pages.md) undoing it
+with the global migration ADR-0008's Context exists to avoid — and no later phase budgets
+for that move. There is no walking-skeleton exemption.
+
+The parents hold non-translatable columns only:
+
+- `courses` — `id`, `tenant_id`, `organization_id` (nullable), `slug_key` (a stable
+  authoring handle that **nothing routes on**), published / draft state, audit columns,
+  `row_version`, plus `UNIQUE (tenant_id, id)` so `lessons` can carry its composite
+  foreign key.
+- `lessons` — `id`, `tenant_id`, `organization_id`, `course_id`, `sort`, state, audit
+  columns.
+
+The translatable columns live in `course_translations` and `lesson_translations`, each
+keyed `PRIMARY KEY (<entity>_id, locale)` and each holding `title`, `summary` / `body`,
+and the routable `slug`. Both satellites carry a real `tenant_id` column, a mirrored
+`organization_id`, their own `ENABLE` + `FORCE ROW LEVEL SECURITY` with the full canonical
+policy set, and a composite foreign key on `(tenant_id, <entity>_id)`. Row Level Security
+is per table and is never inherited from a parent through a check constraint; a satellite
+holding `title` and `slug` holds the content, so an unprotected satellite is a content
+leak.
+
+The slug constraint is `UNIQUE (tenant_id, locale, slug)` — flat across organizations,
+with `organization_id` deliberately excluded. Every column in that key is `NOT NULL`, so
+PostgreSQL's nulls-are-distinct rule cannot apply and the constraint rejects every
+duplicate it is meant to reject. The full reasoning, including why adding `organization_id`
+to the key is the tempting move that breaks it, is in
+[Localization Standards § Pattern A](../standards/08-localization.md) and
+[Localization § Slugs and URLs](../architecture/12-localization.md).
+
+`tenant_locales` already exists — [Phase 02a Packet 6](phase-02a-kernel-tenancy.md) ships
+it and already states it is required before any tenant-owned content table ships. This is
+the phase that makes good on that.
+
+What this phase does **not** build: a translation editor, per-locale publish readiness as a
+workflow, the `tenant_route_slugs` cross-table registry, or locale negotiation from
+`Accept-Language`. Those are [Phase 04](phase-04-cms-media-pages.md). What it builds is the
+shape, so that adding a locale later is an `INSERT` and not a migration.
+
+### Read API — two endpoints
+
+From [Phase 05](phase-05-education-learning-content.md), through the API conventions
+established in [Phase 02a Packet 4](phase-02a-kernel-tenancy.md):
+
+- `GET /api/v1/courses/{slug}?locale={locale}` — course detail with its lesson list.
+- `GET /api/v1/courses/{slug}/lessons/{lessonSlug}?locale={locale}` — lesson detail.
+
+`locale` is **required**; a request without it is a 400, not a silent default. With
+per-locale slugs a slug does not identify a course on its own — the same string can be one
+course's Turkish slug and another's English slug inside one tenant — so locale is an
+identifying input, not a preference, and a defaulted locale would let one URL resolve to
+different courses as a tenant's locale set changes. It lives in the query string rather
+than the path because [Localization Standards](../standards/08-localization.md) puts locale
+in the path of **public URLs**, and the public URL is the renderer's
+`/{locale}/courses/{slug}` route, which supplies this parameter. Any cache in front of
+these endpoints keys on the query string.
+
+Slug resolution is **exact** on `(tenant_id, locale, slug)`. The fallback chain applies to
+display fields after the entity is resolved and **never** to the slug lookup: a course with
+no `en` translation has no `en` URL, and requesting one is a 404. For the same reason a
+lesson with no translation in the requested locale is omitted from the course's lesson list
+rather than rendered as a link that cannot resolve.
+
+Both are anonymous, both resolve tenant and organization from the host, both return
+RFC 7807 Problem Details on failure, both flow through the MediatR pipeline and return
+`Result<T>`. Nothing bypasses the pipeline — the tenant-context and audit machinery has
+its first real caller here.
+
+### Public renderer — two pages
+
+From [Phase 06](phase-06-renderer-admin-studio.md), in `frontend/apps/web` under the
+`(public)` route group:
+
+- Course catalog page — lists the tenant's published courses.
+- Lesson page — renders a lesson body.
+
+Both are Server Components fetching through the typed SDK. Both read the tenant's
+branding tokens, level taxonomy and lesson-body `TenantContentType` from customization
+data — the lesson page renders the field list the tenant declared, not a fixed one.
+Layout, typography and colour come from `TenantSettings`, not from a hard-coded theme.
+
+### Host-based tenant resolution, end to end
+
+The full path from [Phase 02a Packet 7](phase-02a-kernel-tenancy.md), exercised for
+real: an inbound request's `Host` header resolves through `platform_host_to_tenant` to
+a `(tenant_id, organization_id?)` pair, the request-scoped `ITenantContext` is
+populated, the transaction sets `app.tenant_id` / `app.organization_id` with
+`SET LOCAL`, and Row Level Security filters every read.
+
+Two hosts are registered in local development, one per seed tenant.
+
+### Genericity proof
+
+Both seed tenants — the English school and the yoga studio from
+[Phase 02a Packet 7](phase-02a-kernel-tenancy.md) — render their own catalog and lesson
+pages from their own customization data:
+
+| Tenant | `TenantLevelTaxonomy` | `TenantContentType` | Branding |
+|---|---|---|---|
+| English school | CEFR levels (A1 … C2) | `GrammarTopic` | Its own tokens |
+| Yoga studio | Difficulty levels (Foundation … Advanced) | `AsanaPose` | Its own tokens |
+
+The two sites differ in taxonomy, content shape, copy and visual identity. The binary,
+the schema and the query paths are identical. If a code path has to branch on which
+tenant it is serving, [ADR-0018](../decisions/0018-tenant-driven-customization-model.md)
+is not being honoured and the branch is the bug.
+
+### Explicitly not in this phase
+
+Named so that no reader has to guess, and so no later phase can assume it was done
+here:
+
+| Capability | Owning phase |
+|---|---|
+| Authentication, sessions, login | [Phase 02b](phase-02b-events-auth.md) |
+| Identity domain, roles, permissions, invitations | [Phase 03](phase-03-identity-admin.md) |
+| CMS editing, page builder, media library | [Phase 04](phase-04-cms-media-pages.md) |
+| Translation editor, per-locale publish readiness workflow, `tenant_route_slugs` registry | [Phase 04](phase-04-cms-media-pages.md) |
+| Course versioning, programs, lesson items, completion rules | [Phase 05](phase-05-education-learning-content.md) |
+| Admin Studio, navigation, SEO, full block registry | [Phase 06](phase-06-renderer-admin-studio.md) |
+| Enrollment, learner portal, progress tracking | [Phase 07](phase-07-enrollment-learner-portal.md) |
+| Search — the `ITenantSearch` port and its PostgreSQL default | [Phase 04](phase-04-cms-media-pages.md) |
+| Search — the Meilisearch adapter behind that port | [Phase 09](phase-09-billing-integrations-analytics.md) |
+| Live classroom | [Phase 08c](phase-08c-classroom.md) |
+| Billing | [Phase 09](phase-09-billing-integrations-analytics.md) |
+| Hub, entitlement gating | [Phase 02c](phase-02c-hub-foundation.md) |
+
+## Deliverables
+
+- `Course` and `Lesson` aggregates in `LearnStack.Modules.Education`, with migrations,
+  EF configurations, query filters and RLS policies.
+- `course_translations` and `lesson_translations` satellites, each with its own
+  `tenant_id`, mirrored `organization_id`, `ENABLE` + `FORCE ROW LEVEL SECURITY` and full
+  policy set, composite foreign key on `(tenant_id, <entity>_id)`, and
+  `UNIQUE (tenant_id, locale, slug)`.
+- Two anonymous read endpoints with OpenAPI documentation and generated SDK clients,
+  taking `locale` as a required parameter.
+- Two public route segments in `frontend/apps/web`, tenant-branded, rendering from
+  customization data.
+- Two hosts wired to two tenants in `platform_host_to_tenant`, resolvable in local
+  development.
+- Seed data extending [Phase 02a Packet 7](phase-02a-kernel-tenancy.md)'s two tenants
+  with a course and a handful of lessons each. One of the two tenants has **two** enabled
+  locales with genuinely different slugs per locale, so the schema is exercised rather
+  than merely declared; the other has one.
+- A demo script (`make demo` or equivalent) that boots the stack, seeds, and prints the
+  two URLs.
+- Frontend tests covering host-to-tenant resolution and `(public)` route rendering —
+  the first real tests in `apps/web`, replacing the `--passWithNoTests` placeholder
+  removed in [Phase 02a Packet 3b](phase-02a-kernel-tenancy.md). There is no
+  authenticated route to test against yet; that split arrives with
+  [Phase 02b](phase-02b-events-auth.md)'s session.
+- **Two CI jobs activate here.** [Phase 01](phase-01-repository-tooling.md) scaffolded
+  three deferred jobs against the phase each expected to unblock it; two of them
+  unblock now, earlier than that phase predicted. (Phase 01 gated them with
+  `if: false`; they are now gated on unset `vars.ENABLE_*` repository variables,
+  because actionlint rejects a constant condition.)
+  - **OpenAPI breaking-change check** — Phase 01 expected Phase 03, because that was
+    where the first real `/api/v1/*` endpoint was going to replace `/healthz`. The two
+    read endpoints above are that first endpoint.
+  - **Lighthouse budget** — Phase 01 expected Phase 04, because that was where the
+    first content-bearing public page was going to ship. The catalog and lesson pages
+    above are that first page, and they are the right ones to hold a budget against:
+    they are what a visitor actually loads.
+
+  The third placeholder, the integration-test job, activates earlier still — in
+  [Phase 02a Packet 7](phase-02a-kernel-tenancy.md), with the first isolation test.
+
+## Completion Criteria
+
+- Opening host A shows the English school's catalog with CEFR levels and its branding;
+  opening host B shows the yoga studio's catalog with its own difficulty taxonomy and
+  branding. One binary, one database, one schema.
+- Clicking through to a lesson on either host renders that tenant's lesson body.
+- The two lesson pages render **different field sets**, driven by each tenant's
+  `TenantContentType` — not the same template with different strings. A reviewer can see
+  the difference without reading the seed data.
+- Requesting tenant B's course slug on tenant A's host returns 404 — not tenant B's
+  course, and not a 500.
+- The two-locale tenant serves the same course at two different slugs under two locale
+  prefixes, and adding a third locale is an `INSERT` into `tenant_locales` plus
+  translation rows — no migration.
+- Two courses in one tenant cannot both hold one `(locale, slug)` pair; the second insert
+  is rejected by the database, and the rejection also fires when one of the two is
+  tenant-wide and the other organization-scoped. An integration test attempts both,
+  connected as `learnstack_app`.
+- Requesting a slug in a locale the course has no translation for returns 404, and a
+  lesson with no translation in the requested locale does not appear in the course's
+  lesson list.
+- The isolation integration tests from
+  [Phase 02a Packet 7](phase-02a-kernel-tenancy.md) still pass, now with real
+  `Course` and `Lesson` rows rather than fixtures, and still run as `learnstack_app`.
+- No code path branches on tenant identity. A reviewer can grep for the two tenant
+  slugs and find them only in seed data and tests.
+- `make demo` on a clean checkout produces both working sites.
+
+## Risks
+
+- **The slice grows.** Every capability listed under "explicitly not in this phase" has
+  a plausible argument for inclusion. The exit gate is a browser, not a feature set; if
+  a change does not move a pixel on one of the two pages, it belongs to its owning
+  phase.
+- **The second tenant becomes decorative.** A yoga studio whose data is a renamed copy
+  of the English school's proves nothing. Its taxonomy, content type and page
+  composition must differ in shape, not only in strings.
+- **Tenant-specific branching creeps into the renderer.** The most likely place is the
+  block or content-type resolution path, where a missing generic primitive is easiest to
+  paper over with a conditional. Any such branch is a defect in the customization model
+  and should be fixed there.
+- **Shortcuts around the pipeline.** Two read endpoints are simple enough to write as
+  direct queries. Doing so skips the tenant-context behavior and the RLS session
+  variables — the exact machinery this phase exists to exercise.
+  `Handlers_Return_Result` catches the shape; reviewers catch the intent.
+- **The translation tables get written as an afterthought.** The satellite is a
+  tenant-owned table in its own right: its own `tenant_id`, its own policy, its own
+  `FORCE`. The failure mode is quiet — the parent's policy looks like it covers the child,
+  and the child is where the title and the slug actually live. An isolation test that
+  reads only the parent will not find it.
+
+## Phase Exit Decision
+
+Phase 02b begins when a reviewer, on a clean checkout, can open two hosts in a browser
+and see two structurally and visually different education sites served by one binary,
+with the cross-tenant isolation suite green under `learnstack_app` and no
+tenant-conditional code anywhere in the request path.
diff --git a/docs/roadmap/phase-03-identity-admin.md b/docs/roadmap/phase-03-identity-admin.md
index a36de70..ffaf4ea 100644
--- a/docs/roadmap/phase-03-identity-admin.md
+++ b/docs/roadmap/phase-03-identity-admin.md
@@ -1,165 +1,462 @@
-# Phase 03: Identity, Authorization, and Admin Foundation
+# Phase 03: Identity Domain, Authorization, and Admin Foundation
 
 ## Goal
 
 Build LearnStack's identity domain (users, memberships with triple-key
 `(user_id, tenant_id, organization_id)`, roles, permissions, invitations) on top of
-the Keycloak OIDC integration delivered in Phase 02b, and ship the first admin
-experience.
+the Keycloak OIDC integration delivered in [Phase 02b](phase-02b-events-auth.md), and
+ship the first admin experience.
 
 Authentication itself (password storage, MFA, token issuance, password reset, account
 recovery) is owned by Keycloak — see
 [ADR-0004](../decisions/0004-authentication-strategy.md) and
-[13-identity-and-auth.md](../architecture/13-identity-and-auth.md). The **audit
+[Identity and Authentication](../architecture/13-identity-and-auth.md). The **audit
 trail** is owned by `LearnStack.Modules.Audit` — Identity does **not** own an audit
-table; it emits MUST-audit events that the central pipeline captures
-([ADR-0016](../decisions/0016-audit-log-subsystem.md)). The audit module and capture
-pipeline were already wired in Phase 02a. This phase delivers the LearnStack-side
-identity domain on top of those primitives.
+table; it emits MUST-class audit intents that the central pipeline makes durable
+([ADR-0033](../decisions/0033-audit-durability-model.md), which supersedes ADR-0016).
+The audit module and its capture pipeline were wired in
+[Phase 02a Packet 9](phase-02a-kernel-tenancy.md). This phase delivers the
+LearnStack-side identity domain on top of those primitives.
+
+This phase also settles a question the corpus has been carrying unanswered: **which
+identity data belongs to a tenant and which belongs to the person**. Every earlier
+phase could avoid it because no tenant admin could write a person's attributes yet.
+From this phase forward one can, and the answer has to exist before the first custom
+field is stored.
 
 ## Scope
 
 ### Identity Model
 
-- `User` — global identity mirrored from Keycloak (`sub`, email, display name).
-- `UserProfile` — LearnStack-owned profile attributes.
+- `User` — global identity mirrored from Keycloak (`sub`, canonical email, global
+  display name). One row per human across the whole platform.
 - `Membership` — per-tenant **and per-organization** relationship; triple key
   `(user_id, tenant_id, organization_id)` per
-  [ADR-0017](../decisions/0017-tenant-organization-hierarchy.md). Carries roles and
-  membership-specific profile data. A user can have memberships in multiple tenants
-  and multiple organizations within one tenant.
+  [ADR-0017](../decisions/0017-tenant-organization-hierarchy.md). Carries roles. A user
+  can hold memberships in multiple tenants and in multiple organizations within one
+  tenant.
+- `MembershipProfile` — the tenant-owned profile record attached to a `Membership`:
+  per-tenant display name, tenant-visible contact fields, locale preference,
+  per-tenant consent flags, and the tenant-defined `custom_fields` JSONB column.
 - `Role` — Platform / Tenant / Organization-scoped per the scope catalogue in
-  [19-permissions.md](../standards/19-permissions.md).
+  [Permission Standards](../standards/19-permissions.md).
 - `Permission` — fine-grained capability inside a role with an explicit scope
   (Platform / Tenant / Organization).
 - `Invitation` — pending membership offer, bound to email + tenant + organization.
 
-> **Audit ownership.** The `AuditEntry` aggregate lives in the **Audit** module
-> ([ADR-0016](../decisions/0016-audit-log-subsystem.md)), not in Identity. Identity
-> publishes integration events (`learnstack.identity.user`,
-> `learnstack.identity.membership`, `learnstack.identity.role`) that the central
-> capture pipeline turns into audit entries — and command-side mutations also flow
-> through the shared `AuditLogBehavior`. There is **no** Identity-owned audit table.
+The aggregate previously named `UserProfile` is split by the ownership rules below: the
+attributes a person owns stay on `User`, and everything a tenant authors moves to
+`MembershipProfile`. There is no single profile aggregate straddling both.
+
+> **Audit ownership.** The `AuditEntry` aggregate lives in the **Audit** module, not in
+> Identity. Identity's commands flow through the shared `AuditLogBehavior`, and
+> MUST-class rows are written on the same transaction as the business write per
+> [ADR-0033](../decisions/0033-audit-durability-model.md). Cross-process identity
+> signals (Keycloak webhooks) arrive as integration events. There is **no**
+> Identity-owned audit table.
+
+### Tenant Data Ownership, DSAR Boundary, and PII Classification
+
+The corpus currently conflates the global `User` aggregate with tenant-owned profile
+data, and three concrete defects follow from it:
+
+- **Custom fields on `User` leak across tenants.**
+  [Tenant Customization Model § Custom fields on built-in entities](../architecture/32-tenant-customization-model.md)
+  adds `custom_fields jsonb` to the `users` table and lets a `TenantCustomFieldDef` with
+  `target_entity = "User"` write into it. `users` is a global table with no
+  `tenant_id`, no query filter and no Row Level Security policy. A learner enrolled in
+  a language school and a yoga studio would carry both tenants' fields in one blob that
+  both tenants read.
+- **A tenant-scoped data request is not separated from global account deletion.**
+  [Data Protection](../architecture/23-data-protection.md) describes one erasure
+  workflow that ends in "invalidate Keycloak user". Initiated by a tenant admin, that
+  workflow destroys an identity that other tenants are actively using. One tenant must
+  not be able to close a person's account with another.
+- **JSONB columns carry no PII metadata.** Data Protection requires every aggregate to
+  declare a PII category and claims a CI check over columns named like `email` or
+  `phone`. A `custom_fields` blob is one column whose keys are authored by tenants at
+  runtime; column-level classification cannot see inside it. Retention, export and
+  redaction are therefore undefined for exactly the data most likely to be personal.
+
+This phase resolves all three.
+
+**Attribute ownership.** Each attribute has exactly one owner, and the owner determines
+the table it lives in and who may write it.
+
+| Attribute class | Owner | Storage | Writable by |
+|---|---|---|---|
+| Credentials, MFA factors, token material | Keycloak | Keycloak realm `learnstack` | Keycloak only |
+| `sub`, canonical email, email-verified flag | Keycloak | mirrored onto `users` | The mirror handler only |
+| Global display name, avatar, preferred UI locale, global account status | The person | `users` | The person; platform admin under an audited `EnterPlatformAdminScope(reason)` |
+| Roles and permissions inside a tenant | Tenant | `memberships` | Tenant / organization admin of that tenant |
+| Per-tenant display name, contact fields, consent flags, locale preference | Tenant | `membership_profiles` | Tenant / organization admin of that tenant, and the person within that tenant |
+| Tenant-defined custom fields | Tenant | `membership_profiles.custom_fields` | Tenant / organization admin of that tenant |
+| Learning behaviour (progress, attempts, attendance) | Tenant | per-module tenant-owned tables | The owning module |
+
+Two rules make the table enforceable:
+
+- **`users` carries no `custom_fields` column and no tenant-authored column of any
+  kind.** A `TenantCustomFieldDef` whose `target_entity` is `User` resolves to
+  `membership_profiles`, not to `users`. The field is defined once per tenant and
+  stored once per membership.
+- **`MembershipProfile` is `[TenantOwned]` and `[OrganizationScoped]`**, with an EF
+  global query filter and a Row Level Security policy built from the canonical template
+  in [Database Standards](../standards/05-database.md). It is an ordinary tenant table
+  and gets the ordinary four layers of defense
+  ([ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md)).
+
+**DSAR boundary.** A data subject access request is scoped to a tenant unless the
+person themselves asks for the account itself.
+
+| Request | Initiated by | Scope | Effect on other tenants |
+|---|---|---|---|
+| Tenant-scoped export | Tenant admin, or the person acting inside that tenant | Rows where `tenant_id = <tenant>` | None |
+| Tenant-scoped erasure | Tenant admin, or the person acting inside that tenant | The membership, its profile, and that tenant's behaviour rows | None |
+| Global account closure | The person, through the platform account surface | The `users` row, the Keycloak user, and a fan-out to every membership | All of them, by design |
+
+- A tenant-scoped export is produced by running the export handlers **inside that
+  tenant's `ITenantContext`, connected as `learnstack_app`**. Row Level Security is the
+  mechanism that bounds the bundle, not a `WHERE tenant_id = …` clause a developer can
+  forget in one of a dozen modules.
+- A tenant-scoped erasure removes the `Membership` and its `MembershipProfile`,
+  anonymises that tenant's behaviour rows, and anonymises the actor field on that
+  tenant's audit entries while keeping the action record
+  ([Data Protection § Right to Erasure](../architecture/23-data-protection.md)). The
+  `users` row survives for as long as any membership remains anywhere.
+- **Global account closure has no tenant-admin endpoint.** It is a platform-scoped
+  operation. It fans out `UserAnonymisationRequestedV1` to every tenant the person
+  belongs to and reconciles completion per Data Protection's 30-day workflow.
+- The audited `EnterPlatformAdminScope(reason)` from
+  [Phase 02a Packet 7](phase-02a-kernel-tenancy.md) is the only path that reads across
+  tenants during either flow, and every use of it is MUST-class audited.
+
+**PII classification on JSONB.** Every `TenantCustomFieldDef` row carries a required
+`pii_category` drawn from the closed set in
+[Data Protection § Personal Data Inventory](../architecture/23-data-protection.md) —
+`PII-Identity`, `PII-Behaviour`, `PII-Sensitive`, or `None`. There is no default; the
+Studio editor forces a choice at definition time, and the definition cannot be saved
+without one.
+
+- Export, redaction and retention walk the **definitions**, not the blob. Without the
+  per-key classification an export either dumps the whole column — leaking values that
+  should have been redacted — or drops it entirely, which fails the portability right.
+- Log and error-tracking redaction is category-driven. `SensitiveTokenCatalog` from
+  [Phase 02a Packet 3](phase-02a-kernel-tenancy.md) matches on property **names**, and
+  the names inside `custom_fields` are authored by tenants at runtime, so it cannot
+  reach them. Custom-field values are redacted by their declared category before a log
+  event or an error-tracking payload is constructed.
+- `Payment` is **not** an allowed category for a tenant-defined field. Payment data
+  carries a seven-year retention obligation that a tenant-authored JSONB key cannot
+  honour; a definition attempting it is rejected at save time with
+  `Result.Fail(business_rule_violation, …)`.
+
+Three checks make this mechanical, registered in
+[Architecture Tests Catalogue](../standards/21-architecture-tests-catalogue.md) under
+its `Subject_Constraint` convention:
+
+- `User_Aggregate_Has_No_TenantScoped_Columns` — architecture test over the `users`
+  EF configuration.
+- `Every_TenantCustomFieldDef_Declares_PiiCategory` — architecture test over the
+  aggregate's invariants plus a migration scan for a `NOT NULL` `pii_category`.
+- `Tenant_Scoped_Export_Contains_No_Foreign_Tenant_Rows` — integration test that runs
+  an export for a person holding memberships in both seed tenants, as `learnstack_app`,
+  and asserts the bundle is single-tenant.
+
+### Tenant Custom Fields
+
+`TenantCustomFieldDef` lands here rather than in
+[Phase 02a Packet 8](phase-02a-kernel-tenancy.md), which now ships only
+`TenantContentType` and `TenantLevelTaxonomy`. The aggregate's first consumer is the
+membership admin screen in this phase, and its correctness depends entirely on the
+ownership split above — shipping the table three packets before the rule that governs
+what may be written into it invites exactly the leak this phase closes.
+
+- `tenant_custom_field_defs` with `UNIQUE (tenant_id, target_entity, key)`, the
+  required `pii_category` column, the field's JSON Schema, and `is_required` / `sort`
+  presentation metadata.
+- Allowed `target_entity` values **in this phase**: `Membership` only. The remaining
+  targets light up with their owning phases —
+  `Course` and `Lesson` in [Phase 05](phase-05-education-learning-content.md),
+  `Enrollment` in [Phase 07](phase-07-enrollment-learner-portal.md),
+  `LiveSession` in [Phase 08c](phase-08c-classroom.md). A definition naming a target
+  whose phase has not shipped is rejected at save time rather than silently stored.
+- Values are validated against the field's JSON Schema on every write, and rejected
+  through `Result.Fail(validation_failed)` — never by throwing.
+- Permission keys per [Permission Standards](../standards/19-permissions.md):
+  `customization.custom_field.admin` (Tenant scope) to define fields;
+  `identity.membership.write` (Tenant / Organization scope) to set their values.
+- Studio surface: a definition editor and a schema-driven form on the membership detail
+  page. The visual schema builder is [Phase 06](phase-06-renderer-admin-studio.md).
 
 ### Authentication Integration
 
-Keycloak owns credentials, password reset, email verification, MFA. Phase 03 wires LearnStack into that flow:
+Keycloak owns credentials, password reset, email verification, and MFA. This phase
+wires LearnStack into that flow:
 
-- OIDC token validation against Keycloak's JWKS (Phase 02b already configured the middleware).
-- BFF session handling for the Next.js Studio: HTTP-only cookies, silent refresh, end-session at Keycloak on logout.
-- Post-login membership lookup: resolve memberships for the authenticated user, surface the active tenant via host + claim cross-check.
-- Tenant-specific Keycloak federation surface in Admin Studio (configure SAML/OIDC IdP per tenant) — UI delivered here, runtime in Keycloak.
+- OIDC token validation against Keycloak's JWKS
+  ([Phase 02b](phase-02b-events-auth.md) configured the middleware).
+- BFF session handling for the Next.js Studio: HTTP-only cookies, silent refresh,
+  end-session at Keycloak on logout.
+- Post-login membership lookup: resolve memberships for the authenticated user and
+  surface the active tenant via a host + claim cross-check.
+- Tenant-specific Keycloak federation surface in Admin Studio (configure SAML / OIDC
+  IdP per tenant) — UI delivered here, runtime in Keycloak.
 - Mapping of Keycloak `sub` to LearnStack `UserId`; idempotent on first login.
 
-LearnStack does **not** implement password hashing, password reset email rendering, refresh token storage, or brute-force protection — those are Keycloak responsibilities.
+LearnStack does **not** implement password hashing, password reset email rendering,
+refresh token storage, or brute-force protection — those are Keycloak responsibilities.
 
 ### Authorization
 
 - Role-based authorization.
 - Permission-based authorization.
 - Tenant-scoped permission checks (`Membership.Roles → Permissions`).
-- Resource-scoped policies (e.g., "instructor edits only own courses").
+- Resource-scoped policies (for example, an instructor edits only their own courses).
 - Admin and Studio route guards.
 - API authorization policies.
-- **Lights up the Phase 02a Packet 3 `AuthorizationBehavior` shell** —
-  resolves each command's `[Authorize(Policy)]`, calls
-  `IAuthorizationService.AuthorizeAsync` against the tenant +
-  organization-scoped resource, and returns
-  `Result.FailFor<TResponse>(forbidden)` on deny (per
-  [ADR-0032 § Sub-decision 2](../decisions/0032-exception-handling-logging-and-observability.md)).
+- **Lights up the [Phase 02a Packet 3](phase-02a-kernel-tenancy.md)
+  `AuthorizationBehavior` shell** — resolves each command's `[Authorize(Policy)]`,
+  calls `IAuthorizationService.AuthorizeAsync` against the tenant +
+  organization-scoped resource, and returns `Result.FailFor<TResponse>(forbidden)` on
+  deny, per
+  [ADR-0032 § Sub-decision 2](../decisions/0032-exception-handling-logging-and-observability.md).
 
-### Cross-cutting follow-up at phase exit
+Authorization is the third layer, not the first. A permission check that passes still
+runs under the tenant's `ITenantContext` and under Row Level Security; a deny is a
+better error message, not the isolation boundary.
 
-- **Escalate the `LS0001`
-  ("LearnStackException-DomainExceptionThrow") analyzer from Warning to
-  Error** and remove `LS0001` from `WarningsNotAsErrors`
-  (`backend/Directory.Build.props`) once the codebase reaches the green-bar
-  threshold — the documented escalation point per
-  [ADR-0032 § Sub-decision 4 + Amendment 1](../decisions/0032-exception-handling-logging-and-observability.md).
-  Until this exit gate the analyzer fires as a Warning so legitimate
-  aggregate-invariant throws do not break CI.
+### Gateway Configuration Corrections
+
+The APISIX gateway **adapter** is demand-gated to
+[Phase 11](phase-11-production-hardening.md) per
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md); until then the equivalent
+concerns are handled by ASP.NET middleware. The published route table in
+[API Gateway](../architecture/30-api-gateway.md) is nevertheless corrected **here**,
+because that file is what an operator will paste into a live gateway the first time one
+is needed, and both defects below are silent when read and severe when deployed.
+
+**Route priority.** Every route declares an explicit integer `priority`, and every
+anonymous route whose path is matched by the authenticated catch-all declares a
+strictly higher value than it.
+
+- The published table describes priority bands in comments (`# priority 1`,
+  `# priority 99`, `# priority 100`) but no route carries a `priority` field. APISIX
+  defaults an omitted priority to `0`, so every band ties.
+- `GET /api/v*/localization/*` and the authenticated catch-all `/api/v*/**` both match
+  `GET /api/v1/localization/en`. When the catch-all wins the tie, `openid-connect` with
+  `bearer_only: true` returns 401 to a request that has no token and is not supposed to
+  need one.
+- That request is the first call the public renderer makes. Anonymous rendering from
+  [Phase 02d](phase-02d-walking-skeleton.md) and the public CMS reads from
+  [Phase 04](phase-04-cms-media-pages.md) sit behind exactly this route.
+
+**Route 100's `client_secret_ref` is deleted.** The line currently reads
+`client_secret_ref: vault://learnstack/hub/internal-api-hmac-key`, binding the
+gateway's Keycloak OIDC client secret to the Hub internal-API HMAC signing key. It is
+wrong twice:
+
+- **Functionally** — the `learnstack-gateway` client's secret in the `learnstack` realm
+  is not the Hub signing key, so the OIDC handshake cannot succeed with that value.
+- **Structurally** — it collapses two trust domains into one secret. The HMAC key signs
+  `/api/internal/*` request bodies in the Hub auth chain
+  ([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)). Distributing it
+  into edge-proxy configuration — and, on failure, into edge-proxy error logs — hands
+  anyone who can read either the ability to forge a signed
+  `PUT /api/internal/tenants/{id}/entitlements` or
+  `PUT /api/internal/tenants/{id}/host-mappings` for **any** tenant: granting themselves
+  any plan, or pointing a tenant's hostname somewhere else. The repository's secret-scan
+  check does not catch it, because the committed value is a Vault path rather than a
+  secret.
+
+The correction: route 100 references the gateway's own OIDC client secret at its own
+path, and the Hub HMAC key appears in no gateway configuration at any priority. It is
+held only by the `IEntitlementProvider` / `IUsageReporter` / `IHubTenantSync` adapters
+ADR-0034 names as the sole Hub-facing callers.
 
 ### Invitation Flow
 
-- Tenant admin invites a user (email + role).
-- Invitation token bound to the email; mismatched signup is rejected.
-- New invitee redirected to Keycloak signup with prefilled email; existing user redirected to Keycloak login.
-- After callback, LearnStack creates the `Membership` and marks the invitation accepted.
-- Invitation expiry (default 14 days), accept/revoke endpoints.
+- Tenant admin invites a user (email + role + organization).
+- Invitation token bound to the email; a mismatched signup is rejected.
+- A new invitee is redirected to Keycloak signup with a prefilled email; an existing
+  user is redirected to Keycloak login.
+- After callback, LearnStack creates the `Membership` and marks the invitation
+  accepted.
+- Invitation expiry (default 14 days), accept and revoke endpoints.
+
+An invitation creates a membership in one tenant. It never creates, modifies or deletes
+the global `User` row beyond the first-login mirror.
 
 ### Admin Foundation (identity-management screens only)
 
-Phase 03 ships the identity-management surface in Admin Studio. CMS, page-builder, and catalog screens are owned by Phase 06.
+This phase ships the identity-management surface in Admin Studio. CMS, page-builder and
+catalog screens are owned by [Phase 06](phase-06-renderer-admin-studio.md).
 
 - Login (delegates to Keycloak).
-- Tenant switcher (for multi-tenant operators).
-- Users list and detail.
+- Tenant switcher (for multi-tenant operators) and organization switcher.
+- Users list and detail, scoped to the acting tenant and organization.
 - Roles and permissions management.
 - Invitations.
+- Custom field definitions and the schema-driven membership form.
 - Tenant member settings basics.
+- Tenant-scoped data-request surface: request an export, request an erasure, view
+  status. Global account closure is deliberately absent from this surface.
 
 ### Audit Coverage Wiring
 
-Identity emits the following MUST-audit operations through the **central audit
-pipeline** ([ADR-0016](../decisions/0016-audit-log-subsystem.md)); the
-`AuditLogBehavior` in the MediatR pipeline writes entries via `IAuditStore` — Identity
-itself never touches `audit_log` directly:
+Identity emits the following MUST-class audit operations through the central pipeline;
+`AuditLogBehavior` enrols the row in the same transaction as the business write per
+[ADR-0033](../decisions/0033-audit-durability-model.md). Identity itself never touches
+`audit_log` directly.
 
 - Membership created / removed (per `(user_id, tenant_id, organization_id)`).
 - Role assigned / revoked.
 - Permission set changed.
 - Invitation created / accepted / revoked.
 - Tenant setting changed.
-- Platform-admin cross-tenant access (`actor.platformAdmin = true` with a required
-  `reason` field).
+- Custom field definition created / changed / deleted — a schema change alters what
+  personal data the tenant stores, so the definition history is itself compliance
+  evidence.
+- Tenant-scoped export requested / completed, tenant-scoped erasure requested /
+  completed.
+- Global account closure requested — recorded against every affected tenant.
+- Platform-admin cross-tenant access (`actor.platformAdmin = true`, with the required
+  `reason`).
 - Hub-operator access to a tenant resource (`actor.hubOperator = true`).
 
-Keycloak owns its own audit stream for login success/failure, password reset, MFA
+Keycloak owns its own audit stream for login success and failure, password reset, MFA
 enrolment, and account lock. The Identity module **subscribes** to Keycloak webhooks
-and re-publishes the relevant events as `learnstack.identity.user` integration events;
-the Audit module consumes these and writes audit entries via `IInboxGuard`-protected
-handlers. See [18-audit-coverage.md](../standards/18-audit-coverage.md) for the
-MUST/SHOULD/MAY matrix.
+and re-publishes the relevant events as `learnstack.identity.user` integration events
+through `IEventBus`; the Audit module consumes them through `IInboxGuard`-protected
+handlers. `IEventBus` resolves to `InProcessEventBus` from
+[Phase 02a Packet 5](phase-02a-kernel-tenancy.md); the Dapr-backed transport is
+demand-gated to [Phase 11](phase-11-production-hardening.md) per
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md), and the handler contract
+is identical either way. See
+[Audit Coverage Standards](../standards/18-audit-coverage.md) for the MUST / SHOULD /
+MAY matrix.
+
+### Cross-cutting follow-up at phase exit
+
+- **Escalate both analyzers from Warning to Error** — `LS0001`
+  (`LearnStackException-DomainExceptionThrow`) and `LS0002` (the
+  secrets-in-exception-message rule introduced in
+  [Phase 02b](phase-02b-events-auth.md)) — and remove both from `WarningsNotAsErrors` in
+  `backend/Directory.Build.props` — the documented escalation point per
+  [ADR-0032 § Sub-decision 4 + Amendment 1](../decisions/0032-exception-handling-logging-and-observability.md).
+  Until this gate the analyzer fires as a Warning so that a legitimate
+  aggregate-invariant throw does not break CI. By phase exit the identity domain is the
+  first substantial body of domain code, and the rule has been exercised against real
+  aggregates rather than against an empty solution.
 
 ## Deliverables
 
-- Identity domain (`User`, `UserProfile`, `Membership` triple-keyed,
-  `Role` with scope, `Permission` with scope, `Invitation`) on top of Keycloak.
-- Admin login + tenant switcher + **organization switcher** via OIDC PKCE.
-- Tenant- and org-aware user management screens.
-- Role and permission system with explicit scope (Platform / Tenant / Organization)
-  and resource-scoped policy hooks.
-- Invitation flow end to end (tenant + organization bound).
-- Identity events wired through the central audit pipeline (Audit module captures);
-  Keycloak webhook → Dapr integration event → Audit consumer working end-to-end.
+- Identity domain — `User` (global), `Membership` (triple-keyed), `MembershipProfile`
+  (tenant-owned, organization-scoped), `Role` and `Permission` with explicit scope,
+  `Invitation` — on top of Keycloak.
+- Written attribute-ownership table, enforced by `User_Aggregate_Has_No_TenantScoped_Columns`.
+- Tenant-scoped DSAR export and erasure, running under `ITenantContext` as
+  `learnstack_app`; global account closure as a separate platform-scoped operation.
+- `TenantCustomFieldDef` with a mandatory `pii_category`, the `Membership` target, the
+  definition editor, and the schema-driven membership form.
+- Category-driven redaction of custom-field values in logs and error-tracking payloads.
+- `AuthorizationBehavior` as a real implementation, replacing the Phase 02a shell.
+- Admin login, tenant switcher and organization switcher via OIDC PKCE.
+- Tenant- and organization-aware user management screens.
+- Invitation flow end to end, tenant and organization bound.
+- Identity events wired through the central audit pipeline; Keycloak webhook →
+  `IEventBus` → Audit consumer working end to end.
+- Corrected APISIX route table: explicit priorities on every route, and no Hub HMAC
+  reference anywhere in gateway configuration.
+- `LS0001` and `LS0002` escalated to Error.
 
 ## Completion Criteria
 
-- A tenant admin can only see users from their tenant; an org admin can only see
+- A tenant admin sees only users from their tenant; an organization admin sees only
   users from their organization.
-- Role and permission changes are enforced by both API and UI; permission-scope
-  rejection (Tenant vs Organization) returns the right Problem Details code.
-- Unauthorized users cannot access admin endpoints.
-- Invitation flow is covered by integration tests, including email-mismatch and
-  revoked cases, and across-organization invitations.
-- MUST-audit identity events appear in `audit_log` via the central pipeline with
-  before/after snapshots where applicable; no Identity-owned `audit_*` table exists.
-- Cross-tenant operations from a platform admin role are audited explicitly with the
-  required `reason` field; Hub-operator actions are audited with
-  `actor.hubOperator = true`.
+- No attribute a tenant authored about a person is visible to any other tenant. An
+  integration test creates one person with memberships in both
+  [Phase 02a Packet 7](phase-02a-kernel-tenancy.md) seed tenants, sets a custom field
+  in each, and asserts as `learnstack_app` that neither tenant can read the other's
+  value.
+- `users` has no `custom_fields` column and no tenant-authored column;
+  `User_Aggregate_Has_No_TenantScoped_Columns` is green.
+- A tenant-scoped erasure removes that tenant's membership, profile and behaviour rows
+  and leaves the person's membership in the other tenant fully functional, including
+  the ability to log in.
+- No tenant-admin endpoint can delete or anonymise the global `User` row or the
+  Keycloak user.
+- Every `TenantCustomFieldDef` row carries a `pii_category`; a definition with category
+  `Payment` is rejected; the export bundle contains exactly the fields the categories
+  permit.
+- A custom-field value classified `PII-Identity` does not appear in any log line or
+  error-tracking payload.
+- Role and permission changes are enforced by both API and UI; a permission-scope
+  rejection (Tenant vs Organization) returns the correct Problem Details code.
+- Unauthorized users cannot reach admin endpoints, and a denied command returns
+  `Result.Fail(forbidden)` rather than throwing.
+- Invitation flow is covered by integration tests, including email mismatch, revoked,
+  expired, and cross-organization cases.
+- MUST-class identity audit entries commit in the same transaction as the write they
+  describe, with before / after snapshots where applicable; no Identity-owned `audit_*`
+  table exists.
+- Cross-tenant operations from a platform-admin role are audited with the required
+  `reason`; Hub-operator actions are audited with `actor.hubOperator = true`.
+- The committed APISIX route table declares a priority on every route, the anonymous
+  localization route outranks the authenticated catch-all, and
+  `internal-api-hmac-key` appears nowhere in it.
 
 ## Risks
 
-- Re-implementing capabilities Keycloak already owns (password hashing, reset emails,
-  token rotation). If a feature is in the Keycloak vs. LearnStack split table
-  ([13-identity-and-auth.md](../architecture/13-identity-and-auth.md)), it stays in
+- **Re-implementing what Keycloak owns** — password hashing, reset emails, token
+  rotation. If a capability appears in the Keycloak vs LearnStack split table in
+  [Identity and Authentication](../architecture/13-identity-and-auth.md), it stays in
   Keycloak.
-- Designing the identity model only around the first tenant's needs (the English-
-  learning showcase). Triple-key membership and org-scoped roles must serve every
-  tenant shape, not only the showcase.
-- Keeping roles too simple and postponing permissions until it is painful.
-- Confusing global user identity with tenant membership.
-- Building an Identity-owned audit table by accident. The Audit module is the only
-  owner; Identity emits events.
-- Relying only on frontend checks for admin authorization.
+- **The ownership split erodes one column at a time.** The pressure is always local and
+  always reasonable: a global "phone number" is convenient, and the first tenant to ask
+  for it will not be thinking about the second. `User_Aggregate_Has_No_TenantScoped_Columns`
+  is the mechanical answer; a reviewer asking "which tenant authored this value?" is the
+  human one.
+- **A tenant-scoped erasure quietly becoming global.** The two flows share vocabulary,
+  handler names and UI copy, and the destructive one is easier to implement. Keeping
+  global closure off the tenant-admin surface entirely — no endpoint, no permission key
+  — is cheaper than reviewing every future change to the shared path.
+- **`pii_category` degenerating into a required field nobody thinks about.** If every
+  definition ends up `None`, the classification is decorative and the export is wrong.
+  The Studio editor asks the question in the field's own words, and the seed data sets
+  a non-trivial category so the shape is exercised.
+- **Designing the identity model around the first tenant.** Triple-key membership and
+  organization-scoped roles must serve every tenant shape, not only the language-school
+  showcase in [Phase 10](phase-10-english-learning-mvp.md). Both
+  [Phase 02a Packet 7](phase-02a-kernel-tenancy.md) seed tenants get memberships in
+  this phase.
+- **Keeping roles simple and postponing permissions until it hurts.** The permission
+  key set is small here, but the scope dimension is not optional — retrofitting scope
+  onto flat permissions touches every check.
+- **Relying on frontend checks for admin authorization.** The API enforces; the UI
+  mirrors. A hidden button is a usability decision, never a security one.
+- **Correcting the gateway config and then never deploying it.** The corrected table is
+  configuration for a component that does not run until
+  [Phase 11](phase-11-production-hardening.md). Phase 11 must adopt the corrected file
+  rather than re-deriving one from the architecture doc's older revision.
+
+## Phase Exit Decision
+
+[Phase 04](phase-04-cms-media-pages.md) begins when all of the following hold:
 
+- A person holding memberships in both seed tenants has their tenant-authored
+  attributes stored per tenant, invisible across tenants, and provably so by an
+  integration test running as `learnstack_app`.
+- A tenant-scoped erasure in one tenant leaves that person's access to the other tenant
+  intact, and no tenant-admin path can reach the global account.
+- Every `TenantCustomFieldDef` carries a PII category, and export, redaction and
+  retention are driven by the definitions rather than by the JSONB blob.
+- `AuthorizationBehavior` is a real implementation and every write endpoint carries an
+  explicit policy.
+- `LS0001` and `LS0002` are Errors, both removed from `WarningsNotAsErrors`, and the
+  solution builds clean.
+- The corrected APISIX route table is committed with explicit priorities and no Hub
+  HMAC reference. The gateway adapter itself remains
+  [Phase 11](phase-11-production-hardening.md) work.
+- The identity, DSAR and custom-field architecture tests named above are registered in
+  [Architecture Tests Catalogue](../standards/21-architecture-tests-catalogue.md) and
+  green in CI.
diff --git a/docs/roadmap/phase-04-cms-media-pages.md b/docs/roadmap/phase-04-cms-media-pages.md
index 3f7a85b..3c9f783 100644
--- a/docs/roadmap/phase-04-cms-media-pages.md
+++ b/docs/roadmap/phase-04-cms-media-pages.md
@@ -2,155 +2,444 @@
 
 ## Goal
 
-Turn LearnStack into an education-aware headless CMS and page composition platform, not merely a course management system.
-
-This phase enables landing pages, blog content, catalog pages, campaign pages, and product-specific page blocks.
+Turn LearnStack into an education-aware headless CMS and page-composition platform, not
+merely a course-management system. This phase enables landing pages, blog content,
+catalog pages, campaign pages, and tenant-defined page blocks.
+
+[Phase 02d](phase-02d-walking-skeleton.md) already renders two tenants' catalog and
+lesson pages from customization data. It does so with hard-coded route segments and a
+single built-in content primitive. This phase replaces that with an authored,
+versioned, localized content system that a tenant admin drives from Admin Studio — and
+it is the phase where four long-standing modelling conflicts in the corpus get an
+answer, because every one of them becomes load-bearing the moment content is authored
+rather than seeded.
 
 Decisions consumed in this phase:
 
-- [ADR-0008 Localization Schema](../decisions/0008-localization-schema.md). All
-  tenant-owned content tables introduced here adopt the side-table or JSONB-localized
-  pattern declared in the ADR. The `tenant_locales` table is owned by the Tenancy
-  module and lands in [Phase 02a](phase-02a-kernel-tenancy.md); Phase 04 consumes it.
+- [ADR-0008 Localization Schema](../decisions/0008-localization-schema.md). Every
+  tenant-owned content table introduced here adopts the side-table or JSONB-localized
+  pattern the ADR declares. `tenant_locales` is owned by the Tenancy module and lands in
+  [Phase 02a Packet 6](phase-02a-kernel-tenancy.md); this phase consumes it.
 - [ADR-0013 Page Block Schema Versioning](../decisions/0013-page-block-schema-versioning.md).
-  Every block ships with a `(key, schemaVersion)` tuple, an immutable JSON schema, and
-  a registered renderer. Lazy migration and the `UnknownVersionBlock` / `UnknownBlock`
-  placeholders are part of the renderer contract from day one.
-- [ADR-0018 Tenant-Driven Customization Model](../decisions/0018-tenant-driven-customization-model.md)
-  (supersedes ADR-0011). **Content types** are declared as `TenantContentType` rows
-  (JSON Schema). **Page blocks** are declared as `TenantPageBlock` rows
-  (JSON Schema + composite-renderer key). Both surfaces are tenant data, not code; the
-  customization aggregates were scaffolded in Phase 02a, and Phase 04 lights up the
-  editing + rendering paths.
+  Every block carries a `(key, schemaVersion)` tuple, an immutable validation contract,
+  and a registered renderer. Lazy migration and the `UnknownVersionBlock` /
+  `UnknownBlock` placeholders are part of the renderer contract from day one.
+- [ADR-0018 Tenant-Driven Customization Model](../decisions/0018-tenant-driven-customization-model.md).
+  Content shapes are `TenantContentType` rows; page blocks are `TenantPageBlock` rows.
+  Both are tenant data, not code. The 2026-08-08 Amendment's genericity boundary applies
+  directly here: presentation and content shape are inside it, so nothing in this phase
+  needs a code branch per tenant.
+
+Decision required **before this phase exits**:
+[ADR-0027 — frontend i18n library pick](../decisions/README.md) (`next-intl` vs
+`react-intl` vs `lingui`), reserved against this phase in the decisions README's open
+drafts table.
 
 ## Scope
 
-### Content Type System
-
-Content types are **tenant-defined** per
-[ADR-0018](../decisions/0018-tenant-driven-customization-model.md). The
-`TenantContentType` aggregate (already scaffolded in Phase 02a) gains its full editor
-and runtime surface here:
-
-- `TenantContentType` JSON Schema editor in Admin Studio (tenant admin defines a
-  schema; the system validates it on save).
-- Built-in primitive field types composed by the JSON Schema:
-  - Text, rich text, number, boolean, date/time
-  - Media reference, entry reference
-  - Select / multi-select
-  - JSON / object
-- `ContentEntry` CRUD per type (the entry's `data` column stores the JSON shape
-  matching the active schema version).
-- Draft and published states.
-- Schema-version migration path (lazy on entry save; bulk migration as a tenant-admin
-  operation).
+### Content Type System — one concept, one aggregate
+
+The corpus models a content-type schema twice. The
+[Domain Model](../architecture/02-domain-model.md) lists `ContentType` under **Content**
+("Schema for structured content; tenant-scoped") and `TenantContentType` under **Tenant
+Customization** ("JSON Schema for a content type"). They are the same aggregate with two
+owning modules, two write paths, two validators, and two permission keys. Search already
+picks a side arbitrarily — [Search](../architecture/20-search.md) maps its
+`content_type_key` field to `ContentType.Key`.
+
+**`TenantContentType` survives.** It is the only aggregate in LearnStack that declares a
+content shape. It lives in `LearnStack.Modules.Customization`, ships in
+[Phase 02a Packet 8](phase-02a-kernel-tenancy.md), and gains its editor and runtime
+surface here. `ContentType` is deleted from the domain model rather than renamed, and
+`Search`'s `content_type_key` resolves to `TenantContentType.Key`.
+
+The Content module keeps the half that is genuinely its own:
+
+- `ContentEntry` — an instance of a content shape, with draft and published states. It
+  stores `content_type_key` and `schema_version` as plain columns and validates its
+  `data` payload against the referenced schema revision on every write.
+- **No database foreign key crosses the module boundary.** `content_entries` lives in
+  the Content module's schema and `tenant_content_types` in Customization's; a
+  cross-schema key would be exactly the cross-module join
+  [ADR-0010](../decisions/0010-cross-module-communication.md) and
+  [Database Standards](../standards/05-database.md) forbid. The reference is validated
+  through Mechanism #1 — an application contract in
+  `Customization.Application.Contracts` that resolves a `(tenant_id, key,
+  schema_version)` tuple to its JSON Schema and reports whether the revision is still
+  publishable.
+- Referential integrity is therefore enforced in the application, and the failure mode
+  is explicit: deleting a schema revision requires a zero-instance count across the
+  tenant, per [ADR-0013](../decisions/0013-page-block-schema-versioning.md).
+
+Also in scope:
+
+- `TenantContentType` JSON Schema editor in Admin Studio; the schema is validated as a
+  schema on save, not merely stored.
+- Built-in primitive field types composed by the JSON Schema: text, rich text, number,
+  boolean, date/time, media reference, entry reference, select / multi-select, JSON /
+  object. The set is closed and changes only with a LearnStack release.
+- `ContentEntry` CRUD per type, with draft and published states.
+- Schema-version migration path: lazy on entry save, plus bulk migration as a
+  tenant-admin operation with a dry run.
+
+### Customization Key Shape and Immutable Schema Versions
+
+[ADR-0013](../decisions/0013-page-block-schema-versioning.md) requires immutable
+versioned schemas: a breaking change ships as a new `schemaVersion` and the previous
+version stays supported while any instance references it.
+[Tenant Customization Model § 11](../architecture/32-tenant-customization-model.md)
+requires `UNIQUE (tenant_id, key)` on every customization table. The two cannot both
+hold — the same document's own § 4 example shows `vocabulary-card` at
+`schema_version = 1` and `schema_version = 2` in `tenant_content_types`, and the unique
+constraint rejects the second row. Written as published, the first breaking change a
+tenant makes fails on a constraint violation.
+
+The key shape LearnStack ships, for every versioned customization aggregate
+(`TenantContentType`, `TenantPageBlock`, and `TenantLessonItemType` when
+[Phase 05](phase-05-education-learning-content.md) adds it):
+
+| Constraint | Purpose |
+|---|---|
+| `UNIQUE (tenant_id, key, schema_version)` | Identity of one immutable schema revision |
+| `UNIQUE (tenant_id, key) WHERE status = 'active'` (partial index) | At most one publishable revision per concept |
+
+`(tenant_id, key)` names the concept; `(tenant_id, key, schema_version)` names the
+revision. The partial index preserves what § 10's rule was actually protecting — a
+tenant cannot have two live definitions of `vocabulary-list` — without forbidding the
+version history the ADR requires.
+
+Immutability is scoped precisely, because ADR-0013 permits additive edits within a
+version and the corpus does not currently say which edits those are:
+
+- The **validation contract** of a `(tenant_id, key, schema_version)` tuple is
+  immutable after first publish. Any change a stored instance could fail — a removed
+  field, a narrowed type, a new required field, a tightened enum — raises
+  `schema_version`.
+- Strictly additive changes — an optional field with a default, a widened enum, a new
+  facet — raise `schema_revision` within the same `schema_version`. Instances pin
+  `schema_version` only; `schema_revision` is not part of any unique key.
+- The classification is not left to the author's judgement. On save, the editor diffs
+  the submitted schema against the current revision and refuses an additive claim that
+  removes or narrows anything.
+- `status` moves `draft → active → deprecated`. After first publish, `status` and
+  presentation metadata are the only mutable columns on the row.
 
 ### Page Model
 
-- Page.
-- Page version.
-- Slug.
-- SEO metadata.
-- Locale readiness.
-- Draft/publish workflow.
-- Preview token.
-- Redirect model.
-
-### Page Blocks (Two-Tier Registry)
+- `Page`, `PageVersion` (draft and published snapshots), `PageBlock` instances inside a
+  version.
+- Per-locale slugs and SEO metadata through the side-table pattern below.
+- Locale readiness — which locales a page is publishable in.
+- Draft / publish workflow, preview token, and a `Redirect` model that the CMS
+  auto-creates when a published slug changes.
+
+### Localization and Slug Uniqueness
+
+[Phase 02d](phase-02d-walking-skeleton.md) already ships the side-table pattern for
+`Course` and `Lesson`, with the constraint below, and
+[Localization Standards § Pattern A](../standards/08-localization.md) already publishes it
+as the rule every translation table follows. This phase applies that rule to every routable
+entity it introduces — `Page`, `ContentEntry`, `Redirect`, navigation items — and adds the
+one thing a per-table constraint cannot do.
+
+- Every `<entity>_translations` table carries `tenant_id` as a real column and declares its
+  own Row Level Security policy. Row Level Security is per table; it is not inherited
+  through a parent check constraint, and a translation table without a policy is
+  unprotected while holding the title and the slug.
+- Slug uniqueness is `UNIQUE (tenant_id, locale, slug)` — **flat across organizations**.
+  `organization_id` is not in the key. Two reasons, and the second survives fixing the
+  first: a nullable column in a standard `UNIQUE` constraint does not constrain the rows
+  where it is null, because PostgreSQL treats nulls as distinct — so
+  `UNIQUE (tenant_id, organization_id, locale, slug)` constrains no tenant-wide row at all;
+  and even repaired with `NULLS NOT DISTINCT`, an organization-scoped row and a tenant-wide
+  row could still claim one slug, while a host resolving to `(tenant_id, organization_id)`
+  serves **both** tiers and would have to pick a winner at render time. Preferring the more
+  specific row is an unauthored slug change at a stable URL with no redirect — the failure
+  [Localization § Risks](../architecture/12-localization.md) already calls breaking.
+- The per-locale primary key `(<entity>_id, locale)` stays. It expresses "one translation
+  row per entity per locale" and is not the slug constraint.
+- Entity types that share one URL segment namespace — `Page` and `Redirect` both live at
+  the tenant root — resolve through a single `tenant_route_slugs` registry keyed
+  `UNIQUE (tenant_id, locale, path)`, on the same flat namespace and for the same reason.
+  Per-table uniqueness cannot see across tables, and a page silently shadowing a redirect
+  is the same class of defect as an organization row shadowing a tenant-wide one.
+- A slug collision returns `Result.Fail(business_rule_violation, …)` from the publish
+  command. It names the conflicting entity when the caller may read it — tenant-wide rows
+  and the caller's own organization's rows both qualify under the canonical policy — and
+  otherwise names only the slug and the locale, because naming a row in another
+  organization would leak across the boundary Row Level Security exists to hold. It is
+  never resolved by picking a winner at render time.
+
+Also in scope: locale fallback chain per tenant, the `/{locale}/{slug}` routing shape,
+and per-locale publish readiness. The frontend i18n library is chosen in ADR-0027 (see
+the Phase Exit Decision).
+
+### Page Blocks — Two-Tier Registry
 
 The page-builder resolver consults two tiers in order
-([17-page-builder.md](../architecture/17-page-builder.md)):
+([Page Builder](../architecture/17-page-builder.md)):
 
-**Tier 1 — Built-in primitive blocks** (code-registered, closed set, changes only
-with a LearnStack release):
+**Tier 1 — built-in primitive blocks**, code-registered, a closed set that changes only
+with a LearnStack release:
 
 - Hero, rich text, image, video, CTA.
 - Feature list, FAQ, testimonial.
-- Generic composite renderers: `content-list`, `card-grid`, `default-card` (these are
-  the composites that tenant-defined blocks dispatch to).
-
-**Tier 2 — Tenant-defined blocks** via `TenantPageBlock` rows. A tenant defines a
-schema + composite-renderer key (e.g. `vocabulary-list` → `content-list`) and the
-runtime renders by reading the schema, querying the data, and dispatching to the
-chosen composite. There are **no vertical-prefixed block keys** — a tenant's
-"vocabulary list" block is a `TenantPageBlock` row, not a code identifier.
+- Generic composite renderers: `content-list`, `card-grid`, `default-card` — the
+  composites that tenant-defined blocks dispatch to.
+
+**Tier 2 — tenant-defined blocks** via `TenantPageBlock` rows. A tenant declares a JSON
+Schema plus a composite-renderer key (for example `vocabulary-list` → `content-list`);
+the runtime reads the schema, queries the data, and dispatches to the chosen composite.
+There are **no vertical-prefixed block keys in code** — a tenant's "vocabulary list" is
+a row, not an identifier.
+
+**`TenantPageBlock` lands here in full**, moved out of
+[Phase 02a Packet 8](phase-02a-kernel-tenancy.md), which now ships only
+`TenantContentType` and `TenantLevelTaxonomy`. This phase owns the aggregate, its
+migration under the key shape above, its Studio editor, and its renderer path. Packet 8
+kept the two aggregates the walking skeleton needs to render two tenants; a block
+aggregate with no editor, no renderer and no consumer for two phases is schema shipped
+ahead of its rules — and the versioning rules are decided in this phase.
 
 The block system ships with:
 
-- Versioned block schema (`(key, schemaVersion)` per
-  [ADR-0013](../decisions/0013-page-block-schema-versioning.md)).
-- Safe rendering with `UnknownVersionBlock` / `UnknownBlock` placeholders.
-- Per-tenant block enablement via `TenantPageBlock` rows (no flag table).
-- Schema-driven editor form for both built-in and tenant-defined blocks.
+- Versioned block schemas under the `(tenant_id, key, schema_version)` shape above.
+- Safe rendering: known key and version renders the component, known key with an unknown
+  version renders `UnknownVersionBlock`, an unknown key renders `UnknownBlock`. Each
+  block renders inside an error boundary, so one bad block does not take down the page.
+- Per-tenant block enablement through the existence of the `TenantPageBlock` row itself
+  — there is no separate flag table.
+- A schema-driven editor form serving both tiers from the same code path.
 
 ### Navigation
 
-- Header menu.
-- Footer menu.
-- Nested menu items.
-- External links.
-- Internal page references.
-- Course and catalog references.
-
-### Media Library
-
-- SeaweedFS upload.
-- Asset metadata.
-- Folder and tag organization.
-- Image dimensions.
-- File type validation.
-- File size limits.
-- Signed/private access readiness.
-- Public asset URL strategy.
+- Header and footer menus, nested menu items.
+- External links, internal page references, course and catalog references.
+- Menu items are localized through the same translation pattern as pages, and a menu
+  item pointing at an unpublished page in the requested locale is hidden rather than
+  rendered as a dead link.
+
+### Media Library and the Transcoding Pipeline
+
+Storage and asset management:
+
+- Upload to SeaweedFS through `IStorageProvider`
+  ([ADR-0029](../decisions/0029-object-storage-seaweedfs.md)), under the tenant- and
+  organization-scoped key layout in [Media Pipeline](../architecture/16-media-pipeline.md).
+- `MediaAsset` and `MediaVariant`, asset metadata, folder and tag organisation, image
+  dimensions, file-type validation, size limits.
+- Public / tenant-scoped / per-user access tiers with signed URL minting, and the public
+  asset URL strategy.
+
+**This phase owns the media processing pipeline.** No phase currently does:
+[Media Pipeline](../architecture/16-media-pipeline.md) describes `IVideoTranscoder`,
+ffmpeg workers, HLS renditions and a managed-service scale path in full detail, and the
+roadmap never names a phase that builds any of it — while
+[Phase 08c](phase-08c-classroom.md) explicitly states that classroom recordings are
+*not* transcoded there. Media is authored in this phase, so the pipeline belongs here.
+
+- **Images** — `IImageProcessor` with an in-process implementation: variants at `w400`,
+  `w800`, `w1600` and a 128×128 thumbnail, WebP plus a JPEG/PNG fallback, synchronous
+  under 5 MB and queued above it. EXIF stripped except orientation. SVG sanitised
+  (no `<script>`, no external `xlink:href`, no event handlers) before it is ever served.
+- **Video** — `IVideoTranscoder` in `LearnStack.SharedKernel`, with an **ffmpeg-backed
+  worker as the default implementation**: `ffprobe` metadata, HLS renditions at 480p /
+  720p / 1080p, poster image, sprite-sheet thumbnail strip. The worker runs on the
+  Hangfire infrastructure wired in [Phase 02b](phase-02b-events-auth.md), on its own
+  queue, with the ffmpeg binary version pinned in the container image and asserted at
+  startup.
+- **The managed alternative is not built here.** Mux, AWS MediaConvert and Cloudflare
+  Stream sit behind the same `IVideoTranscoder` port and land in
+  [Phase 11](phase-11-production-hardening.md), on the demand-gating discipline of
+  [ADR-0035](../decisions/0035-demand-gated-infrastructure.md), under the trigger:
+  in-house transcode backlog or per-minute cost exceeds the managed alternative. Until
+  that trigger fires there is one implementation, and adopting a managed service is a
+  composition-root change.
+- Source files are retained for 30 days and then archived, so an encoding-profile change
+  can be replayed.
+- Transcoding is a per-tenant resource cost. Concurrent transcode jobs per tenant are
+  bounded, and the bound is a `LimitKey` so it becomes plan-gated the moment
+  [Phase 02c](phase-02c-hub-foundation.md) supplies a real entitlement projection.
+
+### Search — the port and its PostgreSQL default
+
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md) demand-gates Meilisearch
+behind `ITenantSearch`, with a PostgreSQL full-text default shipping now. This is the
+first phase with content to index, so the port and its default land here.
+
+- `ITenantSearch` and `IPlatformSearch` in `LearnStack.SharedKernel`, with the signatures
+  [ADR-0012](../decisions/0012-search-strategy.md) specifies.
+- A PostgreSQL `tsvector` implementation over `content_entries` and the page model, with
+  a per-locale generated `tsvector` column and a GIN index per locale.
+- The mandatory `tenant_id` predicate is composed **inside** the implementation, not by
+  callers, along with the organization term where the entity is organization-scoped.
+  Direct SQL search from a handler is forbidden.
+- Cross-tenant search isolation is asserted by integration test from this phase, not from
+  [Phase 09](phase-09-billing-integrations-analytics.md).
+- Meilisearch is **not** built here. Its trigger — search quality or scale exceeds
+  PostgreSQL full-text — is expected to fire in Phase 09.
+
+### Hosts and Canonical URLs
+
+Page SEO metadata, canonical URLs and redirect targets need to know which hosts serve a
+tenant. They read `platform_host_to_tenant` through `IHostToTenantResolver`, and
+**never** call the Hub — the correction is already landed in
+[Phase 02a Packet 7](phase-02a-kernel-tenancy.md) per
+[ADR-0034](../decisions/0034-hub-contract-surface-invariant.md), and this phase is the
+first substantial consumer of it. An anonymous page load, and the canonical URL it
+renders, must not depend on a control plane being reachable.
+
+Registration of a custom domain remains Hub-side
+([ADR-0022](../decisions/0022-custom-domain-tls.md),
+[Phase 02c](phase-02c-hub-foundation.md)); the tenant-facing status viewer is
+[Phase 06](phase-06-renderer-admin-studio.md). This phase reads the mapping, and does
+not write it.
 
 ### Admin Studio CMS Screens
 
-- Content type list/detail (over `TenantContentType` rows — JSON Schema editor,
-  schema-version tracking, sample-data preview).
-- Content entry list/detail (schema-driven form derived from the active
-  `TenantContentType`).
-- Page list/detail.
-- Page builder/editor (two-tier block picker; both primitive and tenant-defined
-  blocks).
-- Page-block editor (`TenantPageBlock` CRUD: schema + composite renderer key).
-- Media library.
+- Content type list and detail: JSON Schema editor, revision history, additive-vs-breaking
+  diff on save, sample-data preview.
+- Content entry list and detail: schema-driven form derived from the active revision.
+- Page list and detail.
+- Page builder / editor: two-tier block picker, reorder, schema-driven form, inline
+  preview through the production renderer.
+- Page-block editor: `TenantPageBlock` CRUD — schema, composite renderer key, version
+  lifecycle.
+- Custom field values on content entries, using the `TenantCustomFieldDef` surface
+  delivered in [Phase 03](phase-03-identity-admin.md).
+- Media library with upload, folders, variant status, and transcode job state.
 - Navigation editor.
-- Publish/preview controls.
+- Publish and preview controls, including per-locale readiness.
+
+The visual drag-and-drop schema builder is [Phase 06](phase-06-renderer-admin-studio.md);
+this phase ships the picker-and-reorder Studio MVP the page-builder architecture
+describes.
 
 ## Deliverables
 
-- Tenant-aware headless CMS.
-- Page builder data model.
-- Media upload and asset library.
-- Draft/publish workflow.
-- APIs for public rendering.
+- Tenant-aware headless CMS over a single content-shape aggregate, `TenantContentType`,
+  with `ContentType` removed from the domain model.
+- `TenantPageBlock` complete: aggregate, migration, Studio editor, renderer path.
+- The versioned key shape — `UNIQUE (tenant_id, key, schema_version)` plus the partial
+  active-revision index — applied to every versioned customization aggregate, with the
+  additive-vs-breaking diff enforced at save time.
+- Page, page version, per-locale slug, SEO metadata, redirect and preview model.
+- Translation tables for every routable entity this phase introduces, each carrying
+  `tenant_id` and its own Row Level Security policy, with slug uniqueness on
+  `UNIQUE (tenant_id, locale, slug)` and `organization_id` absent from that key, plus a
+  `tenant_route_slugs` registry keyed `UNIQUE (tenant_id, locale, path)` for the shared
+  root namespace.
+- Navigation model and editor.
+- Media library on SeaweedFS with `IImageProcessor` and `IVideoTranscoder`, the
+  ffmpeg-backed default worker, and a per-tenant concurrent-transcode limit expressed as
+  a `LimitKey`.
+- `ITenantSearch` / `IPlatformSearch` with a PostgreSQL full-text implementation over
+  content entries and pages, tenant-filtered inside the port.
+- Admin Studio CMS screens per the list above.
+- Public read APIs for the renderer, versioned per
+  [ADR-0024](../decisions/0024-api-versioning-policy.md).
+- ADR-0027 Accepted, and the chosen i18n library wired into `frontend/apps/web`.
 
 ## Completion Criteria
 
-- A tenant admin can create a new `TenantContentType` (e.g. `VocabularyCard`) from
-  Studio with a JSON Schema, create entries against it, and reference those entries
-  from a page — **without any LearnStack code change**.
-- A tenant admin can create a `TenantPageBlock` (e.g. `vocabulary-list`) that
-  dispatches to a built-in composite renderer (e.g. `content-list`) — again, **without
-  any LearnStack code change**.
-- A page can contain multiple renderable blocks across the two-tier registry.
-- A media asset can be uploaded and used inside a page block.
-- Draft and published versions are separated.
-- Published pages do not accidentally show draft content.
-- Preview flow works for admin users.
-- The same Studio editor and rendering pipeline serves two tenants with totally
-  different content-type / page-block sets without code branching.
+- A tenant-scoped search returns that tenant's content entries and zero rows belonging to
+  the other seed tenant, proven by integration test.
+- A tenant admin creates a new `TenantContentType` from Studio with a JSON Schema,
+  creates entries against it, and references those entries from a page — **without any
+  LearnStack code change**.
+- A tenant admin creates a `TenantPageBlock` that dispatches to a built-in composite
+  renderer — again, **without any LearnStack code change**.
+- Publishing a breaking schema change creates `schema_version = 2`, leaves existing
+  entries rendering against version 1, and does not violate a unique constraint.
+- An additive edit submitted as a `schema_revision` bump that in fact removes a field is
+  rejected at save time with the offending field named.
+- Exactly one `active` revision exists per `(tenant_id, key)` at all times, asserted by
+  an integration test that attempts to activate a second.
+- Two different courses in one tenant cannot both publish `/en/courses/beginner`; the
+  second publish returns a business-rule failure naming the first. The same holds for a
+  page and a redirect competing for one root path, and for an organization-scoped entity
+  competing with a tenant-wide one. An integration test attempts all three and the
+  database rejects each, connected as `learnstack_app`.
+- When the conflicting row belongs to another organization, the failure names the slug and
+  the locale but not the row — asserted by a test, because the constraint is enforced with
+  Row Level Security bypassed and the handler has to make that choice deliberately.
+- A page and a course in **different** tenants may hold the same slug, and each host
+  serves its own.
+- A page can contain multiple renderable blocks across both registry tiers, and a block
+  whose `TenantPageBlock` row was deleted renders `UnknownBlock` without taking the page
+  down.
+- An image asset uploaded through Studio produces its variants and is usable inside a
+  page block; a video asset produces an HLS master playlist, a poster and a thumbnail
+  strip through the ffmpeg worker.
+- An SVG containing a `<script>` element is stored sanitised and served without it.
+- Draft and published versions are separated, published pages never show draft content,
+  and the preview flow works for admin users.
+- The same Studio editor and rendering pipeline serve both
+  [Phase 02a Packet 7](phase-02a-kernel-tenancy.md) seed tenants with completely
+  different content-type and page-block sets, with no code branching on tenant identity.
+- Canonical URLs and redirect targets resolve from `platform_host_to_tenant` with the
+  Hub unreachable.
 
 ## Risks
 
-- Building a visually complex page builder too early.
-- Ignoring block schema versioning.
-- Designing media access without public/private separation.
-- Building CMS and education catalog as disconnected systems.
-- Re-introducing per-domain block keys (`english.*`, `yoga.*`) into code — explicitly
-  forbidden by ADR-0018. Tenant data, not code, expresses the per-domain shape.
+- **Building a visually complex page builder too early.** The Studio MVP is a picker and
+  reorder buttons with schema-driven forms. Drag-and-drop is
+  [Phase 06](phase-06-renderer-admin-studio.md), and pulling it forward costs more than
+  it looks because every interaction has to survive the two-tier registry.
+- **Ignoring block schema versioning under deadline pressure.** Editing a published
+  schema in place is one line and works in every test a developer writes, because their
+  test data is new. It breaks the tenant whose pages are three months old. The save-time
+  diff exists precisely because the failure is invisible to the person making it.
+- **Re-introducing per-domain block keys into code.** `english.*` and `yoga.*`
+  identifiers are forbidden by ADR-0018 and caught by
+  `Core_Modules_HaveNo_DomainSpecific_Names` from
+  [Phase 02a Packet 10](phase-02a-kernel-tenancy.md). Tenant data expresses the
+  per-domain shape.
+- **The unified content-type decision half-landing.** Deleting `ContentType` from the
+  domain model is easy; the risk is a Content-module class quietly re-creating it
+  because reading Customization through an application contract is slightly more work
+  than a navigation property. A cross-module EF navigation is forbidden by ADR-0010 and
+  is what a reviewer should look for first in this phase's diffs.
+- **Slug uniqueness drifting back into per-table folklore.** The rule lives in
+  [Localization Standards § Pattern A](../standards/08-localization.md) as the pattern every
+  translation table follows, and [Phase 02d](phase-02d-walking-skeleton.md) already applies
+  it to `Course` and `Lesson`. The recurring temptation is to add `organization_id` to the
+  key when an entity is `[OrganizationScoped]` — it reads as the careful thing to do, and it
+  is the defect: it stops constraining tenant-wide rows entirely, and it re-opens the
+  cross-tier collision. A migration review that sees `organization_id` inside a slug unique
+  key should stop there.
+- **The transcoding pipeline becoming an operational surprise.** ffmpeg workers are
+  CPU-heavy and easy to under-provision. The per-tenant concurrency bound and the
+  queue's own metrics ship with the worker, not after the first backlog.
+- **Designing media access without public / private separation**, or building CMS and
+  the education catalog as disconnected systems. Both are corpus-level regressions;
+  the catalog in [Phase 05](phase-05-education-learning-content.md) composes the same
+  blocks and the same content types.
+- **ADR-0027 slipping past the exit gate.** An i18n library chosen after the Studio and
+  the public renderer already have strings is a mechanical but wide refactor. The gate
+  is there to make the cost visible while it is still small.
 
 ## Phase Exit Decision
 
-When this phase is complete, public rendering and Admin Studio UI work can become more serious.
-
+[Phase 05](phase-05-education-learning-content.md) begins when all of the following
+hold:
+
+- A tenant admin composes a complete, localized, published page from tenant-defined
+  content types and page blocks, with media, without a LearnStack code change — on both
+  seed tenants, with different shapes.
+- The versioned key shape is in the schema, a breaking change ships as a new
+  `schema_version`, exactly one revision is active per key, and the additive-vs-breaking
+  diff rejects a mis-declared edit.
+- `ContentType` no longer exists anywhere in the corpus or the codebase; every content
+  shape resolves through `TenantContentType`.
+- Slug uniqueness is enforced by a constraint that can actually reject a row — proven by
+  integration tests for the same-tier, cross-tier and cross-table cases — and
+  `tenant_route_slugs` covers the shared root namespace that no per-table constraint can
+  see.
+- Image and video assets are processed end to end by the in-house pipeline, and
+  `IVideoTranscoder` has exactly one registered implementation with the managed
+  alternative recorded against [Phase 11](phase-11-production-hardening.md) and its
+  trigger.
+- ADR-0027 is **Accepted** and the chosen library is wired, not merely selected.
+- Public rendering and Admin Studio work can proceed against a stable content contract —
+  which is what [Phase 06](phase-06-renderer-admin-studio.md) assumes.
diff --git a/docs/roadmap/phase-05-education-learning-content.md b/docs/roadmap/phase-05-education-learning-content.md
index 3fbe8b7..0f81a0b 100644
--- a/docs/roadmap/phase-05-education-learning-content.md
+++ b/docs/roadmap/phase-05-education-learning-content.md
@@ -2,59 +2,118 @@
 
 ## Goal
 
-Build the core education domain: program, course, course version, module, lesson, lesson
-item models — all **domain-agnostic**. Domain-specific shapes (CEFR levels, vocabulary
-cards, asana catalogs, code-challenge runners, …) live as **tenant customization data**
-([ADR-0018](../decisions/0018-tenant-driven-customization-model.md)) in the
-customization aggregates already scaffolded in Phase 02a; this phase lights up the
-runtime read paths against those aggregates.
+Build the core education domain — program, course, course version, module, lesson,
+lesson item — and light up the tenant customization runtime that gives those structures
+their per-tenant shape. Every model here is **domain-agnostic**. Domain-specific shapes
+(CEFR levels, vocabulary cards, asana sequences, submitted-code exercises) live as
+**tenant customization data**
+([ADR-0018](../decisions/0018-tenant-driven-customization-model.md)), never as code.
+
+This phase **deepens** what [Phase 02d](phase-02d-walking-skeleton.md) already shipped
+rather than creating it. `Course` and `Lesson` exist in thin form from the walking
+skeleton — slug, title, published state, an ordered lesson list, and a body rendered
+from a single primitive. Phase 05 adds the structure a real catalog needs: programs,
+versioning, modules, lesson items, and tenant-defined item types.
+
+This phase also carries the decision the customization model has been running without.
+**[ADR-0025](../decisions/README.md#open-adr-drafts) — the scoring and completion DSL
+sandbox engine — must be Accepted in this phase.** It is reserved with Phase 05 as its
+target, and it is an exit blocker: [Phase 02a Packet 8](phase-02a-kernel-tenancy.md)
+deliberately stores rule bodies as opaque `text` with a `dialect` discriminator because
+the three candidate engines do not share a column type. Rules can be authored before the
+engine exists; they cannot be **evaluated** before it exists.
 
 Decisions consumed:
 
 - [ADR-0018 Tenant-Driven Customization Model](../decisions/0018-tenant-driven-customization-model.md)
-  — `TenantLevelTaxonomy`, `TenantLessonItemType`, `TenantCompletionRule` resolve at
-  runtime.
+  — `TenantLevelTaxonomy`, `TenantLessonItemType`, `TenantScoringRule` and
+  `TenantCompletionRule` resolve at runtime. Its **2026-08-08 Amendment** draws the
+  genericity boundary this phase must respect: content shape, presentation and pure rule
+  evaluation are tenant data; stateful entitlement and external capability invocation
+  are platform features.
 - [ADR-0013 Page Block Schema Versioning](../decisions/0013-page-block-schema-versioning.md)
-  — same `(key, schemaVersion)` semantics apply to lesson item types.
+  — the same `(key, schemaVersion)` semantics apply to lesson item types.
+- [ADR-0021 Feature-Based Entitlement](../decisions/0021-feature-based-entitlement.md)
+  — the runtime limits below are `LimitKeys` entries, so a plan raises them up to a
+  platform ceiling rather than the ceiling being hard-coded per tenant.
 
 ## Scope
 
+### What Phase 02d already shipped
+
+Phase 05 does not re-create these; its migrations are additive, and the one destructive
+change (lesson bodies become lesson items) goes through the two-step deprecation window
+in [Database Standards](../standards/05-database.md).
+
+| Already exists | Phase 05 adds |
+|---|---|
+| `Course` — slug, title, summary, published / draft | Program membership, versioning, categories, tags, SEO, catalog visibility |
+| `Lesson` — ordered within a course, single-primitive body | Module membership, lesson items, required / optional, duration, prerequisites |
+| Two anonymous read endpoints | The authenticated authoring surface and the versioned read path |
+| `[TenantOwned]` markers, EF query filters, RLS policies | The same layers on every new table, with no exception |
+
+### ADR-0025 — the scoring and completion DSL engine
+
+The one decision this phase cannot ship without. The ADR settles:
+
+- **The engine.** CEL (Common Expression Language, `cel-dotnet`), a restricted Lua
+  (NLua / MoonSharp with a stripped standard library), or a custom AST interpreter over
+  a closed grammar. The choice determines the stored representation, so it also
+  determines what the `dialect` discriminator from
+  [Phase 02a Packet 8](phase-02a-kernel-tenancy.md) resolves to.
+- **The sandbox boundary.** No file, network or process I/O. No reflection. No
+  host-object graph traversal. No unbounded loops or recursion. Deterministic: time and
+  randomness reach the expression only through the injected `IClock` / `IRandom`
+  abstractions, so a rule replayed over the same facts yields the same answer.
+- **The allowed function set.** A closed, versioned catalogue. Adding a function is a
+  LearnStack release and a catalogue revision, not a tenant action — the same closure
+  rule the primitive renderer set already carries.
+- **The evaluation budget.** Wall-clock ceiling, step ceiling and memory ceiling per
+  evaluation, enforced by the host rather than trusted to the expression.
+- **The failure posture**, which must fail closed in both directions. A rule that
+  exceeds its budget or throws must never silently mark a lesson complete and never
+  silently assign a scoring band. The evaluation returns a failure the caller surfaces;
+  the attempt is flagged, and the failure is audited.
+- **The migration path.** Rows authored under one `dialect` before the decision either
+  migrate or are rejected on first evaluation with a message the tenant admin can act
+  on. Silent reinterpretation of a rule body under a different dialect is not an option.
+
+[Phase 08a](phase-08a-assessment-notifications.md) consumes this engine for assessment
+scoring and does not re-decide it.
+
 ### Catalog
 
 - Program.
 - Course (+ optional `organization_id` for org-scoped catalogs).
 - Course version.
 - Category.
-- **Level** — `Level` rows are looked up by `(tenant_id, taxonomy_key, key)` against
-  the tenant's `TenantLevelTaxonomy` (CEFR for an English tenant, `Difficulty` for a
-  yoga tenant, `Track` for a coding bootcamp tenant). The taxonomy itself is data, not
-  code; the `Level` aggregate just holds whatever items the active taxonomy declares.
+- **Level** — `Level` rows are looked up by `(tenant_id, taxonomy_key, key)` against the
+  tenant's `TenantLevelTaxonomy` (CEFR for the English school, `Difficulty` for the yoga
+  studio, `Track` for a coding bootcamp). The taxonomy is data, not code; the `Level`
+  aggregate holds whatever items the active taxonomy declares.
 - Tag.
-- Instructor profile reference (with tenant-defined custom fields via
-  `TenantCustomFieldDef` for fields like `dialectsTaught` or `certifications`).
+- Instructor profile reference, with tenant-defined custom fields via
+  `TenantCustomFieldDef` (which lands in [Phase 03](phase-03-identity-admin.md)) for
+  fields such as `dialectsTaught` or `certifications`.
 - Catalog visibility.
 - Featured courses.
 - Course SEO metadata.
 
-### Course Versioning
-
-Course and CourseVersion must be separated.
+### Course versioning
 
-Reasons:
+`Course` and `CourseVersion` are separate aggregates because:
 
-- Published course changes should not break existing learner experiences.
-- Draft course structure can be prepared before publishing.
-- Existing enrollments can remain attached to the correct version.
+- Editing a published course must not change what an enrolled learner is working
+  through.
+- Draft structure has to be assembled before it is visible.
+- Existing enrollments stay attached to the version they started against
+  ([Phase 07](phase-07-enrollment-learner-portal.md) binds to `CourseVersion`, not
+  `Course`).
 
-Required capabilities:
+Required capabilities: draft version, published version, version clone, change summary,
+publish validation.
 
-- Draft version.
-- Published version.
-- Version clone.
-- Change summary.
-- Publish validation.
-
-### Learning Structure
+### Learning structure
 
 - Module.
 - Lesson.
@@ -64,11 +123,14 @@ Required capabilities:
 - Estimated duration.
 - Prerequisite readiness.
 
-### Lesson Item Types (Two-Tier Registry)
+### Lesson item types — two-tier registry
 
-Lesson items follow the same two-tier pattern as page blocks:
+`TenantLessonItemType` lands **here**, moved out of
+[Phase 02a Packet 8](phase-02a-kernel-tenancy.md), because this is the phase that gives
+it a consumer. Shipping an aggregate several phases before anything reads it produces a
+schema tuned to an imagined reader.
 
-**Tier 1 — Built-in primitive item types** (code-registered, closed set):
+**Tier 1 — built-in primitive item types** (code-registered, closed set):
 
 - Rich text lesson.
 - Video.
@@ -78,14 +140,22 @@ Lesson items follow the same two-tier pattern as page blocks:
 - Assignment reference placeholder.
 - Live session reference placeholder.
 
-**Tier 2 — Tenant-defined item types** via `TenantLessonItemType` rows. A tenant
+**Tier 2 — tenant-defined item types** via `TenantLessonItemType` rows. A tenant
 declares a JSON Schema for the item payload and points at a player composite key
-(e.g. `SpeakingPracticeItem` → `live-session-player`, `VocabularyDrillItem` →
-`flashcard-player`). The lesson-item renderer dispatches by reading the schema and
-the player key — no LearnStack code change is required to add a tenant-specific item
-type.
+(`SpeakingPracticeItem` → `live-session-player`, `GuidedSequenceItem` →
+`lesson-shell`). The lesson-item renderer dispatches by reading the schema and the
+player key — no LearnStack code change adds a tenant-specific item type. The composite
+and primitive renderer sets those keys resolve against are closed and canonical in
+[32-tenant-customization-model.md § 2](../architecture/32-tenant-customization-model.md);
+[Phase 06](phase-06-renderer-admin-studio.md) owns their reconciliation.
+
+### Scoring and completion rule runtime
 
-### Completion Rules
+The `TenantScoringRule` and `TenantCompletionRule` aggregates, their tables, and their
+evaluation runtime all land here — moved out of Phase 02a Packet 8, and blocked until
+ADR-0025 is Accepted. The body column is `text` with a `dialect` discriminator, the shape
+[Phase 02a Packet 8](phase-02a-kernel-tenancy.md) fixed so that the engine choice did not
+have to be made first.
 
 Built-in primitive completion checks:
 
@@ -94,53 +164,233 @@ Built-in primitive completion checks:
 - Quiz passed placeholder.
 - All required lessons completed.
 
-Per-tenant completion semantics resolve through `TenantCompletionRule` — a sandboxed
-boolean DSL expression that the runtime evaluates against the learner's
-progress + attempt state. Example: an English lesson-package may require
-*"all lessons complete AND speaking session attended AND vocab drill score ≥ 70%"*;
-that whole rule is one `TenantCompletionRule` row, not code.
-
-### Admin Studio Education Screens
-
-- Program list/detail.
-- Course list/detail (with optional org-scope filter).
+Per-tenant completion semantics resolve through `TenantCompletionRule`: a boolean
+expression evaluated in the ADR-0025 sandbox against the learner's already-recorded
+progress and attempt state. A lesson package may require *"all lessons complete AND
+speaking session attended AND drill score ≥ 70%"* — one row, not code. Scoring rules
+follow the same path with a band-contribution shape instead of a boolean.
+
+Two constraints follow from the [ADR-0018
+Amendment](../decisions/0018-tenant-driven-customization-model.md)'s genericity
+boundary, and both are load-bearing here:
+
+- A rule **evaluates over facts that already exist**. A rule that needs to decrement a
+  session balance, hold a credit, or expire an allowance is asking for stateful
+  entitlement, which is a platform feature — not a customization row.
+- A rule **does not invoke external capability**. Running a learner's submitted code or
+  scoring pronunciation from audio is a sandbox with a runtime and a resource budget,
+  not an expression. Those arrive as platform features through provider adapters.
+
+### Customization runtime cost model
+
+The customization runtime is the platform's central read path — every rendered page,
+lesson and catalog entry passes through schema lookup, taxonomy lookup, reference
+resolution and, on the learner path, rule evaluation. Its cost model is written here
+because this is the phase where the read path first carries real payloads, and because a
+cost model retrofitted after the caches exist is a rewrite. The conceptual model lives
+in
+[32-tenant-customization-model.md](../architecture/32-tenant-customization-model.md);
+this phase implements and measures it.
+
+**Validation timing — write time, not read time.**
+
+- JSON Schema validation happens when a schema is saved (is this a valid schema?) and
+  when an instance is saved (does this payload match its schema version?). Both are
+  authoring-path operations with a human waiting on one request.
+- The read path does **not** re-validate. Entries pin `schema_version` at creation
+  ([ADR-0013](../decisions/0013-page-block-schema-versioning.md)) and schema versions are
+  immutable, so a stored payload cannot drift out of conformance with the version it
+  declares. An entry whose declared version no longer resolves renders the
+  `UnknownVersionBlock` placeholder — it does not trigger validation on a hot path.
+- Validating on read would put a schema compile and a full document walk in front of
+  every catalog page, for a defect the write path already prevents.
+
+**Cache strategy.**
+
+- Three read-through caches: `TenantContentType` by `(tenant, key, version)`,
+  `TenantLessonItemType` by `(tenant, key, version)`, `TenantLevelTaxonomy` by
+  `(tenant, key)`.
+- Because schema versions are immutable, a versioned entry **never needs invalidation**.
+  Only the *active version pointer* for a key changes, and only on publish. Cache the
+  immutable body aggressively; keep the pointer on a short TTL behind a per-tenant
+  generation key that publish bumps.
+- Invalidation uses that generation key, not a prefix scan.
+  `ICacheService.RemoveByPrefixAsync` was removed or redesigned in
+  [Phase 02a Packet 5](phase-02a-kernel-tenancy.md) precisely because prefix eviction
+  cannot be honoured across instances; this phase must not reintroduce the assumption.
+- Compiled artefacts — the compiled JSON Schema validator and the compiled rule — live
+  in a per-process L1 cache only and are never serialised to L2. The L1 cache is a
+  bounded LRU with a global entry cap, so a tenant with a thousand schema versions
+  cannot evict every other tenant's working set.
+- Cold start after a deploy pays compilation once per `(tenant, key, version)` actually
+  requested. That cost is measured, not assumed.
+
+**Reference resolution and the N+1 path.**
+
+- The naive implementation resolves each `$ref` when the renderer reaches it. A guided
+  sequence with forty pose references becomes forty round trips, multiplied by the
+  number of items on the page. This is the single most likely performance defect in the
+  customization runtime, and it does not appear in a two-item development fixture.
+- The rule is a **two-phase walk**: collect every reference across the payload tree by
+  depth level, then issue one batched read per `(content type, depth level)`. With the
+  depth cap below, a render costs at most three batched reads per referenced content
+  type regardless of fan-out.
+- Taxonomy and schema lookups never reach the database on a warm cache.
+- The budget is asserted by a test that **counts database round trips** for a
+  representative lesson render, not by code review. A round-trip count is a number a
+  regression can move; a review comment is not.
+
+**Limits.**
+
+Each limit is enforced at **write time** — a payload no reader can render must not be
+storable — and each is a `LimitKeys` entry a plan may raise up to a platform ceiling
+that no plan exceeds.
+
+| Limit | Default | Why it exists |
+|---|---|---|
+| `$ref` depth | 3 | Bounds resolution round trips and makes cycle detection cheap |
+| Block instances per page version | 100 | Bounds render fan-out and editor payload size |
+| Lesson items per lesson | 100 | Same, on the learning path |
+| Array items per field | 200, and every array schema must declare `maxItems` | An unbounded array is an unbounded render |
+| Resolved references per render | 200 | Caps total fan-out even when each level is within depth |
+| Customization row payload size | 256 KB | Keeps schema and rule bodies inside one round trip |
+
+Reference cycles are rejected at save. A schema that references itself within the depth
+cap is legal; one that cannot terminate is not.
+
+**The `embed-html` sanitisation contract.**
+
+`embed-html` is the one primitive that accepts author-supplied HTML inside a set the
+corpus otherwise calls closed and safe. Its author is a tenant content editor — lower
+trust than a platform operator, higher than a learner — and its output is served to
+every learner on that tenant's host. The contract:
+
+- **The backend sanitises on write and the renderer sanitises on render.** Server-side
+  sanitisation is authoritative because the API serves HTML to any client, not only to
+  the browser that runs DOMPurify. Re-sanitising on render means tightening the
+  allow-list applies to rows already stored.
+- **Closed allow-list** of tags and attributes. No `<script>`, no `<style>`, no
+  event-handler attributes, no `javascript:` / `vbscript:` URLs, and no `data:` URLs
+  except `data:image/*`. `<iframe>` survives only when its host matches an allow-list
+  declared in the tenant's settings; otherwise it is stripped.
+- **Content Security Policy without `unsafe-inline`.** A renderer that needs inline
+  script or style to display embedded HTML has already lost the argument.
+- **Host-scoped session cookies**, never wildcard-domain. Tenants are separated by host
+  ([Phase 02a Packet 7](phase-02a-kernel-tenancy.md)); a cookie scoped to the parent
+  domain would let a single sanitiser miss on one tenant's host reach another tenant's
+  session, defeating at the browser what Row Level Security enforces at the database.
+  [Security Standards](../standards/11-security.md) is the authority.
+- **Rejected at save, stripped at render.** A save that violates the allow-list fails
+  with the offending node reported, so the editor learns what is disallowed. A render
+  that finds a violation in an older row strips it silently and increments a counter —
+  by then there is no one to tell.
+- **Plan-gated and audited.** `embed-html` availability is a feature key, so a tenant
+  with no use for an HTML sink cannot be attacked through one, and its use is a row in
+  the Customization module's audit-coverage matrix
+  ([Audit Coverage Standards](../standards/18-audit-coverage.md)).
+
+### Admin Studio education screens
+
+Built against the shell [Phase 03](phase-03-identity-admin.md) ships. The full
+cross-phase screen ownership table lives in **one** place —
+[Phase 06](phase-06-renderer-admin-studio.md) — and these are Phase 05's rows in it:
+
+- Program list / detail.
+- Course list / detail (with optional org-scope filter).
 - Course structure editor.
 - Module editor.
 - Lesson editor.
 - Lesson item editor (schema-driven for both built-in and tenant-defined item types).
-- `TenantLessonItemType` editor (the schema + player key surface).
-- `TenantLevelTaxonomy` editor (items + metadata; tenant admin declares CEFR /
-  difficulty / track / kyu-dan / …).
-- `TenantCompletionRule` editor (sandboxed DSL editor with live validation).
+- `TenantLessonItemType` editor (schema + player key).
+- `TenantLevelTaxonomy` editor (items + metadata; the tenant admin declares CEFR /
+  difficulty / track / kyu-dan).
+- `TenantCompletionRule` editor — sandboxed DSL editor with live validation against the
+  ADR-0025 engine.
 - Course publish flow.
 
 ## Deliverables
 
-- Education catalog API.
-- Versioned course structure.
-- Lesson content management.
-- Course publish workflow.
-- Public catalog rendering data.
+- ADR-0025 **Accepted**, with the engine, sandbox boundary, allowed function set,
+  evaluation budget and failure posture written down.
+- The rule evaluation runtime: compile, cache, evaluate, budget-enforce, audit —
+  consumed by `TenantCompletionRule` here and by assessment scoring in
+  [Phase 08a](phase-08a-assessment-notifications.md).
+- `TenantLessonItemType` aggregate, migrations, editor and renderer dispatch.
+- `TenantScoringRule` and `TenantCompletionRule` aggregates with their migrations, both
+  `[TenantOwned]` with query filters, RLS policies and isolation tests, bodies stored as
+  `text` + `dialect`.
+- Education catalog API — programs, courses, versions, categories, levels, tags, SEO.
+- Versioned course structure with draft / publish / clone.
+- Lesson content management with lesson items across both registry tiers.
+- Public catalog rendering data, extending the two read endpoints
+  [Phase 02d](phase-02d-walking-skeleton.md) shipped.
+- The customization runtime cost model implemented and **measured**: validation on the
+  write path, the two-tier cache with generation-key invalidation, the batched
+  reference walk, the enforced limit set, and the `embed-html` sanitisation contract.
 
 ## Completion Criteria
 
-- Admin can create a course and add modules and lessons.
-- Course can be edited as draft and then published.
-- Published course detail can be read by the public site.
-- CourseVersion behavior is covered by integration tests.
-- Lesson items can be stored with different types.
+- ADR-0025 is Accepted, and a `TenantCompletionRule` expression that attempts file,
+  network or reflection access is **rejected at evaluation time** by an integration
+  test — the sandbox invariant in
+  [32-tenant-customization-model.md § 11](../architecture/32-tenant-customization-model.md).
+- A rule that exceeds its evaluation budget fails closed: the lesson is not marked
+  complete, no scoring band is assigned, and the failure is audited.
+- An admin creates a course, adds modules and lessons, edits it as a draft, and
+  publishes it; the published course detail is readable by the public site.
+- `CourseVersion` behaviour is covered by integration tests, including that an existing
+  enrollment reference stays pinned to its version when a new version publishes.
+- Both seed tenants from [Phase 02a Packet 7](phase-02a-kernel-tenancy.md) — the English
+  school and the yoga studio — have a lesson built from a **tenant-defined**
+  `TenantLessonItemType` rendering through a built-in player composite, with their own
+  level taxonomy, and no code path branches on which tenant it is.
+- A representative lesson render issues a **bounded, asserted number of database round
+  trips** independent of reference fan-out.
+- A payload that exceeds any limit in the table above is rejected at save with a message
+  naming the limit.
+- HTML pasted into an `embed-html` field with a `<script>` tag, an `onerror` attribute or
+  a `javascript:` URL is rejected at save and stripped at render.
+- `Core_Modules_HaveNo_DomainSpecific_Names` is green — no `Cefr`, `Asana`,
+  `CodeChallenge` or comparable identifier appears in any module.
 
 ## Risks
 
-- Making Course directly mutable.
+- **ADR-0025 slipping past this phase.** It is the phase's only hard blocker, and the
+  temptation is to ship the catalog and leave rule evaluation for
+  [Phase 08a](phase-08a-assessment-notifications.md). That is how the schema decision
+  gets made implicitly by whichever engine someone prototypes with. Mitigated by the
+  exit gate below.
+- **Making `Course` directly mutable.** Editing a published course in place breaks
+  learners mid-course and destroys the version history enrollment depends on.
 - **Hardcoding a domain-specific level system into the core.** Forbidden by ADR-0018.
   The answer is always a `TenantLevelTaxonomy` row — never a `CEFRLevel` enum, a
-  `KyuRank` table, or an `AsanaDifficulty` value object.
-- Freezing the built-in lesson-item primitive set too early; tenant-specific item
-  types belong in `TenantLessonItemType`, not the primitive set.
-- Overdesigning completion rules before the progress phase; `TenantCompletionRule`
-  carries the per-tenant logic so the platform stays generic.
-- Letting a "first vertical = English" shortcut sneak English keywords into Catalog or
-  Learning Content code; the architecture test
-  `Core_Modules_HaveNo_DomainSpecific_Names` will reject it.
-
+  `KyuRank` table or an `AsanaDifficulty` value object.
+- **Freezing the built-in lesson-item primitive set too early**; tenant-specific item
+  types belong in `TenantLessonItemType`, not in the primitive set.
+- **A cost model that exists only on paper.** Every item above is cheap to write and
+  cheap to skip, and each one is invisible in a development fixture with two content
+  entries. Mitigated by making the round-trip count and the limit rejections completion
+  criteria with tests behind them, not review items.
+- **`embed-html` treated as one more primitive.** It is an HTML sink written by a
+  lower-trust actor inside a set the corpus calls closed and safe, and it is the most
+  likely cross-tenant compromise path in the whole customization model. Mitigated by the
+  written contract, the feature gate and the host-scoped cookie rule.
+- **A "first vertical = English" shortcut** leaking English keywords into Catalog or
+  Learning Content code. The architecture test rejects it; reviewers should reject the
+  intent earlier.
+
+## Phase Exit Decision
+
+[Phase 06](phase-06-renderer-admin-studio.md) begins when:
+
+- **ADR-0025 is Accepted** and its engine is implemented, sandboxed, budgeted and
+  covered by a sandbox-escape test. This is an unconditional blocker — the phase does
+  not exit with rule bodies still opaque.
+- A course can be authored, versioned, published and read end to end, with lesson items
+  from both registry tiers.
+- Both seed tenants render structurally different lessons from their own customization
+  data, on the same code paths.
+- The customization runtime cost model is implemented **and measured**: write-time
+  validation, generation-key cache invalidation, a bounded round-trip count for a
+  representative render, enforced limits, and the `embed-html` contract with tests
+  behind each clause.
diff --git a/docs/roadmap/phase-06-renderer-admin-studio.md b/docs/roadmap/phase-06-renderer-admin-studio.md
index c95b2a2..70b61b2 100644
--- a/docs/roadmap/phase-06-renderer-admin-studio.md
+++ b/docs/roadmap/phase-06-renderer-admin-studio.md
@@ -2,129 +2,287 @@
 
 ## Goal
 
-Turn CMS and education catalog data into real product experiences: a public tenant site renderer and a usable Admin Studio.
+Turn CMS and education catalog data into real product experiences: a complete public
+tenant site renderer, a usable Admin Studio, and the portal shell that every
+learner-facing and instructor-facing screen after this phase is built into.
 
-After this phase, LearnStack should be able to publish a simple but real education website for a tenant.
+[Phase 02d](phase-02d-walking-skeleton.md) already put a site in a browser — a catalog
+page and a lesson page, on two hosts, for two tenants. That skeleton proved the request
+path. It is not a website: it has no navigation, no SEO, no error pages, one block, and
+no editing surface. Phase 06 **deepens** it into something a tenant can publish.
+
+After this phase, LearnStack publishes a simple but real education website for a tenant,
+and a non-developer tenant admin can maintain it.
 
 ## Scope
 
-### Public Site Renderer
-
-The Next.js `apps/web` app should support:
-
-- Tenant + **organization** resolution by host via `IHostToTenantResolver`
-  (`platform_host_to_tenant` projection mirrored from Hub).
-- Published page rendering composed from the two-tier block resolver: built-in
-  primitive blocks (Tier 1) + tenant-defined blocks (Tier 2) via `TenantPageBlock`.
-- Navigation rendering.
-- Course catalog page (driven by tenant-defined `level-card` / `card-grid` blocks
-  over the catalog data).
-- Course detail page (driven by tenant-defined `LessonPackage` content type
-  composites when present).
-- SEO metadata.
-- 404 and redirect handling.
-- Basic theme tokens with optional **per-organization branding override** merged on
-  top of tenant defaults.
-- **Entitlement-aware UI** — `useFeatureFlag(FeatureKey)` and `useLimit(LimitKey)`
-  hooks read `platform_entitlement_cache`. Feature gating hides nav items / tabs;
-  limit visualization shows `current/limit` in Studio.
-
-### Tenant Branding
+### What Phase 02d already shipped
+
+| Already exists | Phase 06 adds |
+|---|---|
+| Host-based tenant + organization resolution, end to end | Per-organization branding override on the resolved context |
+| Catalog page and lesson page, Server Components over the typed SDK | Navigation, SEO metadata, 404 and redirect handling, full page composition |
+| One built-in content primitive | The complete two-tier block registry with safe-render placeholders |
+| Branding tokens read from `TenantSettings` | The branding configuration surface that writes them |
+| First frontend tests, replacing the `--passWithNoTests` placeholder | The browser-level end-to-end suite |
+
+### Public site renderer
+
+The Next.js `apps/web` app supports:
+
+- Tenant + **organization** resolution by host via `IHostToTenantResolver`, reading
+  `platform_host_to_tenant` and never the Hub
+  ([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)).
+- Published page rendering composed from the two-tier block resolver: built-in primitive
+  blocks (Tier 1) plus tenant-defined blocks (Tier 2) via `TenantPageBlock`, with
+  `UnknownVersionBlock` / `UnknownBlock` placeholders and a React error boundary per
+  block ([ADR-0013](../decisions/0013-page-block-schema-versioning.md)).
+- Navigation rendering — header, footer, nested items, internal page and catalog
+  references.
+- Course catalog page and course detail page, driven by tenant-defined blocks over the
+  [Phase 05](phase-05-education-learning-content.md) catalog data.
+- SEO metadata: per-page title and description, canonical URLs, Open Graph, sitemap and
+  `robots.txt` per host.
+- 404 and redirect handling, including the redirect model
+  [Phase 04](phase-04-cms-media-pages.md) ships. An unknown **host** returns 404 with no
+  platform disclosure; an unknown **path on a known host** returns the tenant's own 404
+  page.
+- Theme tokens with optional **per-organization branding override** merged on top of
+  tenant defaults.
+- **Entitlement-aware UI** — `useFeatureFlag(FeatureKey)` and `useLimit(LimitKey)` read
+  the entitlement projection. Feature gating hides nav items and tabs rather than
+  disabling them; limit visualisation shows `current/limit` in Studio. The UI mirrors
+  the server's decision; it never is the decision.
+- WCAG 2.2 AA across public site, Studio and portal
+  ([Accessibility Standards](../standards/16-accessibility.md)).
+
+### Block registry — one canonical location
+
+Block and renderer keys have drifted across the corpus: the same identifier appears as a
+built-in block in one document, as a composite renderer in another, and in the glossary
+as an example of a set it belongs to in neither. `card-grid` is the concrete case — it
+is named as a built-in block in
+[17-page-builder.md](../architecture/17-page-builder.md), registered as a block in the
+resolver example in
+[14-frontend-architecture.md](../architecture/14-frontend-architecture.md), described as
+a composite renderer key in the [glossary](../glossary.md) and in phase documents, and
+it appears in **no** registry at all.
+
+This phase is where the registry becomes real code, so this is where the drift is
+settled. Two registries, two owners, no overlap:
+
+| Key kind | Canonical location | Example |
+|---|---|---|
+| Built-in **block** keys (Tier 1 of the page-builder resolver) | [17-page-builder.md](../architecture/17-page-builder.md) | `hero`, `rich-text`, `image` |
+| **Primitive** and **composite renderer** keys (what blocks and tenant-defined types dispatch to) | [32-tenant-customization-model.md § 2](../architecture/32-tenant-customization-model.md) | `markdown`, `default-card`, `content-list`, `lesson-shell` |
+
+Rules that follow:
+
+- `card-grid` is a **composite renderer key**. It is added to the composite set in
+  32-tenant-customization-model and removed from the built-in block list in
+  17-page-builder, which is where it was miscategorised.
+- The [glossary](../glossary.md) **cites** these registries and never introduces a key.
+  A term document that invents a member of a closed set makes the set open.
+- A new key enters the registry document first, then the code, then any prose that
+  mentions it — the same order [Standards 21](../standards/21-architecture-tests-catalogue.md)
+  requires for test identifiers, and for the same reason.
+- The frontend test suite asserts the shipped registry and the registry documents agree
+  in both directions: every documented key resolves to a component, and every registered
+  component is documented. A closed set that nothing checks is a convention.
+
+### Tenant branding
 
 - Logo.
-- Primary and secondary colors.
+- Primary and secondary colours.
 - Typography tokens.
 - Header / footer settings.
-- Basic theme preview.
-- **Per-organization branding override** (`OrganizationBranding`) — optional row that
-  merges on top of the tenant default at render time.
-
-### Admin Studio — Content Surface
-
-Phase 03 delivers the **identity-management** surface of Admin Studio (login, tenant
-switcher, **org switcher**, users with org filter, roles, invitations). Phase 06
-picks up where that ends and delivers the **content-management** surface; the two
-should reuse the same shell, layout, and permission system.
-
-- Content management (content types, content entries, draft / publish flow).
-- Page builder / editor (block picker, reorder, schema-driven form, preview) that
-  surfaces both built-in primitive blocks and tenant-defined `TenantPageBlock`
-  entries.
-- Media library (upload, folders, asset management).
-- Navigation editor.
-- Course catalog management (course CRUD, version selection, SEO metadata, optional
-  org scope).
-- Course structure editor (modules, lessons, lesson items with custom item-type
-  renderers from `TenantLessonItemType`).
-- Preview of published and draft content.
-- Tenant branding configuration surface (logo, theme tokens, header / footer) +
-  per-organization branding override editor.
-- Tenant settings surfaces: feature-flag editor for `tenant_feature_flags` overrides
-  (see [21-feature-flags.md](../architecture/21-feature-flags.md)), **read-only
-  entitlement projection viewer** for plan-level features + limits, and
-  **custom-domain status viewer** (registration happens in the operator portal —
-  Studio is read-only here, see
-  [27-custom-domain-tls.md](../architecture/27-custom-domain-tls.md)).
-- **Tenant Customization editor** — full CRUD on `TenantContentType`,
-  `TenantPageBlock`, `TenantLessonItemType`, `TenantLevelTaxonomy`,
-  `TenantScoringRule`, `TenantCompletionRule`, `TenantCustomFieldDef`,
-  `TenantTemplateLibrary` per
-  [32-tenant-customization-model.md](../architecture/32-tenant-customization-model.md).
-  JSON Schema editor for type schemas; sandboxed DSL editor for scoring / completion
-  rules.
-- **Audit log viewer** — paginated, filterable view over the Audit module's read API
-  (tenant admins see their tenant; org admins see their org).
-
-Login, tenant switcher, org switcher, dashboard shell, users, roles, and invitations
-are **not** scoped to this phase — they are delivered in Phase 03 and are consumed by
-Phase 06 as the surrounding shell.
-
-### UI Foundation
+- Theme preview.
+- **Per-organization branding override** (`OrganizationBranding`) — an optional row that
+  merges on top of the tenant default at render time, applied when the resolved request
+  carries an organization id.
+
+### Admin Studio — screen ownership
+
+Four documents have claimed overlapping sets of Studio screens. **This table is the
+single ownership record**; a phase document lists its own screens, and this table says
+which phase that is. The finished information architecture — how the screens group into
+a menu — is described in
+[32-tenant-customization-model.md § 9](../architecture/32-tenant-customization-model.md);
+that tree is descriptive, not a delivery plan.
+
+| Screen group | Owning phase |
+|---|---|
+| Studio shell, login, tenant switcher, org switcher, dashboard chrome, users, roles, invitations, `TenantCustomFieldDef` editor, tenant IdP federation surface | [Phase 03](phase-03-identity-admin.md) |
+| Content types, content entries, pages, page builder, `TenantPageBlock` editor, media library, navigation editor, publish / preview controls | [Phase 04](phase-04-cms-media-pages.md) |
+| Programs, courses, course structure, modules, lessons, lesson items, `TenantLessonItemType` editor, `TenantLevelTaxonomy` editor, `TenantCompletionRule` editor, course publish flow | [Phase 05](phase-05-education-learning-content.md) |
+| Branding and theme configuration, per-organization branding override, tenant settings (feature-flag overrides, read-only entitlement projection viewer, read-only custom-domain status), audit log viewer, the customization editor consolidation, cross-phase Studio information architecture | **Phase 06** |
+| Notification template library (`TenantTemplateLibrary`), assessment and question-bank screens, `TenantScoringRule` editor | [Phase 08a](phase-08a-assessment-notifications.md) |
+| Instructor availability, session and booking management | [Phase 08b](phase-08b-scheduling.md) |
+| Classroom session monitoring and recording metadata | [Phase 08c](phase-08c-classroom.md) |
+| Orders, invoices, analytics dashboards | [Phase 09](phase-09-billing-integrations-analytics.md) |
+
+Operator-facing screens — plan editing, tenant provisioning, custom-domain registration,
+licence issuance — are **not** Admin Studio. They belong to the operator portal, a
+separate application in the `learnstack-hub` repository
+([ADR-0019](../decisions/0019-learnstack-hub.md)). Studio's custom-domain surface is
+read-only status ([27-custom-domain-tls.md](../architecture/27-custom-domain-tls.md)).
+
+**Phase 06's own Studio work**, in detail:
+
+- Tenant branding configuration surface (logo, theme tokens, header / footer) plus the
+  per-organization override editor.
+- Tenant settings: feature-flag editor for `tenant_feature_flags` overrides
+  ([21-feature-flags.md](../architecture/21-feature-flags.md)), read-only entitlement
+  projection viewer for plan-level features and limits, read-only custom-domain status
+  viewer.
+- **Audit log viewer** — paginated, filterable view over the Audit module's read API.
+  Tenant admins see their tenant; organization admins see their organization
+  ([31-audit-subsystem.md](../architecture/31-audit-subsystem.md)).
+- **Customization editor consolidation** — the per-aggregate editors ship with their
+  owning phases; Phase 06 assembles them into one coherent surface with a shared JSON
+  Schema editor component and a shared sandboxed-DSL editor component, so a tenant admin
+  meets one editing idiom rather than four.
+- Preview of published and draft content, using the production renderer in preview mode.
+- The Studio information-architecture pass: navigation, permission-aware menu
+  construction, and empty / loading / error states applied consistently across screens
+  delivered by Phases 03 through 05.
+
+### Portals — the `(portal)` route group and the instructor portal
+
+Three later phases require an instructor-facing surface and none has owned it:
+[Phase 08b](phase-08b-scheduling.md) needs availability editing and a booking digest,
+[Phase 08c](phase-08c-classroom.md) has the instructor joining a session "from the
+portal", and [Phase 10](phase-10-english-learning-mvp.md) walks an instructor through a
+live class. **Phase 06 owns it.**
+
+- Phase 06 delivers the `(portal)` route group in `apps/web`
+  ([ADR-0009](../decisions/0009-frontend-single-app-first.md)): the authenticated shell,
+  layout, role-aware navigation, permission-aware elements, and the tenant + organization
+  + locale resolution the portal shares with the public site.
+- Phase 06 delivers the **instructor portal's first screens** — the instructor's own
+  courses drawn from the catalog, their profile with tenant-defined custom fields, and
+  preview-as-learner for content they author.
+- [Phase 07](phase-07-enrollment-learner-portal.md) delivers the **learner portal**
+  screens inside this shell — my courses, course overview, lesson player, progress.
+- Every later phase that needs an instructor screen adds it to the portal that exists
+  from this phase: availability and booking digest in
+  [Phase 08b](phase-08b-scheduling.md), session join in
+  [Phase 08c](phase-08c-classroom.md). None of them invents a surface.
+
+### UI foundation
 
 - Shared UI package.
 - Form components.
 - Data table.
-- Modal/drawer.
-- Toast/notification.
-- Empty/loading/error states.
+- Modal / drawer.
+- Toast / notification.
+- Empty / loading / error states.
 - Permission-aware UI elements.
 
-### API Client
+### API client
 
-- Typed frontend SDK.
+- Typed frontend SDK, generated from the OpenAPI document
+  ([Phase 02a Packet 4](phase-02a-kernel-tenancy.md) ships the generation scaffold; this
+  phase is where it has a full surface to generate from).
 - Authenticated request handling.
 - Tenant context handling.
-- Error mapping.
+- Error mapping from RFC 7807 Problem Details to typed client errors.
+
+### End-to-end test stack — a carried dependency
+
+Phase 06 is the first phase to run browser tests, so it is the first phase that depends
+on the ephemeral end-to-end stack actually working. `infra/compose/e2e.yml` overlays the
+development stack with `volumes: !reset []`, which discards more than the named volumes:
+it also discards the **PostgreSQL init script** and the **SeaweedFS S3 identity file**.
+A browser suite launched against that stack meets a database without the
+`learnstack_app` / `learnstack_migration` roles the init script creates and an object
+store with no S3 identity — so the run either fails at boot or, worse, proceeds against
+a stack where the isolation roles are absent and every isolation assumption the browser
+tests inherit is quietly untrue. The same overlay leaves Valkey on its named volume, so
+cache and rate-limit state leaks between runs.
+
+The fix lands in [Phase 02a Packet 3b](phase-02a-kernel-tenancy.md). It is recorded here
+because Phase 06 is its consumer and the phase that notices if it regresses: a green
+browser suite against a mis-provisioned stack is worse evidence than no suite.
 
 ## Deliverables
 
-- Working public site renderer.
-- Usable Admin Studio.
-- Basic tenant branding support.
-- Shared UI and SDK foundation.
+- A complete public site renderer: navigation, SEO, error and redirect handling, the
+  full two-tier block registry with safe-render placeholders, and per-organization
+  branding.
+- The reconciled block / renderer registry, canonical in one document per key kind, with
+  the code and the documents asserted to agree.
+- Admin Studio's Phase 06 surface: branding, tenant settings, entitlement viewer, audit
+  log viewer, customization editor consolidation, preview, and the cross-phase
+  information-architecture pass.
+- The `(portal)` route-group shell and the instructor portal's first screens.
+- Shared UI package and the typed SDK over the full API surface.
+- A browser-level end-to-end suite running against the fixed ephemeral stack.
 
 ## Completion Criteria
 
-- A homepage can be published for a tenant.
-- Published pages are visible on the public site for both tenant-default hosts and
-  custom domains resolved via `IHostToTenantResolver`.
-- Course catalog and course detail pages render correctly with tenant-defined block
-  shapes.
-- Admin can preview draft pages.
-- Tenant branding is reflected on the public site; per-org override applies when the
-  resolved request carries an organization id.
-- Admin Studio is usable for core content, catalog, and **customization** workflows
-  (a non-developer tenant admin can author a new `TenantContentType` or
-  `TenantPageBlock` end-to-end without code changes).
-- Entitlement projection viewer accurately reflects the plan's feature / limit set
-  for the current tenant.
-- Audit log viewer surfaces the last 200 entries for the current tenant with filter
-  by module / actor / outcome.
+- A homepage can be published for a tenant and is visible on both the tenant-default
+  host and a custom domain resolved via `IHostToTenantResolver`.
+- Course catalog and course detail pages render with tenant-defined block shapes; an
+  unknown block key renders the placeholder rather than breaking the page.
+- Navigation, SEO metadata, sitemap, `robots.txt`, tenant 404 and redirects work per
+  host.
+- Tenant branding is reflected on the public site; the per-organization override applies
+  when the resolved request carries an organization id.
+- **Every block and renderer key that appears in any document resolves in the shipped
+  registry, and every registered key is documented** — asserted by a test, in both
+  directions.
+- Admin Studio is usable for the content, catalog and customization workflows a
+  non-developer tenant admin needs: authoring a new `TenantContentType` or
+  `TenantPageBlock` end to end, with no code change.
+- The entitlement projection viewer reflects the current tenant's plan feature and limit
+  set; the audit log viewer surfaces the last 200 entries with filters by module, actor
+  and outcome.
+- An instructor signs in, reaches the portal, and sees their own courses; a learner
+  reaching an instructor-only route is refused by the API, not merely hidden by the UI.
+- The browser end-to-end suite runs green against `infra/compose/e2e.yml` with the
+  PostgreSQL init script and the SeaweedFS S3 identity file **present**, and two
+  consecutive runs are independent of one another.
+- Both seed tenants — the English school and the yoga studio — produce visually and
+  structurally different published sites from the same binary, now with navigation, SEO
+  and full page composition rather than the two skeleton pages.
 
 ## Risks
 
-- Polishing Admin Studio too early instead of validating workflows.
-- Writing the renderer with a single-tenant assumption.
-- Coupling page block rendering too tightly to the editing model.
-- Treating SEO requirements as a later patch.
+- **Polishing Admin Studio instead of validating workflows.** The measure is whether a
+  tenant admin completes an authoring task unaided, not how the screen looks.
+- **Writing the renderer with a single-tenant assumption.** Two tenants have existed
+  since [Phase 02a Packet 7](phase-02a-kernel-tenancy.md) and both have been rendering
+  since Phase 02d; a single-tenant assumption now is a regression, not an oversight.
+- **Coupling block rendering to the editing model.** The public renderer must not import
+  editor code; the editor composes the same registry, from the other side.
+- **Treating SEO as a later patch.** Metadata, canonical URLs and sitemaps are structural
+  in an App Router application, and retrofitting them means touching every route.
+- **The registry drifting again.** Two canonical locations only work if new keys enter
+  through them. Mitigated by the bidirectional registry test — the drift that produced
+  `card-grid` was invisible precisely because nothing compared prose to code.
+- **A green browser suite on a mis-provisioned stack.** If the Packet 3b compose fix
+  regresses, the end-to-end suite still goes green while running without the isolation
+  roles. Mitigated by asserting the init script and S3 identity are present as part of
+  the suite's own preconditions.
+- **The instructor portal being deferred again.** It is now owned here; a later phase
+  that finds no portal to add a screen to should treat that as a Phase 06 exit failure,
+  not build its own surface.
+
+## Phase Exit Decision
+
+[Phase 07](phase-07-enrollment-learner-portal.md) begins when:
 
+- A tenant admin publishes a complete site — pages, navigation, catalog, SEO, error
+  pages — for both seed tenants, without a code change, and the two sites differ in
+  structure rather than only in strings.
+- The block and renderer registries are canonical in one document per key kind, and the
+  bidirectional registry test is green.
+- The Admin Studio screen ownership table above matches what actually shipped in
+  Phases 03 through 06; a screen owned by no phase is an exit blocker, not a backlog
+  item.
+- The `(portal)` shell exists with the instructor portal's first screens in it, so
+  Phase 07 adds learner screens to a surface rather than creating one.
+- The browser end-to-end suite is green against the repaired ephemeral stack, with the
+  PostgreSQL init script and the SeaweedFS S3 identity file present and Valkey state
+  reset between runs.
diff --git a/docs/roadmap/phase-07-enrollment-learner-portal.md b/docs/roadmap/phase-07-enrollment-learner-portal.md
index 1d63b0b..8cee8a4 100644
--- a/docs/roadmap/phase-07-enrollment-learner-portal.md
+++ b/docs/roadmap/phase-07-enrollment-learner-portal.md
@@ -2,54 +2,145 @@
 
 ## Goal
 
-Allow users to enter a real learning experience: course access, learner portal, lesson consumption, and progress tracking.
+Give a named learner state. Everything before this phase is either anonymous — the
+public site from [Phase 02d](phase-02d-walking-skeleton.md) and
+[Phase 06](phase-06-renderer-admin-studio.md) — or administrative — the Studio surfaces
+from [Phase 03](phase-03-identity-admin.md) and Phase 06. Phase 07 is where a person
+signs in, is granted access to a course, consumes lessons, and leaves a progress trail
+behind.
 
-This phase moves the platform from CMS/catalog capabilities into the first learning product capabilities.
+This phase moves the platform from CMS and catalog capabilities into the first learning
+product capabilities. It consumes the versioned course structure and lesson items from
+[Phase 05](phase-05-education-learning-content.md), the identity and membership model
+from Phase 03, and the outbox and background-job infrastructure from
+[Phase 02b](phase-02b-events-auth.md).
+
+### What Phase 02d did not build
+
+Worth stating plainly, because a walking skeleton is easy to over-read:
+
+[Phase 02d](phase-02d-walking-skeleton.md) is **anonymous and read-only**. It renders a
+catalog page and a lesson page for two tenants through two anonymous `GET` endpoints.
+There is no user, no enrollment, no course access, no progress row, and no learner-side
+write path anywhere behind it. The lesson page it produced has no "mark complete"
+control and nothing to store if it had one.
+
+Manual enrollment, invitation enrollment, lesson progress, resume-learning, and the
+learner portal shell are therefore **new construction in this phase** — not shells being
+lit up. What Phase 07 inherits from 02d is narrow and read-side only: `Course` and
+`Lesson` exist (deepened into `CourseVersion`, modules and lesson items by Phase 05),
+host-based tenant and organization resolution works end to end, and the public content
+path exists to contrast the entitled one against.
 
 ## Scope
 
 ### Enrollment
 
-- Enrollment model.
-- Manual enrollment (admin grants access directly).
-- Invitation-based enrollment (existing Phase 03 invitation flow extends to course access).
+- Enrollment model, bound to a `CourseVersion` so a republished course does not move a
+  learner mid-course.
+- Manual enrollment (admin grants access directly) — first built here.
+- Invitation-based enrollment (the [Phase 03](phase-03-identity-admin.md) invitation
+  flow extends to carry a course).
 - Readiness for program, course, and cohort access models.
 - Enrollment status:
   - Active
   - Suspended
   - Completed
   - Cancelled
-- Enrollment source enum is defined exhaustively but only `manual` and `invitation` are wired in this phase. Other sources land later:
+- Enrollment source enum is defined exhaustively; only `manual` and `invitation` are
+  wired in this phase:
   - `manual` — admin grants directly (here).
-  - `invitation` — tenant invitation accepted with course attached (here).
-  - `billing` — order paid emits an integration event consumed by Enrollment (Phase 09; see § Entitlements).
-  - `bulk_import` — out of scope; not on the MVP path.
-  - `integration` — external LMS / SSO push; deferred.
+  - `invitation` — tenant invitation accepted with a course attached (here).
+  - `billing` — a paid order emits an integration event that Enrollment consumes
+    ([Phase 09](phase-09-billing-integrations-analytics.md); see § Course access).
+  - `integration` — external LMS / SSO push. Lands with the integration registry and
+    LTI / xAPI readiness in [Phase 09](phase-09-billing-integrations-analytics.md).
+  - `bulk_import` — **no phase in this roadmap builds it.** The enum value is reserved
+    so that adding a CSV import tool later is a feature, not a migration.
+
+### Cohort
+
+Phase 07 **owns the `Cohort` aggregate**. It is specified in full by
+[Domain Model § Enrollment & Access](../architecture/02-domain-model.md), its permission
+keys (`enrollment.cohort.read` / `.write` / `.delete`) are already registered against the
+Enrollment module in [Permission Standards](../standards/19-permissions.md), and
+[Phase 08b](phase-08b-scheduling.md)'s `LiveBooking` binds "a learner **or** a cohort" to
+a live session. Without an owning phase that binding references a type nothing builds.
+Enrollment is the right owner: the foreign key lives on `Enrollment` (`CohortId`,
+nullable), and cohort membership *is* enrollment membership.
+
+Built here:
+
+- `Cohort` aggregate — `[TenantOwned]` and `[OrganizationScoped]`, because a branch runs
+  its own cohorts ([ADR-0017](../decisions/0017-tenant-organization-hierarchy.md)). EF
+  global query filter plus a Row Level Security policy from the canonical template in
+  [Database Standards](../standards/05-database.md), per
+  [ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md).
+- Many-to-one binding to `CourseVersion`. Many cohorts may share one version on
+  different timelines.
+- Lifecycle `open → in-progress → completed → archived`.
+- `Enrollment.CohortId` nullable — one-off enrollments leave it null and behave exactly
+  as they do without cohorts.
+- Roster read and a **derived** cohort progress projection over the member enrollments'
+  `Progress` records. A projection, not an aggregate: per-cohort progress has no
+  independent truth.
+- Cancelling a cohort does **not** cascade-cancel its enrollments. That is an operator
+  action with its own audit entry; cancelling enrollments individually is the safer
+  default.
+
+Named out of scope here, with owners, so nothing about cohorts is homeless either:
 
-### Entitlements
+| Cohort capability | Owning phase |
+|---|---|
+| Cohort ↔ live session binding through `LiveBooking` | [Phase 08b](phase-08b-scheduling.md) |
+| Cohort classroom rooms and attendance | [Phase 08c](phase-08c-classroom.md) |
+| Cohort-level reporting and analytics | [Phase 09](phase-09-billing-integrations-analytics.md) |
 
-Phase 07 owns the **Entitlement aggregate** and the **enrollment-source entitlement** path:
+### Course access
 
-- The `Entitlement` aggregate (id, tenant, user, scope, source, granted-at, revoked-at).
+Phase 07 owns the **`CourseAccess` aggregate** and the **enrollment-source grant**
+path:
+
+- The `CourseAccess` aggregate (id, tenant, user, scope, source, granted-at, revoked-at).
+  Named per [the glossary's *Course Access* entry](../glossary.md) — it is **not** an
+  `Entitlement`, whose subject is always a tenant and whose only author is the Hub.
 - Source `manual` and `invitation` populated directly by this phase.
-- Permission `enrollment.entitlement.read` / `enrollment.entitlement.write` (see [19-permissions.md](../standards/19-permissions.md)).
-- Access checks at the lesson-content boundary use `Entitlement`, not raw enrollment state — so paid access (Phase 09) and free access (Phase 07) share one read path.
+- Permissions `enrollment.course_access.read` / `enrollment.course_access.write`
+  ([19-permissions.md](../standards/19-permissions.md)).
+- Access checks at the lesson-content boundary use `CourseAccess`, not raw enrollment
+  state — so paid access (Phase 09) and free access (Phase 07) share one read path.
+
+**Billing-source course access** is produced in
+[Phase 09](phase-09-billing-integrations-analytics.md): a paid `Order` emits `OrderPaidV1`
+which the Enrollment module consumes and converts into a `CourseAccess` with
+`source = billing`. Phase 07 ships the consumer contract; Phase 09 ships the producer.
+The hand-off seam is the integration event, not a shared table.
 
-**Billing-source entitlements** are produced in Phase 09: a paid `Order` emits `OrderPaidV1` which the Enrollment module consumes (via the Phase 02b outbox) and converts into an `Entitlement` with `source = billing`. Phase 07 ships the consumer contract; Phase 09 ships the producer. The hand-off seam is the integration event, not a shared table.
+**What `CourseAccess` is not.** It is a boolean grant, not a balance. A consumable
+allowance — a ten-session credit pack, "three make-up classes per term" — is *stateful
+course access*, and the genericity boundary in
+[ADR-0018 Amendment (2026-08-08)](../decisions/0018-tenant-driven-customization-model.md)
+places it outside tenant customization data: a ledger that is decremented, refunded,
+expired and audited cannot be declared by a JSON Schema. No phase in this roadmap builds
+one. When a paying tenant needs it, it arrives as a platform feature in a LearnStack
+release — its own ADR, built on
+[Phase 09](phase-09-billing-integrations-analytics.md)'s billing primitives and
+[Phase 08b](phase-08b-scheduling.md)'s booking lifecycle — never as a customization
+row.
 
 ### Learner Portal
 
-Initial screens:
+Built on the Studio shell, permission system, and typed SDK from
+[Phase 06](phase-06-renderer-admin-studio.md), under the `(portal)` route group:
 
 - My courses.
 - Course overview.
-- Lesson player (dispatches to built-in lesson-item players for primitive types and
-  to tenant-defined player composites via `TenantLessonItemType` for tenant-defined
-  types).
+- Lesson player (dispatches to built-in lesson-item players for primitive types and to
+  tenant-defined player composites via `TenantLessonItemType` for tenant-defined types).
 - Lesson resources.
 - Progress summary (driven by `TenantCompletionRule`).
-- Profile basics (with optional tenant-defined custom fields via
-  `TenantCustomFieldDef` on `User`).
+- Profile basics (with optional tenant-defined custom fields via `TenantCustomFieldDef`
+  on `User`).
 
 ### Progress Tracking
 
@@ -60,17 +151,25 @@ Initial screens:
 - Last viewed lesson.
 - Resume learning.
 
-**Completion semantics resolve through `TenantCompletionRule`** per
-[ADR-0018](../decisions/0018-tenant-driven-customization-model.md): the Progress
-module evaluates the active completion rule against the learner's lesson / module /
-attempt state. A built-in default rule ships ("all required lessons complete") and a
-tenant may override it (e.g. an English tenant adds "speaking session attended AND
-vocab drill score ≥ 70%"). No completion code lives in Progress beyond the DSL
-evaluator + the primitive checks.
+**Completion semantics come from the tenant — and the engine that evaluates them is not
+built here.** Per
+[ADR-0018](../decisions/0018-tenant-driven-customization-model.md), a tenant's
+`TenantCompletionRule` decides when a lesson, module, or course is complete. The DSL
+engine behind that rule is chosen in **ADR-0025** (open; see
+[decisions/README.md § Open ADR Drafts](../decisions/README.md)) and its runtime
+evaluator ships in [Phase 05](phase-05-education-learning-content.md).
+
+Phase 07 is a **consumer** of that evaluator: Progress hands it the learner's lesson,
+module, and attempt state and stores the verdict. It writes no rule-evaluation code of
+its own. If it does, the platform has two engines and they will eventually disagree
+about whether a learner finished a course.
+
+Until a tenant supplies an override, the built-in default — "all required lessons
+complete" — applies. It is a primitive check shipped by Phase 05, not a second engine.
 
 ### Learning Events
 
-Example events:
+Recorded as versioned integration events through `IOutbox`:
 
 - Course viewed.
 - Lesson started.
@@ -78,33 +177,104 @@ Example events:
 - Resource downloaded.
 - Course completed.
 
+The `outbox_messages` table ships in [Phase 02a](phase-02a-kernel-tenancy.md); the
+dispatcher, retry, dead-letter and inbox guard ship in
+[Phase 02b](phase-02b-events-auth.md). Phase 07 declares event types and topics and
+builds no dispatch machinery. [Phase 09](phase-09-billing-integrations-analytics.md)
+consumes the stream for reporting.
+
 ### Access Control
 
 - Separate public course detail from enrolled course content.
-- Learners can only access private lesson content for courses they are entitled to.
+- Learners can only access private lesson content for courses they are entitled to. An
+  unentitled request returns 404, not 403 — the existence of another tenant's or another
+  learner's content is not disclosed.
 - Admin and instructor preview capabilities are separate from learner access.
 
+### Isolation and Audit
+
+- `Enrollment`, `CourseAccess`, `Cohort`, and `Progress` are `[TenantOwned]`; `Enrollment`
+  and `Cohort` are additionally `[OrganizationScoped]`. Each carries an EF global query
+  filter and an RLS policy from the canonical template in
+  [Database Standards](../standards/05-database.md).
+- Cross-tenant and cross-organization isolation integration tests run as
+  `learnstack_app`, the non-owning application role — a test that runs as the table owner
+  passes even when every policy is inert.
+- Baseline MUST-audit coverage applies: enrollment created / suspended / cancelled /
+  completed, and course access granted / revoked
+  ([18-audit-coverage.md](../standards/18-audit-coverage.md)). Per
+  [ADR-0033](../decisions/0033-audit-durability-model.md) those rows are durable intent
+  written inside the same transaction as the business change. A granted course access whose
+  audit row was silently dropped is precisely the failure ADR-0033 exists to prevent.
+
 ## Deliverables
 
-- Enrollment API.
-- Learner portal MVP.
-- Lesson player MVP.
-- Progress tracking.
-- Learning event recording.
+- `LearnStack.Modules.Enrollment` scaffolded — `{Domain, Application, Application.Contracts, Infrastructure}`,
+  its `IModule` registration, `docs/modules/enrollment/audit.md`, and its
+  permission-catalogue rows. Per
+  [architecture 03](../architecture/03-module-boundaries.md) this module covers enrollment
+  **and** progress; there is no separate `Progress` assembly.
+- Enrollment API with manual and invitation sources, bound to `CourseVersion`.
+- `Cohort` aggregate, roster, lifecycle, and derived cohort progress projection.
+- `CourseAccess` aggregate with the `OrderPaidV1` consumer contract in place for
+  [Phase 09](phase-09-billing-integrations-analytics.md).
+- Learner portal MVP under the `(portal)` route group.
+- Lesson player MVP dispatching built-in and tenant-defined item types.
+- Progress tracking evaluated through the Phase 05 completion-rule runtime.
+- Learning event recording through the outbox.
+- Isolation integration tests for every new tenant-owned aggregate, running as
+  `learnstack_app`.
 
 ## Completion Criteria
 
-- Admin can enroll a user in a course.
-- Learner can see their courses.
-- Learner can complete a lesson.
-- Course progress is calculated.
-- Unauthorized users cannot access private lesson content.
-- Learning events are recorded for analytics.
+- An admin can enroll a user in a course manually, and an invited user lands enrolled
+  after accepting.
+- A learner sees their courses, opens a lesson, and completes it.
+- Course progress is calculated by evaluating the tenant's active
+  `TenantCompletionRule`, not by code in the Progress module.
+- Both seed tenants exercise this path, and the English school's completion rule differs
+  in shape from the yoga studio's — the same code path produces two different verdicts
+  from two different rows.
+- A cohort with at least two enrolled learners exists, its derived progress reads
+  correctly, and it is bindable by id — so [Phase 08b](phase-08b-scheduling.md)'s
+  `LiveBooking` has a real type to reference.
+- An unentitled user requesting private lesson content receives 404.
+- Cross-tenant and cross-organization isolation tests covering `Enrollment`,
+  `CourseAccess`, `Cohort`, and `Progress` are green under `learnstack_app`.
+- MUST-class audit entries for enrollment and course-access operations are present and
+  committed with their business transaction.
+- Learning events reach a consumer through the outbox at least once, idempotently.
 
 ## Risks
 
-- Confusing enrollment with billing.
-- Storing progress only as frontend state.
-- Leaving lesson content access control to the public renderer.
-- Failing to define the CourseVersion and enrollment relationship clearly.
+- **Confusing enrollment with billing.** Enrollment grants access; billing produces a
+  reason to grant it. The seam is `OrderPaidV1`, not a shared table.
+- **Storing progress only as frontend state.** Progress that lives in the browser is lost
+  on a device change and cannot drive a completion rule or a report.
+- **Leaving lesson content access control to the public renderer.** The renderer mirrors
+  authorization; the API enforces it. A content endpoint that trusts the caller's route
+  group is a data leak waiting for a direct `curl`.
+- **Failing to define the `CourseVersion` ↔ enrollment relationship clearly.** An
+  enrollment bound to `Course` rather than `CourseVersion` silently changes what a
+  learner is enrolled in the next time the course is republished.
+- **Reimplementing completion logic locally.** The tempting shortcut is a small
+  `if (allLessonsComplete)` in Progress while waiting for the Phase 05 evaluator. It
+  works, it ships, and it becomes the second engine nobody remembers to delete.
+- **Cohort growing into a scheduling feature.** Cohorts are groups of people. The moment
+  a cohort holds session times, capacity, or attendance, it has absorbed
+  [Phase 08b](phase-08b-scheduling.md)'s `LiveSession` and the two will disagree.
+
+## Phase Exit Decision
+
+[Phase 08a](phase-08a-assessment-notifications.md) begins when a learner on either seed
+tenant can be enrolled — manually and by invitation — open the portal, complete a lesson,
+and see progress computed by that tenant's own `TenantCompletionRule` through the
+Phase 05 evaluator; when an unentitled request for private lesson content returns 404;
+when a cohort with real members exposes a correct derived progress read; and when the
+isolation suite covering `Enrollment`, `CourseAccess`, `Cohort`, and `Progress` is green
+under `learnstack_app` with MUST-class audit rows committed alongside their business
+transactions.
 
+If ADR-0025 is not yet Accepted and the Phase 05 completion-rule evaluator has not
+shipped, this gate cannot be met: progress *recording* is buildable, tenant-defined
+completion is not. That dependency is resolved in Phase 05, not worked around here.
diff --git a/docs/roadmap/phase-08a-assessment-notifications.md b/docs/roadmap/phase-08a-assessment-notifications.md
index e9792cd..dbf3002 100644
--- a/docs/roadmap/phase-08a-assessment-notifications.md
+++ b/docs/roadmap/phase-08a-assessment-notifications.md
@@ -2,9 +2,30 @@
 
 ## Goal
 
-Make the learning experience interactive without taking on live classroom complexity in the same milestone.
+Make the learning experience interactive — quizzes, placement tests, and the messages
+that surround them — without taking on live classroom complexity in the same milestone.
 
-This phase covers assessment, notification workflows, background job foundations, and the event/outbox pipeline that later supports live sessions and recording jobs.
+This phase adds three things a learning product needs once learners exist
+([Phase 07](phase-07-enrollment-learner-portal.md)): a way to ask them questions and
+score the answers, a way to tell them something happened, and the scheduled work that
+carries both. All three run on infrastructure that already exists; this phase builds
+domain capability on top of it, not new plumbing.
+
+### What this phase does not own
+
+Three mechanisms are routinely mis-attributed to this phase. Stated once, here, so no
+reader and no later phase has to guess:
+
+| Mechanism | Owning phase | What Phase 08a adds |
+|---|---|---|
+| Outbox — `outbox_messages` table, `OutboxFlushBehavior` | [Phase 02a](phase-02a-kernel-tenancy.md) | Nothing |
+| Outbox dispatcher — polling, retry, backoff, dead-letter, inbox guard, `IEventBus` transport | [Phase 02b](phase-02b-events-auth.md) | Event types, topics, and idempotent consumers |
+| Hangfire — host, Postgres storage, queue policy, tenant-aware job activator, enqueue-time `tenant_id` guard | [Phase 02b](phase-02b-events-auth.md) | Job definitions that run on it |
+| Scoring / completion DSL engine — ADR-0025, sandbox, evaluator | [Phase 05](phase-05-education-learning-content.md) | Callers, answer maps, and result-band projection |
+
+Phase 08a writes **no** dispatcher, **no** job host, and **no** expression evaluator. If
+it does, each of those has two implementations that will drift apart, and the second one
+is invisible until it disagrees with the first in production.
 
 ## Scope
 
@@ -26,6 +47,16 @@ This phase covers assessment, notification workflows, background job foundations
 - Pass/fail rule.
 - Result visibility.
 
+`Assessment`, `QuestionBank`, and `Attempt` are `[TenantOwned]`; `Assessment` is
+additionally `[OrganizationScoped]` where a branch runs its own question set. Each
+carries an EF global query filter and a Row Level Security policy from the canonical
+template in [Database Standards](../standards/05-database.md), per
+[ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md). Attempt
+graded and score published are baseline MUST-audit operations
+([18-audit-coverage.md](../standards/18-audit-coverage.md)), written as durable intent
+inside the grading transaction per
+[ADR-0033](../decisions/0033-audit-durability-model.md).
+
 ### Placement Test Readiness
 
 The core remains generic per
@@ -35,37 +66,81 @@ Core provides:
 
 - Assessment, attempt, attempt-answer, score primitives.
 - Attempt lifecycle (started → in-progress → submitted → graded → published).
-- A **scoring engine** that evaluates `TenantScoringRule` DSL expressions against an
-  attempt's answer map and returns a structured result. Built-in primitive operators
-  cover sum, weighted-sum, threshold-band, and lookup-table operations; tenant rules
-  compose these.
-- Result-band → recommendation projection (e.g. a band `{min, max} → level_key`
-  mapping that resolves against the tenant's `TenantLevelTaxonomy`).
-
-The **English tenant** (Phase 10) ships its placement test as:
+- A **scoring path** that hands an attempt's answer map to the `TenantScoringRule`
+  evaluator and stores the structured result.
+- Result-band → recommendation projection (a band `{min, max} → level_key` mapping that
+  resolves against the tenant's `TenantLevelTaxonomy`).
+
+**The evaluator is not built here.** The DSL engine behind `TenantScoringRule` is chosen
+in **ADR-0025** (open; see
+[decisions/README.md § Open ADR Drafts](../decisions/README.md)) and its sandboxed
+runtime ships in [Phase 05](phase-05-education-learning-content.md), one phase before
+this one, because `TenantCompletionRule` needs the same engine. Rule bodies are stored as
+opaque `text` with a `dialect` discriminator — the shape fixed in
+[Phase 02a Packet 8](phase-02a-kernel-tenancy.md) and materialised as tables in
+[Phase 05](phase-05-education-learning-content.md), precisely so the engine choice did
+not have to precede the schema.
+
+Phase 08a is a **consumer**: it supplies the answer map, invokes the evaluator, and
+projects the result onto a level recommendation. Built-in primitive operators (sum,
+weighted sum, threshold band, lookup table) are part of the Phase 05 engine's operator
+set, not a parallel implementation in Assessment.
+
+The **English tenant** ([Phase 10](phase-10-english-learning-mvp.md)) ships its placement
+test as:
 
 - A `TenantScoringRule` row that weights grammar / vocabulary / listening / speaking
   sections and emits a CEFR level recommendation.
 - A `TenantLevelTaxonomy` row declaring CEFR (A1, A2, B1, B2, C1, C2).
-- A `TenantContentType` for `SpeakingPrompt`, `VocabularyCard`, `GrammarTopic`
-  question content.
-
-A **yoga tenant** ships the same kind of placement test with completely different
-data (sections: balance / flexibility / breath; result-band → asana-difficulty
-recommendation) — **same code path, different `TenantScoringRule` and
-`TenantLevelTaxonomy` rows**.
+- A `TenantContentType` for `SpeakingPrompt`, `VocabularyCard`, `GrammarTopic` question
+  content.
+
+The **yoga tenant** seeded in [Phase 02a Packet 7](phase-02a-kernel-tenancy.md) ships the
+same kind of placement test with completely different data (sections: balance /
+flexibility / breath; result band → difficulty recommendation) — **same code path,
+different `TenantScoringRule` and `TenantLevelTaxonomy` rows**. Both tenants exist by
+this phase, so the claim is testable here rather than asserted.
+
+### Notification Templates — `TenantTemplateLibrary`
+
+`TenantTemplateLibrary` lands in this phase. It was scaffolded with the other
+customization aggregates in [Phase 02a](phase-02a-kernel-tenancy.md)'s original plan and
+re-homed to its consumer: the notification dispatcher is the only thing that reads it,
+and an unread template store is a schema nobody validates.
+
+- Owned by `LearnStack.Modules.Customization`, consistent with every other
+  `Tenant*` aggregate ([32-tenant-customization-model.md](../architecture/32-tenant-customization-model.md)).
+- Keyed by `(tenant_id, template_key, channel, locale)` with an optional
+  per-organization override row that resolves ahead of the tenant default — a branch may
+  sign its own reminders.
+- Body and subject authored in Liquid / Handlebars; the dispatcher renders against the
+  dispatch context.
+- `[TenantOwned]` with query filter and RLS policy from the canonical template.
+- Template created / updated / deleted is a baseline MUST-audit operation with both
+  `before` and `after` snapshots ([18-audit-coverage.md](../standards/18-audit-coverage.md)) —
+  a template is the text a learner receives, and changing it silently is a support
+  incident.
+- Resolution falls back locale → tenant default locale → built-in platform template, so a
+  missing translation degrades to a delivered message rather than a dropped one.
+- The Studio editor for this aggregate ships **here**, built on the shared customization
+  editor components [Phase 06](phase-06-renderer-admin-studio.md) consolidates. The
+  [Admin Studio screen ownership table](phase-06-renderer-admin-studio.md) is the single
+  ownership record and assigns this screen to this phase — which is also the phase that
+  first creates the aggregate, its migration, its policy and its audit coverage. A
+  Phase 06 editor would target a table with no migration behind it.
 
 ### Notifications
 
 - Notification dispatch orchestration in the Notifications module.
-- Channels: email (wired), SMS placeholder, WhatsApp placeholder, in-app placeholder.
-- Notification preference per user.
-- Dispatch job (Hangfire-backed).
-- Delivery status.
-- Template resolution via **`TenantTemplateLibrary`** (the
-  customization-module-owned aggregate scaffolded in Phase 02a) — per-channel,
-  per-locale, optional per-organization override. Templates author body + subject in
-  Liquid / Handlebars; the dispatcher renders against the dispatch context.
+- Channels: email wired through the `IEmailProvider` adapter
+  ([06-extension-model.md](../architecture/06-extension-model.md)); SMS, WhatsApp, and
+  in-app are placeholders behind the same port shape.
+- Notification preference per user, respected before dispatch.
+- Dispatch runs as a Hangfire job on the host wired in
+  [Phase 02b](phase-02b-events-auth.md) — this phase defines the job, its queue and its
+  retry policy, not the runner.
+- Delivery status, with failures visible rather than swallowed.
+- Template resolution via `TenantTemplateLibrary`, above.
 
 ### Notification Use Cases
 
@@ -74,44 +149,98 @@ recommendation) — **same code path, different `TenantScoringRule` and
 - Course enrollment.
 - Lesson reminder.
 - Assessment completed.
-- Live session reminder events prepared for Phase 08b.
+- Live session reminder trigger points prepared for
+  [Phase 08b](phase-08b-scheduling.md), which supplies the events and template keys.
+
+Each use case is driven by an integration event consumed from the outbox, not by a direct
+call from the originating module. The producing module enqueues; Notifications consumes.
+Consumers are idempotent through the `IInboxGuard` from
+[Phase 02b](phase-02b-events-auth.md) — at-least-once delivery means "enrollment
+confirmed" can arrive twice, and a learner must not receive it twice.
 
 ### Background Jobs
 
-- Hangfire setup.
-- Tenant-aware job payload.
-- Retry policy.
-- Dead-letter state.
-- Outbox dispatcher baseline.
-- Job observability.
+Additions to the existing host, not a new one:
+
+- Notification dispatch job.
+- Attempt-expiry job for abandoned attempts.
+- Job-level retry policy and dead-letter state for this phase's jobs.
+- Job observability: queue depth, execution duration, and failure counts surfaced
+  through the existing OpenTelemetry pipeline.
+
+Tenant-aware job payloads, the job activator, the enqueue-time `tenant_id` guard, and the
+`Hangfire_Job_Payloads_Include_TenantId` architecture test all come from
+[Phase 02b](phase-02b-events-auth.md). This phase's jobs inherit them and add no
+infrastructure.
 
 ## Deliverables
 
-- Assessment MVP.
-- Notification engine MVP.
-- Background job foundation.
-- Outbox dispatcher baseline.
-- Provider adapter foundation for notifications.
+- `LearnStack.Modules.Assessment` and `LearnStack.Modules.Notifications` scaffolded —
+  each with `{Domain, Application, Application.Contracts, Infrastructure}`, its `IModule`
+  registration, its `docs/modules/<module>/audit.md`, and its permission-catalogue rows.
+- Assessment MVP: assessments, question bank, attempts, grading, result visibility.
+- Placement-test path scored through the Phase 05 `TenantScoringRule` evaluator, with the
+  result-band → level projection.
+- `TenantTemplateLibrary` aggregate, migration, RLS policy, resolution order, and audit
+  coverage.
+- `TenantTemplateLibrary` Studio editor: per-channel, per-locale template authoring, the
+  per-organization override row, and a render preview against a sample dispatch context.
+- Notification engine MVP with the `IEmailProvider` adapter wired and other channels
+  behind the port.
+- Integration-event consumers for the notification use cases, idempotent via the inbox
+  guard.
+- Notification dispatch and attempt-expiry jobs on the Phase 02b Hangfire host.
 
 ## Completion Criteria
 
-- Admin can create a quiz.
-- Learner can complete an assessment attempt and view the result.
-- Notification templates can drive at least one email flow.
-- Background jobs preserve tenant context.
-- Retry and failure behavior is observable.
-- Outbox-dispatched integration events are idempotent.
+- An admin can create a quiz; a learner can complete an attempt and view the result.
+- A placement-test attempt scores through a `TenantScoringRule` row and yields a level
+  recommendation from the tenant's own `TenantLevelTaxonomy`.
+- Both seed tenants run a placement test whose sections, bands, and recommended levels
+  differ in shape, with no branch on tenant identity anywhere in the Assessment module.
+- At least one email flow is driven end to end by a `TenantTemplateLibrary` template,
+  including the per-organization override and the locale fallback.
+- A tenant admin creates and edits a notification template in the Admin Studio, including
+  a per-organization override, with no code change.
+- A notification consumer that receives the same integration event twice sends one
+  message.
+- Background jobs preserve tenant context; retry and failure behaviour is observable in
+  metrics and logs.
+- MUST-class audit entries exist for attempt graded, score published, and template
+  changed, committed with their business transactions.
 
 ## Risks
 
-- Building a full assessment engine too early.
-- Hardcoding notification providers into core logic.
-- Putting any domain-specific placement-test rule (CEFR mapping, asana difficulty,
-  kyu/dan progression, …) into the core Assessment module. All such rules live as
+- **Building a full assessment engine too early.** The MVP question types are the closed
+  set above; short answer, ordering, and matching stay placeholders until a tenant needs
+  them.
+- **Hardcoding notification providers into core logic.** Every channel goes through its
+  port; the Notifications module must not import a provider SDK type.
+- **Putting a domain-specific placement-test rule (CEFR mapping, asana difficulty,
+  kyu/dan progression, …) into the core Assessment module.** All such rules live as
   `TenantScoringRule` rows. The architecture test
-  `Core_Modules_HaveNo_DomainSpecific_Names` enforces this.
-- Running background jobs without tenant context.
-- Choosing a scoring DSL engine ad-hoc — the engine choice is an ADR-pending item
-  that **must land before this phase implements** the scoring engine. See
-  [decisions/README.md § Open ADR Drafts](../decisions/README.md).
-
+  `Core_Modules_HaveNo_DomainSpecific_Names` enforces it.
+- **Re-implementing the scoring evaluator locally.** The likely trigger is a Phase 05
+  evaluator that lacks one operator this phase wants. The fix is an operator added to the
+  Phase 05 engine, not an expression parser in Assessment.
+- **Rebuilding the dispatcher or the job host.** Both exist from Phase 02b. A "small
+  local scheduler" for reminder emails is the classic version of this mistake, and it
+  loses tenant context the first time it runs unattended.
+- **Templates treated as configuration rather than content.** A template is user-visible
+  text with a locale and an audit trail; editing it in a config file bypasses both.
+- **Running background jobs without tenant context.** Mitigated by the Phase 02b activator
+  and enqueue guard — provided this phase's jobs use the standard payload shape rather
+  than passing ids by hand.
+
+## Phase Exit Decision
+
+[Phase 08b](phase-08b-scheduling.md) begins when a learner can complete an assessment and
+receive its result, when a placement test scores through a tenant-authored
+`TenantScoringRule` and returns a level from that tenant's taxonomy, when at least one
+email flow renders from `TenantTemplateLibrary` and delivers through `IEmailProvider`,
+when a redelivered integration event produces exactly one message, and when this phase's
+jobs run on the Phase 02b Hangfire host with tenant context intact and failures visible.
+
+Phase 08b depends on the notification engine directly — it contributes booking and
+reminder trigger points and no dispatch machinery of its own — so a notification path that
+is not yet end-to-end blocks it.
diff --git a/docs/roadmap/phase-08b-scheduling.md b/docs/roadmap/phase-08b-scheduling.md
index e91d10d..1cffcac 100644
--- a/docs/roadmap/phase-08b-scheduling.md
+++ b/docs/roadmap/phase-08b-scheduling.md
@@ -2,34 +2,55 @@
 
 ## Goal
 
-Build the scheduling backbone — instructor availability, live session lifecycle, bookings, attendance modelling, session materials — without taking on the WebRTC classroom in the same milestone.
+Build the scheduling backbone — instructor availability, live session lifecycle,
+bookings, attendance modelling, session materials — without taking on the WebRTC
+classroom in the same milestone.
 
-This phase was originally part of a combined "08B: Scheduling and In-App Classroom". It was split to reduce the load of a single phase (10 domain types, two largely independent subsystems) and to keep classroom integration risk isolated.
+This phase was originally part of a combined "08B: Scheduling and In-App Classroom". It
+was split to reduce the load of a single phase (10 domain types, two largely independent
+subsystems) and to keep classroom integration risk isolated.
 
-Phase 08c follows and delivers the in-app classroom that consumes the scheduling primitives built here.
+[Phase 08c](phase-08c-classroom.md) follows and delivers the in-app classroom that
+consumes the scheduling primitives built here.
+
+Scheduling is deliberately a pure domain phase: it introduces no new infrastructure.
+Every mechanism it relies on already exists — the notification engine from
+[Phase 08a](phase-08a-assessment-notifications.md), the Hangfire background-job host and
+tenant-aware job activator from [Phase 02b](phase-02b-events-auth.md), and the outbox
+from [Phase 02a](phase-02a-kernel-tenancy.md).
 
 ## Scope
 
 ### Scheduling
 
 - Instructor availability — recurring and one-off teaching windows.
-- `LiveSession` aggregate — scheduled live event with time, capacity, role mix, session timezone, and lifecycle (`scheduled → opened → in-progress → ended → archived`).
-- `LiveBooking` — reservation that ties a learner or cohort to a session; statuses (`pending`, `confirmed`, `cancelled`, `no_show`).
+- `LiveSession` aggregate — scheduled live event with time, capacity, role mix, session
+  timezone, and lifecycle (`scheduled → opened → in-progress → ended → archived`).
+- `LiveBooking` — reservation that ties a learner or cohort to a session; statuses
+  (`pending`, `confirmed`, `cancelled`, `no_show`).
 - Group and one-on-one readiness.
 - Cancellation and reschedule semantics; conflict detection.
 - Session capacity enforcement.
-- Session material attachment — files, links, or content entries surfaced inside the classroom (rendered in Phase 08c).
+- Session material attachment — files, links, or content entries surfaced inside the
+  classroom (rendered in [Phase 08c](phase-08c-classroom.md)).
 
 ### Notifications Wiring
 
-Live-session notifications dispatch through the Phase 08a notification engine:
+Live-session notifications ride the notification engine built in
+[Phase 08a](phase-08a-assessment-notifications.md) — dispatch orchestration, channel
+adapters, delivery status and `TenantTemplateLibrary` template resolution all come from
+there — and run on the Hangfire background-job host wired in
+[Phase 02b](phase-02b-events-auth.md), which is also what carries tenant context into
+the scheduled reminder jobs. This phase contributes only the trigger points and the
+template keys; it builds no dispatch machinery of its own.
 
 - Booking confirmation.
 - Session reminder (24h, 1h).
 - Cancellation / rescheduling notice.
 - Instructor-side booking digest.
 
-No-show notifications and attendance-derived notifications wait until Phase 08c populates the actual attendance.
+No-show notifications and attendance-derived notifications wait until
+[Phase 08c](phase-08c-classroom.md) populates the actual attendance.
 
 ### Domain Concepts Delivered Here
 
@@ -39,30 +60,59 @@ No-show notifications and attendance-derived notifications wait until Phase 08c
 - `LiveBooking`
 - `LiveSessionMaterial`
 
-The classroom-runtime concepts (`LiveRoom`, `LiveRoomProvider`, `LiveRoomToken`, `LiveAttendance`, `LiveRecording`, `LiveSessionEvent`) land in Phase 08c.
+The classroom-runtime concepts (`LiveRoom`, `LiveRoomProvider`, `LiveRoomToken`,
+`LiveAttendance`, `LiveRecording`, `LiveSessionEvent`) land in
+[Phase 08c](phase-08c-classroom.md).
+
+Every table behind these concepts is `[TenantOwned]`, and the scheduling ones are
+additionally `[OrganizationScoped]` — a branch schedules its own instructors and its own
+rooms. Each carries an EF global query filter and a Row Level Security policy built from
+the canonical template in [Database Standards](../standards/05-database.md), per
+[ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md).
 
 ## Deliverables
 
+- `LearnStack.Modules.Scheduling` scaffolded — `{Domain, Application,
+  Application.Contracts, Infrastructure}`, its `IModule` registration,
+  `docs/modules/scheduling/audit.md`, and its permission-catalogue rows.
 - Scheduling API.
 - Booking flow end to end (admin / learner / instructor).
 - Session material attachment.
-- Notifications wired through 08a for booking lifecycle events.
+- Notifications wired through [Phase 08a](phase-08a-assessment-notifications.md) for
+  booking lifecycle events.
 - Tenant timezone handling for session times.
 
 ## Completion Criteria
 
 - Instructor availability can be defined.
 - A learner or admin can create a session booking; conflicts and capacity are enforced.
-- Sessions move through their lifecycle on schedule (`opened` at start time, `ended` at scheduled end or explicit close).
-- Booking-related notifications dispatch via 08a.
-- Sessions render correctly in the admin studio schedule view (without classroom controls — those come in 08c).
+- Sessions move through their lifecycle on schedule (`opened` at start time, `ended` at
+  scheduled end or explicit close).
+- Booking-related notifications dispatch via the
+  [Phase 08a](phase-08a-assessment-notifications.md) engine, on
+  [Phase 02b](phase-02b-events-auth.md) Hangfire jobs that carry tenant context into the
+  reminder schedule.
+- Sessions render correctly in the admin studio schedule view (without classroom
+  controls — those come in [Phase 08c](phase-08c-classroom.md)).
 
 ## Risks
 
-- Building scheduling as a general-purpose calendar product instead of a focused live-session scheduler.
-- Hard-coupling scheduling to the live-classroom runtime; the seam between scheduling and classroom is the `LiveSession` aggregate id only.
-- Timezone handling sloppiness — instructor availability windows have a timezone; sessions store UTC + the host's timezone at booking time.
+- Building scheduling as a general-purpose calendar product instead of a focused
+  live-session scheduler.
+- Hard-coupling scheduling to the live-classroom runtime; the seam between scheduling
+  and classroom is the `LiveSession` aggregate id only.
+- Timezone handling sloppiness — instructor availability windows have a timezone;
+  sessions store UTC + the host's timezone at booking time.
 
 ## Phase Exit Decision
 
-Phase 08c can begin when scheduling, bookings, and material attachment are stable and notifications dispatch end to end.
+[Phase 08c](phase-08c-classroom.md) can begin when an instructor's availability produces
+bookable sessions, a booking survives the full lifecycle (create, confirm, reschedule,
+cancel) with conflicts and capacity enforced, the booking notifications arrive through
+the [Phase 08a](phase-08a-assessment-notifications.md) engine, and cross-tenant and
+cross-organization isolation tests over the new scheduling tables are green under
+`learnstack_app`.
+
+The classroom phase consumes exactly one thing from here — the `LiveSession` aggregate
+id. If Phase 08c needs any other scheduling internal, the seam is wrong and belongs back
+in this phase.
diff --git a/docs/roadmap/phase-08c-classroom.md b/docs/roadmap/phase-08c-classroom.md
index 3afe532..4cfacc4 100644
--- a/docs/roadmap/phase-08c-classroom.md
+++ b/docs/roadmap/phase-08c-classroom.md
@@ -2,43 +2,138 @@
 
 ## Goal
 
-Deliver the in-app WebRTC classroom on top of the Phase 08b scheduling primitives: provider-agnostic room runtime via `ILiveClassProvider`, scoped LiveKit join tokens, attendance computed from classroom events, recording metadata and consent flow.
-
-Phase 08c is the highest-density architectural milestone in the roadmap. It is split out from the original combined "08B: Scheduling and In-App Classroom" so that scheduling failures and classroom failures do not blend into a single risk surface.
-
-Decisions consumed in this phase:
-
-- [ADR 0005 — Live Classroom Media Stack](../decisions/0005-live-classroom-media-stack.md) — self-hosted LiveKit OSS by default.
+Deliver the in-app WebRTC classroom on top of the [Phase 08b](phase-08b-scheduling.md)
+scheduling primitives: a provider-agnostic room runtime behind `ILiveClassProvider`,
+scoped join tokens, attendance computed from classroom events, and a recording flow
+that cannot start without consent.
+
+Phase 08c is the highest-density architectural milestone in the roadmap. It is split
+out from the original combined "08B: Scheduling and In-App Classroom" so that
+scheduling failures and classroom failures do not blend into a single risk surface.
+
+This phase is also where LiveKit actually arrives.
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md) lists it, but names it a
+**deliberate exception** to demand-gating rather than an instance of it:
+`ILiveClassProvider` ships with **no default implementation**, because a null classroom
+is not a degraded classroom — it is no product. There is nothing to default to before the
+feature exists, so the block is *scheduled* rather than gated, and its trigger is stated
+as the product fact — live classes become a requirement — rather than the circular "the
+classroom phase begins". This is that phase.
+
+Decisions consumed here:
+
+- [ADR-0005 — Live Classroom Media Stack](../decisions/0005-live-classroom-media-stack.md)
+  — LiveKit is the SFU; self-hosted OSS and LiveKit Cloud are both supported paths
+  behind one abstraction.
+- [ADR-0035 — Demand-Gated Infrastructure](../decisions/0035-demand-gated-infrastructure.md)
+  — the port ships early, the adapter ships when the trigger fires.
 - [07-in-app-live-classroom.md](../architecture/07-in-app-live-classroom.md)
 - [08-livekit-cost-model.md](../architecture/08-livekit-cost-model.md)
-- [16-media-pipeline.md](../architecture/16-media-pipeline.md) — recording, consent, retention.
+- [16-media-pipeline.md](../architecture/16-media-pipeline.md) — recording, consent,
+  retention.
 - [18-webrtc-build-vs-adopt.md](../architecture/18-webrtc-build-vs-adopt.md)
 
 ## Scope
 
-### Provider Abstraction
-
-- `ILiveClassProvider` interface implemented by `LiveKitSelfHostedProvider`.
-- `LiveKitCloudProvider` registered behind the same interface for one-switch fallback.
-- `ManualMeetingLinkProvider` registered as explicit fallback only — not the target architecture.
-- Domain code and application code reference the interface; LiveKit SDK types live only in `Infrastructure.LiveClassroom.LiveKit`.
-
-### Runtime Domain Concepts
+### Deployment posture: which LiveKit, and when
+
+The cost model in
+[08-livekit-cost-model.md](../architecture/08-livekit-cost-model.md) does not agree
+with itself. Its Recommendation section says the first production deployment should be
+self-hosted LiveKit OSS. Its own scenarios say otherwise at the volumes LearnStack will
+actually see first:
+
+| Cost-model scenario | Workload | Cheaper mode |
+|---|---|---|
+| A — 100 one-on-one sessions / month, no recording | pilot | **LiveKit Cloud** |
+| C — 100 four-person group sessions / month, no recording | pilot | **LiveKit Cloud** |
+| B — 1,000 one-on-one sessions / month, no recording | growth | roughly break-even |
+| D — 1,000 sessions / month, every session recorded | growth + recording | **self-hosted**, by ~5× |
+| E — 5,000 sessions / month, every session recorded | scale | **self-hosted**, by ~6× |
+
+The scenarios are right and the recommendation is stale. Self-hosting pays back on
+**recording volume and bandwidth**, not on existing. At pilot volume a self-hosted
+deployment buys a TURN server, a Valkey node, an Egress node and an on-call rotation in
+exchange for saving nothing, and it buys them during the phase with the most novel
+failure modes. [ADR-0005](../decisions/0005-live-classroom-media-stack.md) does not
+force the issue either way: it names self-hosted OSS "a supported path" and Cloud "an
+optional managed path", and leaves the sequencing to the roadmap. This phase sets it.
+
+**The decision rule.**
+
+1. **Start on LiveKit Cloud**, behind `ILiveClassProvider`. It is the fastest path to a
+   working classroom, it removes SFU and TURN operations from the phase that already
+   carries WebRTC reconnection, token scoping, consent and webhook idempotency, and at
+   pilot volume it is also the cheaper one.
+2. **Emit the cost counters from day one** — participant-minutes, downstream bytes,
+   recorded minutes, concurrent peak — so the crossing is measured rather than guessed.
+   See § Cost instrumentation below.
+3. **Move to self-hosted when measured volume crosses the break-even the cost model
+   computes.** Two independent crossings, either of which is sufficient:
+   - **Recorded minutes.** Cloud bills recording per minute past a small included
+     quota; a self-hosted Egress node plus its storage is a flat monthly cost. This
+     crossing arrives first and arrives at a volume well below the live-minute one —
+     the cost model's Scenario D is already past it by roughly 5×.
+   - **Participant-minutes and downstream transfer.** The live-only crossing sits
+     around the cost model's Scenario B.
+4. **The move is a configuration change, not a code change.** That is the entire reason
+   `ILiveClassProvider` exists, and it is the claim this phase must make true rather
+   than assume.
+
+The cost model owns the arithmetic and the recheck cadence; this phase owns the rule
+and the measurement. Re-derive the crossing at each recheck rather than treating a
+2026-05-14 snapshot as a constant — LiveKit Cloud plan tiers and Hetzner / AWS egress
+rates both move.
+
+`ManualMeetingLinkProvider` is a third path and is neither of these. It exists so a
+tenant with no LiveKit account at all can still schedule a session against an external
+meeting URL. It is an escape hatch, not a deployment posture: attendance, recording and
+in-room events are all unavailable behind it, and the classroom UX degrades to a link.
+
+### Provider abstraction
+
+- `ILiveClassProvider` — the port. Domain and application code reference only this.
+- One `LiveKitProvider` adapter in `Infrastructure.LiveClassroom.LiveKit`. Cloud and
+  self-hosted are the **same adapter against a different server URL and credential**,
+  because LiveKit OSS and LiveKit Cloud speak the same API. Two adapter classes that
+  differ only in configuration would mean two code paths to test and a "one-switch
+  fallback" that is not actually one switch.
+- `ManualMeetingLinkProvider` as the explicit escape hatch described above.
+- The `LiveRoomProvider` discriminator records **which target served each room**, so a
+  recording's provenance and a session's cost attribution survive the migration from
+  Cloud to self-hosted. Rooms opened before the switch keep pointing at where their
+  media actually lived.
+- LiveKit SDK types stay inside the adapter namespace; SDK exceptions are translated to
+  `ProviderException` subclasses at the boundary, per
+  [21-architecture-tests-catalogue.md](../standards/21-architecture-tests-catalogue.md).
+- The adapter is wrapped in `IProviderResilience<ILiveClassProvider>` with retry,
+  timeout and circuit breaker read from `appsettings.Resilience:liveClassProvider:`.
+
+### Runtime domain concepts
 
 - `LiveRoom` — runtime room bound 1:1 to a `LiveSession` while open.
-- `LiveRoomProvider` — discriminator (`livekit_self_hosted`, `livekit_cloud`, `manual_link`).
-- `LiveRoomToken` — short-lived join token (≤ 5 min TTL), scoped per user + room + role.
+- `LiveRoomProvider` — discriminator (`livekit_self_hosted`, `livekit_cloud`,
+  `manual_link`).
+- `LiveRoomToken` — short-lived join token (≤ 5 min TTL), scoped per user + room +
+  role.
 - `LiveAttendance` — computed participation record per participant.
 - `LiveRecording` — recording metadata + consent + retention.
-- `LiveSessionEvent` — append-only event stream (`room_opened`, `participant_joined`, `screen_share_started`, ...).
+- `LiveSessionEvent` — append-only event stream (`room_opened`, `participant_joined`,
+  `screen_share_started`, …).
+
+All six are `[TenantOwned]`; `LiveRoom` and `LiveAttendance` inherit the
+`[OrganizationScoped]` marker from the `LiveSession` they hang off. Each gets an EF
+global query filter and a Row Level Security policy from the canonical template in
+[Database Standards](../standards/05-database.md).
 
 ### Classroom UX (MVP)
 
-The target experience is an embedded classroom inside the LearnStack portal, not an external Zoom or Google Meet link.
+The target experience is an embedded classroom inside the LearnStack portal, not an
+external Zoom or Google Meet link.
 
 - Instructor joins from the portal.
 - Learner joins from the portal.
-- Backend issues scoped LiveKit join tokens only for authorised participants.
+- Backend issues scoped join tokens only for authorised participants.
 - Role-based room permissions (instructor publishes by default; learner can request).
 - Audio, video, screen sharing.
 - Participant list.
@@ -47,74 +142,173 @@ The target experience is an embedded classroom inside the LearnStack portal, not
 - Reconnection state visible to the user.
 - Recording indicator visible to all participants whenever recording is active.
 
+### Authorization surface
+
+Joining a live session requires, in order:
+
+1. Authenticated user ([Phase 02b](phase-02b-events-auth.md) +
+   [Phase 03](phase-03-identity-admin.md)).
+2. Membership in the resolved tenant and organization
+   ([Phase 03](phase-03-identity-admin.md)).
+3. Permission to join the session ([Phase 03](phase-03-identity-admin.md) +
+   [Phase 07](phase-07-enrollment-learner-portal.md) entitlement check).
+4. Resource-scope match — the user is a booked participant or an instructor on **this**
+   session.
+5. Recording consent, if recording is enabled for this session.
+
+Failures at any layer produce a Problem Details response with a specific `code`
+(`unauthorized`, `forbidden`, `recording_consent_required`); the classroom UI maps
+these to actionable copy. The token is minted only after all five pass — a token that
+exists is a token that was authorised, so an expired-token retry re-runs the whole
+chain rather than refreshing a previously granted claim.
+
 ### Attendance
 
-- Computed from `LiveSessionEvent` streams (`participant_joined`, `participant_left`, `network_drop`).
-- Configurable rules per tenant: minimum duration, late join tolerance, rejoin coalescing.
-- Attendance status drives no-show notifications via the Phase 08a notification engine.
+- Computed from `LiveSessionEvent` streams (`participant_joined`, `participant_left`,
+  `network_drop`).
+- Configurable rules per tenant: minimum duration, late join tolerance, rejoin
+  coalescing. These are tenant configuration values, not tenant DSL — attendance is a
+  platform computation with tenant-supplied thresholds.
+- Attendance status drives no-show notifications via the
+  [Phase 08a](phase-08a-assessment-notifications.md) notification engine, closing the
+  loop [Phase 08b](phase-08b-scheduling.md) left open.
 
-### Recording and Consent
+### Recording and consent
 
-Recording is **opt-in**, off by default per tenant. The consent flow is part of the join path, not a separate setup step. See [16-media-pipeline.md](../architecture/16-media-pipeline.md) § Recordings.
+Recording is **opt-in**, off by default per tenant. The consent flow is part of the
+join path, not a separate setup step. See
+[16-media-pipeline.md](../architecture/16-media-pipeline.md) § Recordings.
 
 - Per-tenant recording policy.
 - Per-session recording flag.
-- Per-participant consent state captured before the room is joined; absence blocks the join.
-- Recording metadata persisted: storage key, duration, consent state, retention deadline.
-- Recording can be configured at policy / metadata level even when execution is disabled — for tenants that want the audit trail without the bandwidth.
-- LiveKit Egress writes the recording to S3 / SeaweedFS; LearnStack does not transcode in this phase.
-
-### Provider Webhooks
+- Per-participant consent state captured **before** the room is joined; absence blocks
+  the join. Consent is not a checkbox the UI can skip past — the token is not issued
+  without it.
+- Recording metadata persisted: storage key, duration, consent state, retention
+  deadline.
+- Recording can be configured at policy / metadata level even when execution is
+  disabled — for tenants that want the audit trail without the bandwidth.
+- Consent grant and withdrawal are MUST-class audit operations per
+  [ADR-0033](../decisions/0033-audit-durability-model.md): the row is written as
+  durable intent inside the same transaction as the consent state change, so a crash
+  cannot leave a recording whose consent trail is missing.
+- LiveKit Egress writes the recording to S3 / SeaweedFS; LearnStack does not transcode
+  in this phase. Transcoding and the media pipeline proper belong to
+  [Phase 04](phase-04-cms-media-pages.md).
+
+### Provider webhooks
 
 - `https://api.<domain>/webhooks/livekit` with HMAC signature verification.
 - Idempotent: `(provider, event_id)` deduplicated.
 - Tenant id derived from the stored provider account, never trusted from the payload.
-
-### Operational Readiness
-
-- Coturn (TURN / STUN) configured and reachable.
-- LiveKit running in dev compose alongside the application (already true since Phase 01).
-- Cost dashboards instrumented from Phase 09 are populated from `LiveSessionEvent` streams.
-
-## Authorization Surface
-
-Joining a live session requires:
-
-1. Authenticated user (Phase 02b + Phase 03).
-2. Membership in the resolved tenant (Phase 03).
-3. Permission to join the session (Phase 03 + Phase 07 entitlement check).
-4. Resource-scope match (the user is a booked participant or an instructor on this session).
-5. Recording consent (if recording is enabled for this session).
-
-Failures at any layer produce a Problem Details response with a specific `code` (`unauthorized`, `forbidden`, `recording_consent_required`); the classroom UI maps these to actionable copy.
+- Webhook receipt is the only path that opens and closes a `LiveRoom`. The classroom UI
+  reports what it observes; the server records what the provider confirms.
+
+### Cost instrumentation
+
+The decision rule above is unactionable without measurement, so the counters ship in
+this phase even though the reporting surface does not:
+
+- Emitted here: per-session participant-minutes, downstream bytes, recorded minutes,
+  concurrent-participant peak, egress CPU-seconds, and provider error counts — all
+  carried on `LiveSessionEvent` and on OpenTelemetry metrics per
+  [10-observability.md](../standards/10-observability.md).
+- Reported in [Phase 09](phase-09-billing-integrations-analytics.md): the classroom
+  usage and cost report that turns those counters into the monthly figures the
+  break-even rule reads.
+- Alerted in [Phase 11](phase-11-production-hardening.md): budget thresholds, and the
+  cost-model recheck on the production-launch checklist.
+
+A classroom that runs without these counters cannot answer "should we self-host yet?",
+which means the answer defaults to "no" forever.
+
+### Operational readiness
+
+- LiveKit and Coturn have been in the dev compose file since
+  [Phase 01](phase-01-repository-tooling.md).
+  [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) leaves them out of the
+  default local loop until a phase can call them; this is that phase, and it turns them
+  back on. Local development runs against LiveKit OSS in compose regardless of which
+  target production uses — the adapter is the same.
+- Coturn (TURN / STUN) configured and reachable, and verified from a network that
+  blocks UDP, which is where TURN either works or silently does not.
+- LiveKit Cloud credentials live behind `ISecretProvider`, not in configuration files.
 
 ## Deliverables
 
-- `ILiveClassProvider` abstraction + `LiveKitSelfHostedProvider` implementation.
-- In-app classroom UX MVP with audio / video / screen / chat / participant list.
+- `LearnStack.Modules.Classroom` scaffolded — `{Domain, Application, Application.Contracts, Infrastructure}`,
+  its `IModule` registration, `docs/modules/classroom/audit.md`, and its
+  permission-catalogue rows.
+- `ILiveClassProvider` port and the `LiveKitProvider` adapter, target-selectable by
+  configuration, wrapped in `IProviderResilience<ILiveClassProvider>`.
+- `ManualMeetingLinkProvider` escape hatch.
+- In-app classroom UX MVP with audio / video / screen share / chat / participant list.
 - Token issuance pipeline with TTL and role scoping.
-- Attendance computation from event streams.
-- Recording consent flow + recording metadata model + provider webhook handler.
-- LiveKit usage events surface in the Phase 09 analytics pipeline.
+- Attendance computation from event streams, and no-show notifications through the
+  [Phase 08a](phase-08a-assessment-notifications.md) engine.
+- Recording consent flow, recording metadata model, and the provider webhook handler.
+- Classroom cost counters emitted and surfaced to
+  [Phase 09](phase-09-billing-integrations-analytics.md)'s analytics pipeline.
+- A written record of which LiveKit target production runs on, and the measured numbers
+  that justify it.
 
 ## Completion Criteria
 
 - Instructor and learner can join a scheduled session inside the portal.
-- Token issuance is < 200 ms p95; classroom join time is < 1.5 s p95 (per [15-performance.md](../standards/15-performance.md)).
-- Cross-tenant join attempt (identity `{tenantA}:{userId}` against a room owned by tenant B) is rejected.
-- Attendance reflects participant join/leave streams correctly across reconnections.
-- Recording cannot start without consent; consent state is recorded in `LiveRecording`.
+- Token issuance is < 200 ms p95; classroom join time is < 1.5 s p95 (per
+  [15-performance.md](../standards/15-performance.md)).
+- Cross-tenant join attempt — identity `{tenantA}:{userId}` against a room owned by
+  tenant B — is rejected, and the rejection is tested rather than assumed.
+- Attendance reflects participant join / leave streams correctly across reconnections,
+  including the case where a participant drops and rejoins inside the coalescing
+  window.
+- Recording cannot start without consent; consent state is recorded in `LiveRecording`
+  and audited durably.
 - Recording, when enabled, writes to S3 / SeaweedFS with the correct key prefix.
-- LiveKit provider webhook handler is signature-verified, idempotent, and tenant-scoped.
+- The provider webhook handler is signature-verified, idempotent, and tenant-scoped.
+- Switching the LiveKit target from Cloud to self-hosted is a configuration change with
+  no recompile, demonstrated at least once in a non-production environment. Untested,
+  this claim is a hope.
+- The cost counters produce non-zero, plausible values for a real session.
 
 ## Risks
 
-- Treating live classes as simple meeting links instead of a product capability.
-- Coupling core session logic directly to LiveKit SDK types — guarded by the architecture test forbidding provider SDK imports in Domain / Application.
-- Underestimating TURN / STUN, bandwidth, and recording operations — see [08-livekit-cost-model.md](../architecture/08-livekit-cost-model.md).
-- Enabling recording without consent and retention policy.
-- Treating this phase as "demo-quality" — the classroom is the vertical-slice exit criterion for English Learning.
+- **Treating live classes as meeting links** instead of a product capability. The
+  `ManualMeetingLinkProvider` exists to serve a tenant edge case; if it becomes the path
+  most sessions take, the phase failed.
+- **The cost model's stale recommendation gets followed anyway.** Self-hosting at pilot
+  volume costs more money and far more attention than Cloud, during the phase least able
+  to spare either. The decision rule in this document overrides that recommendation
+  until the cost model is rechecked.
+- **The provider switch is never exercised.** A one-switch fallback that has never been
+  switched is not a fallback. The completion criterion above exists because this failure
+  is silent until the day it matters.
+- **Cost counters slip to Phase 09.** They are cheap here and expensive to retrofit —
+  they hang off `LiveSessionEvent`, which this phase defines. Without them the migration
+  decision has no input.
+- **Coupling core session logic to LiveKit SDK types**, guarded by the architecture test
+  forbidding provider SDK imports in Domain / Application, and by the
+  `ProviderException` translation rule at the adapter boundary.
+- **Enabling recording without a consent and retention policy.** Recording is the single
+  highest-consequence capability in the platform: it produces a durable artefact of
+  identifiable people, often minors. Consent blocks the join; retention has a tenant-
+  level cap; deletion is two-step.
+- **Underestimating TURN / STUN and bandwidth operations** — see
+  [08-livekit-cost-model.md](../architecture/08-livekit-cost-model.md). TURN failures
+  look like "the app is broken" to the user and like nothing at all in the logs.
+- **Treating this phase as demo-quality.** The classroom is the capability that makes
+  LearnStack a platform for education businesses that teach live rather than a course
+  catalog with videos.
 
 ## Phase Exit Decision
 
-Phase 09 (Billing, Integrations, Analytics) can begin when classroom join, attendance, recording metadata, and provider webhook handling are stable and integrated with notifications.
+[Phase 09](phase-09-billing-integrations-analytics.md) begins when two people in
+different networks can join a scheduled session from the portal and hold a working
+class — audio, video, screen share, chat, reconnection — with attendance computed from
+the event stream, recording blocked without consent and audited durably when granted,
+the webhook handler signature-verified and idempotent, cross-tenant join attempts
+rejected under test, and the classroom cost counters producing real numbers.
+
+The provider question does not gate the exit. Running on LiveKit Cloud is the expected
+state at exit; what gates the exit is that the switch to self-hosted has been performed
+once outside production and the counters that will call for it are live.
diff --git a/docs/roadmap/phase-09-billing-integrations-analytics.md b/docs/roadmap/phase-09-billing-integrations-analytics.md
index bf11177..2f96612 100644
--- a/docs/roadmap/phase-09-billing-integrations-analytics.md
+++ b/docs/roadmap/phase-09-billing-integrations-analytics.md
@@ -2,13 +2,21 @@
 
 ## Goal
 
-Move LearnStack toward a real commercial and operational platform: package/subscription foundations, external integrations, and measurable analytics.
+Move LearnStack toward a real commercial and operational platform: package and
+subscription foundations, external integrations, measurable analytics, and the search
+engine that the earlier phases have been running without.
 
-Billing should exist as a core capability, but provider-specific and vertical-specific pricing rules should remain behind adapters and configuration.
+Billing exists as a core capability, while provider-specific and tenant-specific pricing
+rules stay behind adapters and configuration.
+
+This is also the phase where the platform starts being able to answer questions about
+itself. Every phase up to here produced capability; this one produces the instruments
+that say whether the capability is being used, what it costs, and whether anyone paid
+for it.
 
 ## Scope
 
-### Billing Primitives
+### Billing primitives
 
 - Product.
 - Plan.
@@ -17,62 +25,219 @@ Billing should exist as a core capability, but provider-specific and vertical-sp
 - Subscription.
 - Invoice reference.
 - Payment provider account.
-- **Billing-source entitlement bridge.** Phase 09 does not own the `Entitlement` aggregate (Phase 07 does). It owns the producer side: a paid `Order` emits an `OrderPaidV1` integration event with the buyer's user id, the granted product (course / program / package), and the tenant context. The Enrollment module (Phase 07) consumes the event and creates an `Entitlement` with `source = billing`. See [Phase 07 § Entitlements](phase-07-enrollment-learner-portal.md) for the consumer contract.
-
-### Payment Provider Adapter
-
-Initial design:
-
-- Provider abstraction.
-- Webhook endpoint convention.
-- Idempotency.
-- Payment status mapping.
-- Tenant-specific provider configuration.
-
-Potential providers:
-
-- Stripe.
-- iyzico.
-- PayTR.
-- Manual/offline payment.
-
-### Commerce Use Cases
+- **Billing-source entitlement bridge.** Phase 09 does not own the `CourseAccess`
+  aggregate ([Phase 07](phase-07-enrollment-learner-portal.md) does). It owns the
+  producer side: a paid `Order` emits an `OrderPaidV1` integration event through the
+  outbox, carrying the buyer's user id, the granted product (course / program /
+  package), and the tenant context. The Enrollment module consumes it and creates an
+  `CourseAccess` with `source = billing`. See
+  [Phase 07 § Course access](phase-07-enrollment-learner-portal.md) for the consumer
+  contract, and [ADR-0010](../decisions/0010-cross-module-communication.md) for why this
+  crossing is an integration event rather than a direct call.
+
+### Stateful entitlement — credit packs and quotas
+
+The [ADR-0018 Amendment (2026-08-08)](../decisions/0018-tenant-driven-customization-model.md)
+draws the genericity boundary here explicitly: a ten-session credit pack or a
+"three make-up classes per term" allowance is a **platform feature**, not tenant
+customization data. A `TenantContentType` JSON Schema can declare a shape; it cannot
+declare a ledger that is decremented, refunded, expired and audited.
+
+So the capability is built in code, once, generically — but **no phase in this roadmap
+builds it**. [Phase 07 § What `CourseAccess` is not](phase-07-enrollment-learner-portal.md)
+and [Phase 10](phase-10-english-learning-mvp.md) both say so, and this phase agrees: a
+ledger that is decremented, refunded, expired and audited is a platform feature needing
+its own ADR and its own release, not a field bolted onto an access grant.
+
+What Phase 09 does own is the **purchase**: a credit-pack `Product` carries a quantity
+and sells through the same `Order` path as anything else, producing the same
+`OrderPaidV1`. The pack's size, price, expiry window and refund rule are tenant
+configuration.
+
+When the ledger is built, three things move together and none of them belongs here: the
+balance aggregate, its decrement point at `LiveBooking` confirmation
+([Phase 08b](phase-08b-scheduling.md)), and its refund rule. Naming them together is the
+point — the failure mode is a balance that two modules both believe they own. Until that
+ADR exists, a tenant that needs prepaid sessions sells them as a `Product` and tracks
+consumption outside the platform.
+
+### Payment provider adapter
+
+- Provider abstraction behind `IPaymentProvider`, per the adapter pattern in
+  [06-extension-model.md](../architecture/06-extension-model.md).
+- Webhook endpoint convention: signature-verified, idempotent on
+  `(provider, event_id)`, tenant derived from the stored provider account and never
+  from the payload — the same rules the classroom webhook follows in
+  [Phase 08c](phase-08c-classroom.md).
+- Payment status mapping from provider vocabulary into LearnStack's.
+- Tenant-specific provider configuration; provider credentials read through
+  `ISecretProvider`, never from tenant rows.
+
+Candidate providers: Stripe, iyzico, PayTR, and a manual / offline provider. The manual
+provider ships first and is not a placeholder — it is the one every deployment needs,
+it exercises the whole order lifecycle without a network dependency, and it is what
+integration tests run against.
+
+### Commerce use cases
 
 - Free course enrollment.
 - Paid course access.
-- Package purchase.
+- Package / credit-pack purchase.
 - Subscription placeholder.
-- Coupon/discount placeholder.
+- Coupon / discount placeholder.
 - Manual payment approval.
 
 ### Integrations
 
-Adapter approach:
+By the time this phase starts, most adapters already exist — email and SMS from
+[Phase 08a](phase-08a-assessment-notifications.md), storage from
+[Phase 04](phase-04-cms-media-pages.md), live classroom from
+[Phase 08c](phase-08c-classroom.md). What this phase adds is the **registry**: one
+place where a tenant's configured providers, their credentials' secret references,
+their health, and their per-tenant enablement are visible and manageable.
 
-- Email provider.
-- SMS provider.
-- Live classroom provider.
-- Live meeting fallback provider.
-- Storage provider.
-- Search provider.
+- Integration registry with per-tenant provider selection and health reporting.
 - CRM provider placeholder.
-- LTI/xAPI readiness.
+- LTI / xAPI readiness — the export shape, not the certification.
+
+### Search: engine, isolation, and index topology
+
+Search has been running on the `ITenantSearch` port since
+[Phase 04](phase-04-cms-media-pages.md), backed by **PostgreSQL full-text search**.
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md) demand-gates Meilisearch
+behind that port, with the trigger "search quality or scale exceeds PostgreSQL FTS".
+This phase is where the trigger is expected to fire. PostgreSQL FTS is adequate for
+"find the row"; a public course-catalog search box is a different job. It has no typo
+tolerance, no prefix or as-you-type matching, and no native faceting, and its Turkish
+support is a Snowball stemmer rather than ICU-quality tokenisation of an agglutinative
+language. Those are precisely the weaknesses
+[ADR-0012](../decisions/0012-search-strategy.md) cites when it selects Meilisearch, and
+a Turkish-serving tenant meets all four the first time a visitor mistypes a course
+name.
+
+Two things must be settled before the adapter lands. Both are corrections to the
+existing design, and both are landed as a dated Amendment to
+[ADR-0012](../decisions/0012-search-strategy.md) plus an update to
+[20-search.md](../architecture/20-search.md).
+
+#### The isolation problem
+
+Every other data path in LearnStack carries four independent isolation layers
+([ADR-0003](../decisions/0003-tenant-isolation-defense-in-depth.md)): request context,
+EF query filter, PostgreSQL Row Level Security, and an architecture test. ADR-0012 as
+written gives search **one** — a `tenant_id` filter composed in application code — and
+hands the engine a master key with no tenant scope on it. One forgotten filter, or one
+call path that reaches the SDK directly, and the isolation is gone with nothing behind
+it. That is a single-layer surface inside a corpus that claims defense in depth
+everywhere else.
+
+Two observations sharpen this. First, the PostgreSQL FTS default that search runs on
+until this phase is protected by RLS like every other table, because its projection
+tables are ordinary tenant-owned tables. **The Meilisearch migration is the moment
+search isolation gets weaker**, not stronger — so the adapter has to bring the missing
+layer with it. Second, an engine that cannot enforce isolation itself is not
+automatically disqualified; it just cannot be the only thing enforcing it.
+
+The resolution — search gets four layers too, at different boundaries:
+
+| Layer | Database path | Search path |
+|---|---|---|
+| Request context | `ITenantContext`, resolved per request | `ITenantSearch` resolves the tenant or throws; it never falls back to platform scope |
+| Caller cannot bypass | EF global query filter | The helper composes the `tenant_id` filter and ANDs caller filters underneath it; callers pass criteria, never filter strings |
+| **Engine-enforced** | PostgreSQL RLS | **Meilisearch tenant token** — a short-TTL token minted per request from the master key with the tenant's `searchRules` baked in. The engine refuses out-of-tenant documents even when the query layer is wrong |
+| Mechanical | Architecture test | Architecture test banning direct SDK use outside the adapter namespace, plus a startup assertion that every registered index declares `tenant_id` filterable |
+
+The engine-enforced layer is the one ADR-0012 is missing, and it is the one that turns
+a code review into a guarantee. Concretely:
+
+- The Meilisearch master key lives behind `ISecretProvider` and never leaves the search
+  adapter. No request-handling code holds it.
+- `ITenantSearch` mints a tenant token per request (or per short-lived cache window)
+  scoped to the current tenant, and queries with that token.
+- `IPlatformSearch` — the cross-tenant path for legal hold and abuse investigation —
+  is the only caller allowed to use an unscoped key, it is a separate type, and every
+  call writes a `platform-admin` audit entry per
+  [18-audit-coverage.md](../standards/18-audit-coverage.md).
+- Integration tests assert that a query issued with tenant A's token against a
+  deliberately un-filtered request returns zero of tenant B's documents. The test that
+  matters is the one where the application-layer filter is *removed on purpose*.
+
+Residual risk, stated rather than hidden: both search layers live inside the same
+process boundary, so a compromised application process defeats both. RLS has the same
+property. The layers protect against the realistic failure — a bug, a new call path, a
+forgotten filter — not against a compromised host, which is
+[11-security.md](../standards/11-security.md)'s problem.
+
+#### The index-explosion problem
+
+ADR-0012 rejects index-per-tenant with clear arithmetic: 10,000 tenants × 4 locales ×
+4 kinds is 160,000 indexes, and Meilisearch is not built for that cardinality. Then
+[20-search.md § Tenant Content-Type Kinds](../architecture/20-search.md) reintroduces
+exactly that explosion through a different door: a `TenantContentType` marked
+`searchable: true` "materialises a search kind", producing an index per locale. Kinds
+are tenant-declared, so the kind set is unbounded and grows with tenant count — the
+rejected topology, arrived at by another route. It also collides: two tenants declaring
+the same content-type key would share an index name while having different schemas.
+
+The resolution — the index topology is closed and tenant-independent:
+
+- **Built-in kinds are a closed, platform-owned set** (`course`, `content-entry`,
+  `media`, `lesson-item`). One index per `(kind, locale)`. Adding a kind is a code
+  change and a schema registration, never a tenant row.
+- **Total index count is `|kinds| × |locales|`** — eight today with two locales — and
+  it does not move when the ten-thousandth tenant signs up. That is the property the
+  ADR wanted and the reason it rejected index-per-tenant.
+- **Tenant-declared searchable content types do not get their own index.** They are
+  documents in the shared `content-entry` index, discriminated by the
+  `content_type_key` field the schema already carries, and always underneath the
+  mandatory `tenant_id` filter. Two tenants using the same key never collide, because
+  no query ever crosses the tenant filter.
+- **Tenant-declared facets resolve through a flattened, generic facet map** —
+  `facet_string.*`, `facet_number.*`, `facet_date.*` — rather than per-type fields. An
+  English tenant's `level` facet and a yoga tenant's `difficulty` facet are the same
+  index attribute with different values, which is precisely
+  [ADR-0018](../decisions/0018-tenant-driven-customization-model.md)'s claim expressed
+  in an index.
+- **Facet declarations are capped per tenant**, enforced at `TenantContentType`
+  registration. Filterable attributes are a shared, finite resource on a shared index;
+  an uncapped declaration is one tenant degrading everyone's search.
+- Locale stays an index split, unchanged. ADR-0012's reasoning there is sound: ICU
+  tokenisation, stop words and stemming are genuinely per-language, the locale list is
+  small and platform-controlled, and it does not grow with tenants.
+
+#### Search work in this phase
+
+- Meilisearch adapter behind `ITenantSearch` / `IPlatformSearch`, with tenant-token
+  minting and the master key behind `ISecretProvider`.
+- Reindex from the existing projection tables into the Meilisearch topology, with the
+  alias-swap cutover from [20-search.md](../architecture/20-search.md) § Reindex.
+- Search query telemetry feeding the analytics module.
+- Platform-admin cross-tenant search via `IPlatformSearch`, audited.
+- Drift dashboards and the nightly reconciliation surface.
+- The dated ADR-0012 Amendment and the 20-search.md correction described above.
+
+The outbox-driven indexing pipeline is engine-independent and does not change: the same
+integration events that maintained the FTS projection tables feed the Meilisearch
+indexer. That is what makes this a swap rather than a rewrite, and it is the payoff for
+having shipped the port five phases before the engine.
 
-### Live Classroom Usage Analytics
+### Live classroom usage analytics
 
-Track provider-agnostic metrics:
+The counters emitted in [Phase 08c](phase-08c-classroom.md) become reports here.
+Provider-agnostic metrics:
 
-- Session created.
-- Room opened.
-- Participant joined.
-- Participant left.
-- Participant connection duration.
-- Screen share started/stopped.
-- Recording started/stopped.
+- Session created, room opened.
+- Participant joined, participant left, connection duration.
+- Screen share started / stopped.
+- Recording started / stopped, recorded minutes.
 - Attendance status.
+- Downstream bytes and concurrent-participant peak.
 - Provider error.
 
-These events should support both learning analytics and provider cost monitoring.
+These serve two consumers at once: learning analytics, and the provider cost monitoring
+that feeds [Phase 08c](phase-08c-classroom.md)'s LiveKit Cloud-versus-self-hosted
+decision rule. That rule reads its inputs from the reports built here — without them it
+has no way to fire.
 
 ### Analytics
 
@@ -85,7 +250,7 @@ Event groups:
 - Live classroom events.
 - System events.
 
-Read model examples:
+Read models:
 
 - Course completion report.
 - Enrollment report.
@@ -95,37 +260,102 @@ Read model examples:
 - Live session attendance report.
 - Classroom usage and cost report.
 
-### Search Reporting and Platform-Admin Search
-
-Initial index population lands earlier: `content-entry` and `media` indexes go online in Phase 04, `course` index in Phase 05, public search endpoints in Phase 06 (see [20-search.md § Roadmap Touchpoints](../architecture/20-search.md) and [ADR 0012](../decisions/0012-search-strategy.md)). Phase 09 adds:
-
-- Search query telemetry feeding the analytics module.
-- Platform-admin cross-tenant search via `IPlatformSearch` (audited as `platform-admin`, see [18-audit-coverage.md](../standards/18-audit-coverage.md)).
-- Drift dashboards and the nightly reconciliation surface.
+Analytics read models are projections per
+[ADR-0010](../decisions/0010-cross-module-communication.md) — they are built from
+integration events, not from cross-module queries into other modules' tables. Every
+event carries a version suffix from the first one; an unversioned analytics event is a
+schema that can never change.
 
 ## Deliverables
 
-- Billing domain primitives.
-- Payment adapter infrastructure.
-- Integration registry.
-- Analytics event ingestion and basic reports.
-- Search reporting + platform-admin cross-tenant search (`IPlatformSearch`).
-- Live classroom usage reporting foundation.
+- `LearnStack.Modules.Billing`, `LearnStack.Modules.Analytics` and
+  `LearnStack.Modules.Integrations` scaffolded — each with
+  `{Domain, Application, Application.Contracts, Infrastructure}`, its `IModule`
+  registration, its `docs/modules/<module>/audit.md`, and its permission-catalogue rows.
+- Billing domain primitives and the `OrderPaidV1` producer path.
+- Payment adapter infrastructure with the manual provider working end to end.
+- Credit-pack purchase path, with the balance boundary against
+  [Phase 07](phase-07-enrollment-learner-portal.md) settled and written down.
+- Integration registry with per-tenant provider configuration and health.
+- Meilisearch adapter behind `ITenantSearch`, with engine-enforced tenant tokens and
+  the closed index topology.
+- `IPlatformSearch` cross-tenant search, audited.
+- Reindex and nightly reconciliation, with drift dashboards.
+- Dated ADR-0012 Amendment and 20-search.md correction covering isolation layers and
+  index topology.
+- Analytics event ingestion, the read models listed above, and the classroom usage and
+  cost report.
 
 ## Completion Criteria
 
-- Product, plan, and price can be created.
-- Mock/manual payment provider works through the adapter.
-- Successful order creates entitlement.
-- Webhook idempotency is tested.
-- Learning, commerce, and classroom events can be reported.
-- Platform-admin cross-tenant search runs through `IPlatformSearch` with audit entries.
+- Product, plan, and price can be created for a tenant.
+- The manual payment provider drives an order to paid through the adapter, and a paid
+  order produces a `CourseAccess` in the Enrollment module via `OrderPaidV1`.
+- A credit pack can be bought, its balance decremented by a confirmed booking, and
+  refunded by a cancellation inside the tenant's window.
+- Webhook idempotency is tested: the same provider event delivered twice produces one
+  order state change.
+- Search runs on Meilisearch through `ITenantSearch` with per-request tenant tokens.
+- **A query issued with the application-layer tenant filter deliberately removed still
+  returns zero cross-tenant documents**, because the engine rejects them. This is the
+  criterion that proves the isolation layer is real.
+- Total Meilisearch index count equals `|kinds| × |locales|` and does not change when a
+  tenant is added — verified by adding a tenant with three searchable content types and
+  observing no new index.
+- Platform-admin cross-tenant search runs through `IPlatformSearch` and writes a
+  `platform-admin` audit entry per call.
+- Reindex completes with an alias swap and no search downtime.
+- Learning, commerce, and classroom events can be reported, and the classroom cost
+  report produces the inputs [Phase 08c](phase-08c-classroom.md)'s provider decision
+  rule needs.
 
 ## Risks
 
-- Designing too closely around the first payment provider.
-- Merging billing and enrollment into the same model.
-- Designing analytics only for dashboard needs.
-- Growing event schemas without versioning.
-- Ignoring live classroom usage costs until after production launch.
-
+- **Designing too closely around the first payment provider.** Provider vocabulary leaks
+  into the domain most easily through status enums and webhook payload shapes. The
+  manual provider shipping first is the mitigation: a domain that models manual payment
+  cleanly is a domain nobody shaped around Stripe.
+- **Merging billing and enrollment into the same model.** The bridge is one integration
+  event in one direction. If Phase 09 code reads `CourseAccess` or Phase 07 code reads
+  `Order`, the boundary is gone.
+- **A second credit ledger.** The most likely place is a "remaining sessions" counter
+  added here for convenience while Phase 07 holds the authoritative one. Two counters
+  disagree the first time a refund races a booking.
+- **Migrating search without the engine-enforced layer.** The tempting version of this
+  phase ships the Meilisearch adapter with the existing application-side filter and
+  leaves tenant tokens for later. That version makes tenant isolation strictly weaker
+  than it was on PostgreSQL FTS, which is a regression disguised as a feature.
+- **Index topology settled by accident.** If the adapter is written before the
+  ADR-0012 Amendment lands, whatever the first indexer does becomes the topology, and
+  the tenant-declared-kind explosion arrives by default.
+- **Designing analytics only for the current dashboard.** Read models built backwards
+  from a specific chart cannot answer the next question. Model the events; derive the
+  charts.
+- **Growing event schemas without versioning.** Cheap now, and unfixable once a
+  consumer exists in another process.
+- **Ignoring classroom usage costs.** The cost counters exist from Phase 08c
+  specifically so this phase can report on them; if the reports slip, the self-hosting
+  decision in Phase 08c never gets its inputs and defaults to whatever was configured
+  first.
+
+## Phase Exit Decision
+
+[Phase 10](phase-10-english-learning-mvp.md) begins when a tenant can sell something and
+find something.
+
+Concretely: an order goes from created to paid through the payment adapter and grants an
+`CourseAccess` the learner can act on; a credit-pack `Product` sells and produces its
+order without the platform pretending to track a balance; search runs on Meilisearch
+with cross-tenant leakage blocked by the engine and demonstrated under a test that
+removes the application-layer filter on purpose; the index count is independent of
+tenant count; and the analytics read models — including the classroom cost report —
+return real numbers for a tenant that has actually been used.
+
+If the Meilisearch trigger has **not** fired by the end of this phase — search quality on
+PostgreSQL FTS is adequate for every live tenant — then the correct exit is to ship the
+ADR-0012 Amendment and the topology decision, leave the adapter unwritten, and record
+the trigger as still pending in
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md)'s table. A demand-gated
+building block whose demand has not arrived is not an incomplete phase. Writing the
+adapter anyway, before a tenant needs it, is the failure this roadmap is structured to
+avoid.
diff --git a/docs/roadmap/phase-09b-hub-billing.md b/docs/roadmap/phase-09b-hub-billing.md
index c0da96a..796078b 100644
--- a/docs/roadmap/phase-09b-hub-billing.md
+++ b/docs/roadmap/phase-09b-hub-billing.md
@@ -1,146 +1,58 @@
-# Phase 09b: Hub Billing and Invoicing (parallel track)
+# Phase 09b: Hub Billing (pointer)
 
-## Goal
-
-Extend the **`learnstack-hub`** repository with the **platform-level billing** that
-governs each tenant's LearnStack subscription: `Plan` ↔ `HubSubscription` lifecycle,
-`HubInvoice` / `HubInvoiceLine` ledger, payment-provider adapter, usage-based
-metering integration, dunning and grace-period rules, and the operator UI for these.
-
-Runs **in parallel** with Phase 09 (LearnStack-side tenant storefront billing). Both
-phases own their own surfaces and do not overlap:
-
-| Concern | Owner |
-|---------|-------|
-| Tenant sells courses to learners | **Phase 09** (LearnStack core's `Billing` module — storefront) |
-| LearnStack vendor charges a tenant for the LearnStack subscription | **Phase 09b** (Hub-side platform billing) |
-
-Phase 02c shipped `Plan` and `HubSubscription` as **provisioning** primitives; this
-phase fills in the **commercial** side.
-
-Decisions referenced:
-
-- [ADR-0019 LearnStack Hub](../decisions/0019-learnstack-hub.md)
-- [ADR-0020 Triple Deployment + Hybrid License](../decisions/0020-triple-deployment-hybrid-license.md)
-- [ADR-0021 Feature-Based Entitlement](../decisions/0021-feature-based-entitlement.md)
-
-## Scope
-
-### Hub-Side Aggregates
-
-- `HubInvoice` / `HubInvoiceLine` — invoice ledger per tenant.
-- `UsageAggregate` — aggregated usage by tenant + month (concurrent classroom
-  sessions, total minutes, storage GB, learner count, custom-domain count).
-- `DunningPolicy` — per-plan rules for missed-payment escalation.
-- `PaymentProviderAccount` (Hub-side) — Stripe / iyzico / wire-only configurations
-  for vendor's own payment collection.
-- Extension of `HubSubscription` with `billing_state`, `current_period_start`,
-  `current_period_end`, `cancel_at_period_end`, `dunning_state`, `grace_until`.
+> **Pointer document.** The authoritative plan for Hub billing lives in the
+> **`learnstack-hub`** repository at `docs/roadmap/hub-billing.md`. This file records
+> only what a LearnStack reader needs: why the phase exists, where the repository
+> boundary falls, what starts the work, and the one LearnStack-side dependency. The Hub
+> billing aggregates, the dunning and grace state machine, the invoice ledger and the
+> operator portal surface are Hub concerns and are described there, not here.
 
-### Usage Ingestion
-
-- LearnStack core's `POST /api/v1/usage/report` (already shipped in Phase 02c)
-  produces the raw stream; this phase adds **aggregation** on Hub side: a Hangfire
-  job rolls raw reports into `UsageAggregate` daily.
-- Soft-limit alerts (`usage.alert.soft_limit_reached` event, already produced in
-  Phase 02c) surface in the operator portal and (optionally) email the tenant admin.
-
-### Billing Lifecycle
-
-- New subscription on tenant create (via the existing Phase-02c flow) starts with
-  `billing_state = trial`.
-- Trial → active transition triggers the first invoice generation.
-- Period-end (monthly / annual) closes the current period, generates an invoice
-  (`HubInvoice`), and emits `learnstack.hub.invoice.generated` Dapr event.
-- Failed payment enters `dunning_state = grace` for the configured window
-  (default 14 days); during grace, the entitlement projection stays active. On grace
-  expiry, the projection downgrades to a `read-only` feature set and a notice banner
-  is pushed via the next entitlement refresh.
-- Cancellation honours `cancel_at_period_end` (no immediate access loss).
-
-### Payment Provider Adapters
-
-- Stripe adapter (cards + ACH + SEPA).
-- iyzico adapter (Turkish market).
-- Manual / wire-transfer adapter (operator marks payment received).
-- All three implement `IHubPaymentProvider`; adding a fourth is a code edit, not an
-  ADR.
-
-> **Naming.** Hub-side `IHubPaymentProvider` is **distinct** from the LearnStack-core
-> `IPaymentProvider` (Phase 09's tenant-facing storefront billing). The two
-> interfaces share a common shape (idempotency key, webhook signature verification,
-> status mapping) but are scoped to different billing relationships:
-> `IPaymentProvider` charges *learners* on behalf of a tenant; `IHubPaymentProvider`
-> charges *tenants* on behalf of LearnStack for their LearnStack subscription. Hub
-> adapters live in the `learnstack-hub` repo's
-> `Hub.Infrastructure.Payments.{Stripe,Iyzico,Manual}` packages; LearnStack-core
-> adapters live in `LearnStack.Infrastructure.Payments.{...}` in this repo.
-> Mixing them in one process is forbidden by the Hub / LearnStack codebase
-> separation invariant ([ADR-0019](../decisions/0019-learnstack-hub.md)).
-
-### Operator Portal Extensions
-
-- Per-tenant billing tab: subscription state, current period, recent invoices,
-  payment-provider info, dunning state, grace expiry.
-- Invoice viewer + PDF export.
-- Plan-change workflow: operator switches a tenant's plan; entitlement projection is
-  re-pushed; pro-rated invoice generated.
-- Bulk invoice export (CSV) for accounting.
+## Goal
 
-### Tenant-Facing Hooks (in LearnStack core, **not** new code in Hub)
+Let the LearnStack vendor charge a tenant for that tenant's LearnStack subscription —
+plan and subscription lifecycle, invoicing, payment collection, dunning, grace, and the
+operator surface over all of it. Every line of that is Hub-side code in the Hub
+repository ([ADR-0019](../decisions/0019-learnstack-hub.md),
+[ADR-0020](../decisions/0020-triple-deployment-hybrid-license.md)).
 
-- A read-only billing tab in Studio (LearnStack core) shows the tenant their own
-  subscription state, recent invoices, and "next payment due" — sourced from a thin
-  proxy API that calls the Hub. The proxy lives in LearnStack core and uses
-  `IEntitlementProvider`'s billing-info extension; **no new Hub endpoint** is added
-  to the four-endpoint contract surface.
+## Division of responsibility
 
-### Compliance
+Two different billing relationships exist. Conflating them is the most common reading
+error in this corpus, so it is written out:
 
-- Tax handling per region (Stripe Tax for the Stripe adapter; manual table for
-  others).
-- Invoice retention 7 years (per the Hub-side audit retention floor).
-- Hub-side audit entries for every operator billing action (plan change, manual
-  invoice, refund).
+| Money flows | Phase | Where the code lives |
+|---|---|---|
+| A learner pays a **tenant** for a course | [Phase 09](phase-09-billing-integrations-analytics.md) — storefront billing | LearnStack core, behind `IPaymentProvider` |
+| A tenant pays the **LearnStack vendor** for the platform | Phase 09b — platform billing | `learnstack-hub`, behind `IHubPaymentProvider` |
 
-## Deliverables
+The two ports share a shape — idempotency key, webhook signature verification, status
+mapping — and never run in the same process. Self-Hosted tenants skip this phase
+entirely: they buy a licence key rather than a subscription.
 
-- Hub-side billing aggregates + schema + Hangfire jobs.
-- Stripe + iyzico + manual payment-provider adapters.
-- Operator portal billing surface.
-- LearnStack-core proxy endpoint that the tenant's Studio billing tab consumes.
-- Dunning + grace-period state machine working end-to-end.
-- Invoice PDF generation pipeline.
+## Scope on the LearnStack side
 
-## Completion Criteria
+Deliberately almost nothing — but **two** things, not one. The first is **usage
+reporting**: the
+`IUsageReporter` adapter and `POST /api/v1/usage/report`, which ship in
+[Phase 02c](phase-02c-hub-foundation.md) and are already part of the contract surface
+enumerated in [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md). Phase 09b
+aggregates and bills against that stream; it does not extend it.
 
-- An operator can move a tenant from trial → active → cancelled with appropriate
-  invoices generated and entitlement projection refreshes.
-- A failed payment triggers dunning; the tenant continues operating until grace
-  expiry; on expiry, the projection downgrades to read-only and Studio shows the
-  notice banner.
-- The tenant's Studio billing tab shows accurate subscription + invoice data, sourced
-  via the proxy from Hub.
-- Operator audit log captures every billing action with `actor.hubOperator = true`.
-- Hub-side architecture tests green; LearnStack-core architecture tests
-  (`LearnStack_Modules_DoNotReference_Hub`, no new endpoints on internal API) still
-  green.
+A read-only subscription view inside Studio is optional and, if built, reads through
+`IEntitlementProvider` — no LearnStack module gains a dependency on Hub billing, and
+`LearnStack_Modules_DoNotReference_Hub` stays green. Any new endpoint the Hub billing
+design needs requires an ADR, per ADR-0034's second invariant.
 
-## Risks
+## Trigger
 
-- **Two-billing confusion**: tenant admins conflating their own storefront billing
-  with the platform billing they pay for LearnStack. Mitigated by clear UI separation
-  (storefront in Studio's "Catalog → Products"; platform billing under
-  "Settings → Subscription") + consistent terminology.
-- **Payment provider drift**: Stripe / iyzico API breaking changes. Mitigated by
-  adapter pattern + contract tests against recorded fixtures.
-- **Grace period gaming**: tenants entering grace repeatedly. Mitigated by
-  `IUsageReporter` continuing to report during grace; operator portal surfaces
-  serial-grace tenants.
+Phase 09b starts when a tenant must be invoiced commercially — a signed SaaS or
+Dedicated contract with a paying customer. Until then the roadmap holds the slot and the
+Hub repository holds the design.
 
 ## Phase Exit Decision
 
-Phase 09b is complete when SaaS deployment can charge a real tenant end-to-end:
-operator provisions tenant → trial → active → invoice generated → payment captured
-→ next period rolls over. Self-Hosted tenants do not need Phase 09b (they pay via
-license-key purchase, not subscription billing).
+Phase 09b is complete when a SaaS deployment charges a real tenant end to end: operator
+provisions the tenant, trial converts to active, an invoice is generated, payment is
+captured, and the next period rolls over — with LearnStack unchanged apart from the
+usage it was already reporting. The exit criteria in detail live in the Hub repository's
+`docs/roadmap/hub-billing.md`.
diff --git a/docs/roadmap/phase-10-english-learning-mvp.md b/docs/roadmap/phase-10-english-learning-mvp.md
index 58d02d5..05d3a0c 100644
--- a/docs/roadmap/phase-10-english-learning-mvp.md
+++ b/docs/roadmap/phase-10-english-learning-mvp.md
@@ -1,191 +1,235 @@
-# Phase 10: First Tenant Customization Showcase (online English education)
+# Phase 10: Tenant Customization Showcase (online English education)
 
 ## Goal
 
-Prove that LearnStack can produce a real, end-to-end education product **without
-LearnStack writing any domain-specific code**. The first showcase happens to be an
-online English-learning platform, but every CEFR-level, vocabulary-card, placement-test
-scoring rule, and speaking-practice item is loaded as **tenant customization data**
-([ADR-0018](../decisions/0018-tenant-driven-customization-model.md)) at tenant
-provisioning, not compiled into the binary.
-
-A second, non-English tenant (e.g. a coding bootcamp or a yoga studio) ships in
-parallel as the **substrate-genericity proof**: the same code paths must serve both
-tenants and the cross-tenant isolation tests must pass.
-
-The bar for any change to LearnStack core during this phase: *Does this belong in the
-core because every education product will need it, or does it belong as tenant
-customization data because only some domains need it?* If the latter, the answer is
-to extend a customization aggregate, **not** to add a module or a domain identifier.
+Build one complete, commercially plausible education product — an online English school
+— entirely out of tenant customization data, and in doing so exercise **every**
+customization aggregate LearnStack ships. The question this phase answers is not "can
+the platform serve more than one domain?" but "**is the customization surface complete
+enough for one domain to be finished on it?**"
+
+That is a change of direction from the earlier plan, and the reason is that the original
+question is already answered. Two tenants in unrelated domains — an English school and a
+yoga studio — exist from
+[Phase 02a Packet 7](phase-02a-kernel-tenancy.md) onward, render side by side from
+[Phase 02d](phase-02d-walking-skeleton.md), and are carried through every phase in
+between. Genericity is therefore proven **continuously**, by construction, not
+retroactively in a showcase. What no earlier phase proves is *depth*: each of them
+touches the two or three aggregates its own slice needs. Phase 10 is the first place a
+single tenant uses all eight at once, in one coherent product, with real content and a
+real learner journey.
+
+The failure mode this phase hunts is specific: an aggregate that exists, has tests, and
+still cannot express what a real tenant actually needs — a content type whose schema
+cannot describe a vocabulary card's audio reference, a page block that cannot compose
+the page the tenant wants, a completion rule that cannot say what "finished" means for a
+speaking lesson. Those gaps are invisible against seed fixtures and obvious against a
+product.
+
+The bar for any change to LearnStack core during this phase is unchanged: *does this
+belong in the core because every education product needs it, or does it belong as
+customization data because only some domains need it?* If the latter, the answer is to
+extend a customization aggregate — never to add a module or a domain identifier.
 
 ## Scope
 
-### Tenant Customization Data — English Tenant
-
-Loaded at provisioning into the customization aggregates from Phase 02a:
-
-- **`TenantLevelTaxonomy`** — CEFR levels (A1, A2, B1, B2, C1, C2). Items declared
-  in the taxonomy; the `Level` table holds the items keyed by
-  `(tenant_id, taxonomy_key, key)`.
-- **`TenantContentType`** — `VocabularyCard` (word + part-of-speech + definition +
-  examples + audio reference), `GrammarTopic` (title + summary + examples + level
-  reference), `SpeakingPrompt` (prompt + difficulty + sample answers), `LessonPackage`
-  (composite content type referencing courses + supplementary content).
-- **`TenantLessonItemType`** — `SpeakingPracticeItem` (prompts + live-session
-  reference), `VocabularyDrillItem` (deck reference + drill mode), `GrammarExerciseItem`
-  (exercise reference + scoring config).
-- **`TenantScoringRule`** — placement-test → CEFR-level recommendation DSL.
-  Receives an attempt's answer map, returns the recommended level key.
-- **`TenantCompletionRule`** — English lesson-package completion semantics (all
-  lessons + speaking session attended + vocab drill score ≥ threshold).
-- **`TenantPageBlock`** — `vocabulary-list`, `level-card`, `placement-test-entry`,
-  `instructor-grid` (each pointing at a built-in `content-list` / `card-grid` /
-  `default-card` composite renderer).
-- **`TenantCustomFieldDef`** — `User.preferredAccent` (enum: BrE/AmE/AusE/other),
-  `InstructorProfile.dialectsTaught`, `Enrollment.preferredPace`.
-- **`TenantTemplateLibrary`** — English-locale email templates for invitation,
-  enrollment, placement-test result, speaking-session reminder, password reset.
-
-### Tenant Customization Data — Second Tenant (genericity proof)
-
-A non-English tenant ships in parallel. Recommended candidates:
-
-- **Coding bootcamp** — `Track` taxonomy (Frontend / Backend / DevOps), `CodeChallenge`
-  content type, `CodeRunnerItem` lesson item, track-based completion rule.
-- **Yoga studio** — `Difficulty` taxonomy, `AsanaPose` content type, `BreathExerciseItem`
-  lesson item, session-attendance completion rule.
-
-The second tenant must exercise **every** customization aggregate to prove no
-customization gap exists.
-
-### Public Site (English tenant)
-
-Initial pages composed from the customization data:
-
-- Home page (composed from tenant-defined blocks: hero, course preview, level cards,
-  instructor grid, testimonials).
-- Courses page (driven by `Course` + tenant-defined `level-card` block).
-- Level detail pages (driven by `TenantLevelTaxonomy` items).
-- Placement test landing page (renders the `placement-test-entry` block).
-- Instructor / teacher page (renders the `instructor-grid` block over
-  `InstructorProfile`s with the tenant's custom fields).
+### The eight customization aggregates
+
+Each aggregate is delivered by an earlier phase. Phase 10 is where one tenant fills all
+eight, and where a gap in any of them stops being theoretical.
+
+| Aggregate | Delivered by | What the English tenant puts in it |
+|---|---|---|
+| `TenantContentType` | [Phase 02a Packet 8](phase-02a-kernel-tenancy.md) | `VocabularyCard` (word + part of speech + definition + examples + audio reference), `GrammarTopic` (title + summary + examples + level reference), `SpeakingPrompt` (prompt + difficulty + sample answers), `LessonPackage` (composite referencing courses + supplementary content) |
+| `TenantLevelTaxonomy` | [Phase 02a Packet 8](phase-02a-kernel-tenancy.md) | CEFR levels A1 … C2. The taxonomy declares the vocabulary; the `Level` table holds items keyed by `(tenant_id, taxonomy_key, key)` |
+| `TenantCustomFieldDef` | [Phase 03](phase-03-identity-admin.md) | `User.preferredAccent` (BrE / AmE / AusE / other), `InstructorProfile.dialectsTaught`, `Enrollment.preferredPace` |
+| `TenantPageBlock` | [Phase 04](phase-04-cms-media-pages.md) | `vocabulary-list`, `level-card`, `placement-test-entry`, `instructor-grid` — each pointing at a built-in `content-list` / `card-grid` / `default-card` composite renderer |
+| `TenantLessonItemType` | [Phase 05](phase-05-education-learning-content.md) | `SpeakingPracticeItem` (prompts + live-session reference), `VocabularyDrillItem` (deck reference + drill mode), `GrammarExerciseItem` (exercise reference + scoring config) |
+| `TenantScoringRule` | [Phase 05](phase-05-education-learning-content.md) | Placement test → CEFR level recommendation. Takes an attempt's answer map, returns a level key from the tenant's own taxonomy |
+| `TenantCompletionRule` | [Phase 05](phase-05-education-learning-content.md) | Lesson-package completion: all lessons done **and** speaking session attended **and** vocabulary drill score above the tenant's threshold |
+| `TenantTemplateLibrary` | [Phase 08a](phase-08a-assessment-notifications.md) | English-locale templates for invitation, enrollment, placement-test result, speaking-session reminder, password reset |
+
+### The genericity boundary applies to the data set
+
+The English tenant's customization data must stay inside the boundary drawn by the
+[ADR-0018 genericity amendment](../decisions/0018-tenant-driven-customization-model.md).
+Content shape, presentation, and pure rule evaluation over already-recorded facts are
+tenant data. Two things are not, and the showcase must not need either:
+
+- **Stateful entitlement.** A pack of ten prepaid speaking sessions, or a "three make-up
+  classes per term" allowance, requires a balance that is decremented, refunded, expired
+  and audited. A JSON Schema declares shape; it cannot declare a ledger. If the English
+  tenant's commercial model needs one, that is a **platform feature** requiring its own
+  ADR and a LearnStack release — it does not arrive through this phase, and it is not
+  smuggled in as a custom field.
+- **External capability invocation.** Running submitted code, or scoring pronunciation
+  from an audio clip, needs a sandbox, a runtime, a resource budget and a security
+  boundary. A rule DSL evaluates; it does not execute programs.
+
+`SpeakingPracticeItem` sits on the correct side of that line: it declares a shape that
+*references* the live-classroom capability [Phase 08c](phase-08c-classroom.md) already
+ships. It does not invoke anything the platform cannot already do.
+
+**Why the coding bootcamp is not the showcase.** An earlier draft of this phase offered
+a coding bootcamp as a candidate second tenant. It was dropped for exactly this reason:
+its defining feature — running a learner's submitted code — is external capability
+invocation, outside the customization boundary. Choosing it would have forced either a
+domain-specific runner module (violating the platform's central rule) or a showcase that
+quietly omitted the one thing that made the domain interesting. A yoga studio, whose
+distinctive content and taxonomy are pure shape, is honest about what the model can
+actually do.
+
+### The second tenant
+
+The second tenant already exists. The yoga studio seeded in
+[Phase 02a Packet 7](phase-02a-kernel-tenancy.md) has been running on the same code paths
+since the kernel landed, and every phase from [Phase 02d](phase-02d-walking-skeleton.md)
+onward has been exercised against both tenants. Phase 10 does not create it, deepen it,
+or re-prove it. It keeps the yoga tenant in the isolation suite and in the regression
+path — nothing the English showcase adds may break it, and any core change that only
+works for one of the two is the defect this arrangement exists to catch.
+
+### Public site (English tenant)
+
+Composed entirely from customization data:
+
+- Home page — hero, course preview, level cards, instructor grid, testimonials, all from
+  tenant-defined blocks.
+- Courses page — `Course` data rendered through the tenant's `level-card` block.
+- Level detail pages — driven by `TenantLevelTaxonomy` items.
+- Placement-test landing page — renders the `placement-test-entry` block.
+- Instructor page — renders `instructor-grid` over `InstructorProfile`s carrying the
+  tenant's custom fields.
 - Pricing / packages page.
 - Blog / resources page.
-- Contact / lead form page.
+- Contact / lead-capture page.
 
-### Learning Experience
+### Learning experience
 
 - Learner onboarding.
-- **Placement-test attempt → scored via `TenantScoringRule` → recommended level
-  produced**. No English-specific code in any module.
-- Recommended level / course.
-- Enrolled course dashboard.
-- Lesson player rendering custom lesson-item types (`SpeakingPracticeItem`,
-  `VocabularyDrillItem`, etc.) via the `TenantLessonItemType` registry.
-- Vocabulary resources (driven by `VocabularyCard` entries).
-- Speaking session booking.
-- In-app classroom entry from the learner portal.
-
-### In-App Speaking Sessions
-
-English learning uses the LearnStack classroom capability for speaking sessions
-unchanged from Phase 08c. Initial scope:
-
-- One-on-one speaking session.
-- Small group speaking session readiness.
-- Instructor joins from instructor portal.
-- Learner joins from learner portal.
-- Session material panel (sources content via `TenantContentType` references).
-- Attendance.
-- Session notes placeholder.
-- Recording metadata placeholder (recording itself stays tenant-configurable and
-  off by default).
-- Speaking-session learning events.
-
-Deferred (post-MVP, unchanged from earlier roadmap):
-
-- AI pronunciation scoring.
-- Live transcription.
-- Automatic speaking feedback.
-- Breakout rooms.
-- Advanced whiteboard.
-
-### Instructor Experience
-
-- Instructor profile.
-- Availability management.
-- Session list.
-- Join classroom action.
-- Learner notes placeholder (tenant-customizable via `TenantCustomFieldDef`).
-- Attendance marking.
-
-### Admin Experience
-
-- Manage `TenantLevelTaxonomy` items (CEFR levels for the English tenant; `Track`
-  for the coding tenant — same UI, different data).
-- Manage courses, instructors, lesson packages.
-- Manage placement test attempt history and scoring rule overrides.
-- View leads / enrollments.
-- View speaking session schedule.
-- **Manage tenant customization aggregates** in the Studio editor (this is the editor
-  shipped in Phase 06).
-
-### Commercial Flow
-
-MVP options (unchanged):
-
-- Manual enrollment.
-- Manual payment approval.
-- Optional online payment adapter (Phase 09's storefront billing).
-- Lead form to admin follow-up.
-
-The tenant's own LearnStack subscription is on the Hub side (Phase 09b); the tenant
-admin sees it read-only in Studio. The MVP can also run with `NullEntitlementProvider`
-(no Hub) for non-SaaS demonstrations.
+- **Placement-test attempt scored by `TenantScoringRule`, producing a recommended level
+  key from the tenant's own taxonomy.** No English-specific code executes anywhere in
+  that path.
+- Recommended level and course.
+- Enrolled-course dashboard.
+- Lesson player rendering custom lesson-item types through the `TenantLessonItemType`
+  registry.
+- Vocabulary resources driven by `VocabularyCard` entries.
+- Speaking-session booking against instructor availability from
+  [Phase 08b](phase-08b-scheduling.md).
+- Classroom entry from the learner portal.
+
+### In-app speaking sessions
+
+The English tenant uses the classroom capability from
+[Phase 08c](phase-08c-classroom.md) unchanged — one-on-one sessions, small-group
+readiness, instructor and learner join from their own portals, a session material panel
+sourcing content through `TenantContentType` references, attendance, session notes, and
+recording metadata with recording itself tenant-configurable and off by default.
+
+Not built here, and no phase owns them: AI pronunciation scoring, live transcription,
+automatic speaking feedback, breakout rooms, and advanced whiteboard sit in the post-MVP
+backlog recorded in [MVP Scope](../architecture/05-mvp-scope.md). The first three are
+external capability invocation and are outside the customization boundary regardless of
+when they are built.
+
+### Instructor experience
+
+Instructor profile, availability management, session list, join-classroom action,
+learner notes backed by `TenantCustomFieldDef`, attendance marking.
+
+### Admin experience
+
+- Manage `TenantLevelTaxonomy` items — the same Studio screen the yoga tenant uses for
+  its difficulty taxonomy, with different data.
+- Manage courses, instructors, and lesson packages.
+- Manage placement-test attempt history and scoring-rule versions.
+- View leads and enrollments.
+- View the speaking-session schedule.
+- **Manage every customization aggregate** in the Studio editor shipped in
+  [Phase 06](phase-06-renderer-admin-studio.md). This phase is the first time that editor
+  is driven across its full surface by someone building a product rather than a fixture.
+
+### Commercial flow
+
+Manual enrollment, manual payment approval, an optional online payment adapter from
+[Phase 09](phase-09-billing-integrations-analytics.md)'s storefront billing, and lead-form
+follow-up. The tenant's own LearnStack subscription is Hub-side
+([Phase 09b](phase-09b-hub-billing.md)) and appears read-only in Studio; the showcase
+also runs on `NullEntitlementProvider` with no Hub at all for non-SaaS demonstrations.
 
 ## Deliverables
 
-- Two tenants live: one English-learning, one non-English domain.
-- Tenant customization data sets for both tenants loaded via the customization
-  aggregates.
-- Placement-test → scored via `TenantScoringRule`.
-- English course catalog + non-English catalog.
-- Learner portal flow.
-- Teacher / session workflow.
-- In-app speaking classroom MVP.
-- Cross-tenant isolation suite green (`Tenant_A_cannot_read_Tenant_B`,
-  `Org_X_cannot_read_Org_Y_within_TenantA`).
-- Architecture test `Core_Modules_HaveNo_DomainSpecific_Names` continues to hold —
-  i.e. *no* CEFR / English / Yoga / Track string appears anywhere in the LearnStack
-  core source tree.
+- A complete English-school customization data set filling all eight aggregates, loaded
+  at provisioning through the `seed-tenant` path — no code, no migration, no module.
+- Public site, learner portal, instructor portal and admin screens for that tenant,
+  rendered from that data.
+- Placement test scored end to end through `TenantScoringRule` against
+  `TenantLevelTaxonomy`.
+- Lesson completion resolved through `TenantCompletionRule`, including the
+  speaking-session and drill-score conditions.
+- In-app speaking classroom working for the tenant's own session types.
+- A written **customization gap list**: every place the English tenant wanted something
+  an aggregate could not express, with each entry resolved as an aggregate extension, a
+  named platform feature outside the boundary, or an accepted limitation.
+- The yoga tenant still green: cross-tenant isolation suite
+  (`Tenant_A_cannot_read_Tenant_B_data`, `Org_X_cannot_read_Org_Y_within_TenantA`)
+  passing as `learnstack_app`, and both sites still rendering.
+- `Core_Modules_HaveNo_DomainSpecific_Names` still green — no CEFR, English, yoga, or
+  track string anywhere in the LearnStack core source tree.
 
 ## Completion Criteria
 
-- A visitor can open the English tenant public site rendered entirely from tenant
+- A visitor opens the English tenant's public site and every page is composed from
   customization data.
-- A visitor can start a placement test.
-- The test produces a CEFR-level recommendation **through `TenantScoringRule`
-  evaluation** against the tenant's `TenantLevelTaxonomy` — no English-specific code
-  involved.
-- A tenant admin can enroll the visitor in the recommended course.
-- A learner can open a course and complete a lesson (with completion resolved via
-  `TenantCompletionRule`).
-- A learner can book or access a speaking session.
-- Instructor and learner can join the session inside the portal.
-- The second tenant runs the same code paths against its own customization data set
-  and passes the cross-tenant isolation tests.
-- **Zero domain-specific names** in LearnStack core source tree; architecture test
-  enforces.
+- A visitor starts a placement test; the test produces a CEFR-level recommendation
+  through `TenantScoringRule` evaluation against the tenant's own taxonomy, with no
+  English-specific code involved.
+- A tenant admin enrolls that visitor in the recommended course.
+- A learner opens a course, completes a lesson, and completion resolves through
+  `TenantCompletionRule` including its speaking-session condition.
+- A learner books and joins a speaking session; the instructor joins from the instructor
+  portal.
+- **All eight customization aggregates hold real English-tenant rows** and each one is
+  reachable and editable from the Studio editor.
+- The gap list is written and every entry is resolved — an extension shipped, a platform
+  feature named with its owning decision, or a limitation accepted in writing.
+- The yoga tenant is unchanged and unbroken, and the isolation suite is green.
+- Zero domain-specific names in LearnStack core; the architecture test enforces it.
 
 ## Risks
 
-- **Polluting core boundaries** to ship the English showcase faster. Architecture
-  test + code review are the discipline.
-- **Hardcoding CEFR concepts** into the generic Level model. Rejected — CEFR is a
-  `TenantLevelTaxonomy` instance, not a core concept.
-- **Adding an English-specific module** ("just for now"). Rejected — the answer is
-  always to extend a customization aggregate.
-- **Starting pronunciation and AI feedback** before the classroom workflow is stable.
-  Deferred unchanged.
-- **Letting landing-page polish outrank platform validation.** Both tenants exercising
-  the substrate is the actual MVP exit criterion.
+- **Polluting core boundaries to ship the showcase faster.** The pressure is highest
+  here, because the showcase is the first thing that looks like a product and the
+  temptation is to make one screen work rather than make the aggregate express it.
+  Architecture tests catch the naming; only review catches the intent.
+- **Hardcoding CEFR into the generic level model.** Rejected — CEFR is a
+  `TenantLevelTaxonomy` instance, not a core concept. The same screen must keep serving
+  the yoga studio's difficulty taxonomy without a branch.
+- **An English-specific module "just for now".** Rejected. The answer is always an
+  aggregate extension, and an extension that cannot express the need is a genuine
+  finding for the gap list rather than a reason to write a module.
+- **Smuggling a platform feature in as tenant data.** Session credit packs are the likely
+  candidate — they look like a custom field and behave like a ledger. If it holds a
+  balance or calls out of the process, it is not customization data
+  ([ADR-0018](../decisions/0018-tenant-driven-customization-model.md)).
+- **Letting landing-page polish outrank the gap list.** The showcase's value is the list
+  of things the customization surface could not do. A beautiful site with an empty gap
+  list means the phase was run as marketing, not as validation.
+- **Treating this phase as the genericity proof again.** It is not. If the yoga tenant
+  has quietly rotted since Phase 02d, that is a regression from an earlier phase, and it
+  is found here far too late.
+
+## Phase Exit Decision
+
+[Phase 11](phase-11-production-hardening.md) begins when the English tenant is a product
+a real school could operate — public site, placement test, enrollment, lesson delivery,
+speaking sessions and admin, all driven by data in all eight customization aggregates —
+**and** the customization gap list is closed, with every entry either shipped as an
+aggregate extension, named as a platform feature with an owning decision, or accepted in
+writing as a limitation. The yoga tenant must still be running unchanged on the same
+binary with the isolation suite green.
+
+If the gap list contains an unresolved entry that blocks the tenant from operating, the
+phase does not exit: a customization surface that a single real tenant cannot finish on
+is not ready to be hardened for production.
diff --git a/docs/roadmap/phase-11-production-hardening.md b/docs/roadmap/phase-11-production-hardening.md
index 49724f7..15360e2 100644
--- a/docs/roadmap/phase-11-production-hardening.md
+++ b/docs/roadmap/phase-11-production-hardening.md
@@ -2,12 +2,227 @@
 
 ## Goal
 
-Move LearnStack from MVP/demo quality to production-ready platform quality.
+Turn a working product into an operable one, and build the infrastructure that was
+deliberately not built earlier.
 
-This phase is not only about performance. It covers security, observability, backups, deployment, data integrity, live classroom reliability, and operational maturity.
+Phase 11 carries two distinct bodies of work that share one exit gate.
+
+The first is the classical hardening surface: security posture, reliability, backups,
+observability backends, performance budgets, live-classroom operations, deployment
+pipelines, and compliance readiness. That work has always belonged here.
+
+The second is new. [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) applies
+the one-way-door test to every infrastructure choice and routes the additive ones —
+Dapr, Kafka, a distributed cache, Vault, APISIX, signed licence keys, custom-domain TLS
+automation, `audit_log` partitioning — behind ports that ship in
+[Phase 02a Packet 5](phase-02a-kernel-tenancy.md), with their vendor adapters landing
+here against written triggers. Phase 11 is therefore not a checklist appended to a
+finished product. It is a real phase that builds real subsystems, and it must be planned
+as one.
+
+Two consequences follow, and both are stated plainly rather than implied:
+
+- **Until this phase ships, LearnStack supports `Development` and `SaaS` end to end.**
+  `Dedicated`, `SelfHostedOnline` and `SelfHostedAirGapped` are prepared seams in the
+  composition root — the enum values exist, the branches exist, the ports exist — but no
+  integration suite proves them. Phase 11 builds those suites, and until it does, the
+  product claim is two modes, not five.
+- **A trigger may fire early.** Each demand-gated item below carries an observable
+  condition, not a date. If one fires during an earlier phase, the item moves to that
+  phase and ADR-0035's table is amended. Nothing here is waiting on the calendar.
 
 ## Scope
 
+### Demand-gated building blocks
+
+Most items below have a port in `LearnStack.SharedKernel` and a default implementation
+from [Phase 02a Packet 5](phase-02a-kernel-tenancy.md), with a trigger condition recorded
+in [ADR-0035 § The gated set](../decisions/0035-demand-gated-infrastructure.md), which is
+the authority for those rows. Three items are gated work with no port and no row there —
+the `audit_log` partition conversion (a migration, not a swap), the air-gapped OTLP file
+target, and the deployment-mode integration suites — and their triggers are stated inline
+below. `IVideoTranscoder`'s default ships in [Phase 04](phase-04-cms-media-pages.md)
+rather than Packet 5. What follows is the work each one turns into once its trigger
+fires.
+
+**Dapr sidecar, pub/sub, state and secret components** — *trigger: a second process must
+consume an integration event.* `DaprEventBus` behind `IEventBus`, the component YAML per
+topic under the `learnstack.{module}.{aggregate}` convention, sidecar injection
+annotations for the deployment target, and the Dapr health and readiness surface wired
+into the platform's own probes. The `InProcessEventBus` shipped in Packet 5 keeps its
+place as the `Development` transport, and keeps the same `IIntegrationEventHandler<T>`
+interface, the same `IInboxGuard` and the same tenant-context restoration — which is
+precisely what makes this swap a composition-root change rather than a refactor. See
+[ADR-0014](../decisions/0014-adopt-dapr.md) and
+[29-dapr-integration.md](../architecture/29-dapr-integration.md).
+
+**Kafka** — *trigger: event volume, replay or ordering across processes is required.*
+Broker topology, per-topic partition count and the partition key that guarantees
+per-aggregate ordering, retention policy, consumer-group naming, and the subscriber-side
+dead-letter destination. Kafka sits behind `IEventBus` through Dapr; no module ever holds
+a producer. See [15-event-and-outbox.md](../architecture/15-event-and-outbox.md).
+
+**Valkey-backed distributed cache behind `ICacheService`** — *trigger: more than one
+application instance runs concurrently.* The `InMemoryCacheService` from Packet 5 is
+correct for exactly one process and silently wrong for two, so this adapter lands the
+moment a second replica does. Includes the L1/L2 layering used by the entitlement read
+path, the cross-instance invalidation topic, and — if the generation-key redesign from
+Packet 5 was chosen over removal — the generation counters that replace
+`RemoveByPrefixAsync`. See [ADR-0030](../decisions/0030-redis-compatible-store-valkey.md).
+
+**Vault behind `ISecretProvider`** — *trigger: secrets must rotate without a redeploy, or
+a non-dev deployment exists.* KV mount layout, per-environment policies, the application
+role and its lease renewal, and the rotation cadence below under **Security**.
+`ConfigurationSecretProvider` remains the `Development` implementation. No module imports a
+Vault client; the swap happens once at the composition root.
+
+**APISIX edge gateway** — *trigger: a non-dev deployment needs edge rate limiting, host
+routing or JWT pre-validation.* Standalone file-driven configuration promoted to a
+reviewed production artefact: the route allow-list, plugin ordering, the mTLS guard on
+`/api/internal/*`, the CORS and rate-limit plugins, and the route-priority ordering that
+keeps a public route from falling through to the authenticated catch-all. Until this
+lands, the equivalent controls run as ASP.NET middleware in the application itself. See
+[ADR-0015](../decisions/0015-api-gateway-apisix.md) and
+[30-api-gateway.md](../architecture/30-api-gateway.md).
+
+**`SignedLicenseKeyEntitlementProvider` hardening** — *trigger: a Self-Hosted contract is
+signed.* The provider skeleton — `.lic` parsing, `kid` resolution, RS256
+verification, payload-schema validation, and serving lookups from the embedded
+projection — lands with the Hub repository's `P02c-6` as a coordinated pull request.
+The provider is not this phase's deliverable; what follows is what that skeleton is
+missing:
+
+- Signing-key rotation procedure, including how a key issued under the previous
+  generation stays verifiable through its remaining validity.
+- Signed revocation-list distribution and the offline verification path for an
+  air-gapped installation that cannot fetch one.
+- `SIGHUP` hot-reload runbook — how an operator installs a renewed key without dropping
+  in-flight requests, and what the process does when the new key fails verification.
+- Multi-day grace-period load testing: the 30-day grace window from
+  [ADR-0020](../decisions/0020-triple-deployment-hybrid-license.md) exercised end to end
+  with the Hub unreachable for the whole window, not simulated with a clock jump on an
+  idle instance.
+
+See [26-hybrid-license-model.md](../architecture/26-hybrid-license-model.md).
+
+**Custom-domain TLS automation** — *trigger: a tenant needs its own domain in
+production.* Certificate issuance, renewal and revocation, the ACME client and DNS
+provider adapters, the gateway-side certificate installation path, and the renewal job at
+scale. The `PUT /api/internal/tenants/{id}/host-mappings` endpoint and its LearnStack-side
+handler are **not** in this phase — they ship in
+[Phase 02c](phase-02c-hub-foundation.md), because host resolution is a one-way door while
+the automation that populates the mapping is additive
+([27-custom-domain-tls.md § 11](../architecture/27-custom-domain-tls.md)). Certificate
+material
+moves between the Hub-owned and LearnStack-owned secret stores by secret-store
+replication and is referenced from the host-mapping payload by path, never by value. Host
+resolution itself never calls the Hub in any deployment mode: `IHostToTenantResolver`
+reads `platform_host_to_tenant` and nothing else, and that is already true from
+[Phase 02a Packet 7](phase-02a-kernel-tenancy.md). See
+[ADR-0022](../decisions/0022-custom-domain-tls.md) and
+[27-custom-domain-tls.md](../architecture/27-custom-domain-tls.md).
+
+**`audit_log` monthly partitioning and the retention job** — *trigger: measured
+`audit_log` growth justifies partition maintenance.*
+[Phase 02a Packet 9](phase-02a-kernel-tenancy.md) ships `audit_log` as a single plain
+table with the corrected composite primary key `(id, timestamp)` from
+[ADR-0033](../decisions/0033-audit-durability-model.md). This phase converts it to a
+range-partitioned table and lands the two Hangfire jobs
+[ADR-0028](../decisions/0028-audit-log-partition-management.md) specifies:
+`learnstack:audit:partition-management` (two-month create-ahead horizon, platform-maximum
+drop policy) and `learnstack:audit:retention-purge` (per-tenant, per-class row deletes
+inside still-attached partitions), both on a daily cadence, plus the
+`Partition_Manager_Job_Is_Registered_AtStartup` architecture test.
+**ADR-0028 stands as a decision** — Hangfire over `pg_partman`, monthly range partitions,
+the create-ahead and drop policies — and nothing in it is reopened. Only its schedule
+moved: audit *correctness* is a Phase 02a concern, audit *scale* is this phase's.
+
+**Air-gapped OTLP file target** — *trigger: a `SelfHostedAirGapped` deployment exists.*
+Carried out of [Phase 02a Packet 3](phase-02a-kernel-tenancy.md), which left the
+telemetry path for that mode as a documented seam with no network exporter wired. This
+phase picks the file-exporter package, points Serilog and the OTel SDK at
+`/var/learnstack/otel/`, defines the operational controls around that directory, and adds
+the test asserting no network telemetry exporter is ever wired when `DeploymentMode` is
+`SelfHostedAirGapped`. Specified in full under [Observability](#observability) below.
+
+**`Dedicated` / `SelfHostedOnline` / `SelfHostedAirGapped` integration suites** —
+*trigger: a contract or a deployment exists for the mode.* These three `DeploymentMode`
+values are prepared seams until this phase builds their suites. **Until then, LearnStack
+supports `Development` and `SaaS` end to end and nothing else.** A suite here means: the
+composition root resolves every port to the implementation that mode requires, a full
+user journey runs against that resolution in CI, and the mode's distinctive constraints
+are asserted rather than assumed — no network egress for `SelfHostedAirGapped`, a
+separate database and Keycloak realm per customer for `Dedicated`, licence-key
+entitlement rather than Hub entitlement for both Self-Hosted variants. The composition
+root keeps branching once on `DeploymentMode`; modules never read it, and
+`Modules_Do_Not_Reference_DeploymentMode` keeps holding.
+
+**Managed video transcoding behind `IVideoTranscoder`** — *trigger: in-house transcode
+backlog or per-minute cost exceeds the managed alternative.*
+[Phase 04](phase-04-cms-media-pages.md) ships an ffmpeg-backed worker as the single
+registered implementation of `IVideoTranscoder`. Mux, AWS MediaConvert and Cloudflare
+Stream sit behind the same port; adopting one is a composition-root change plus the
+provider's credential wiring, its webhook receiver for completion callbacks, and a
+cost-comparison record against the in-house baseline. See
+[16-media-pipeline.md](../architecture/16-media-pipeline.md).
+
+### Resource fairness
+
+No earlier phase owns resource fairness.
+[25-deployment-models.md § 2](../architecture/25-deployment-models.md#2-saas-mode) draws
+the correctness / contention split and states why Row Level Security cannot close the
+second half: RLS is a visibility predicate, and a filtered query consumes exactly as much
+of the database as an unfiltered one. A single tenant running a pathological query
+degrades every other tenant on the instance while all four isolation layers stay green.
+That document names the gap; this phase closes it.
+
+Resource fairness is a separate mechanism and this phase builds it.
+
+- **`statement_timeout`.** A ceiling set per database role, not globally: a short one on
+  `learnstack_app` (the request path, including anonymous public page renders), a longer
+  one on `learnstack_platform` for administrative and reporting work, and an explicit
+  exemption path for the migration role. A cancelled statement surfaces as an
+  `InfrastructureException` mapped to RFC 7807 Problem Details with the correlation id —
+  not as an unhandled 500. See
+  [Database Standards § Connection Management](../standards/05-database.md).
+- **Per-tenant connection-pool partitioning.** One shared Npgsql pool means one tenant's
+  slow queries can hold every connection in it. The pool is partitioned so that no single
+  tenant occupies more than a bounded share, with the remainder reserved so that a
+  saturated tenant cannot make the platform unreachable. The partitioning must preserve
+  PgBouncer **transaction**-pooling mode, which is a hard prerequisite for RLS —
+  `SET LOCAL app.tenant_id` is transaction-scoped, and statement-mode pooling would reset
+  it mid-transaction. `Db_Connection_String_Is_TransactionPooled` stays green through this
+  work.
+- **Query cost ceiling.** A planner-cost threshold above which a query is rejected before
+  execution rather than cancelled after it has already consumed resources. This applies
+  first and hardest to queries the platform did not write — see the `data_source` limit
+  below — and second to any endpoint that accepts a caller-supplied filter or sort.
+- **Hangfire queue fairness and per-tenant concurrency limits.** Every job payload
+  already carries a tenant id (`Hangfire_Job_Payloads_Include_TenantId`), which is what
+  makes fairness implementable. A tenant that enqueues fifty thousand notification jobs
+  must not delay every other tenant's jobs behind them. The work: a per-tenant concurrency
+  cap, a fair-share dispatch order across tenants rather than strict FIFO across the whole
+  queue, a bounded per-tenant queue depth with a defined rejection behaviour when it is
+  exceeded, and separate queues for latency-sensitive and bulk work so a bulk backlog
+  cannot starve an interactive job.
+- **A limit on the `data_source` query surface.**
+  [ADR-0018](../decisions/0018-tenant-driven-customization-model.md) grants tenants a
+  query surface inside `TenantPageBlock.data_source` — a content type, a filter, a limit
+  and an ordering — and that surface currently has no ceiling. A tenant author can request
+  `order_by: random` with a large limit over the tenant's whole content set on a page that
+  every anonymous visitor loads. The bounds this phase sets: a maximum `limit` per query, a
+  maximum number of `data_source` queries a single page render may issue, a requirement
+  that filter fields be indexed, an explicit cost treatment for random ordering, and a
+  render-time budget after which the block degrades to a cached or empty result rather
+  than holding the request. This is the tenant-facing half of the query cost ceiling, and
+  it sits inside the genericity boundary
+  ([ADR-0018 Amendment, 2026-08-08](../decisions/0018-tenant-driven-customization-model.md)):
+  the tenant declares *what* to fetch, the platform decides *how much*.
+
+Edge rate limiting at APISIX and the plan-level `LimitKeys.MaxApiRequestsPerHour` cap are
+the other two halves of this problem — they bound request *arrival*. This subsection
+bounds request *cost* once a request is inside. Neither substitutes for the other.
+
 ### Security
 
 - Secure headers (HSTS, CSP with nonces, COOP/CORP, Permissions-Policy).
@@ -22,68 +237,95 @@ This phase is not only about performance. It covers security, observability, bac
   these; configuration is reviewed in Keycloak.
 - Secret management: Vault rotation cadence (90 days for provider keys, yearly for
   Hub HMAC shared secret + mTLS client certs), no secrets in repo, no secrets in
-  env files committed.
-- Audit log coverage review against the per-module matrices.
+  env files committed. The Vault adapter itself lands in this phase — see
+  **Demand-gated building blocks** above.
+- Audit log coverage review against the per-module matrices, including confirmation that
+  no tenant `AuditConfig` override has narrowed baseline MUST coverage and that a
+  config-store failure still fails closed
+  ([ADR-0033](../decisions/0033-audit-durability-model.md)).
 - Tenant + **organization** isolation regression suite (expansion of the Phase 02a
-  CI gate to cover every module from Phases 04–09).
+  CI gate to cover every module from Phases 04–09). The suite runs as `learnstack_app`,
+  the non-owning application role — a suite that runs as the table owner passes even when
+  every policy is inert
+  ([ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md)).
 - File upload security (MIME sniff, size limits, AV scan hook, key scoping).
 - Live classroom token expiration and permission review.
 - Provider webhook signature verification.
 - **Hub contract surface review**: mTLS + signed JWT + HMAC pen-test, replay-window
-  validation, four-endpoint surface confirmation (no creep).
-- **APISIX standalone config review**: route allow-list, plugin order, mTLS guard on
-  `/api/internal/*`.
+  validation on `jti`, and confirmation against the enumerated endpoint set in
+  [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md). The property under
+  review is not a count. It is the two invariants: the Hub stores no tenant content, and
+  every LearnStack↔Hub crossing goes through `IEntitlementProvider`, `IUsageReporter` or
+  `IHubTenantSync` — asserted by `Hub_NeverStores_TenantData` and
+  `Hub_Client_Referenced_Only_By_Named_Adapters`.
+- **APISIX standalone config review**: route allow-list, plugin order, route-priority
+  ordering, mTLS guard on `/api/internal/*`.
 
 ### Reliability
 
-- Health checks (LearnStack core + Hub).
-- Readiness / liveness endpoints.
+- Health checks and readiness / liveness endpoints.
 - Background job retry policy.
-- Dead-letter handling (outbox DLQ + Hangfire DLQ).
-- Outbox dispatcher reliability under multi-pod load.
+- Dead-letter handling (outbox DLQ + Hangfire DLQ), including the subscriber-side
+  dead-letter destination for events that exhaust their retries.
+- Outbox dispatcher reliability under multi-pod load — the claim mechanism must hold
+  across the whole batch or use a lease column, so two dispatchers cannot both claim the
+  same rows.
 - Idempotent webhook handling.
 - Graceful shutdown.
 - Live classroom provider failure handling.
 - Recording job failure handling.
-- **Hub outage tolerance** — LearnStack core continues to operate on the cached
-  entitlement projection for at least 24h during a Hub outage; the 15-min TTL is the
-  refresh cadence, the cached projection is the graceful-degradation buffer.
-- **Self-Hosted phone-home failure tolerance** — 30-day grace period from
-  ADR-0020 validated end-to-end.
-- **Cross-instance L1 cache invalidation** via `learnstack.cache.invalidation` Dapr
-  topic tested under failure (Kafka partition outage).
+- **Hub outage tolerance** — LearnStack continues to operate through a Hub outage on the
+  entitlement read path fixed by
+  [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md): L1 in-process cache →
+  L2 distributed cache → `platform_entitlement_cache` (durable, carrying `valid_until`
+  and `grace_until`) → Hub. The distributed-cache TTL is a refresh cadence; the durable
+  projection and its grace window are the degradation buffer, and a cold cache during an
+  outage falls through to the projection rather than throwing out of a feature-flag
+  check. Each feature-key class declares fail-open or fail-closed explicitly.
+- **Self-Hosted phone-home failure tolerance** — the 30-day grace period from
+  [ADR-0020](../decisions/0020-triple-deployment-hybrid-license.md) validated end to end
+  as part of licence-key hardening above.
+- **Cross-instance L1 cache invalidation** via the `learnstack.cache.invalidation` topic,
+  tested under failure (broker partition outage). This test becomes meaningful only once
+  the Dapr and Valkey adapters land in this phase; before that there is one instance and
+  one cache.
 
 ### Observability
 
 - Structured logs.
-- Correlation id.
-- OpenTelemetry traces (LearnStack core + Hub share the same backend).
+- Correlation id end to end.
+- OpenTelemetry traces.
 - Metrics.
 - Error tracking.
-- Slow query logging.
+- Slow query logging — the diagnostic counterpart to the `statement_timeout` ceiling
+  under **Resource fairness**.
 - Background job monitoring.
 - Live classroom connection quality metrics.
 - Provider usage and cost metrics.
 - **Dapr-component health dashboards** (`dapr_component_pubsub_*`,
   `dapr_component_state_*`, `dapr_component_secretstores_*`) alongside LearnStack
-  metrics.
+  metrics, once the Dapr adapter lands.
 - **APISIX gateway metrics** (route hit rate, plugin latency, mTLS handshake
   failures).
 - **Hub-side metrics** (entitlement projection push lag, license-verify success
-  rate, custom-domain pipeline state).
+  rate, custom-domain pipeline state), consumed from the same backend the Hub exports to.
 - **Outbox lag** (`learnstack_outbox_pending_count`) alerts above threshold per
   module.
+- **Per-tenant resource metrics** — statement duration percentiles, connection-pool
+  occupancy, job queue depth and `data_source` render cost, all keyed by tenant. Without
+  these, the fairness controls above are untunable: an operator cannot set a ceiling they
+  cannot observe being approached.
 - **Air-gapped OTLP file target** — wire the `SelfHostedAirGapped` telemetry
-  path (Phase 02a Packet 3 left it as a documented seam) to a local file
-  exporter under `/var/learnstack/otel/`, the contract target in
+  path ([Phase 02a Packet 3](phase-02a-kernel-tenancy.md) left it as a documented seam)
+  to a local file exporter under `/var/learnstack/otel/`, the contract target in
   [20-infrastructure-stack.md § Composition Root and Deployment Mode](../standards/20-infrastructure-stack.md).
   Packet 3 already guarantees no network egress in air-gapped mode (the OTLP
-  network exporter is not wired there); this packet picks the concrete
+  network exporter is not wired there); this phase picks the concrete
   file-exporter package and points Serilog + the OTel SDK at the directory so
   air-gapped traces / metrics / logs land on disk for off-network shipping.
-  This packet also defines the operational controls around that directory —
+  It also defines the operational controls around that directory —
   rotation cadence and size/age retention limits, owning user/group and a
-  restrictive permission mode, and the write-failure behavior when the
+  restrictive permission mode, and the write-failure behaviour when the
   volume fills (best-effort, logged, never blocking the request path, per
   the pattern `LocalFileErrorTracker` already follows for
   `/var/learnstack/errors/`) — and adds a test asserting no network
@@ -98,13 +340,19 @@ This phase is not only about performance. It covers security, observability, bac
 - CDN strategy for media and public assets.
 - Pagination enforcement.
 - Search indexing optimization.
-- Public page rendering performance.
+- Public page rendering performance, including the customization runtime's cost model —
+  schema validation timing, block resolution caching, and the N+1 risk in a page composed
+  of many `data_source` blocks.
 - Classroom bandwidth profile testing.
 - Recording and egress cost testing.
+- The load tests required by [15-performance.md § Load Testing](../standards/15-performance.md).
 
 ### Live Classroom Operations
 
-LearnStack's classroom media stack is **self-hosted LiveKit OSS** ([ADR 0005](../decisions/0005-live-classroom-media-stack.md)). Phase 11 validates the self-hosted deployment for production and documents the Cloud-fallback path behind the same `ILiveClassProvider`.
+LearnStack's classroom media stack is **self-hosted LiveKit OSS**
+([ADR-0005](../decisions/0005-live-classroom-media-stack.md)). Phase 11 validates the
+self-hosted deployment for production and documents the Cloud-fallback path behind the
+same `ILiveClassProvider`.
 
 - Validate the self-hosted LiveKit deployment under expected MVP load.
 - Define the first production region strategy.
@@ -118,71 +366,176 @@ LearnStack's classroom media stack is **self-hosted LiveKit OSS** ([ADR 0005](..
 ### Data Operations
 
 - Backup strategy.
-- Restore drills.
-- Migration strategy.
+- Restore drills — a drill counts only when a backup is restored to a fresh instance and
+  the integration suite passes against it.
+- Migration strategy, including the two-step plan every destructive change requires.
 - Seed data strategy.
 - Data retention policy.
 - Soft delete and purge jobs.
 - Recording retention and purge jobs.
+- `audit_log` retention and partition lifecycle — see **Demand-gated building blocks**
+  above; the jobs and their cadence are specified by
+  [ADR-0028](../decisions/0028-audit-log-partition-management.md).
 
 ### Deployment
 
-- Production Dockerfiles for both LearnStack core and Hub.
-- Environment configuration for the three production deployment modes
-  (`SaaS`, `Dedicated`, `SelfHosted`) per
-  [ADR-0020](../decisions/0020-triple-deployment-hybrid-license.md).
-- CI / CD pipeline (separate pipelines for `learnstack` and `learnstack-hub` repos).
-- Staging environment for both.
-- Production environment for both.
-- Rollback strategy (image-by-sha for both repos).
-- Release checklist that covers the four-endpoint contract surface (any change to
-  the surface is ADR-gated and ships in a coordinated cross-repo release).
+- Production Dockerfile and image pipeline for LearnStack.
+- Environment configuration for every `DeploymentMode` value, per
+  [ADR-0020](../decisions/0020-triple-deployment-hybrid-license.md), with the integration
+  suites described under **Demand-gated building blocks** proving each one.
+- CI / CD pipeline.
+- Staging environment.
+- Production environment.
+- Rollback strategy (image-by-sha).
+- **Release-tag scheme.** [ADR-0026](../decisions/README.md) is reserved for this phase
+  and is currently the open question behind
+  [14-git-workflow.md § Tagging and Releases](../standards/14-git-workflow.md), which
+  today says "`vYYYY.MM.DD.<n>` or `vMAJOR.MINOR.PATCH`. Specifically: ADR-pending". The
+  decision must reconcile a continuously-deployed SaaS instance with a Self-Hosted
+  release cadence where a customer runs a pinned version for months, and it must be
+  **Accepted before this phase exits** — a Self-Hosted distribution without a stated
+  version scheme cannot be supported.
+- Release checklist covering the Hub contract surface: any change to the endpoint set in
+  [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md) is ADR-gated and ships
+  as a coordinated cross-repository release, with the `entitlement-v1.schema.json`
+  snapshot test green in both repositories.
 - **Self-Hosted distribution** — packaged installer (Docker Compose bundle +
-  Kubernetes Helm chart) with a documented license-key flow.
+  Kubernetes Helm chart) with a documented licence-key flow.
+
+> The Hub's own production pipeline, staging and production environments, and release
+> process live in the `learnstack-hub` repository's roadmap. This phase owns only
+> LearnStack's side and the coordination points between them.
 
 ### Compliance Readiness
 
 - GDPR/KVKK data handling review.
-- User data export placeholder.
-- User deletion/anonymization strategy.
-- Consent tracking placeholder.
-- Terms/privacy content support.
+- User data export.
+- User deletion / anonymization strategy, honouring the global-`User`-versus-tenant-owned-profile
+  boundary established in [Phase 03](phase-03-identity-admin.md).
+- Consent tracking.
+- Terms / privacy content support.
 - Classroom recording consent and retention review.
 
 ## Deliverables
 
-- Production deployment pipeline.
-- Staging environment.
-- Security baseline.
-- Observability baseline.
-- Backup/restore process.
-- Performance baseline.
+- Dapr, Kafka, Valkey, Vault and APISIX adapters registered behind their existing ports,
+  with the `DeploymentMode` composition root resolving each per mode.
+- Integration suites for `Dedicated`, `SelfHostedOnline` and `SelfHostedAirGapped`, and
+  the support claim updated from two modes to five.
+- `audit_log` converted to monthly range partitions, with the partition-management and
+  retention-purge jobs registered and monitored.
+- Licence-key operational surround: rotation procedure, revocation-list distribution,
+  hot-reload runbook, grace-period load-test results.
+- Custom-domain TLS automation — ACME client, DNS provider adapters, renewal job, and
+  the edge certificate installation path — with certificate material travelling by
+  secret-store replication rather than by payload. The `host-mappings` endpoint itself
+  shipped in [Phase 02c](phase-02c-hub-foundation.md).
+- Managed-transcoder adapter behind `IVideoTranscoder`, or a recorded decision that its
+  trigger has not fired.
+- Air-gapped telemetry file target with its operational controls and its no-egress test.
+- Resource-fairness controls: role-scoped `statement_timeout`, per-tenant pool
+  partitioning, query cost ceiling, Hangfire fair-share dispatch with per-tenant
+  concurrency caps, and bounded `data_source` queries.
+- Production deployment pipeline, staging environment, rollback path.
+- Security baseline and the expanded tenant + organization isolation regression suite.
+- Observability baseline: dashboards, alerts, and per-tenant resource metrics.
+- Backup and restore process with a completed drill.
+- Performance baseline against the budgets in
+  [15-performance.md](../standards/15-performance.md).
 - Live classroom operations checklist.
-- Release checklist.
+- Release checklist and operational runbooks under `docs/runbooks/`.
+- ADR-0026 Accepted, and
+  [14-git-workflow.md § Tagging and Releases](../standards/14-git-workflow.md) updated to
+  cite it instead of saying "ADR-pending".
 
 ## Completion Criteria
 
-- Full user journey works in staging for all three deployment modes (`SaaS`,
-  `Dedicated`, `SelfHosted`).
-- Production deployment is repeatable and documented for LearnStack core **and**
-  Hub.
-- Backup restore test passes (LearnStack core + Hub independently).
-- Tenant + organization isolation regression tests exist and are not skippable.
-- Critical flows have sufficient logging and tracing including the Hub contract
-  surface.
-- Public site performance is acceptable.
+- Every `DeploymentMode` value has an integration suite that runs a full user journey in
+  CI, and the documented support claim matches what those suites prove.
+- A second application instance can be started without a correctness regression:
+  distributed cache, cross-instance invalidation, and outbox dispatch under two
+  dispatchers all behave.
+- An integration event crosses a process boundary through Dapr and is consumed exactly
+  once by a subscriber in another process, with tenant context restored on the consumer
+  side.
+- No module references a Dapr, Kafka, Valkey or Vault client type.
+  `Modules_Do_Not_Reference_DeploymentMode` is green.
+- Production deployment is repeatable and documented.
+- Backup restore test passes on a fresh instance.
+- Tenant + organization isolation regression tests exist, are not skippable, and run as
+  `learnstack_app`.
+- **A single tenant cannot degrade another tenant's request latency beyond a stated
+  bound.** Demonstrated, not asserted: a load test that runs a pathological query pattern
+  and a large job burst on tenant A while measuring tenant B's p95 on the public read
+  path.
+- `audit_log` partitions exist for the current and next two months, the retention purge
+  runs on schedule, and dropping a partition never removes a row still inside its
+  retention class.
+- No network telemetry exporter is wired under `SelfHostedAirGapped`, asserted by test
+  rather than by review.
+- Critical flows have sufficient logging and tracing, including the Hub contract surface.
+- Public site performance meets the stated budgets, with the customization runtime's cost
+  measured on a page composed of multiple `data_source` blocks.
 - File uploads are safely constrained.
-- In-app classroom flows are load-tested for the expected MVP usage.
-- Live classroom cost monitoring exists before production launch.
-- Hub outage tolerance proven (24h cached projection survival).
-- Self-Hosted 30-day grace period proven end-to-end.
+- In-app classroom flows are load-tested for the expected MVP usage, and classroom cost
+  monitoring exists before production launch.
+- Hub outage tolerance proven: entitlement resolution survives a Hub outage on a cold
+  cache by falling through to `platform_entitlement_cache` and honouring `grace_until`.
+- Self-Hosted 30-day grace period proven end to end on a running instance.
+- ADR-0026 is Accepted.
 
 ## Risks
 
-- Underestimating operational debt when moving from MVP to production.
-- Testing tenant isolation only manually.
-- Taking backups without testing restore.
-- Launching production without observability.
-- Missing idempotency in critical payment or webhook flows.
-- Launching in-app classes without bandwidth, region, TURN, recording, and cost controls.
+- **The phase is treated as a checklist.** It is the largest phase in the roadmap by
+  volume of new subsystems. Planning it as a hardening pass at the end of a release
+  guarantees it gets compressed, and the compressed part will be whichever item has no
+  customer waiting on it — usually the fairness controls and the air-gapped mode.
+- **The demand-gated adapters are written against an unfamiliar codebase.** They land
+  after every consumer exists rather than before. The ports bound this cost, but an
+  adapter written by someone who was not there when the port was designed will find
+  assumptions the port never wrote down.
+- **A trigger fires early and nobody notices.** Adding a second replica is a routine
+  operational act that silently invalidates `InMemoryCacheService`. The triggers must be
+  written into the operational runbooks, not only into
+  [ADR-0035](../decisions/0035-demand-gated-infrastructure.md), so that the person
+  scaling the deployment is the person who reads them.
+- **Fairness controls are set once and never tuned.** A `statement_timeout` chosen
+  without production percentile data is either useless or an outage. The per-tenant
+  metrics are a prerequisite for the ceilings, not a companion to them.
+- **Tenant isolation tested only manually,** or tested as the owning role where every
+  policy is inert.
+- **Backups taken without testing restore.**
+- **Production launched without observability**, or with dashboards that show platform
+  aggregates and no per-tenant breakdown — the shape that hides exactly the problem this
+  phase exists to prevent.
+- **Missing idempotency in payment or webhook flows.**
+- **In-app classes launched without bandwidth, region, TURN, recording and cost
+  controls.**
+- **The support claim outruns the suites.** Announcing five deployment modes before their
+  integration suites are green reintroduces the problem
+  [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) was written to remove.
+
+## Phase Exit Decision
+
+LearnStack is production-ready when all of the following hold:
+
+- Every `DeploymentMode` value that the product claims to support has a green integration
+  suite, and any value without one has been publicly reclassified as unsupported.
+- Every demand-gated building block whose trigger has fired has shipped its adapter;
+  every block whose trigger has not fired still has a working default, a named phase and
+  a written trigger.
+- A load test shows one tenant's worst-case behaviour leaving another tenant's p95 inside
+  a stated bound, on both the request path and the job queue.
+- A backup has been restored to a fresh instance and the integration suite passed against
+  it, within the last quarter.
+- The isolation regression suite covers every module shipped in Phases 04–09, runs as
+  `learnstack_app`, and is not skippable.
+- ADR-0026 is Accepted and the release process follows it.
+- The operational runbooks under `docs/runbooks/` cover the incidents this phase's
+  subsystems can produce: Hub outage, licence expiry, partition-management failure,
+  certificate renewal failure, broker outage, and a tenant saturating a shared resource.
 
+Anything not true at this gate is either finished before launch or removed from the
+support claim. There is no third option — a mode or capability that is documented,
+untested and unsupported is the failure mode this roadmap's sequencing principle exists
+to prevent.
diff --git a/docs/roadmap/phase-12-hub-marketplace.md b/docs/roadmap/phase-12-hub-marketplace.md
index 2358640..d0407e1 100644
--- a/docs/roadmap/phase-12-hub-marketplace.md
+++ b/docs/roadmap/phase-12-hub-marketplace.md
@@ -1,91 +1,69 @@
-# Phase 12: Hub Marketplace (optional, post-MVP)
+# Phase 12: Hub Marketplace (pointer, optional, post-MVP)
 
-## Goal
-
-Open a **marketplace** on the `learnstack-hub` side where tenants can publish and
-consume **reusable tenant customization data** — content types, page-block schemas,
-lesson-item types, level taxonomies, scoring rules, completion rules, custom field
-defs, and template libraries. A yoga studio that has authored a particularly good
-`AsanaPose` content type can publish it; a new yoga tenant can install it on
-provisioning and skip the design step.
-
-This phase is **strictly post-MVP** and **strictly optional**. The platform works
-fully without it. If the marketplace never ships, no LearnStack feature breaks. The
-phase exists in the roadmap because it is the natural next-step opportunity once the
-tenant-customization-as-data model proves itself in Phase 10.
-
-Decisions referenced:
-
-- [ADR-0018 Tenant-Driven Customization Model](../decisions/0018-tenant-driven-customization-model.md)
-- [ADR-0019 LearnStack Hub](../decisions/0019-learnstack-hub.md)
-
-## Scope (Tentative)
-
-### Marketplace Aggregates (Hub-side)
-
-- `MarketplaceListing` — a publishable bundle (name, description, version, author,
-  license, content).
-- `MarketplaceListingVersion` — semver-versioned snapshot.
-- `MarketplaceInstall` — record of a tenant installing a listing version.
-- `MarketplaceReview` — optional tenant feedback (rating + free text).
-
-### Bundle Shape
-
-A listing is a JSON document carrying:
+> **Pointer document.** The authoritative plan for the marketplace lives in the
+> **`learnstack-hub`** repository at `docs/roadmap/hub-marketplace.md`. The listing
+> aggregates, bundle format, sandbox validator, publisher and consumer flows, and the
+> operator review queue are Hub concerns and are described there. This file records why
+> the slot exists, where the LearnStack boundary falls, and what would start the work.
 
-- One or more `TenantContentType` JSON Schemas.
-- Zero or more `TenantPageBlock` definitions + their renderer-key references.
-- Zero or more `TenantLessonItemType` definitions + their player-key references.
-- Zero or more `TenantLevelTaxonomy` definitions.
-- Zero or more `TenantScoringRule` / `TenantCompletionRule` DSL expressions.
-- Zero or more `TenantCustomFieldDef` definitions.
-- Zero or more `TenantTemplateLibrary` templates.
-- Manifest with required LearnStack version, required feature keys, sample data.
-
-### Publisher Flow
-
-- A tenant admin exports a subset of their customization data as a draft listing.
-- Sandbox validation runs the bundle against a clean tenant fixture; failures block
-  publish.
-- Operator review (Hub-side) for compliance / content sanity before public listing.
-- Approved listings appear in the marketplace.
-
-### Consumer Flow
-
-- A tenant admin browses the marketplace from Studio.
-- "Install" triggers a Hub-side flow that pushes the bundle into the tenant's
-  customization aggregates via a dedicated endpoint (new ADR required — adds an
-  endpoint to the Hub contract surface).
-- Conflicts (same `key` already exists for the tenant) prompt for rename or skip.
-
-### Revenue / Pricing (Out of Scope for Initial)
-
-- The first marketplace iteration is **free-only** — no listing fees, no
-  per-install pricing. Pricing models are deferred to a follow-on phase if and when
-  the marketplace gains traction.
-
-## Deliverables (Tentative)
-
-- Hub-side marketplace aggregates + schema.
-- Sandbox validator that boots a clean LearnStack tenant fixture against a candidate
-  bundle.
-- Operator review queue + approval flow.
-- Tenant-facing marketplace browser inside Studio (LearnStack-core change).
-- New Hub endpoint for bundle install — requires a new ADR (the four-endpoint surface
-  is closed by default; this is one of the few candidate fifth endpoints).
-
-## Open Questions
+## Goal
 
-- Versioning semantics when a tenant has customized an installed bundle locally.
-- Revenue split / pricing model for paid listings (deferred).
-- Cross-tenant data leakage prevention in published sample data (the publisher's
-  real data must never escape; only schemas + DSL expressions + sample fixtures
-  travel).
-- Operator review burden at scale.
+Let tenants publish and install **reusable tenant customization data** — content types,
+page-block schemas, lesson-item types, level taxonomies, scoring and completion rules,
+custom field definitions, template libraries. A yoga studio that has authored a good
+pose content type publishes it; a new yoga tenant installs it at provisioning and skips
+the design step.
+
+The marketplace is the natural commercial consequence of
+[ADR-0018](../decisions/0018-tenant-driven-customization-model.md): if a tenant's
+product really is data, then that data is transferable. It only sells anything the
+customization model can express — the [ADR-0018 genericity
+boundary](../decisions/0018-tenant-driven-customization-model.md) applies unchanged, so
+a listing never carries executable capability, only shape, presentation and pure rules.
+
+## Standing
+
+**Strictly optional and strictly post-MVP.** The platform is complete without it; if the
+marketplace never ships, no LearnStack feature breaks. Nothing on the roadmap spine
+depends on this phase.
+
+## Scope on the LearnStack side
+
+- A marketplace browser and an install action inside Studio, both reading through a
+  named Hub adapter.
+- An install path that writes into the tenant's own customization aggregates, with
+  conflict handling when a `key` already exists for that tenant.
+- A new Hub endpoint for bundle install. That requires its own ADR — not because the
+  contract surface has a fixed size, but because it is a cross-repository contract that
+  both repositories must agree on
+  ([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)).
+- **Whether a published bundle counts as tenant content under ADR-0034's first
+  invariant is unresolved, and it blocks the track.** A listing is authored by a
+  tenant, describes that tenant's product, and may carry sample fixtures drawn from
+  that tenant's data. The Hub repository's `hub-marketplace.md` § The unresolved
+  collision with ADR-0034 states the three candidate answers — metadata-in-Hub with
+  the body outside, a separate service, or a narrow amendment — and requires an
+  accepted ADR before any code. That is the same ADR named in the bullet above; it
+  answers where listings live, not merely how they are installed.
+
+## Pricing and revenue
+
+The first iteration is **free-only** — no listing fees, no per-install pricing. Paid
+listings, revenue splits and payout mechanics are **not on this roadmap at all**. They
+enter it only if production usage produces evidence that tenants want to sell
+customization bundles, at which point they are scoped in the Hub repository's
+`docs/roadmap/hub-marketplace.md` alongside the rest of the marketplace design.
+
+## Trigger
+
+Phase 12 starts when the customization-as-data model in production demonstrates demand
+for cross-tenant sharing — tenants asking for another tenant's content type, or
+operators repeatedly hand-copying customization data between tenants at provisioning.
+Absent that signal, the roadmap reserves the slot and nothing else.
 
 ## Phase Exit Decision
 
-Phase 12 has no fixed entry or exit criteria — it is gated entirely on whether the
-tenant-customization-as-data model in production demonstrates demand for
-cross-tenant sharing. The roadmap reserves the slot; the team activates it only
-when the market signals warrant.
+Phase 12 has no fixed entry or exit criteria, because it has no fixed commitment. The
+gate is the trigger above: without production evidence of demand the phase does not
+start, and starting it means adopting the Hub repository's plan and its exit criteria as
+written there.
diff --git a/docs/standards/00-principles.md b/docs/standards/00-principles.md
index 6a767e6..eb14db0 100644
--- a/docs/standards/00-principles.md
+++ b/docs/standards/00-principles.md
@@ -56,6 +56,9 @@ We prefer code that says what it does. Strongly-typed ids over `Guid`. Result ty
 
 We invest in correct foundations before chasing surface polish. Tenant resolution, module boundaries, event infrastructure, observability — these are paid up front. Pixel-perfect UI, animation timings, and editor ergonomics come after the engine works.
 
+"Foundation" is not a synonym for "infrastructure we have heard of". Principle 16 is
+the test that separates the two; read them together.
+
 ## 7. Trust the Type System
 
 If the type system can prove an invariant, the type system should prove it. Magic strings get replaced by enums or value objects. Nullability is checked, not assumed. C# nullable reference types and TypeScript strict mode are non-negotiable.
@@ -99,6 +102,67 @@ Duplication invites drift.
 
 If a principle, standard, or pattern feels wrong, the answer is a PR that changes it — not silent deviation. Standards are versioned documents, not folklore. Drift kills modular monoliths.
 
+## 16. The One-Way-Door Test
+
+Principle 6 says foundations come first. It does not say every technology choice is a
+foundation. One question separates the two
+([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)):
+
+> If I add this six months from now, will I have to touch code that is already written?
+
+- **Yes → one-way door. Ship it now.** Tenant and organization isolation touches every
+  query ever written. The `outbox_messages` table and its ownership touch every
+  integration event. Strongly-typed identifiers touch every signature. The localization
+  schema touches every slug and every URL. The cost of each grows with the codebase, so
+  the cheapest moment to pay it is the earliest one.
+- **No → additive. Ship the port now, the adapter on a named trigger.** A Dapr adapter
+  touches three classes at the composition root today and will touch three classes in
+  six months. So will Kafka, APISIX, Vault, the Hub client, signed licence keys,
+  custom-domain TLS automation, and `audit_log` partitioning. Each ships as an interface
+  in `LearnStack.SharedKernel` with a working default implementation behind it; the
+  vendor adapter arrives when its trigger fires.
+
+**Why this principle exists.** The Day-1 foundation doctrine, stated on its own, swept
+additive port-isolated choices into the same bucket as genuinely irreversible schema and
+isolation decisions. The result was a local stack running fourteen services that the
+backend could call one of, and a first user-visible artefact sitting behind work no user
+can see. The doctrine is right; it needed a discriminator.
+
+A demand-gated building block is **not** "deferred". It qualifies only when four things
+are written down: the port, a working default implementation, an owning phase, and the
+trigger condition that promotes the adapter. Three of four is a gap with better
+paperwork. The current gated set and its triggers live in
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md); the day-to-day rules live
+in [20-infrastructure-stack.md](20-infrastructure-stack.md).
+
+## 17. A Hypothetical Customer Cannot Decide a Technical Question
+
+A deployment mode, market segment, or customer profile with **no signed contract** may
+not be the deciding factor in a technical choice. It may break a tie between
+alternatives that are otherwise equal. It may not, on its own, rule an option out.
+
+**Why this principle exists.** `SelfHostedAirGapped` has zero customers and ships
+nothing before [Phase 11](../roadmap/phase-11-production-hardening.md). It is
+nonetheless the *first-listed* reason
+[ADR-0028](../decisions/0028-audit-log-partition-management.md) rejects `pg_partman`,
+and the stated load-bearing case for an abstraction in
+[Cross-Cutting Concerns](../architecture/33-cross-cutting-concerns.md). A constraint no
+one is paying for was steering decisions that everyone pays for.
+
+How to apply it:
+
+- State the requirement the segment implies, and who has committed to it. "A signed
+  Self-Hosted contract requires no PostgreSQL extensions" is a decision driver. "Someone
+  might one day want air-gapped" is not.
+- If the hypothetical wins anyway on its own merits, say so in those terms and drop the
+  segment from the rationale.
+- If it is genuinely a tiebreak, record it as one. Tiebreaks are cheap and honest;
+  fabricated constraints are neither.
+
+This is the mirror of Principle 11 (Reversibility Beats Cleverness): keeping the option
+open costs almost nothing, so it does not need a customer to justify it — and it does
+not get to veto a better default in the meantime.
+
 ## Tone Across the Codebase
 
 - Be precise. Avoid words that hedge unnecessarily.
diff --git a/docs/standards/01-architecture-standards.md b/docs/standards/01-architecture-standards.md
index be3dc59..5d37715 100644
--- a/docs/standards/01-architecture-standards.md
+++ b/docs/standards/01-architecture-standards.md
@@ -4,8 +4,10 @@
 **Derives from:** [ADR-0002 Initial Architecture](../decisions/0002-initial-architecture.md),
 [ADR-0010 Cross-Module Communication](../decisions/0010-cross-module-communication.md)
 (Amendment 1: outbox dispatch via Dapr pub/sub),
-[ADR-0014 Adopt Dapr](../decisions/0014-adopt-dapr.md),
-[ADR-0016 Audit Log Subsystem](../decisions/0016-audit-log-subsystem.md),
+[ADR-0014 Adopt Dapr](../decisions/0014-adopt-dapr.md)
+(scheduled by [ADR-0035 Demand-Gated Infrastructure](../decisions/0035-demand-gated-infrastructure.md)),
+[ADR-0033 Audit Durability Model](../decisions/0033-audit-durability-model.md)
+(supersedes [ADR-0016 Audit Log Subsystem](../decisions/0016-audit-log-subsystem.md)),
 [ADR-0017 Tenant + Organization Hierarchy](../decisions/0017-tenant-organization-hierarchy.md),
 [ADR-0018 Tenant-Driven Customization Model](../decisions/0018-tenant-driven-customization-model.md)
 (supersedes ADR-0011 Vertical Extension Points).
diff --git a/docs/standards/02-backend-coding.md b/docs/standards/02-backend-coding.md
index 705a4b2..64da860 100644
--- a/docs/standards/02-backend-coding.md
+++ b/docs/standards/02-backend-coding.md
@@ -187,7 +187,9 @@ Rules:
 
 Standard MediatR pipeline (in order; outermost first, innermost last). Bound by
 [ADR-0032 § Sub-decision 2](../decisions/0032-exception-handling-logging-and-observability.md)
-and consistent with [ADR-0016 § Pipeline behavior order](../decisions/0016-audit-log-subsystem.md):
+and consistent with [ADR-0033](../decisions/0033-audit-durability-model.md), which keeps
+this order and changes only the durability contract of what step 3 records
+(ADR-0033 supersedes ADR-0016):
 
 1. **`ValidationBehavior`** — FluentValidation. Invalid input → returns
    `Result.Fail(validation_failed, errors)`; never throws
@@ -197,29 +199,80 @@ and consistent with [ADR-0016 § Pipeline behavior order](../decisions/0016-audi
    correlation fields ([10-observability.md § Correlation](10-observability.md)),
    starts the manual `<module>.<operation>` `Activity`, and measures handler
    latency for the histogram metric.
-3. **`AuditLogBehavior`** — Per [ADR-0016](../decisions/0016-audit-log-subsystem.md),
-   wraps the inner pipeline with `try / catch`. On exception, writes a
-   failure-class audit entry and rethrows via `ExceptionDispatchInfo` to
-   preserve the original stack. On success, reads `IAuditStateCapture` and
-   writes the success entry. Failure of `IAuditStore` itself is logged but
-   never blocks the business operation.
+3. **`AuditLogBehavior`** — Wraps the inner pipeline with `try / catch`. On
+   exception it records the failure outcome and rethrows via
+   `ExceptionDispatchInfo` to preserve the original stack.
+
+   Per [ADR-0033](../decisions/0033-audit-durability-model.md) this behavior
+   keeps its position and **decides**; it does not own the durable write. On
+   the way in it classifies `(module, operation)` from the in-process audit
+   catalogue plus the tenant's cached `audit_config` overrides — it issues no
+   query, because at step 3 no transaction is open, `app.tenant_id` is unset,
+   and `audit_config` is RLS-protected, so a read there would return zero rows
+   silently. For MUST it mints the audit id and parks a pending intent in the
+   scoped `IAuditStateCapture`, touching no `DbContext`.
+
+   On the way out it **reconciles**: if the intent's state is anything other
+   than `Committed` — never written, rolled back, or a commit whose outcome is
+   unknown — it writes the row standalone with the real outcome, in its own
+   short transaction. "Written" is not "committed", and a per-request flag
+   cannot observe a rollback. A MUST-class audit that cannot be written at all
+   **fails closed**: the caller receives `503 audit_unavailable`.
+   **SHOULD/MAY-class** entries stay best-effort — written on the same outbound
+   pass, logged on failure, never blocking the business operation.
 4. **`TenantContextBehavior`** — Asserts `ITenantContext.IsResolved` (the
    `TenantResolverMiddleware` populated it from the inbound HTTP request,
    the Hangfire `JobActivator` populated it from the job payload, or the
-   integration-event handler scope populated it from the event envelope);
-   sets the `app.tenant_id` and `app.organization_id` PostgreSQL session
-   variables via the `DbConnectionInterceptor` so RLS sees the right values.
+   integration-event handler scope populated it from the event envelope)
+   and carries the resolved tenant + organization forward for the rest of
+   the pipeline. Unresolved context short-circuits with
+   `Result.Fail(tenant_mismatch)` unless the request carries
+   `[AllowsUnresolvedTenantContext]`.
+
+   This behavior does **not** set the PostgreSQL session variables. It runs
+   at step 4; the transaction opens at step 6; and
+   `set_config('app.tenant_id', …, true)` / `SET LOCAL` are
+   **transaction-local**, so a value set here is discarded before the
+   transaction that needs it ever begins. The same objection rules out a
+   `DbConnectionInterceptor`, which fires at connection open rather than at
+   transaction start.
+   [Security Standards § Tenant Context](11-security.md) is the single
+   authority for where the session variables are set; the canonical policy
+   template that reads them lives in
+   [Database Standards § Tenant-Owned and Organization-Scoped Tables](05-database.md).
 5. **`AuthorizationBehavior`** — `IAuthorizationService.AuthorizeAsync`
    against the command's resource. Denial returns
    `Result.Fail(forbidden)`; no exception.
-6. **`TransactionBehavior`** — Opens a `DbContext.Database` transaction (UoW).
-   Commits on a success-`Result`; rolls back on a fail-`Result` or any
-   exception that bubbles through. No transaction for forbidden or
-   validation-failed requests because those short-circuit upstream.
+6. **`TransactionBehavior`** — Opens the ambient transaction through
+   `IUnitOfWork` and, as its **first statement inside that transaction**,
+   issues `SET LOCAL app.tenant_id` / `app.organization_id` from the
+   `ITenantContext` step 4 asserted, so Row Level Security evaluates every
+   subsequent statement — including the MUST-class audit insert — against
+   the right values. Commits on a success-`Result`; rolls back on a
+   fail-`Result` or any exception that bubbles through. No transaction for
+   forbidden or validation-failed requests because those short-circuit
+   upstream.
+
+   This behavior owns the **commit boundary**, and therefore owns two further
+   responsibilities per
+   [ADR-0033](../decisions/0033-audit-durability-model.md). First, immediately
+   before `COMMIT` it calls `IAuditStore.WritePendingAsync`, which inserts the
+   complete MUST-class audit row on this transaction — a no-op when no intent
+   is pending, and a rollback plus `audit_unavailable` when it fails. Placing
+   the write here rather than in the EF interceptor is deliberate: at
+   pre-commit every flush has happened, so the row's snapshots are complete
+   however many times the handler saved. Second, it records the outcome on
+   `IAuditStateCapture` — `Committed` once `CommitAsync` returns, `RolledBack`
+   after a rollback, `Indeterminate` when `CommitAsync` faults and the
+   server-side result is genuinely unknown. That signal is the only thing step
+   3's reconcile pass trusts.
 7. **`OutboxFlushBehavior`** — Per
    [15-event-and-outbox.md](../architecture/15-event-and-outbox.md), enrols
-   `IOutbox` messages in the current transaction; they ship via
-   `DaprEventBus` on commit.
+   `IOutbox` messages in the current transaction; the dispatcher ships them
+   through the registered `IEventBus` after commit. The registered
+   implementation is `InProcessEventBus` until the Dapr adapter's trigger
+   fires ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md));
+   handler code is identical either way, which is the point of the port.
 8. **Handler** — domain logic; returns `Result<T>`. **No** `throw new
    DomainException` for expected business-rule violations — use
    `Result.Fail(business_rule_violation, ...)`. The
diff --git a/docs/standards/05-database.md b/docs/standards/05-database.md
index 70a97e8..332a13b 100644
--- a/docs/standards/05-database.md
+++ b/docs/standards/05-database.md
@@ -4,7 +4,8 @@
 **Derives from:** [ADR-0002 Initial Architecture](../decisions/0002-initial-architecture.md)
 (Amendments 1 + 2),
 [ADR-0003 Tenant Isolation Defense in Depth](../decisions/0003-tenant-isolation-defense-in-depth.md)
-(Amendment 1: Organization Scope),
+(Amendment 1: Organization Scope; **Amendment 3: corrected RLS policy template and
+database role model**),
 [ADR-0006 Events and Outbox](../decisions/0006-events-and-outbox.md)
 (Amendment 1: Dapr pub/sub dispatch transport),
 [ADR-0014 Adopt Dapr](../decisions/0014-adopt-dapr.md),
@@ -28,10 +29,12 @@ PostgreSQL schema, EF Core, and migration conventions.
 | Columns | `snake_case` | `published_at` |
 | Primary keys | `id` (`uuid`) | `id` |
 | Foreign keys | `<entity>_id` | `course_id` |
-| Indexes | `ix_<table>_<columns>` | `ix_courses_tenant_id_slug` |
-| Unique indexes | `ux_<table>_<columns>` | `ux_courses_tenant_id_slug` |
-| Check constraints | `ck_<table>_<rule>` | `ck_courses_slug_format` |
-| RLS policies | `<table>_tenant_isolation` | `courses_tenant_isolation` |
+| Indexes | `ix_<table>_<columns>` | `ix_lessons_tenant_id_course_id` |
+| Unique indexes | `ux_<table>_<columns>` | `ux_course_translations_tenant_id_locale_slug` |
+| Check constraints | `ck_<table>_<rule>` | `ck_course_translations_slug_format` |
+| RLS policies (tenant-owned) | `<table>_isolation` — exactly one permissive policy | `courses_isolation` |
+| RLS policies (restrictive guards) | `<table>_org_write_guard` / `<table>_org_delete_guard` | `courses_org_write_guard` |
+| RLS policies (platform-scoped) | `<table>_read` / `<table>_insert` / `<table>_update` / `<table>_delete` | `platform_host_to_tenant_read` |
 | Triggers | `tg_<table>_<purpose>` | `tg_courses_set_updated_at` |
 | Functions | `fn_<purpose>` | `fn_set_updated_at` |
 | Read-model tables | `public_<module>_<concept>` | `public_education_course_summaries` |
@@ -41,63 +44,487 @@ PostgreSQL schema, EF Core, and migration conventions.
 
 ## Tenant-Owned and Organization-Scoped Tables
 
-Every tenant-owned table **must** carry `tenant_id` + RLS policy + EF filter.
-Org-scoped tables additionally carry an `organization_id` column (nullable when the
-row may be tenant-wide) and an org-aware RLS policy per
-[ADR-0017](../decisions/0017-tenant-organization-hierarchy.md).
+Every tenant-owned table **must** carry `tenant_id` + one RLS policy + an EF filter.
+Org-scoped tables additionally carry an `organization_id` column (nullable when the row
+may be tenant-wide), and the organization term is `AND`-ed into that same policy per
+[ADR-0017](../decisions/0017-tenant-organization-hierarchy.md) and
+[ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md).
+
+> **One permissive policy per table.** The natural instinct is to write a tenant policy
+> and an organization policy. Do not. `CREATE POLICY` is permissive by default and
+> PostgreSQL combines permissive policies with `OR`, so a second permissive policy
+> **widens** access instead of narrowing it. This is not theoretical — it is the defect
+> ADR-0003 Amendment 3 corrects, and it made every tenant-wide row visible to every
+> tenant. A second policy is allowed only when it is declared `AS RESTRICTIVE`, which
+> combines with `AND` and therefore cannot widen anything. The template below uses
+> exactly one of each.
 
 ```sql
 CREATE TABLE courses (
     id              uuid PRIMARY KEY,
     tenant_id       uuid NOT NULL,
     organization_id uuid NULL,                -- org-scoped; null = tenant-wide
-    slug            text NOT NULL,
-    title           text NOT NULL,
+    slug_key        text NOT NULL,            -- stable authoring handle; NOT routable
+    -- No title, no description, no slug: translatable columns live in
+    -- course_translations per ADR-0008. See § Translation satellite tables.
     -- ... domain columns ...
     created_at      timestamptz NOT NULL DEFAULT now(),
     created_by      uuid NOT NULL,
     updated_at      timestamptz NOT NULL DEFAULT now(),
     updated_by      uuid NOT NULL,
     row_version     bigint NOT NULL DEFAULT 0,
-    CONSTRAINT ux_courses_tenant_id_slug UNIQUE (tenant_id, slug)
+    CONSTRAINT ux_courses_tenant_id_slug_key UNIQUE (tenant_id, slug_key),
+    -- Composite unique on (tenant_id, id) exists solely so child tables can
+    -- carry a composite FK. See § Foreign keys between tenant-owned tables.
+    CONSTRAINT ux_courses_tenant_id_id   UNIQUE (tenant_id, id)
 );
 
+-- Enable *and* force: without FORCE, the table owner bypasses its own policies.
 ALTER TABLE courses ENABLE ROW LEVEL SECURITY;
+ALTER TABLE courses FORCE  ROW LEVEL SECURITY;
+
+-- ONE permissive policy, ONE AND-ed predicate. Two permissive policies would be
+-- OR-ed together and a tenant-wide row (organization_id IS NULL) would satisfy
+-- the organization half on its own — visible to every tenant.
+--
+-- NULLIF(..., '') is not decoration. A customized (dotted) GUC becomes a session
+-- placeholder the first time it is assigned, and its reset value is the empty
+-- string, not "undefined". On a pooled connection whose previous transaction set
+-- app.tenant_id and whose next one forgets to, current_setting(..., true) returns
+-- '' and ''::uuid RAISES instead of filtering. NULLIF turns that into NULL, and a
+-- NULL policy result is false for both USING and WITH CHECK — fail-closed for the
+-- never-set path and the reset path alike.
+CREATE POLICY courses_isolation ON courses
+    USING (
+        tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid
+        AND (
+            organization_id IS NULL                                                                -- tenant-wide row
+            OR organization_id = NULLIF(current_setting('app.organization_id', true), '')::uuid    -- caller's org
+            OR current_setting('app.scope', true) = 'tenant'                                       -- tenant-scope READ
+        )
+    )
+    WITH CHECK (
+        tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid
+        AND (
+            organization_id IS NULL
+            OR organization_id = NULLIF(current_setting('app.organization_id', true), '')::uuid
+        )
+    );
 
--- Tenant isolation (mandatory):
-CREATE POLICY courses_tenant_isolation ON courses
-    USING (tenant_id = current_setting('app.tenant_id')::uuid);
+-- The tenant-scope hatch above widens READS across organizations, which is what
+-- cross-org reporting needs. It must not widen writes — but USING is also what
+-- selects the rows an UPDATE may target, and for DELETE it is the ONLY gate
+-- (PostgreSQL has no WITH CHECK for DELETE). Without the restrictive policy
+-- below, a tenant-scope session could delete another organization's rows, or
+-- reassign them to itself.
+CREATE POLICY courses_org_write_guard ON courses
+    AS RESTRICTIVE FOR UPDATE
+    USING (
+        organization_id IS NULL
+        OR organization_id = NULLIF(current_setting('app.organization_id', true), '')::uuid
+    );
 
--- Organization isolation (only for [OrganizationScoped] tables):
-CREATE POLICY courses_organization_isolation ON courses
+CREATE POLICY courses_org_delete_guard ON courses
+    AS RESTRICTIVE FOR DELETE
     USING (
         organization_id IS NULL
-        OR organization_id = current_setting('app.organization_id', true)::uuid
+        OR organization_id = NULLIF(current_setting('app.organization_id', true), '')::uuid
     );
 
-CREATE INDEX ix_courses_tenant_id ON courses (tenant_id);
-CREATE INDEX ix_courses_organization_id ON courses (organization_id)
-    WHERE organization_id IS NOT NULL;
+-- No standalone index on tenant_id: ux_courses_tenant_id_slug_key and
+-- ux_courses_tenant_id_id are both b-trees with tenant_id leading, and either serves
+-- a tenant-only lookup. One composite index carries the organization dimension.
+-- Deliberately NOT partial: the policy's `organization_id IS NULL` branch matches
+-- every tenant-wide row, and a b-tree indexes NULLs, so the non-partial form serves
+-- both branches of the predicate.
+CREATE INDEX ix_courses_tenant_id_organization_id ON courses (tenant_id, organization_id);
+```
+
+### Foreign keys between tenant-owned tables
+
+**Every foreign key between two tenant-owned tables is composite on `tenant_id`.**
+
+PostgreSQL evaluates referential integrity as a security-restricted operation on behalf
+of the table owner, and RI checks are **not subject to Row Level Security**. A
+single-column `lessons.course_id → courses.id` therefore lets a row in tenant A
+reference a row in tenant B: the child's own `WITH CHECK` passes because its
+`tenant_id` is A's, and the FK check passes because it can see B's row. The result is a
+permanent cross-tenant reference in the one system whose top-line threat is
+cross-tenant leakage — and it is invisible to every policy, because no policy ran.
+
+```sql
+CREATE TABLE lessons (
+    id          uuid PRIMARY KEY,
+    tenant_id   uuid NOT NULL,
+    course_id   uuid NOT NULL,
+    -- ... domain columns ...
+    CONSTRAINT fk_lessons_course
+        FOREIGN KEY (tenant_id, course_id) REFERENCES courses (tenant_id, id)
+);
 ```
 
+The parent therefore carries `UNIQUE (tenant_id, id)` purely to be referenceable this
+way. The cost is one redundant-looking unique index per parent table; the alternative is
+a class of cross-tenant corruption that no RLS policy can catch.
+
+This block is the **single canonical RLS template**.
+[ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md),
+[Tenant Isolation](../architecture/09-tenant-isolation.md) and
+[ADR-0017](../decisions/0017-tenant-organization-hierarchy.md) link here rather than
+repeating it — a template copied into four documents is a template that drifts in four
+directions.
+
 Rules:
 - `tenant_id` is the **first column** of every composite index unless profiling proves
   otherwise.
-- Every tenant-owned table has an RLS policy keyed on
-  `current_setting('app.tenant_id')`. The session variable name `app.tenant_id` is the
-  canonical convention; do not use other names (`app.current_tenant_id`,
-  `learnstack.tenant_id`, etc.) — the architecture test
-  `Every_TenantOwned_Table_HasRls_With_AppTenantId` enforces this.
-- Org-scoped tables additionally enforce isolation against
-  `current_setting('app.organization_id', true)`. The second argument `true`
-  (missing-OK) lets the predicate degrade to "tenant-wide row" when no org context is
-  set.
-- Application sets `app.tenant_id` and (where relevant) `app.organization_id` on the
-  ambient transaction via `SET LOCAL`. The interceptor that performs this also asserts
-  the values are set before any query executes.
-- Platform-admin operations use a separate database role (`learnstack_platform`) that
-  bypasses RLS; the outbox processor uses `learnstack_outbox_admin` for the same
-  reason (see [15-event-and-outbox.md](../architecture/15-event-and-outbox.md)).
+- Every tenant-owned table carries **exactly one** policy whose predicate `AND`s the
+  tenant term with the organization term. A tenant-wide table simply omits the
+  organization half. If a second policy is ever genuinely needed it must be declared
+  `AS RESTRICTIVE`; a second permissive policy widens access rather than narrowing it.
+- Every tenant-owned table declares both `ENABLE` and `FORCE ROW LEVEL SECURITY`.
+- Every policy carries an explicit `WITH CHECK`. `USING` governs which rows are
+  visible; `WITH CHECK` governs which rows may be written. The `app.scope = 'tenant'`
+  escape hatch is deliberately **absent** from `WITH CHECK`: a tenant-scope reporting
+  query may read across organizations, but nothing may write outside its organization.
+  `WITH CHECK` does not deliver that property on its own. PostgreSQL has no `WITH CHECK`
+  for `DELETE`, and `USING` is also what selects the rows an `UPDATE` may target — so
+  the two `AS RESTRICTIVE` `FOR UPDATE` / `FOR DELETE` guards in the template above are
+  what actually close the `USING`-only write paths. They are part of the template for
+  every organization-scoped table, not an optional hardening step.
+- The session variable names `app.tenant_id`, `app.organization_id`, `app.scope` and
+  `app.resolving_host` are canonical and the set is closed; do not invent alternatives
+  (`app.current_tenant_id`, `learnstack.tenant_id`, …). The first three are set by
+  `TransactionBehavior` inside the ambient transaction. `app.resolving_host` is set by
+  `CachedHostToTenantResolver` alone, in its own short read-only transaction, and is
+  read by exactly one policy — see § Table classes. Always call `current_setting` with
+  the second argument `true` (missing-OK), and always wrap the result in `NULLIF(…, '')`,
+  so an unset context yields `NULL` and the predicate filters the row out rather than
+  raising inside a pooled connection.
+- The application sets `app.tenant_id` and `app.organization_id` with `SET LOCAL`
+  **inside the ambient transaction**, after it opens. These settings are
+  transaction-local: set before the transaction begins — in a MediatR behavior that
+  runs earlier, or in a connection interceptor that fires at connection open — they are
+  discarded before the query they are meant to protect ever runs. See
+  [Security Standards § Tenant Context](11-security.md).
+- `organization_id` on a tenant-owned row is **immutable after insert**, enforced by a
+  `BEFORE UPDATE` trigger (`tg_<table>_organization_id_immutable`). A row does not move
+  between organizations: its audit rows
+  ([ADR-0016](../decisions/0016-audit-log-subsystem.md)), its storage prefix
+  `tenants/{tenant_id}/organizations/{organization_id}/…` and its cache-key prefix are
+  all organization-qualified per
+  [ADR-0017](../decisions/0017-tenant-organization-hierarchy.md), so re-parenting would
+  orphan three subsystems at once. Moving content between organizations is a copy, not
+  an update.
+
+### Translation satellite tables
+
+A `<entity>_translations` table is a tenant-owned table in its own right, not an
+extension of its parent, and it gets the full template:
+
+```sql
+CREATE TABLE course_translations (
+    course_id       uuid NOT NULL,
+    tenant_id       uuid NOT NULL,     -- a real column; RLS is per table, never inherited
+    organization_id uuid NULL,         -- mirrors the parent; for RLS, never for uniqueness
+    locale          text NOT NULL,
+    title           text NOT NULL,
+    slug            text NOT NULL,
+    -- ... other translatable columns ...
+    PRIMARY KEY (course_id, locale),
+    CONSTRAINT ux_course_translations_tenant_id_locale_slug
+        UNIQUE (tenant_id, locale, slug),
+    CONSTRAINT fk_course_translations_course
+        FOREIGN KEY (tenant_id, course_id) REFERENCES courses (tenant_id, id)
+        ON DELETE CASCADE
+);
+```
+
+It then declares `ENABLE` + `FORCE ROW LEVEL SECURITY` and the same
+one-permissive-policy-plus-two-restrictive-guards set as its parent. A satellite with no
+policy of its own is unprotected — a check constraint on the parent does not propagate
+Row Level Security, and a table holding `title` and `slug` holds the content.
+
+`organization_id` on a satellite exists **only** to carry the isolation predicate.
+Denormalizing it is safe because of the immutability rule above. It is deliberately
+**absent** from the slug unique key — see § Constraints and
+[Localization Standards § Pattern A](08-localization.md).
+
+The foreign key is composite on `tenant_id` for the reason in § Foreign keys between
+tenant-owned tables. A composite key that also carried `organization_id` would not work:
+the column is nullable, and under the default `MATCH SIMPLE` a foreign key with any null
+column is not checked at all — which would silently re-open the cross-tenant reference
+hole the composite key exists to close.
+
+### Table classes
+
+Not every table in the tenancy schema is tenant-owned, and applying the template above
+to all of them produces a deadlock rather than isolation. Three classes exist, and every
+migration states which one its table is.
+
+| Class | Rule | Tables |
+|---|---|---|
+| **Tenant-owned** | The full template above: `ENABLE` + `FORCE`, one permissive policy `AND`-ing the tenant term with the organization term, explicit `WITH CHECK`, restrictive `UPDATE` / `DELETE` guards when org-scoped | every domain table, plus `organizations`, `tenant_domains`, `tenant_locales`, `tenant_settings` (org-scoped), `tenant_feature_flags`, `platform_entitlement_cache`, `outbox_messages` |
+| **Tenant-owned, self-keyed** | Identical, except the tenant term is `id = …` because the row's primary key *is* the tenant id | `tenants` |
+| **Platform-scoped** | `ENABLE` + `FORCE`, and role-qualified per-command policies: the read is widened by an explicitly declared non-tenant predicate, writes stay tenant-keyed | `platform_host_to_tenant` |
+
+**A table is platform-scoped only when it is read before the tenant is known.** That is
+one table today, and adding a second is a decision, not a convenience.
+`platform_entitlement_cache` does **not** qualify despite its name: `IFeatureFlags`
+resolves the tenant from `ITenantContext` and throws `TenantContextMissingException`
+when there is none, and `IEntitlementProvider.RefreshAsync` is driven by
+`PUT /api/internal/tenants/{id}/entitlements`, which carries the tenant id in its path.
+Both directions have a tenant, so the table keeps the tenant-owned template and the
+application role never holds a table-wide read of every tenant's plan.
+
+#### `tenants` — self-keyed
+
+`tenants` has no `tenant_id` column; its `id` **is** the tenant id, so the canonical
+predicate would reference a column that does not exist. The policy keys on `id`:
+
+```sql
+ALTER TABLE tenants ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tenants FORCE  ROW LEVEL SECURITY;
+
+CREATE POLICY tenants_isolation ON tenants
+    USING      (id = NULLIF(current_setting('app.tenant_id', true), '')::uuid)
+    WITH CHECK (id = NULLIF(current_setting('app.tenant_id', true), '')::uuid);
+```
+
+Two consequences are binding:
+
+- **A tenant id is never minted inside a handler.** The registry that owns the `Tenant`
+  aggregate assigns it — the Hub in SaaS / Dedicated (`POST /api/internal/tenants`
+  carries it), configuration in Self-Hosted, the fixture in a seed — and the
+  provisioning transaction sets `app.tenant_id` to that id before the `INSERT`, so
+  `WITH CHECK` passes. A handler that generated the id itself could not satisfy its own
+  policy. A provisioning path that genuinely cannot supply an id ahead of the write runs
+  under `EnterPlatformAdminScope("tenant-provisioning")`; that is the sanctioned escape,
+  not a reason to weaken the policy.
+- **Enumerating tenants requires the platform role.** `SELECT … FROM tenants` with no
+  `app.tenant_id` returns zero rows, so `PlatformJob<TParams>`'s active-tenant sweep and
+  every operator list screen go through `EnterPlatformAdminScope(reason)`. This is the
+  intended cost: the application role cannot enumerate the customer list.
+
+`tenants.slug` is globally unique, and PostgreSQL enforces unique indexes with row
+security bypassed, so a duplicate-slug insert reveals that *some* tenant already holds
+the slug. That is accepted here because slugs appear in hostnames and are public by
+construction. It is not accepted anywhere else, which is why tenant-owned natural keys
+are `UNIQUE (tenant_id, …)`.
+
+#### `platform_host_to_tenant` — platform-scoped
+
+`IHostToTenantResolver` reads this table **in order to determine the tenant**. At that
+moment `app.tenant_id` is unset, so the tenant-owned template returns zero rows and no
+tenant can ever resolve. The answer is not to drop row security — a table without
+`ENABLE ROW LEVEL SECURITY` is indistinguishable from one nobody thought about — but to
+give the read an explicitly declared key of its own. The resolver announces the host it
+is about to resolve, and the policy admits exactly that row.
+
+```sql
+ALTER TABLE platform_host_to_tenant ENABLE ROW LEVEL SECURITY;
+ALTER TABLE platform_host_to_tenant FORCE  ROW LEVEL SECURITY;
+
+-- READ. Two deliberate branches, neither satisfiable by accident: an unset dotted GUC
+-- is the empty string on a pooled connection, NULLIF turns it into NULL, and NULL is
+-- false for USING.
+--   app.resolving_host — the pre-context single-row lookup by IHostToTenantResolver
+--   app.tenant_id      — a tenant listing its own hosts (Studio, canonical URLs)
+CREATE POLICY platform_host_to_tenant_read ON platform_host_to_tenant
+    FOR SELECT TO learnstack_app
+    USING (
+        host = NULLIF(current_setting('app.resolving_host', true), '')
+        OR tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid
+    );
+
+-- WRITE is never pre-context: every writer knows its tenant. Hub sync carries it in
+-- PUT /api/internal/tenants/{id}/host-mappings; provisioning and Self-Hosted
+-- configuration both declare it. Writes therefore stay tenant-keyed.
+CREATE POLICY platform_host_to_tenant_insert ON platform_host_to_tenant
+    FOR INSERT TO learnstack_app
+    WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid);
+
+CREATE POLICY platform_host_to_tenant_update ON platform_host_to_tenant
+    FOR UPDATE TO learnstack_app
+    USING      (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid)
+    WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid);
+
+CREATE POLICY platform_host_to_tenant_delete ON platform_host_to_tenant
+    FOR DELETE TO learnstack_app
+    USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid);
+```
+
+A wide `SELECT` policy does **not** widen `UPDATE` or `DELETE`. PostgreSQL applies the
+command's own policies in addition to the `SELECT` policy, and a row must satisfy both.
+A session that can see another tenant's host through `app.resolving_host` still cannot
+repoint it: the `UPDATE` reports `UPDATE 0`, and an `INSERT` naming a foreign tenant
+raises `new row violates row-level security policy`.
+
+**`app.resolving_host` must be set inside an explicit transaction.** `SET LOCAL` outside
+a transaction block emits `WARNING: SET LOCAL can only be used in transaction blocks`
+and has no effect, and a session-level `set_config(…, false)` would survive on a pooled
+connection into the next request. `CachedHostToTenantResolver` therefore opens a short
+read-only transaction on a cache miss, issues `SET LOCAL app.resolving_host = @host`,
+runs the single-row `SELECT`, and commits. The failure mode of forgetting it is an empty
+result and a 404 — never a wider read.
+
+Because these policies are role-qualified `TO learnstack_app`, **no policy applies to
+the owner**, so under `FORCE` every access by `learnstack_migration` to this table is
+denied. Rows arrive through `learnstack_app` under tenant context (Hub sync, tenant
+provisioning, Self-Hosted configuration, dev seed) or through `learnstack_platform`.
+This does not generalise: the canonical tenant-owned policy carries no `TO` clause, so
+it applies to the owner as well, and per-tenant data migrations under
+`SET LOCAL app.tenant_id` work as § Data Migrations describes.
+
+Rejected alternative, recorded so it is not re-derived: a `SECURITY DEFINER` function
+fronting the lookup would be tighter still — `learnstack_app` would hold `EXECUTE` and
+no table privilege at all — but the function needs an owner that bypasses row security,
+and that is a fifth database role. The four-role model is closed; a fifth requires an
+ADR ([ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md)).
+
+`tenant_domains` is a different table and stays tenant-owned: it holds the tenant's own
+domain lifecycle and verification state, read and written under tenant context.
+`platform_host_to_tenant` holds the resolution index, read before any context exists.
+The two differ in *when* they are read, which is exactly why they cannot share one rule.
+
+### Database roles
+
+Four roles, four **separate login credentials**, four connection strings. The model is
+closed; a fifth role requires an ADR.
+
+| Role | Connection string | Present in | Used by | RLS posture |
+|------|---|---|---------|-------------|
+| `learnstack_migration` | `ConnectionStrings:Migration` | the deploy job / `make migrate` only — **never** in API or worker runtime configuration | `dotnet ef database update`; **owns** every table | `NOBYPASSRLS`; `FORCE ROW LEVEL SECURITY` denies ownership any bypass |
+| `learnstack_app` | `ConnectionStrings:Default` | API host, worker host | every request-path and job-path `DbContext` | `NOBYPASSRLS` |
+| `learnstack_platform` | `ConnectionStrings:PlatformAdmin` | API host, worker host | `EnterPlatformAdminScope(reason)` and nothing else | `BYPASSRLS` |
+| `learnstack_outbox_admin` | `ConnectionStrings:OutboxDispatcher` | the worker host that runs `OutboxProcessor` | `OutboxProcessor` and nothing else | `BYPASSRLS` |
+
+```sql
+-- One-time provisioning, run once per database before the first migration. Ships as
+-- infra/compose/postgres-init/02-create-roles.sql in Phase 02a Packet 6.
+CREATE ROLE learnstack_migration    LOGIN PASSWORD :'migration_pw' NOBYPASSRLS;
+CREATE ROLE learnstack_app          LOGIN PASSWORD :'app_pw'       NOBYPASSRLS;
+CREATE ROLE learnstack_platform     LOGIN PASSWORD :'platform_pw'  BYPASSRLS;
+CREATE ROLE learnstack_outbox_admin LOGIN PASSWORD :'outbox_pw'    BYPASSRLS;
+
+GRANT CONNECT ON DATABASE learnstack
+    TO learnstack_migration, learnstack_app, learnstack_platform, learnstack_outbox_admin;
+
+-- Since PostgreSQL 15 the public schema no longer grants CREATE to PUBLIC, and the
+-- schema is owned by pg_database_owner. Without the CREATE grant below the first
+-- migration fails with "permission denied for schema public" — and the tempting fix
+-- (make the migration role a superuser or the database owner) reinstates exactly the
+-- ownership arrangement FORCE ROW LEVEL SECURITY exists to defeat.
+REVOKE ALL   ON SCHEMA public FROM PUBLIC;
+GRANT USAGE, CREATE ON SCHEMA public TO learnstack_migration;
+GRANT USAGE         ON SCHEMA public
+    TO learnstack_app, learnstack_platform, learnstack_outbox_admin;
+
+-- Per-table grants are written in the migration that creates the table; see the matrix
+-- below. There is deliberately no ALTER DEFAULT PRIVILEGES.
+GRANT SELECT, INSERT, UPDATE, DELETE ON courses TO learnstack_app;
+```
+
+Migrations connect **as** `learnstack_migration`, so every table it creates is already
+owned by it — no `ALTER TABLE … OWNER TO` is needed, and seeing one in a migration is a
+sign the migration is running as the wrong role. The connection string `dotnet ef` uses
+and the one the application uses at runtime are **different roles**, and must not be
+unified in any environment, local development included: one shared role makes the runtime
+role the table owner, which is the arrangement `FORCE ROW LEVEL SECURITY` exists to
+defeat, and every isolation test would then pass against inert policies.
+
+`BYPASSRLS` bypasses **policies, not `GRANT`s**: a role holding the attribute with no
+table privilege gets `permission denied for table`. Grant scope is therefore the only
+thing that actually bounds the two bypass roles, and the matrix below is the whole of
+that bound.
+
+#### GRANT matrix
+
+`—` means no privilege. `learnstack_migration` owns every table, which carries all
+privileges implicitly.
+
+| Table | `learnstack_app` | `learnstack_platform` | `learnstack_outbox_admin` |
+|---|---|---|---|
+| `tenants` | `SELECT, INSERT, UPDATE` | `SELECT, INSERT, UPDATE, DELETE` | — |
+| `organizations` | `SELECT, INSERT, UPDATE, DELETE` | `SELECT, INSERT, UPDATE, DELETE` | — |
+| `tenant_domains` | `SELECT, INSERT, UPDATE, DELETE` | `SELECT` | — |
+| `tenant_locales` | `SELECT, INSERT, UPDATE, DELETE` | `SELECT` | — |
+| `tenant_settings` | `SELECT, INSERT, UPDATE, DELETE` | `SELECT` | — |
+| `tenant_feature_flags` | `SELECT, INSERT, UPDATE, DELETE` | `SELECT, INSERT, UPDATE, DELETE` | — |
+| `platform_entitlement_cache` | `SELECT, INSERT, UPDATE` | `SELECT, DELETE` | — |
+| `platform_host_to_tenant` | `SELECT, INSERT, UPDATE, DELETE` | `SELECT, INSERT, UPDATE, DELETE` | — |
+| `outbox_messages` | `SELECT, INSERT` | `SELECT, DELETE` | `SELECT`, `UPDATE (processed_at, attempts, last_error, available_after)` |
+
+Four things the matrix cannot express, and one it must not be asked to:
+
+- **A `GRANT` names a role, not a code path.** "Reserved to the provisioning path" is
+  not something PostgreSQL can enforce — every handler in the API process runs as the
+  same role, so `learnstack_app` holding `INSERT` on `tenants` means any handler may
+  insert a `tenants` row *that satisfies the policy*. Code-path confinement is a
+  separate layer, carried by `Modules_Do_Not_Read_Entitlement_Cache_Directly`,
+  `LearnStack_OutboxAdmin_Role_OnlyUsedBy_OutboxProcessor` and
+  `Platform_DataSource_Resolved_Only_By_PlatformAdminScope`. State the two separately;
+  conflating them produces a sentence that reads like a control and is not one.
+- **No `ALTER DEFAULT PRIVILEGES` grants exist.** Every table's grants are written in
+  the migration that creates it. A new table nobody granted fails loudly with
+  `permission denied` instead of silently inheriting DML — and can never silently widen
+  a `BYPASSRLS` role.
+- **No privilege is ever granted to `PUBLIC`.** A single `GRANT … TO PUBLIC` would
+  un-bound both bypass roles at once, because grant scope is the only thing bounding
+  them.
+- **Sequences.** A table with a generated integer key uses
+  `bigint GENERATED BY DEFAULT AS IDENTITY`, not `bigserial`. An identity column's
+  sequence needs no privilege of its own; a `bigserial` column's does, and forgetting
+  `GRANT USAGE ON SEQUENCE` surfaces as `permission denied for sequence …` on the first
+  insert.
+- **Tenant hard-deprovisioning is not in the matrix** because no phase owns it yet. When
+  it lands it will need `DELETE` for `learnstack_platform` across every tenant-owned
+  table; that is a deliberate widening of a `BYPASSRLS` role and is recorded in the ADR
+  that introduces it, not slipped into a migration.
+
+#### How `EnterPlatformAdminScope(reason)` reaches `learnstack_platform`
+
+**By a second connection, not by `SET ROLE`.** `learnstack_app` is **not** a member of
+`learnstack_platform`; no `GRANT learnstack_platform TO learnstack_app` exists. The
+composition root registers a second, separately-credentialed `NpgsqlDataSource` from
+`ConnectionStrings:PlatformAdmin` as a keyed singleton whose only sanctioned consumer is
+`LearnStack.Infrastructure.MultiTenancy.PlatformAdminScope`.
+`EnterPlatformAdminScope(reason)` opens a DI scope whose `DbContext` is built on that
+data source and returns an `IAsyncDisposable` handle. Module code cannot resolve it;
+`Platform_DataSource_Resolved_Only_By_PlatformAdminScope` enforces that.
+
+`SET ROLE` is rejected on three grounds:
+
+1. **Membership is a standing capability.** Once `learnstack_app` is a member of
+   `learnstack_platform`, any code path that reaches raw SQL can execute
+   `SET ROLE learnstack_platform` and acquire `BYPASSRLS` — the same session reads zero
+   rows as `learnstack_app` and every tenant's rows after the switch. The four-role
+   separation would then be a naming convention, not a boundary.
+2. **A plain `SET ROLE` survives `COMMIT`.** PgBouncer runs `server_reset_query`
+   (`DISCARD ALL`) only in session pooling unless `server_reset_query_always = 1`, and
+   LearnStack runs **transaction** pooling, so a leaked `SET ROLE` persists on the pooled
+   server connection and the next tenant's request runs with `BYPASSRLS`.
+   `SET LOCAL ROLE` does reset at commit, but it makes correctness depend on remembering
+   `LOCAL` on the one statement whose omission is an unbounded cross-tenant read.
+3. **Per-role settings do not follow `SET ROLE`.** `ALTER ROLE … SET statement_timeout`
+   is applied at login from the authenticated role: a session that logs in as
+   `learnstack_app` keeps that role's value after `SET ROLE learnstack_platform`, while a
+   fresh login as `learnstack_platform` gets the platform value. The per-role
+   `statement_timeout` split and the per-role pool separation that
+   [Phase 11](../roadmap/phase-11-production-hardening.md) builds are only implementable
+   when each role logs in for itself.
+
+The residual risk is that the platform credential exists in the API process's
+configuration. It is mitigated by resolving it only through `PlatformAdminScope`; by a
+separate secret path (`learnstack/{deployment}/platform/db-password`) that a deployment
+needing no platform admin simply does not provision, in which case
+`EnterPlatformAdminScope` throws at startup rather than degrading to `learnstack_app`;
+and by an audit row written **inside** the scope before the operation runs and committed
+on its own, so an operation that later fails is still recorded. That row is written as
+`learnstack_platform` and carries the sentinel platform tenant id, because a cross-tenant
+operation has no tenant of its own and `audit_log` is itself tenant-owned.
+
+**Isolation tests connect as `learnstack_app`.** A test that connects as the owner or
+as a `BYPASSRLS` role passes even when every policy is inert, so it proves nothing.
 
 ## Audit Columns
 
@@ -138,7 +565,32 @@ A shared EF interceptor populates these on `SaveChanges`.
 
 - `NOT NULL` aggressively; defaults only when business sense dictates.
 - `CHECK` constraints for invariants the database can enforce (`status IN (...)`, `length(slug) BETWEEN 1 AND 120`).
-- `UNIQUE` constraints for tenant-scoped natural keys (`UNIQUE (tenant_id, slug)`).
+- `UNIQUE` constraints for tenant-scoped natural keys (`UNIQUE (tenant_id, slug_key)`).
+- **A nullable column in a `UNIQUE` constraint does not constrain the rows where it is
+  null.** PostgreSQL follows the SQL standard and treats nulls as distinct for uniqueness
+  purposes, so `UNIQUE (tenant_id, organization_id, key)` permits unlimited duplicates
+  among tenant-wide rows (`organization_id IS NULL`) — the rows a tenant usually creates
+  first, and the ones a single-organization tenant creates exclusively. Two ways out, and
+  the choice is not stylistic. Ask: **does the nullable column select between rows that a
+  consumer resolves by an explicit authored precedence, or does it partition a namespace
+  that must resolve to exactly one row?**
+  - **Authored precedence** — an organization override of a tenant-wide notification
+    template, resolved by the documented org → tenant fallback chain. The column belongs
+    in the key, and the constraint is declared `UNIQUE NULLS NOT DISTINCT (…)`. Available
+    from PostgreSQL 15; LearnStack pins 18.x across all deployment modes
+    ([ADR-0031](../decisions/0031-postgresql-major-version.md)), so partial-index
+    workarounds are never needed for availability.
+  - **One-row namespace** — a routable slug, where a host resolving to
+    `(tenant_id, organization_id)` serves both tiers and something has to pick a winner
+    at render time. The column does **not** belong in the key. Drop it and constrain the
+    flat namespace. See [Localization Standards § Pattern A](08-localization.md).
+
+  Paired partial unique indexes (`WHERE organization_id IS NULL` / `WHERE organization_id
+  IS NOT NULL`) are not the house pattern: they need two names and two predicates that
+  must exhaustively partition the space, PostgreSQL has no `UNIQUE (…) WHERE …` table
+  constraint so they cannot be declared alongside the columns they guard, and they solve
+  the same half of the problem `NULLS NOT DISTINCT` solves while leaving the cross-tier
+  collision open.
 - Foreign keys with `ON DELETE` set explicitly.
 
 ## Soft Delete
@@ -162,7 +614,17 @@ A shared EF interceptor populates these on `SaveChanges`.
 - Pure-SQL data migrations live in migration files when small.
 - Larger data migrations are idempotent Hangfire jobs.
 - Always re-runnable.
-- Tenant-aware: per-tenant data migrations use the tenant role and `SET LOCAL app.tenant_id = ...` per tenant (and `app.organization_id` where applicable).
+- Tenant-aware: per-tenant data migrations run as `learnstack_migration` and issue
+  `SET LOCAL app.tenant_id = '<id>'` inside a transaction **per tenant** — and, on
+  org-scoped tables, `SET LOCAL app.organization_id = '<id>'` inside a transaction
+  **per organization**. Both are mandatory, not hygiene. `learnstack_migration` is
+  `NOBYPASSRLS` and every tenant-owned table is `FORCE ROW LEVEL SECURITY`, so a
+  backfill that skips the tenant variable matches **zero rows** and still reports
+  success; and because the two `AS RESTRICTIVE` write guards deliberately ignore
+  `app.scope = 'tenant'`, a tenant-scope session cannot span organizations for
+  `UPDATE` or `DELETE` — it would silently touch only the tenant-wide
+  (`organization_id IS NULL`) rows. Granting `BYPASSRLS` to the migration role is
+  **not** the fix: it removes the third defense layer for every table in the database.
 
 ## Read Models
 
@@ -180,11 +642,13 @@ CREATE TABLE outbox_messages (
     id              uuid PRIMARY KEY,
     occurred_at     timestamptz NOT NULL DEFAULT now(),
     tenant_id       uuid NOT NULL,
-    correlation_id  text NULL,             -- opaque correlation id from APISIX request-id
+    organization_id uuid NULL,             -- null = tenant-wide event; see note below
+    correlation_id  text NOT NULL,         -- full W3C traceparent, per ADR-0032 § 12
     causation_id    uuid NULL,
     actor_user_id   uuid NULL,
     type            text NOT NULL,         -- assembly-qualified event type name
     topic           text NOT NULL,         -- "learnstack.{module}.{aggregate}"
+    partition_key   text NOT NULL,         -- ordering domain: aggregate id, else tenant_id
     payload         jsonb NOT NULL,
     metadata        jsonb NULL,
     processed_at    timestamptz NULL,
@@ -201,16 +665,65 @@ CREATE INDEX ix_outbox_messages_tenant_pending
     WHERE processed_at IS NULL;
 
 ALTER TABLE outbox_messages ENABLE ROW LEVEL SECURITY;
-CREATE POLICY outbox_messages_tenant_isolation ON outbox_messages
-    USING (tenant_id = current_setting('app.tenant_id', true)::uuid);
--- OutboxProcessor uses the learnstack_outbox_admin role that bypasses RLS to read
--- all tenants' rows for dispatch. See ADR-0006 Amendment 1 and 15-event-and-outbox.md.
+ALTER TABLE outbox_messages FORCE  ROW LEVEL SECURITY;
+
+-- Tenant-wide table: no organization term, but the same one-policy,
+-- USING + WITH CHECK, FORCE-enabled shape as every other tenant-owned table.
+-- NULLIF is mandatory here for the same reason as everywhere else: on a pooled
+-- connection whose previous transaction set app.tenant_id and whose next one does not,
+-- current_setting returns '' and ''::uuid RAISES instead of filtering.
+CREATE POLICY outbox_messages_isolation ON outbox_messages
+    USING      (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid)
+    WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid);
+
+-- Grants. Application code only ever enqueues, so learnstack_app gets no UPDATE and no
+-- DELETE; status transitions belong to the dispatcher and purging belongs to the
+-- audited platform scope.
+GRANT SELECT, INSERT ON outbox_messages TO learnstack_app;
+GRANT SELECT, DELETE ON outbox_messages TO learnstack_platform;
+GRANT SELECT ON outbox_messages TO learnstack_outbox_admin;
+GRANT UPDATE (processed_at, attempts, last_error, available_after)
+    ON outbox_messages TO learnstack_outbox_admin;
+
+-- The OutboxProcessor connects as learnstack_outbox_admin, which holds BYPASSRLS so it
+-- can read every tenant's pending rows for dispatch. That bypass is the reason the
+-- table's own policy still matters: application code writing an outbox row does so as
+-- learnstack_app, inside the business transaction, and WITH CHECK pins the row to the
+-- caller's tenant. BYPASSRLS bypasses policies, not GRANTs — the column list above is
+-- what actually bounds the dispatcher, and SELECT ... FOR UPDATE SKIP LOCKED works with
+-- a column-level UPDATE grant, so no table-wide UPDATE is needed. When locked_by and
+-- locked_until land in Phase 02b, that migration extends this grant; a column added
+-- without extending it fails at runtime with `permission denied for table`.
+-- See ADR-0006 Amendment 1 and 15-event-and-outbox.md.
 ```
 
-`correlation_id` is `text NULL` (not `uuid NOT NULL`): APISIX's `request-id` plugin
-echoes any client-supplied id and falls back to a UUID, so the field is opaque and
-optional. The architecture deep dive lives in
-[15-event-and-outbox.md](../architecture/15-event-and-outbox.md).
+`organization_id` is `uuid NULL` and mirrors the organization context of the transaction
+that enqueued the row —
+[ADR-0032 § Sub-decision 12](../decisions/0032-exception-handling-logging-and-observability.md)
+makes it contractual. It is nullable because a tenant-wide event has no organization, not
+because it is optional on an org-scoped one. The outbox row is the **only** carrier of
+organization context across a transport boundary: the consumer runs in a fresh scope and
+restores `ITenantContext` from the envelope, so an organization that was never persisted
+here cannot be restored there. It is deliberately **not** indexed and **not** part of the
+table's RLS predicate — `outbox_messages` is a tenant-wide table whose policy carries no
+organization term, and the dispatcher reads the column rather than filtering on it.
+
+`correlation_id` is `text NOT NULL` (not `uuid`): it stores the **full W3C `traceparent`
+string** — `00-<32-hex trace-id>-<16-hex span-id>-<2-hex flags>` — so a consumer rehydrates
+the trace with `ActivityContext.TryParse(row.CorrelationId, traceState: null, out var ctx)`
+rather than re-deriving it
+([ADR-0032 § Sub-decision 12](../decisions/0032-exception-handling-logging-and-observability.md),
+[10-observability.md § Correlation](10-observability.md)). It is `text` rather than `uuid`
+because a traceparent is not a UUID. The request middleware synthesises a root traceparent
+when the inbound request carries none, and Hangfire enqueue rejects payloads without one, so
+no enqueue path can produce a row without a correlation id — which is what lets the
+registered `Outbox_Row_Carries_Correlation_Context` assertion rest on the schema rather than
+on developer discipline. The earlier justification for nullability — that APISIX's
+`request-id` plugin echoes any client-supplied id — did not survive contact with
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md), which demand-gates APISIX to
+[Phase 11](../roadmap/phase-11-production-hardening.md): the column exists from Phase 02a,
+so its contract cannot rest on a component that is not there yet. The architecture deep dive
+lives in [15-event-and-outbox.md](../architecture/15-event-and-outbox.md).
 
 ## Raw SQL
 
@@ -232,9 +745,19 @@ Forbidden: string interpolation with non-constant values.
   enforces this in the deployment config; deviation requires an ADR.
 - `app.tenant_id` (and `app.organization_id` when relevant) set **within the same
   transaction** as the work (`SET LOCAL ...`).
-- A checkout interceptor verifies both values are set before queries run; a missing
-  `app.tenant_id` throws `TenantContextMissingException` rather than risking an
-  unscoped query.
+- A `DbCommandInterceptor` — **not** a connection-checkout interceptor — guards the
+  context. Checkout happens before `TransactionBehavior` opens the transaction that
+  carries the `SET LOCAL` values, so a checkout hook would read an unset
+  `app.tenant_id` on every request and throw universally; under PgBouncer transaction
+  pooling it would sometimes read a *previous* transaction's leftover value, which is
+  worse than throwing. The command interceptor instead checks the in-process marker
+  `TransactionBehavior` stamps on the ambient transaction once it has issued the
+  `SET LOCAL` pair, and throws `TenantContextMissingException` when a command against a
+  `[TenantOwned]` table runs without it — no extra round trip.
+- The database-side guard is fail-closed independently: with `app.tenant_id` unset or
+  reset the policy predicate is `NULL`, so the query returns zero rows rather than
+  leaking. The interceptor exists to turn that silent empty result into a loud failure,
+  not to be the isolation boundary.
 
 ## Backups
 
diff --git a/docs/standards/07-frontend-architecture.md b/docs/standards/07-frontend-architecture.md
index 49c562e..40e7ae8 100644
--- a/docs/standards/07-frontend-architecture.md
+++ b/docs/standards/07-frontend-architecture.md
@@ -5,12 +5,12 @@
 [ADR-0004 Authentication Strategy](../decisions/0004-authentication-strategy.md)
 (Amendment 1: `learnstack-hub` realm for the separate operator portal),
 [ADR-0019 LearnStack Hub](../decisions/0019-learnstack-hub.md) (the operator portal
-`learnstack-hub-web` lives in the separate `learnstack-hub` repository).
+`operator-portal` lives in the separate `learnstack-hub` repository).
 
 Next.js App Router layout, tenant resolution, SDK shape, and runtime concerns for the
 tenant-facing `apps/web` application in *this* repository. See
 [03-frontend-coding.md](03-frontend-coding.md) for code-level style. The operator
-portal (`learnstack-hub-web`) lives in the separate `learnstack-hub` repo and follows
+portal (`operator-portal`) lives in the separate `learnstack-hub` repo and follows
 its own standards.
 
 ## Apps and Packages
@@ -46,7 +46,7 @@ frontend/
     auth/                      # OIDC client config + BFF helpers
 ```
 
-The operator portal `learnstack-hub-web` is a **separate Next.js application in the
+The operator portal `operator-portal` is a **separate Next.js application in the
 separate `learnstack-hub` repository** — not under this `frontend/` directory. The two
 apps do not share runtime code; if `packages/ui` is later extracted as a build-time
 dependency, it can be referenced by both repos. See
diff --git a/docs/standards/08-localization.md b/docs/standards/08-localization.md
index 09382ab..44a8699 100644
--- a/docs/standards/08-localization.md
+++ b/docs/standards/08-localization.md
@@ -23,7 +23,8 @@ Localization covers:
 - A tenant has a **default locale**.
 - A tenant has a set of **enabled locales**.
 - Translatable fields are explicitly marked at the schema level (`isLocalized: true`).
-- Slug is unique per `(tenant_id, locale)`.
+- Slug is unique per `(tenant_id, locale)`, enforced on the translation table and flat
+  across organizations — see [§ Pattern A](#pattern-a--side-translation-table-default-for-content-shaped-entities).
 - Fallback chain: requested → tenant default → field-level fallback (if allowed) → render-safe missing-content state.
 
 ## URL Strategy
@@ -51,8 +52,65 @@ application contract — consumers see resolved values, not the on-disk shape.
 Used for `Course`, `Lesson`, `Page`, `ContentEntry`, and anything with multiple
 translatable fields, per-locale slugs, or SEO metadata. The parent table holds
 non-translatable columns; a `<entity>_translations` table holds translatable fields
-keyed by `(<entity>_id, locale)`. The slug is **always per-locale** in this pattern
-(`UNIQUE (entity_id, locale, slug)`).
+keyed by `PRIMARY KEY (<entity>_id, locale)`.
+
+Four rules. A migration reviewer checks all four.
+
+1. **The parent holds no translatable column.** No `title`, no `description`, no `slug`.
+   A parent may hold a `slug_key` — a stable, locale-independent authoring handle — but
+   nothing routes on it.
+2. **The translation table carries `tenant_id` as a real column** and declares its own
+   `ENABLE` + `FORCE ROW LEVEL SECURITY` and full policy set from the canonical template
+   in [Database Standards](05-database.md). Row Level Security is per table; it is not
+   inherited from a parent through a check constraint, and a satellite carrying `title`
+   and `slug` carries the content. It also carries a mirrored `organization_id` when the
+   parent is `[OrganizationScoped]`, for the isolation predicate only, and its foreign
+   key to the parent is composite on `tenant_id`.
+3. **Slug uniqueness is `UNIQUE (tenant_id, locale, slug)`** on the translation table.
+   `UNIQUE (<entity>_id, locale, slug)` is **forbidden**: its columns are a proper
+   superset of the primary key, so it can reject no row the table would otherwise
+   accept, and two courses in one tenant end up sharing `/en/courses/beginner`.
+4. **`organization_id` does not belong in a slug unique key**, even when the entity is
+   organization-scoped. Two reasons, and the second survives fixing the first. In a
+   standard `UNIQUE` constraint PostgreSQL treats nulls as distinct, so
+   `UNIQUE (tenant_id, organization_id, locale, slug)` places no constraint at all on
+   tenant-wide rows — the rows a tenant authors first. And repairing that with
+   `NULLS NOT DISTINCT` still leaves an organization-scoped row and a tenant-wide row
+   free to claim one slug, while a host resolving to `(tenant_id, organization_id)`
+   serves both tiers and would have to pick a winner at render time. One flat namespace
+   per `(tenant_id, locale)` is the rule; an organization that wants its own variant of a
+   shared course gives it its own slug.
+
+```sql
+CREATE TABLE course_translations (
+    course_id       uuid NOT NULL,
+    tenant_id       uuid NOT NULL,
+    organization_id uuid NULL,        -- mirrors the parent; for RLS, never for uniqueness
+    locale          text NOT NULL,
+    title           text NOT NULL,
+    description     text NULL,
+    slug            text NOT NULL,
+    seo_title       text NULL,
+    seo_description text NULL,
+    PRIMARY KEY (course_id, locale),
+    CONSTRAINT ux_course_translations_tenant_id_locale_slug
+        UNIQUE (tenant_id, locale, slug),
+    CONSTRAINT fk_course_translations_course
+        FOREIGN KEY (tenant_id, course_id) REFERENCES courses (tenant_id, id)
+        ON DELETE CASCADE
+);
+```
+
+Slug lookup is **exact** on `(tenant_id, locale, slug)`. The fallback chain resolves
+display fields after the entity is found; it never resolves a slug. An entity with no
+translation in the requested locale has no URL in that locale, and a link to it is
+omitted rather than rendered dead.
+
+A slug collision returns `Result.Fail(business_rule_violation, …)` from the publish
+command. It names the conflicting entity when the caller may read it — tenant-wide rows
+and the caller's own organization's rows both qualify under the canonical policy — and
+otherwise names only the slug and the locale, because naming a row in another
+organization would leak across the boundary Row Level Security exists to hold.
 
 ### Pattern B — JSONB localized field (for compact taxonomy-style fields)
 
@@ -146,7 +204,8 @@ Localized content requires tests for:
 - Requested locale render.
 - Fallback locale render.
 - Missing-translation render.
-- Locale-specific slug uniqueness.
+- Locale-specific slug uniqueness, including the tenant-wide-versus-organization-scoped
+  collision and the same-slug-different-locale case.
 - Notification template selection per recipient locale.
 
 ## Forbidden
@@ -156,3 +215,9 @@ Localized content requires tests for:
 - Storing localized text in a non-localized field then "interpreting" it.
 - Using locale-derived `if`s (`if (locale === "tr")`); branch on capabilities, not on locale identity.
 - Truncating BCP 47 codes (`en-GB` ≠ `en`).
+- Putting a translatable field — `title`, `description`, `slug` — on the parent table
+  when the entity uses Pattern A.
+- Putting `organization_id` inside a slug unique key (§ Pattern A rule 4), or declaring a
+  slug constraint whose columns are a superset of the translation table's primary key.
+- Falling back to another locale to resolve a **slug**. Fallback applies to display
+  fields after the entity is found, never to the lookup.
diff --git a/docs/standards/11-security.md b/docs/standards/11-security.md
index da8f25b..4a817ec 100644
--- a/docs/standards/11-security.md
+++ b/docs/standards/11-security.md
@@ -2,13 +2,17 @@
 
 **Status:** Active
 **Derives from:** [ADR-0003 Tenant Isolation Defense in Depth](../decisions/0003-tenant-isolation-defense-in-depth.md)
-(Amendment 1: Organization Scope),
+(Amendment 1: Organization Scope; **Amendment 3: corrected RLS template, database role
+model, and session-variable placement**),
 [ADR-0004 Authentication Strategy](../decisions/0004-authentication-strategy.md)
 (Amendment 1: `learnstack-hub` realm),
 [ADR-0015 API Gateway: APISIX](../decisions/0015-api-gateway-apisix.md),
 [ADR-0017 Tenant + Organization Hierarchy](../decisions/0017-tenant-organization-hierarchy.md),
 [ADR-0019 LearnStack Hub](../decisions/0019-learnstack-hub.md),
-[ADR-0020 Triple Deployment + Hybrid License](../decisions/0020-triple-deployment-hybrid-license.md).
+[ADR-0020 Triple Deployment + Hybrid License](../decisions/0020-triple-deployment-hybrid-license.md),
+[ADR-0033 Audit Durability Model](../decisions/0033-audit-durability-model.md),
+[ADR-0034 Hub Contract Surface Invariant](../decisions/0034-hub-contract-surface-invariant.md),
+[ADR-0035 Demand-Gated Infrastructure](../decisions/0035-demand-gated-infrastructure.md).
 
 Security is layered. No single control is sufficient. The standards here apply to every PR.
 
@@ -122,6 +126,15 @@ All tenant-facing traffic enters through **APISIX** in standalone mode per
 [ADR-0015](../decisions/0015-api-gateway-apisix.md). The gateway is a defense-in-depth
 layer, not the sole control — the API re-verifies everything.
 
+> **When this becomes live.** APISIX is demand-gated per
+> [ADR-0035](../decisions/0035-demand-gated-infrastructure.md): its trigger is the first
+> non-development deployment that needs edge rate limiting, host routing, or JWT
+> pre-validation, and it lands in
+> [Phase 11](../roadmap/phase-11-production-hardening.md). Until then ASP.NET middleware
+> carries the same responsibilities in-process. Nothing in this section is optional once
+> the gateway is in front of production traffic; none of it is a reason to weaken the
+> in-process control, because the API re-verifies either way.
+
 - `jwt-auth` plugin verifies the access token against the `learnstack` realm's public
   key set; the API also verifies. Both must pass.
 - `cors` plugin handles preflight; authenticated cross-origin traffic is allow-listed
@@ -141,19 +154,35 @@ level.
 ## Hub Contract Surface
 
 The LearnStack ↔ Hub API is a **separate, narrow** surface with stronger controls than
-tenant-facing endpoints. Per
-[ADR-0019](../decisions/0019-learnstack-hub.md):
+tenant-facing endpoints. Per [ADR-0019](../decisions/0019-learnstack-hub.md) and
+[ADR-0034](../decisions/0034-hub-contract-surface-invariant.md):
 
 - **mTLS** with LearnStack-internal CA-signed client certs. Certs are rotated yearly.
 - **Signed JWT (RS256)** carrying `iss`, `aud=learnstack-internal`, `exp ≤ 5 min`,
   `jti` (replay-protected via short-TTL inbox).
 - **HMAC body signature** in the `X-Signature` header (HMAC-SHA256 of the raw body
   with a per-deployment shared secret).
-- All three layers must validate. Failure of any returns `401` with no detail leak.
-- The endpoint set is closed at four:
-  `POST /api/v1/internal/license/verify`, `POST /api/v1/usage/report`,
-  `PUT /api/internal/tenants/{id}/entitlements`, `POST /api/internal/tenants`. Adding
-  a fifth requires an ADR.
+- All three layers must validate on **every** endpoint in the surface, but they fail at
+  two different layers. `/api/internal/*` is bound to its own mTLS listener and is never
+  proxied by APISIX, so a missing, expired or untrusted client certificate is rejected
+  **during the TLS handshake** — no HTTP request reaches the application, so there is no
+  status code and no body to leak. Only the JWT and HMAC checks return `401`, with no
+  detail. Do not write a handler that returns `401` for a certificate failure; it would
+  never be reached, and its existence implies a listener that terminates TLS without
+  requiring the client certificate.
+- The surface is governed by two invariants, not by an endpoint count: the Hub stores no
+  tenant content, and every crossing goes through `IEntitlementProvider`,
+  `IUsageReporter`, or `IHubTenantSync`. The enumerated endpoint set lives in
+  [20-infrastructure-stack.md § Hub HTTPS Contract Surface](20-infrastructure-stack.md);
+  adding an endpoint still requires an ADR, because the surface is a cross-repository
+  contract.
+- **TLS certificates and private keys never travel in the entitlement payload.** That
+  payload is cached, logged, audited and mirrored. Cert material moves by secret-store
+  replication and is referenced from `PUT /api/internal/tenants/{id}/host-mappings` by
+  path, never by value ([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)).
+- **Host resolution never calls the Hub.** `IHostToTenantResolver` reads
+  `platform_host_to_tenant` and nothing else, so a Hub outage cannot take anonymous
+  public pages down.
 
 ## Authorization
 
@@ -181,16 +210,97 @@ for the full strategy. Standards-side:
   Roslyn-allowlist attribute and an audit-log call.
 - Background jobs **must** receive `TenantId` (and `OrganizationId?`) in their
   payload; jobs without it fail at registration.
-- Connection pool checkout sets both `app.tenant_id` and `app.organization_id`
-  before any work runs (`SET LOCAL` inside the ambient transaction; see
-  [05-database.md § Connection Management](05-database.md)).
+- The `app.tenant_id` and `app.organization_id` session variables are set with
+  `SET LOCAL` inside the ambient transaction — see § Tenant Context immediately below,
+  which is the single authority for that placement.
+
+## Tenant Context
+
+**This section is the single authority for RLS session-variable placement.** Every other
+document links here rather than restating the mechanism.
+
+Row Level Security predicates read four PostgreSQL session variables — `app.tenant_id`,
+`app.organization_id`, `app.scope`, and `app.resolving_host` — whose canonical spellings
+and canonical policy templates live in
+[05-database.md § Tenant-Owned and Organization-Scoped Tables](05-database.md) and
+[05-database.md § Table classes](05-database.md). This section fixes **where** the first
+three are set. `app.resolving_host` is set by `CachedHostToTenantResolver` alone, in its
+own short read-only transaction before the host lookup, because the row that determines
+the tenant must be readable before any tenant context exists; it is read by exactly one
+policy, on `platform_host_to_tenant`.
+
+### The rule
+
+`app.tenant_id`, `app.organization_id` **and `app.scope`** are set with **`SET LOCAL`,
+inside the ambient transaction, as the first statement after it opens** — in practice by
+`TransactionBehavior` (step 6 of the MediatR pipeline), from the `ITenantContext` that
+`TenantContextBehavior` asserted at step 4.
+
+`SET LOCAL` and `set_config(name, value, true)` are **transaction-local**. PostgreSQL
+discards them when the transaction ends, and they have no effect at all outside one. Two
+consequences follow, and both are load-bearing:
+
+- **Not from a MediatR behavior that runs before `TransactionBehavior`.** A value set at
+  step 4 is gone before the step-6 transaction opens, so every subsequent query runs with
+  an unset `app.tenant_id`.
+- **Not from a `DbConnectionInterceptor`.** Interceptors fire when the connection opens,
+  not when a transaction starts. Under PgBouncer transaction pooling the connection is
+  shared across transactions, so the value is either absent or — worse — left over from
+  another tenant's transaction.
+
+Because every `current_setting` read is called with its missing-OK argument (`true`)
+**and** wrapped in `NULLIF(…, '')`, both an unset and a reset variable yield `NULL` and
+the policy predicate filters the row out. The failure mode is an empty result set, not a
+leak — but an empty result set arriving from production is an outage, so a
+`DbCommandInterceptor` additionally asserts that `TransactionBehavior` has already issued
+the `SET LOCAL` pair before any command against a `[TenantOwned]` table runs, and throws
+`TenantContextMissingException` when it has not. It cannot be a connection-checkout
+interceptor, for the same reason it cannot be a `DbConnectionInterceptor` that *sets* the
+values: checkout precedes the transaction, so the transaction-local value is not there to
+be observed ([05-database.md § Connection Management](05-database.md)).
+
+### Corrections this supersedes
+
+Six other places previously described different placements. All are corrected; if a
+stale copy surfaces, this section wins:
+
+| Document | Previously said | Now |
+|---|---|---|
+| [02-backend-coding.md § Pipeline Behaviors](02-backend-coding.md) | Pipeline step 4 (`TenantContextBehavior`) sets the variables via a `DbConnectionInterceptor` | Step 4 asserts and carries tenant context; step 6 sets the variables inside the transaction, and links here |
+| Phase 02a Packet 3 `TenantContextBehavior` code TODO | Names a `DbConnectionInterceptor` as the mechanism | Corrected in [Phase 02a Packet 3b](../roadmap/phase-02a-kernel-tenancy.md) to point here and at Packet 7, which implements it |
+| [33-cross-cutting-concerns.md § Pipeline](../architecture/33-cross-cutting-concerns.md) | Step 4 sets the RLS GUCs via a `DbConnectionInterceptor` | Step 4 asserts only; step 6 issues `SET LOCAL` inside the transaction |
+| [ADR-0032 § Sub-decision 2](../decisions/0032-exception-handling-logging-and-observability.md) diagram | `TenantContextBehavior (assert resolved; set RLS GUC)` | Corrected in that ADR's Amendment 2, item 3 |
+| [09-tenant-isolation.md § Isolation flow](../architecture/09-tenant-isolation.md) mermaid | The accessor issues `SET LOCAL` from middleware, before any transaction exists | The transaction issues it at step 6 |
+| [Phase 02a § Cross-cutting Concerns](../roadmap/phase-02a-kernel-tenancy.md) | `TenantContextBehavior` (asserts resolved + sets RLS GUCs) | Asserts only; `TransactionBehavior` sets them |
+
+Neither error was visible in review because the corpus described the *layers* correctly
+while describing the *ordering* wrongly, and no code exercised the ordering yet. The
+implementation lands in
+[Phase 02a Packet 7](../roadmap/phase-02a-kernel-tenancy.md).
+
+### Related authorities
+
+- [ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md) — the
+  corrected RLS policy template, the four-role database model, and the rule that
+  isolation tests connect as `learnstack_app`.
+- [05-database.md § Tenant-Owned and Organization-Scoped Tables](05-database.md) — the
+  single canonical SQL template. It is not repeated here, or anywhere else.
+- [05-database.md § Connection Management](05-database.md) — PgBouncer transaction-mode
+  pooling, which this rule depends on.
+
+A test that connects as the table owner or as a `BYPASSRLS` role passes even when every
+policy is inert. Isolation tests connect as `learnstack_app`; the suite is a
+[Phase 02a Packet 7](../roadmap/phase-02a-kernel-tenancy.md) deliverable.
 
 ## Secrets and Configuration
 
-- Secrets live in **Vault** (production / staging / dev) accessed via `ISecretProvider`
-  (Dapr secret store) per
-  [ADR-0014](../decisions/0014-adopt-dapr.md). Local development can fall back to
-  `EnvironmentSecretProvider`; `.env.example` is checked in, `.env` is gitignored.
+- Every secret read goes through **`ISecretProvider`**. The registered implementation is
+  `ConfigurationSecretProvider` until Vault's trigger fires — secrets must rotate without
+  a redeploy, or a non-development deployment exists — at which point
+  `DaprSecretProvider` → Vault takes over per
+  [ADR-0014](../decisions/0014-adopt-dapr.md) and
+  [ADR-0035](../decisions/0035-demand-gated-infrastructure.md). Call sites are identical
+  either way. `.env.example` is checked in; `.env` is gitignored.
 - Secret namespace: `learnstack/{deployment}/{module}/{key}`. The deployment segment is
   `development | saas | dedicated | selfhosted`.
 - Production secrets rotated at least every 90 days where rotation is feasible (DB
@@ -242,7 +352,7 @@ for the full strategy. Standards-side:
 
 | Surface | Limit |
 |---------|-------|
-| `/v1/auth/*` (login, password reset, register) | 5 req/min per IP |
+| `/api/v1/auth/*` (login, password reset, register) | 5 req/min per IP |
 | Anonymous API | 60 req/min per IP |
 | Authenticated API | 600 req/min per token |
 | Write endpoints | 60 req/min per token |
@@ -301,11 +411,27 @@ where plan-level `LimitKeys.MaxApiRequestsPerHour` differs per tenant.
 ## Audit Log
 
 Every privileged operation writes an audit log entry per
-[ADR-0016 Audit Log Subsystem](../decisions/0016-audit-log-subsystem.md) and the
-[18 Audit Coverage Standard](18-audit-coverage.md). Coverage is **MUST / SHOULD / MAY**
-per module-operation; the MediatR `AuditLogBehavior` writes through `IAuditStore` —
-modules never write `audit_log` directly. Entries are append-only, partitioned by
-month, and queryable by tenant admins for their own tenant (org-admins for their org).
+[ADR-0033 Audit Durability Model](../decisions/0033-audit-durability-model.md)
+(supersedes ADR-0016) and the [18 Audit Coverage Standard](18-audit-coverage.md).
+Coverage is **MUST / SHOULD / MAY** per module-operation; the MediatR
+`AuditLogBehavior` writes through `IAuditStore` — modules never write `audit_log`
+directly. Entries are append-only and queryable by tenant admins for their own tenant
+(org-admins for their org).
+
+Security-relevant durability rules:
+
+- **MUST-class audit fails closed.** The row is enrolled in the same
+  `DbContext.SaveChanges` as the business write, so a privileged operation cannot commit
+  unaudited. It also means the insert runs while `app.tenant_id` is set, which is what
+  lets Row Level Security accept it.
+- **A failure to read `AuditConfig` fails closed too.** A tenant override may narrow
+  SHOULD/MAY coverage; it may never remove baseline MUST coverage.
+- SHOULD/MAY-class audit stays best-effort, and its accepted loss is written down rather
+  than assumed.
+- Monthly partitioning and the retention job land in
+  [Phase 11](../roadmap/phase-11-production-hardening.md) per
+  [ADR-0035](../decisions/0035-demand-gated-infrastructure.md) — audit correctness
+  cannot be retrofitted, audit scale can.
 
 ## Incident Response
 
diff --git a/docs/standards/13-documentation.md b/docs/standards/13-documentation.md
index cbb8446..ceae775 100644
--- a/docs/standards/13-documentation.md
+++ b/docs/standards/13-documentation.md
@@ -149,6 +149,8 @@ Common diagram types:
 - Use tables when comparing options or listing rules.
 - Code samples short, compilable in principle, using project conventions.
 - Cross-link liberally: glossary terms, related architecture docs, standards, ADRs.
+- Markdown prose hard-wraps at 88 columns. Tables, fenced code blocks and long URLs
+  are exempt.
 
 ## Glossary
 
@@ -213,7 +215,7 @@ Amendments must not change the Decision section. If the decision itself changes,
 | New translatable content type | i18n strategy doc |
 | New Tenant Customization aggregate | [32-tenant-customization-model.md](../architecture/32-tenant-customization-model.md) + glossary |
 | New feature key or limit key | [21-feature-flags.md](../architecture/21-feature-flags.md) catalog + matching `FeatureKeys` / `LimitKeys` entry |
-| New Hub endpoint | New ADR (the four-endpoint surface is closed) + [24-learnstack-hub.md](../architecture/24-learnstack-hub.md) |
+| New Hub endpoint | New ADR (the surface is a cross-repository contract; see [ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)) + [24-learnstack-hub.md](../architecture/24-learnstack-hub.md) |
 | Standards rule change | The standard itself + an ADR if non-trivial |
 
 ## Documentation Reviews
diff --git a/docs/standards/14-git-workflow.md b/docs/standards/14-git-workflow.md
index d80f2d5..3ab37b8 100644
--- a/docs/standards/14-git-workflow.md
+++ b/docs/standards/14-git-workflow.md
@@ -51,7 +51,7 @@ Rules:
   that materially contributed. The canonical form is the agent's product name +
   underlying model + context length, with `<noreply@anthropic.com>` as the email
   unless the agent vendor specifies otherwise. Examples:
-  - `Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>`
+  - `Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>`
     (default for Claude Code sessions in this repo).
   - `Co-Authored-By: Codex Opus 4.7 (1M context) <noreply@anthropic.com>` (when the
     assistant is OpenAI Codex / a Codex-derived agent acting on `AGENTS.md`).
@@ -78,7 +78,7 @@ backed by ILiveClassProvider.CreateJoinTokenAsync.
 
 ADR: 0005
 Module: Classroom, Identity
-Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 ```
 
 ## Pull Requests
diff --git a/docs/standards/18-audit-coverage.md b/docs/standards/18-audit-coverage.md
index d87cbe8..7ad797f 100644
--- a/docs/standards/18-audit-coverage.md
+++ b/docs/standards/18-audit-coverage.md
@@ -1,7 +1,9 @@
 # 18 — Audit Coverage Standards
 
 **Status:** Active
-**Derives from:** [ADR-0016 Audit Log Subsystem](../decisions/0016-audit-log-subsystem.md),
+**Derives from:** [ADR-0033 Audit Durability Model](../decisions/0033-audit-durability-model.md)
+(supersedes [ADR-0016](../decisions/0016-audit-log-subsystem.md), which remains the
+subsystem's context),
 [ADR-0017 Tenant + Organization Hierarchy](../decisions/0017-tenant-organization-hierarchy.md),
 [11-security.md](11-security.md) § Audit Log,
 [01-architecture-standards.md](01-architecture-standards.md).
@@ -138,21 +140,39 @@ Rules:
 - One global `audit_log` table partitioned by `occurred_at` **monthly from day one**
   ([ADR-0016](../decisions/0016-audit-log-subsystem.md)). RLS isolates rows by
   `tenant_id`; the partition strategy serves retention pruning.
-- Append-only; the `AuditEntry` aggregate inherits `Entity<TId>` **not**
-  `AuditableEntity<T>`. No `UPDATE` or `DELETE` in application code; CI rejects
-  `UpdateAsync` / `DeleteAsync` calls against `AuditEntry` and a Postgres trigger
-  rejects them at the database layer too.
+- Append-only. The `AuditEntry` aggregate inherits `Entity<TId>` **not**
+  `AuditableEntity<T>` and exposes no mutators; `IAuditStore` has no update method; and
+  the runtime database role `learnstack_app` holds no `UPDATE` or `DELETE` privilege on
+  `audit_log` at all. Exactly **two** mutating paths exist, both owned by the Audit
+  module, both running as `learnstack_platform` through the audited
+  `EnterPlatformAdminScope(reason)` path, and both constrained by the
+  `audit_log_append_only_guard` trigger rather than by convention:
+  - **GDPR redaction** — an `UPDATE` that may change only `actor_email`, `ip_address`,
+    `user_agent`, `before_state`, `after_state` and `changes`. The trigger rejects an
+    `UPDATE` altering any other column, including `actor_user_id`, `operation`, `outcome`
+    and `timestamp`.
+  - **Retention purge** — a `DELETE` of rows past their retention. After Phase 11
+    partitioning this becomes `DETACH` + `DROP PARTITION` and issues no `DELETE` at all.
+
+  A rule that forbade *every* `UPDATE` and `DELETE` would have made both shipped-by-design
+  paths unimplementable. See
+  [31-audit-subsystem.md § 7 Data model → Append-only enforcement](../architecture/31-audit-subsystem.md)
+  for the trigger and § 10 for the redaction path.
 - Tenant admins query their own tenant's entries through a paginated, indexed view.
   Org admins additionally filter by `organization_id`. Platform admins query across
   tenants through a separate read role. Hub operators are platform admins from this
   surface's perspective and their reads are themselves audited.
 - The audit log is **never** the source of truth for application state; downstream
   consumers project from integration events, not from audit entries.
-- Capture pipeline: `AuditChangeTrackerInterceptor` (EF Core SaveChanges interceptor)
-  → `IAuditStateCapture` (before/after/changes JSON capture) →
-  `AuditLogBehavior` (MediatR pipeline behavior that enriches with actor + correlation
-  + operation metadata and writes through `IAuditStore`). Modules see none of this
-  plumbing.
+- Capture pipeline — **decide → write → reconcile**
+  ([ADR-0033](../decisions/0033-audit-durability-model.md)): `AuditLogBehavior` (step 3)
+  classifies and declares a MUST-class intent in `IAuditStateCapture`;
+  `AuditChangeTrackerInterceptor` snapshots each `SaveChanges` into the same buffer and
+  writes nothing; `TransactionBehavior` (step 6) calls `IAuditStore.WritePendingAsync`
+  immediately before `COMMIT`, inserting the complete row on the ambient transaction, and
+  then records whether the commit succeeded; `AuditLogBehavior` reconciles on the way out,
+  re-writing the row standalone whenever the transaction did not commit. Modules see none
+  of this plumbing.
 
 ## Retention
 
@@ -169,7 +189,31 @@ A tenant cannot reduce retention below the platform-defined floor for `security-
 
 ## Required Behaviours
 
-- Every command handler that mutates a MUST-audit resource writes the audit entry in the **same transaction** as the state change (via the outbox if dispatching to consumers, but the audit row itself is local).
+- Every command that mutates a MUST-audit resource has its audit row written in the
+  **same transaction** as the state change, per
+  [ADR-0033](../decisions/0033-audit-durability-model.md). Atomicity comes from the
+  transaction, not from sharing a `SaveChanges` call. If the row cannot be written, the
+  business transaction **fails closed**: it rolls back and the caller receives
+  `503 audit_unavailable` rather than committing unaudited. ADR-0016's "audit never blocks
+  business logic" now applies to SHOULD/MAY-class entries only.
+- **A committed audit row and a committed business row are the same event.** "Inserted"
+  is not "committed": if the transaction rolls back — including on the ordinary path where
+  a handler saves and then returns a failure `Result` — the audit row goes with it and is
+  re-written standalone with outcome `failed`. A MUST-class operation is never left with
+  no row.
+- MUST-class events with **no** business transaction — `denied` outcomes, read-sensitive
+  queries, non-mutating security events — are written standalone, in a short transaction
+  that issues `SET LOCAL app.tenant_id` as its first statement, on a connection outside
+  any business transaction.
+- Classification does not read the database on the request path. The MUST/SHOULD/MAY
+  catalogue is in-process; per-tenant `audit_config` overrides are a cached projection
+  whose loader sets its own tenant GUC. A failure to read a tenant override falls back to
+  the catalogue — which carries the MUST floor, so nothing proceeds unaudited — and is
+  logged and surfaced on the audit health check. An operation the catalogue does not
+  classify at all is **rejected**. A tenant override may narrow SHOULD/MAY coverage and
+  may never remove baseline MUST coverage.
+- Fan-out to external sinks rides the outbox and is best-effort; the **local audit row**
+  is not.
 - Failed `denied` outcomes are audited even though no state changed.
 - Background jobs that mutate MUST-audit resources receive the `actor` via job payload (operator id, or the seed of a system actor with a stable id) and write the entry under that identity.
 - Integration event handlers that mutate state are treated as actors of type `system` and audited accordingly.
@@ -179,10 +223,14 @@ A tenant cannot reduce retention below the platform-defined floor for `security-
 
 The following tests live in `LearnStack.Tests.Architecture` and run on every PR:
 
-- Every handler that calls `SaveChanges` against a MUST-audit aggregate **also** writes
-  an audit row in the same transaction (instrumented via the EF interceptor).
-- The `AuditEntry` aggregate is never updated or deleted by application code (Roslyn
-  analyzer + Postgres trigger).
+- A MUST-class command writes exactly one `audit_log` row, on the same transaction as the
+  business write
+  ([`MustClass_Audit_Writes_Share_The_Business_Transaction`](21-architecture-tests-catalogue.md)).
+- A MUST-class command whose transaction rolls back still produces exactly one row, with
+  outcome `failed` ([`Audit_Survives_Transaction_Rollback`](21-architecture-tests-catalogue.md)).
+- `audit_log` accepts no `UPDATE` or `DELETE` from `learnstack_app`, and accepts from
+  `learnstack_platform` only a column-restricted redaction `UPDATE` and a purge `DELETE`
+  ([`AuditLog_Update_Is_Column_Restricted`](21-architecture-tests-catalogue.md)).
 - `IAuditStore` is the only sanctioned write path: `Modules_Do_Not_Write_AuditLog_Directly`.
 - Every module ships an `audit.md` matrix at the path expected by the doc-coverage
   check.
@@ -203,9 +251,9 @@ Platform admins additionally see cross-tenant entries through a separate route g
 
 ## Forbidden
 
-- Writing an audit entry **after** the controlling transaction commits (the entry can be lost on failure).
+- Writing a MUST-class audit entry **after** the controlling transaction commits, so that a commit failure can lose it. The standalone path is not this: it exists precisely for the cases where no business transaction committed, and it opens its own.
 - Truncating `before`/`after` snapshots silently — if the diff is too large, store an external pointer (`audit_blob_id`) but never an empty object.
-- Mutating an audit row in place.
+- Mutating an audit row in place from anywhere other than the two sanctioned paths (GDPR redaction, retention purge), or widening the trigger's redactable column set without an ADR. Granting `learnstack_app` `UPDATE` or `DELETE` on `audit_log`.
 - Storing audit entries in the same module's read schema (the audit aggregate is global / cross-module).
 - Reducing retention without an ADR.
 - Skipping the matrix in a module spec.
diff --git a/docs/standards/19-permissions.md b/docs/standards/19-permissions.md
index 75c15c1..a70ec34 100644
--- a/docs/standards/19-permissions.md
+++ b/docs/standards/19-permissions.md
@@ -19,7 +19,7 @@ Permissions are dotted, lowercase, three-part keys:
 Examples:
 
 - `education.course.write`
-- `enrollment.entitlement.read`
+- `enrollment.course_access.read`
 - `classroom.recording.delete`
 - `tenancy.feature_flag.admin`
 - `identity.membership.write`
@@ -65,7 +65,7 @@ disjoint and validated at seed time.
 | Scope | Examples | Granted to |
 |-------|----------|------------|
 | **Platform** | `platform.tenant.write`, `platform.feature_flag.admin`, `platform.audit.read`, `platform.hub.operator` | Only platform admins / Hub operators; never assignable to a tenant role. |
-| **Tenant** | `education.course.write`, `enrollment.entitlement.read`, `tenancy.organization.write`, `customization.content_type.write` | Tenant roles; permission check requires a `Membership` in the target tenant. |
+| **Tenant** | `education.course.write`, `enrollment.course_access.read`, `tenancy.organization.write`, `customization.content_type.write` | Tenant roles; permission check requires a `Membership` in the target tenant. |
 | **Organization** | `education.course.write` (org-scoped role), `enrollment.enrollment.write` (org-scoped role) | Org-scoped roles; permission check requires `Membership.OrganizationId` matches the resource's `OrganizationId` (or the role is tenant-scoped). |
 
 Tenant permissions are only meaningful inside a resolved tenant context. Org-scoped
@@ -92,8 +92,8 @@ public sealed class EnrollmentModule : IModule
         registry.Tenant("enrollment.enrollment.read",   "View enrollments");
         registry.Tenant("enrollment.enrollment.write",  "Create or update enrollments");
         registry.Tenant("enrollment.enrollment.delete", "Cancel enrollments");
-        registry.Tenant("enrollment.entitlement.read",  "View entitlements");
-        registry.Tenant("enrollment.entitlement.write", "Grant or revoke entitlements");
+        registry.Tenant("enrollment.course_access.read",  "View course access");
+        registry.Tenant("enrollment.course_access.write", "Grant or revoke course access");
         registry.Tenant("enrollment.cohort.read",       "View cohorts");
         registry.Tenant("enrollment.cohort.write",      "Create or update cohorts");
         registry.Tenant("enrollment.cohort.delete",     "Delete cohorts");
diff --git a/docs/standards/20-infrastructure-stack.md b/docs/standards/20-infrastructure-stack.md
index e9bd254..f56d43f 100644
--- a/docs/standards/20-infrastructure-stack.md
+++ b/docs/standards/20-infrastructure-stack.md
@@ -8,7 +8,17 @@
 [ADR-0021 Feature-Based Entitlement](../decisions/0021-feature-based-entitlement.md),
 [ADR-0029 Object Storage — SeaweedFS](../decisions/0029-object-storage-seaweedfs.md),
 [ADR-0030 Redis-compatible Store — Valkey](../decisions/0030-redis-compatible-store-valkey.md),
-[ADR-0031 PostgreSQL — Start on 18.x](../decisions/0031-postgresql-major-version.md).
+[ADR-0031 PostgreSQL — Start on 18.x](../decisions/0031-postgresql-major-version.md),
+[ADR-0034 Hub Contract Surface Invariant](../decisions/0034-hub-contract-surface-invariant.md),
+[ADR-0035 Demand-Gated Infrastructure](../decisions/0035-demand-gated-infrastructure.md).
+
+Two audit decisions are referenced here but **not owned** here, and the split matters
+because the two are easy to conflate:
+[ADR-0033](../decisions/0033-audit-durability-model.md) owns the audit **durability
+contract** — what must commit with what — and
+[ADR-0028](../decisions/0028-audit-log-partition-management.md) owns the `audit_log`
+**partition lifecycle**. This standard only records that partitioning is demand-gated
+and that modules never write `audit_log` directly.
 
 This standard defines how application code uses the foundation infrastructure introduced
 in the 2026-05-18 redesign: Dapr building blocks, the APISIX gateway, the Hub HTTPS
@@ -17,6 +27,59 @@ root. The broader operational rules (containers, CI/CD, DB ops, observability) l
 [12-infrastructure.md](12-infrastructure.md); the two standards are complementary, not
 overlapping.
 
+## Demand-Gated Building Blocks
+
+**Read this section before the rest of the document.** Most of what follows describes
+Dapr, Kafka, APISIX and Vault in the present tense. Those are accepted decisions about
+**what** LearnStack uses; per
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md) they are not all wired
+today, and this section says which are.
+
+The discriminator is the **one-way-door test**
+([00-principles.md § 16](00-principles.md)):
+
+> If I add this six months from now, will I have to touch code that is already written?
+
+A **yes** ships now — tenant and organization isolation, the `outbox_messages` table and
+its ownership, strongly-typed identifiers, the localization schema. A **no** ships as a
+**port with a working default implementation** now, and its vendor adapter lands in a
+named phase when a written trigger fires.
+
+| Building block | Port | Registered today | Adapter lands in | Trigger |
+|---|---|---|---|---|
+| Dapr pub/sub | `IEventBus` | `InProcessEventBus` | [Phase 11](../roadmap/phase-11-production-hardening.md) | A second process must consume an integration event |
+| Kafka | behind `IEventBus` | `InProcessEventBus` | [Phase 11](../roadmap/phase-11-production-hardening.md) | Cross-process volume, replay, or ordering is required |
+| Dapr state / Valkey | `ICacheService` | `InMemoryCacheService` | [Phase 11](../roadmap/phase-11-production-hardening.md) | More than one application instance runs concurrently |
+| Vault | `ISecretProvider` | `ConfigurationSecretProvider` (**startup-only**, see below) | [Phase 11](../roadmap/phase-11-production-hardening.md) | A production secret must rotate without a redeploy, **or** more than one operator needs access to production secrets |
+| APISIX | composition root | ASP.NET middleware | [Phase 11](../roadmap/phase-11-production-hardening.md) | A non-dev deployment needs edge rate limiting, host routing, or JWT pre-validation |
+| Hub entitlement | `IEntitlementProvider` | `NullEntitlementProvider` | [Phase 02c](../roadmap/phase-02c-hub-foundation.md) | A tenant must be billed or plan-gated |
+| Signed licence key | `IEntitlementProvider` | `NullEntitlementProvider` | [Phase 11](../roadmap/phase-11-production-hardening.md) | A Self-Hosted contract is signed |
+| Custom-domain TLS automation | `IHostToTenantResolver` + `ITlsCertificateProvider` | `platform_host_to_tenant` rows managed by configuration | [Phase 11](../roadmap/phase-11-production-hardening.md) | A tenant needs its own domain in production |
+| `audit_log` partitioning + retention | schema-internal | Single correct table | [Phase 11](../roadmap/phase-11-production-hardening.md) | Measured `audit_log` growth justifies partition maintenance |
+| Meilisearch | `ITenantSearch` | PostgreSQL full-text search | [Phase 09](../roadmap/phase-09-billing-integrations-analytics.md) | Search quality or scale exceeds PostgreSQL FTS |
+| LiveKit | `ILiveClassProvider` | none — scheduled, not gated; see the exception below | [Phase 08c](../roadmap/phase-08c-classroom.md) | Live classes become a product requirement |
+| Managed video transcoding | `IVideoTranscoder` | ffmpeg-backed worker ([Phase 04](../roadmap/phase-04-cms-media-pages.md)) | [Phase 11](../roadmap/phase-11-production-hardening.md) | In-house transcode backlog or per-minute cost exceeds the managed alternative |
+
+Rules that follow from this:
+
+- **Application code does not change when an adapter lands.** Every rule in the rest of
+  this document — cache key shape, topic naming, secret namespace, outbox ownership — is
+  written against the port and holds for the default implementation too. If a rule only
+  makes sense for the vendor adapter, it is a rule about the adapter and belongs in that
+  adapter's section, not in module guidance.
+- **`InProcessEventBus` is a first-class transport, not a stub.** Same
+  `IIntegrationEventHandler<T>`, same `IInboxGuard`, same tenant-context restoration as
+  the durable path. A development path that skips those never exercises the isolation
+  code, and every consumer would end up needing two implementations.
+- **A demand-gated block is not "deferred".** It qualifies only with all four of: a
+  port, a working default implementation, an owning phase, and a written trigger. If a
+  trigger fires earlier than its phase, the item moves to the phase where it fired and
+  ADR-0035's table is amended.
+- **Support claims follow the wiring.** `DeploymentMode` keeps all five values and the
+  composition root keeps branching on it, but only `Development` and `SaaS` are wired end
+  to end before Phase 11. `Dedicated`, `SelfHostedOnline` and `SelfHostedAirGapped` are
+  prepared seams, not supported deployments, until their integration suites exist.
+
 ## Composition Root and Deployment Mode
 
 Every host (`LearnStack.Api`, worker, background-service host) reads
@@ -53,13 +116,19 @@ Rules:
 |---|---|---|---|---|---|
 | Event bus | `InProcessEventBus` (MediatR) | `DaprEventBus` → Kafka | `DaprEventBus` → Kafka | `DaprEventBus` → Kafka (single-broker OK) | `DaprEventBus` → Kafka (single-broker OK) |
 | Cache | `InMemoryCacheService` | `DaprCacheService` → Valkey | `DaprCacheService` → Valkey | `DaprCacheService` → Valkey | `DaprCacheService` → Valkey |
-| Secrets | `EnvironmentSecretProvider` | `DaprSecretProvider` → Vault | `DaprSecretProvider` → Vault | `DaprSecretProvider` → Vault | `DaprSecretProvider` → Vault or file |
+| Secrets | `ConfigurationSecretProvider` | `DaprSecretProvider` → Vault | `DaprSecretProvider` → Vault | `DaprSecretProvider` → Vault | `DaprSecretProvider` → Vault or file |
 | Entitlement | `NullEntitlementProvider` | `HubEntitlementProvider` | `HubEntitlementProvider` | `HubEntitlementProvider` (phone-home) | `SignedLicenseKeyEntitlementProvider` |
 | Host → tenant | Config / single tenant | Hub-mirrored projection | Hub-mirrored projection | Hub-mirrored projection | Config / `.lic` claim |
 | Phone-home | n/a | enabled | enabled | enabled (daily, 30-day grace) | disabled |
 | Error tracking ([ADR-0032](../decisions/0032-exception-handling-logging-and-observability.md)) | `NoOpErrorTracker` | `SentryErrorTracker` | `SentryErrorTracker` | `SentryErrorTracker` (optional; `NoOp` if no DSN) | `LocalFileErrorTracker` |
 | OTLP exporter target ([ADR-0032](../decisions/0032-exception-handling-logging-and-observability.md)) | local OTel Collector (dev compose) | central Collector | central Collector | customer-managed Collector | local file `/var/learnstack/otel/` |
 
+**Reading the table.** It is the **target** wiring, not the current wiring. Every `Dapr*`
+cell resolves to the `Development` column's default implementation until that block's
+trigger fires (§ Demand-Gated Building Blocks). The branch structure is real and
+exercised from [Phase 02a Packet 5](../roadmap/phase-02a-kernel-tenancy.md); the
+right-hand implementations arrive with their adapters.
+
 ## Dapr Building Blocks
 
 LearnStack uses three Dapr building blocks: **pub/sub**, **state**, **secrets**. Other
@@ -72,8 +141,17 @@ ADR-0014 non-goals; do not introduce them without a new ADR.
   from inside the `OutboxProcessor`. Modules never call `IEventBus` directly — they
   write to the outbox.
 - Topic names follow `learnstack.{module}.{aggregate}` (`learnstack.identity.user`,
-  `learnstack.enrollment.enrollment`, `learnstack.classroom.session`). The
-  architecture test `Dapr_PubSub_TopicNames_FollowConvention` enforces this.
+  `learnstack.enrollment.enrollment`, `learnstack.classroom.session`). The convention
+  applies to `InProcessEventBus` too — it is how handlers are addressed, not a Dapr
+  detail — which is why leaving it unasserted against the transport that is actually
+  registered would be the wrong trade. Two tests, not one:
+  `Integration_Event_TopicNames_FollowConvention` is transport-independent, asserts the
+  convention over the declared event types, and lands with `InProcessEventBus` in
+  [Phase 02a Packet 5](../roadmap/phase-02a-kernel-tenancy.md);
+  `Dapr_PubSub_TopicNames_FollowConvention` additionally checks the Dapr component
+  bindings and lands with that adapter in
+  [Phase 11](../roadmap/phase-11-production-hardening.md). Both are registered in
+  [21-architecture-tests-catalogue.md](21-architecture-tests-catalogue.md).
 - Hub-side topics use the same `learnstack.hub.*` prefix
   (`learnstack.hub.entitlement`, `learnstack.hub.custom-domain.activated`).
 - Consumers implement `IIntegrationEventHandler<TEvent>` and **must** invoke
@@ -127,6 +205,16 @@ Rules:
   `IOptions<T>`. Runtime re-fetches happen via `IOptionsMonitor<T>` with a
   Vault-driven refresh — never an ad-hoc `ISecretProvider.GetAsync` call inside a hot
   path.
+- **Until the Vault adapter lands, that refresh path does not exist.** `Development` and
+  `SaaS` both run on `ConfigurationSecretProvider`, which resolves through
+  `IConfiguration` at composition time — including the Sentry DSN, which
+  `ErrorTrackingRegistration` reads once during registration. There is no configuration
+  reload and no options rebinding behind it, so **every secret is fixed for the lifetime
+  of the process and changing one is a redeploy**. That is not an oversight; it is
+  precisely what makes the Vault trigger above legible — "a production secret must rotate
+  without a redeploy" is a condition this arrangement cannot satisfy by construction, so
+  the day it is required is the day the adapter is required. Do not describe
+  `IOptionsMonitor<T>` refresh as available before then.
 - The secret namespace is `learnstack/{deployment}/{module}/{key}` (e.g.
   `learnstack/saas/notifications/email-provider-api-key`). The deployment segment
   matches `DeploymentMode` (lower-case).
@@ -176,20 +264,90 @@ Full deep dive: [15-event-and-outbox.md](../architecture/15-event-and-outbox.md)
 
 ## Hub HTTPS Contract Surface
 
-- The LearnStack core talks to the Hub through **exactly four** endpoints:
-  - `POST /api/v1/internal/license/verify` (LearnStack → Hub: license check)
-  - `POST /api/v1/usage/report` (LearnStack → Hub: usage telemetry)
-  - `PUT /api/internal/tenants/{id}/entitlements` (Hub → LearnStack: projection push)
-  - `POST /api/internal/tenants` (Hub → LearnStack: tenant create)
-- All four use **mTLS** + **signed JWT (RS256)** + **HMAC body signature**. No
-  additional endpoints get added to this surface without a new ADR.
+This is the day-to-day reference for the surface;
+[ADR-0034](../decisions/0034-hub-contract-surface-invariant.md) is the decision that
+governs it, and the Hub-side halves live in the `learnstack-hub` repository.
+
+### The two invariants
+
+The surface is governed by **two invariants, not by an endpoint count**. The corpus
+previously said "exactly four", which was never true — ADR-0019's own decision section
+enumerates six paths — and protecting the number caused real damage: TLS private keys
+were tunnelled through the entitlement payload to avoid declaring a fifth endpoint, and a
+host lookup was added to the Hub client without being recorded at all.
+
+1. **The Hub stores no tenant content.** Courses, lessons, learners, enrollments,
+   classroom sessions, media and content entries live exclusively in LearnStack. The Hub
+   holds tenant *metadata* — plan, subscription, licence, custom domain, compliance caps,
+   aggregated usage. Enforced by `Hub_NeverStores_TenantData` (a Hub-schema scan, owned
+   by the Hub repository).
+2. **Every LearnStack↔Hub crossing goes through a named adapter** —
+   `IEntitlementProvider`, `IUsageReporter`, `IHubTenantSync`. No other type in the
+   codebase may hold a Hub client. Enforced by
+   `Hub_Client_Referenced_Only_By_Named_Adapters` and
+   `LearnStack_Modules_DoNotReference_Hub`.
+
+Adding an endpoint still requires an ADR — not because the count is sacred, but because
+the surface is a cross-repository contract and both repositories have to agree on it.
+
+### The endpoint set
+
+**Hub → LearnStack** — served by the internal listener only, never routed publicly:
+
+| Method | Path | Purpose |
+|---|---|---|
+| `POST` | `/api/internal/tenants` | Create tenant + default organization |
+| `PUT` | `/api/internal/tenants/{id}/entitlements` | Push the entitlement projection |
+| `PUT` | `/api/internal/tenants/{id}/status` | Suspend / activate / archive |
+| `DELETE` | `/api/internal/tenants/{id}` | Terminate |
+| `GET` | `/api/internal/tenants/{id}/usage` | Pull aggregated usage |
+| `PUT` | `/api/internal/tenants/{id}/host-mappings` | Push host → `(tenant_id, organization_id?)` mappings |
+
+**LearnStack → Hub:**
+
+| Method | Path | Purpose |
+|---|---|---|
+| `POST` | `/api/v1/internal/license/verify` | Verify / pull the entitlement projection |
+| `POST` | `/api/v1/internal/license/refresh` | Scheduled phone-home refresh |
+| `POST` | `/api/v1/usage/report` | Report a usage metric (idempotent) |
+| `POST` | `/api/v1/internal/tenants/{id}/custom-domains` | Submit a custom domain on behalf of a tenant admin (proxied; `IHubTenantSync`) |
+
+The Hub's own tenant-facing and operator-facing APIs (`/api/v1/tenants/*`,
+`/api/v1/subscriptions/*`, `/api/v1/webhooks/*`) are **not** part of this surface. They
+are the Hub's public API, governed by the Hub repository.
+
+### Rules
+
+- **Every** endpoint above carries the full auth chain: **mTLS** + **signed JWT (RS256,
+  `aud=learnstack-internal`, `exp ≤ 5 min`, replay-protected `jti`)** + **HMAC body
+  signature**. All three must validate — but they fail at **two different layers**, and
+  the distinction is not cosmetic. `/api/internal/*` is bound to its own mTLS listener
+  and is **never proxied by APISIX**
+  ([30-api-gateway.md § Topology](../architecture/30-api-gateway.md)), so a missing,
+  expired or untrusted client certificate is rejected **during the TLS handshake**:
+  there is no HTTP request, therefore no status code and no response body. Only the JWT
+  and HMAC checks can return `401`, and they do so with no detail leak. A document
+  promising `401` for an mTLS failure is describing a listener that does not exist.
+  See [11-security.md § Hub Contract Surface](11-security.md).
+- **TLS certificates and private keys never travel in the entitlement payload.** That
+  payload is cached in `platform_entitlement_cache`, logged, audited and mirrored — every
+  property you do not want a private key to have. Certificate material moves between the
+  Hub-owned and LearnStack-owned secret stores by secret-store replication, referenced
+  from the `host-mappings` payload **by path, not by value**.
+- **Host resolution never calls the Hub.** `IHostToTenantResolver` reads
+  `platform_host_to_tenant` and nothing else; `IHubClient.LookupHostAsync` does not
+  exist. Putting the Hub on the hot path of an anonymous page load means a Hub outage
+  takes tenant marketing sites down — see § Host → Tenant Resolution below.
 - The Hub URL is read once at startup via `ISecretProvider` and bound to an
   `IOptions<HubOptions>` instance. Inject `IOptionsMonitor<HubOptions>` where dynamic
   refresh is needed.
-- An architecture test
-  (`LearnStack_Modules_DoNotReference_Hub`) ensures no module assembly references the
-  Hub URL directly; only the dedicated `IEntitlementProvider` / `IUsageReporter`
-  adapters in `LearnStack.Infrastructure` do.
+- The projection's wire shape is pinned by a checked-in `entitlement-v1.schema.json` and
+  a snapshot test in **both** repositories. A shape change that lands in one repository
+  and not the other is a contract break, and the snapshot tests are what catch it.
+- The Hub-backed adapters themselves are demand-gated: `NullEntitlementProvider` is the
+  registered implementation until a tenant must be billed or plan-gated, at which point
+  the adapters land in [Phase 02c](../roadmap/phase-02c-hub-foundation.md)
+  ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)).
 
 ## Entitlement Projection
 
@@ -199,6 +357,13 @@ Full deep dive: [15-event-and-outbox.md](../architecture/15-event-and-outbox.md)
 - `IFeatureFlags.IsEnabledAsync(FeatureKey)` is the only sanctioned read path. Direct
   SQL against `platform_entitlement_cache` outside the Tenancy module's infrastructure
   is forbidden (architecture test `Modules_Do_Not_Read_Entitlement_Cache_Directly`).
+- The resolution order is **normative**
+  ([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)):
+  `L1 in-process → L2 ICacheService → platform_entitlement_cache → Hub`. The durable
+  projection sits **between** the caches and the Hub precisely so a cold cache during a
+  Hub outage falls through to a stored answer with a recorded `grace_until`, rather than
+  throwing out of a feature-flag check. Each feature-key class declares fail-open or
+  fail-closed explicitly.
 - Cache TTLs: **L1 (in-process `IMemoryCache`)** = 60s; **L2 (Dapr state → Valkey)** =
   15-minute upper bound. Eager invalidation flows from the Dapr event
   (`learnstack.hub.entitlement` / `learnstack.cache.invalidation`); the TTLs are the
@@ -210,13 +375,23 @@ Full deep dive: [15-event-and-outbox.md](../architecture/15-event-and-outbox.md)
 ## Host → Tenant Resolution
 
 - The `platform_host_to_tenant` table is the **only** authority for
-  `host → (tenant_id, organization_id?)` mapping. It is populated by the Hub for
-  SaaS / Dedicated and by config for SelfHosted.
-- `IHostToTenantResolver` is the only sanctioned read path. The frontend edge calls it
-  via a thin API endpoint; the backend uses it directly for inbound request resolution.
-- Custom-domain activations on Hub publish `learnstack.hub.custom-domain.activated`
-  (and `.deactivated`) Dapr events; LearnStack listens, updates
-  `platform_host_to_tenant`, and invalidates the resolver cache.
+  `host → (tenant_id, organization_id?)` mapping. It is populated through
+  `PUT /api/internal/tenants/{id}/host-mappings` for SaaS / Dedicated and by
+  configuration for Self-Hosted.
+- `IHostToTenantResolver` is the only sanctioned read path, and it reads
+  `platform_host_to_tenant` and **nothing else**. It does not call the Hub — not on a
+  cache miss, not as a fallback, not ever
+  ([ADR-0034](../decisions/0034-hub-contract-surface-invariant.md)). Host resolution sits
+  on the hot path of every anonymous public page load; a resolver that calls a control
+  plane converts a Hub outage into a tenant-marketing-site outage.
+- A cache miss re-reads the table. An unknown host is a 404, not a Hub lookup.
+- The frontend edge calls the resolver via a thin API endpoint; the backend uses it
+  directly for inbound request resolution.
+- Custom-domain activations on Hub push a new host-mapping set; LearnStack updates
+  `platform_host_to_tenant` and invalidates the resolver cache. Once the event-bus
+  adapter lands, the same update also arrives as
+  `learnstack.hub.custom-domain.activated` / `.deactivated` — the push endpoint remains
+  the authority, the event is the invalidation signal.
 
 ## Audit Plumbing
 
@@ -261,11 +436,17 @@ Full deep dive: [15-event-and-outbox.md](../architecture/15-event-and-outbox.md)
 - Reading `DeploymentMode` from inside a module.
 - Calling Hub endpoints from anywhere except the dedicated `IEntitlementProvider` /
   `IUsageReporter` / `IHubTenantSync` adapters.
+- Resolving a host by calling the Hub. `IHostToTenantResolver` reads
+  `platform_host_to_tenant` only.
+- Carrying TLS certificates or private keys in the entitlement payload, or in any other
+  payload LearnStack caches, logs, audits or mirrors.
 - Writing `outbox_messages` from outside the `IOutbox` interface.
 - Writing `audit_log` from outside the `IAuditStore` interface.
 - Writing `platform_entitlement_cache` from outside `IEntitlementProvider.RefreshAsync`.
 - Adding a fifth Dapr building block without a new ADR.
-- Adding a fifth Hub endpoint without a new ADR.
+- Adding an endpoint to the Hub contract surface without a new ADR.
+- Promoting a demand-gated adapter without recording which trigger fired, and amending
+  [ADR-0035](../decisions/0035-demand-gated-infrastructure.md)'s table.
 
 ## References
 
@@ -275,6 +456,8 @@ Full deep dive: [15-event-and-outbox.md](../architecture/15-event-and-outbox.md)
 - [ADR-0020 Triple Deployment + Hybrid License](../decisions/0020-triple-deployment-hybrid-license.md)
 - [ADR-0021 Feature-Based Entitlement](../decisions/0021-feature-based-entitlement.md)
 - [ADR-0032 Exception Handling, Logging, and Observability Architecture](../decisions/0032-exception-handling-logging-and-observability.md)
+- [ADR-0034 Hub Contract Surface Invariant](../decisions/0034-hub-contract-surface-invariant.md)
+- [ADR-0035 Demand-Gated Infrastructure](../decisions/0035-demand-gated-infrastructure.md)
 - [29-dapr-integration.md](../architecture/29-dapr-integration.md)
 - [30-api-gateway.md](../architecture/30-api-gateway.md)
 - [33-cross-cutting-concerns.md](../architecture/33-cross-cutting-concerns.md)
diff --git a/docs/standards/21-architecture-tests-catalogue.md b/docs/standards/21-architecture-tests-catalogue.md
index 83790b9..6923807 100644
--- a/docs/standards/21-architecture-tests-catalogue.md
+++ b/docs/standards/21-architecture-tests-catalogue.md
@@ -7,10 +7,10 @@ subsequent ADRs and phases land their tests; per-test ownership stays with
 the originating ADR / standard.
 
 The single source of truth for the **identifier**, the **assertion**, the
-**source ADR / standard**, and the **scope** of every non-skippable rule
-LearnStack enforces at build time — whether the rule lives in the
-`LearnStack.Tests.Architecture` assembly (xUnit / NetArchTest) or in a
-compile-time Roslyn analyzer under `backend/analyzers/`.
+**source ADR / standard**, the **scope**, and the **implementation status** of every
+non-skippable rule LearnStack enforces at build time — whether the rule lives in the
+`LearnStack.Tests.Architecture` assembly (xUnit / NetArchTest), in a sibling test
+assembly, or in a compile-time Roslyn analyzer under `backend/analyzers/`.
 
 ## Why a catalogue
 
@@ -23,7 +23,152 @@ exactly one line.
 
 The catalogue is **not** a substitute for the originating ADR / standard —
 the rule still lives there. The catalogue only owns the **name**, the
-**short assertion**, and the **pointer back**.
+**short assertion**, the **status**, and the **pointer back**.
+
+That was the theory. In practice the drift this document exists to prevent had already
+happened before a single named test was written: **six** competing spellings of the
+tenant-isolation rule across eleven files, and **five** of the organization-scope rule.
+§ Canonical names and superseded spellings reconciles them. Reconciling now is a
+find-and-replace in Markdown; reconciling once the tests exist is a refactor across a
+dozen files plus the test code.
+
+## What a structural test proves — and what it does not
+
+**A structural assertion that a policy *exists* is not a proof that it *isolates*.**
+
+This is not a hypothetical distinction. The Row Level Security template that
+[ADR-0003 Amendment 3](../decisions/0003-tenant-isolation-defense-in-depth.md)
+supersedes satisfied every structural assertion in this catalogue — the table had RLS
+enabled, it had a policy, the policy named `app.tenant_id`, the entity carried
+`[TenantOwned]`, the EF filter was present — while making **every tenant-wide row
+visible to every tenant**. It created two *permissive* policies, and PostgreSQL combines
+permissive policies with `OR`, so the second policy widened access instead of narrowing
+it. A test that asserts shape would have been green throughout.
+
+A structure-shaped test that passes against a broken policy is worse than no test,
+because it converts an open question into a false answer.
+
+Two consequences, both binding:
+
+- **Structural assertions stay.** They are cheap, they run on every build, and they
+  catch the common failure — someone forgot the policy entirely. They are a *coverage*
+  check, not a *correctness* check, and this catalogue labels them as such.
+- **The binding proof of isolation is runtime.** Isolation is a property of what a
+  query returns, and only a query can observe it. The proof lives in the
+  [Phase 02a Packet 7](../roadmap/phase-02a-kernel-tenancy.md) integration suite, which
+  connects as **`learnstack_app`** — a non-owning, `NOBYPASSRLS` role. A test that
+  connects as the table owner or as a `BYPASSRLS` role passes even when every policy on
+  every table is inert, and therefore proves nothing at all.
+
+Rows in this catalogue carry a **Kind** of *structural*, *runtime*, or *compile-time* so
+a reader can tell which question the test answers.
+
+## Implementation status
+
+Every row below carries a status:
+
+| Status | Meaning |
+|---|---|
+| **Implemented** | The test exists, runs in CI, and can fail. The row names the file. |
+| **Registered** | The name is reserved and the assertion is agreed; no code yet. The row names the owning phase or packet. A registered test is a commitment, not a claim. |
+| **Retired** | Moved to § Retired with the reason and the replacement. |
+
+Claiming a rule is "enforced by an architecture test" when the test is registered but
+not implemented is the failure mode this column exists to prevent.
+
+### Implemented today
+
+Fourteen test methods exist in
+[`backend/tests/LearnStack.Tests.Architecture`](../../backend/tests/LearnStack.Tests.Architecture),
+shipped by [Phase 01](../roadmap/phase-01-repository-tooling.md) and
+[Phase 02a Packets 2–3](../roadmap/phase-02a-kernel-tenancy.md):
+
+| Test | File |
+|---|---|
+| `MediatR_Pipeline_Order_Matches_Canonical_Sequence` | `CrossCuttingFoundationTests.cs` |
+| `IExceptionHandler_Registered_AtStartup` | `CrossCuttingFoundationTests.cs` |
+| `OTel_Pipeline_Includes_TenantContextSpanProcessor` | `CrossCuttingFoundationTests.cs` |
+| `Logging_Goes_Through_Microsoft_Extensions_Logging` | `CrossCuttingFoundationTests.cs` |
+| `Modules_Do_Not_Reference_Sentry_SDK_Directly` | `CrossCuttingFoundationTests.cs` |
+| `Adapters_Wrap_Provider_Exceptions` | `CrossCuttingFoundationTests.cs` |
+| `Handlers_Return_Result` | `CrossCuttingFoundationTests.cs` |
+| `Modules_Do_Not_Reference_DeploymentMode` | `CrossCuttingFoundationTests.cs` |
+| `IErrorTrackingProvider_Is_Singleton` | `CrossCuttingFoundationTests.cs` |
+| `ModuleDomain_DoesNotDependOn_OtherModuleDomain` (per-module theory) | `ModuleDependencyTests.cs` |
+| `ModuleDomain_DoesNotDependOn_AnyApplicationOrInfrastructure` (per-module theory) | `ModuleDependencyTests.cs` |
+| `Meta_NetArchTest_DetectsAPlantedViolation` | `ModuleDependencyTests.cs` |
+| `No_Source_Folder_Named_Verticals` | `RepositoryLayoutTests.cs` |
+| `Frontend_Has_Only_The_Web_App` | `RepositoryLayoutTests.cs` |
+
+Three further rules in this catalogue are **implemented outside** that assembly and are
+no less binding:
+
+| Rule | Where |
+|---|---|
+| `ValidationBehavior_DoesNotThrow_ValidationException` | `LearnStack.Tests.Unit` + `LearnStack.Tests.Integration` |
+| `TenantContextSpanProcessor_DoesNotThrow_When_Context_Missing` | `LearnStack.Tests.Unit` |
+| `LearnStackException-DomainExceptionThrow` (`LS0001`) | `backend/analyzers/LearnStack.Analyzers` + `DomainExceptionThrowAnalyzerTests` |
+
+`Meta_NetArchTest_DetectsAPlantedViolation` deserves its own note: it plants a forbidden
+dependency and asserts NetArchTest **finds** it. If that meta-test ever passes in the
+inverted sense — NetArchTest reporting the planted dependency as absent — every other
+NetArchTest-based row in this catalogue is vacuously green. Keep it in perpetuity.
+
+Everything else in this document is **Registered**.
+
+## Canonical names and superseded spellings
+
+One rule, one identifier. When a document, skill, or comment uses a superseded spelling,
+the fix is to replace it with the canonical name — not to add a row here.
+
+### Tenant isolation
+
+**Canonical: `Every_TenantOwned_Entity_HasFilterAndRlsPolicy`** — one rule covering the
+marker, the EF global query filter, and the table's RLS policy. Splitting it into an
+entity-level and a table-level test is what produced half the drift; a `[TenantOwned]`
+entity without a policy and a table with a policy but no marker are the same defect seen
+from two sides.
+
+| Superseded spelling | Where it appeared |
+|---|---|
+| `Every_TenantOwned_Entity_HasTenantId` | [ADR-0017](../decisions/0017-tenant-organization-hierarchy.md), [Tenant Isolation](../architecture/09-tenant-isolation.md) |
+| `Every_TenantOwned_Entity_Has_TenantId` | [Platform / Tenant / Organization](../architecture/28-platform-tenant-organization.md), `add-tenant-owned-entity`, `run-tests-locally` skills |
+| `Every_TenantOwned_Entity_HasTenantIdAndFilter` | [Tenant Isolation](../architecture/09-tenant-isolation.md) |
+| `Every_TenantOwned_Table_HasRlsPolicy` | [Tenant Isolation](../architecture/09-tenant-isolation.md) |
+| `Every_TenantOwned_Table_HasRls_With_AppTenantId` | `add-ef-migration`, `add-tenant-owned-entity`, `add-architecture-test`, `run-tests-locally` skills |
+
+### Organization scope
+
+**Canonical: `Every_OrgScoped_Entity_HasOrgIdAndFilter`** — nullable `OrganizationId`
+column, org-aware EF filter, and the organization term `AND`-ed into the table's single
+policy.
+
+| Superseded spelling | Where it appeared |
+|---|---|
+| `Every_OrgScoped_Entity_HasOrganizationId_Nullable` | [ADR-0017](../decisions/0017-tenant-organization-hierarchy.md) |
+| `Every_OrgScoped_Entity_HasOrgQueryFilter` | [ADR-0017](../decisions/0017-tenant-organization-hierarchy.md) |
+| `Every_OrgScoped_Table_HasOrganizationRlsPolicy` | [ADR-0017](../decisions/0017-tenant-organization-hierarchy.md) |
+| `Every_OrgScoped_Table_HasOrgRlsPolicy` | [Tenant Isolation](../architecture/09-tenant-isolation.md) |
+
+### Domain genericity
+
+**Canonical: `Core_Modules_HaveNo_DomainSpecific_Names`** for the name rule, and
+**`No_Source_Folder_Named_Verticals`** for the folder rule. They are two rules, not one:
+the folder check has been green since Phase 01 and is the weaker of the pair — renaming a
+folder was never the failure mode anyone worried about, `CefrLevel` on an Education
+aggregate is.
+
+| Superseded spelling | Where it appeared | Canonical name |
+|---|---|---|
+| `No_DomainSpecific_Names_In_Modules` | [ADR-0018 § Architecture tests](../decisions/0018-tenant-driven-customization-model.md), [Extension Model](../architecture/06-extension-model.md) | `Core_Modules_HaveNo_DomainSpecific_Names` |
+| `No_Per_Vertical_Folders` | [ADR-0018 § Architecture tests](../decisions/0018-tenant-driven-customization-model.md) | `No_Source_Folder_Named_Verticals` |
+
+ADR-0018 is Accepted and is not rewritten; the mapping lives here for the same reason
+ADR-0017's spellings do. Every mutable carrier is corrected in place.
+
+The reconciliation is a [Phase 02a Packet 10](../roadmap/phase-02a-kernel-tenancy.md)
+deliverable: the canonical names go green in CI and the superseded spellings disappear
+from the corpus in the same pass.
 
 ## How to add an entry
 
@@ -35,10 +180,16 @@ When a new test or analyzer lands:
    after the ADR is superseded; the test name should age well). Cite the
    ADR in the test's `[Description]` / `[FactDescription]` attribute, not
    in the type name.
-2. Add a row to the right section table below.
-3. Cite the catalogue entry from the originating doc:
+2. Check § Canonical names and superseded spellings first. If the rule already has a
+   canonical identifier, use it rather than minting a near-synonym.
+3. Add a row to the right section table below, with **Status**, **Kind**, and **Phase**.
+4. Cite the catalogue entry from the originating doc:
    `[name](../standards/21-architecture-tests-catalogue.md#name-lowercased-with-dashes)`.
 
+When a rule is agreed but not yet written, register it with **Status: Registered** and
+the owning packet. Registering costs one row and makes the gap legible; the alternative
+is a rule that lives only in an ADR's implementation notes.
+
 When a test is renamed:
 
 1. Edit the catalogue row first.
@@ -84,8 +235,9 @@ otherwise).
   legacy `app.UseExceptionHandler(lambda)` and inline `app.Use((ctx, next)
   => {...})` patterns are absent.
 - **Source:** ADR-0032 § Sub-decision 1.
-- **Type:** xUnit + service-collection inspection.
-- **Phase:** 02a.
+- **Type:** xUnit + service-collection inspection. **Kind:** structural.
+- **Status:** **Implemented** — `CrossCuttingFoundationTests.cs`.
+- **Phase:** 02a (Packet 3).
 
 #### `MediatR_Pipeline_Order_Matches_Canonical_Sequence`
 
@@ -93,11 +245,14 @@ otherwise).
   `Validation → Logging → AuditLog → TenantContext → Authorization →
   Transaction → OutboxFlush → Handler`. No `ExceptionHandlingBehavior` is
   registered; no extra behaviors are inserted between the eight canonical
-  steps.
+  steps. The test asserts a hardcoded sequence rather than reading
+  `CanonicalBehaviorOrder`, so an accidental reorder of the production list
+  cannot slip past.
 - **Source:** ADR-0032 § Sub-decision 2;
   [02-backend-coding.md § Pipeline Behaviors](02-backend-coding.md).
-- **Type:** xUnit + reflection over `IServiceCollection`.
-- **Phase:** 02a.
+- **Type:** xUnit + reflection over `IServiceCollection`. **Kind:** structural.
+- **Status:** **Implemented** — `CrossCuttingFoundationTests.cs`.
+- **Phase:** 02a (Packet 3).
 
 #### `ValidationBehavior_DoesNotThrow_ValidationException`
 
@@ -113,8 +268,9 @@ otherwise).
   via `WebApplicationFactory<Program>` and the
   `CrossCuttingTestController.validate` endpoint). The integration
   variant lights up the full controller → MediatR pipeline → Problem
-  Details body shape so a regression at any layer surfaces.
-- **Phase:** 02a (Packet 3 — both variants shipped).
+  Details body shape so a regression at any layer surfaces. **Kind:** runtime.
+- **Status:** **Implemented** — both variants, outside the Architecture assembly.
+- **Phase:** 02a (Packet 3).
 
 #### `Domain_Methods_Do_Not_Throw_For_Expected_Cases`
 
@@ -124,15 +280,12 @@ otherwise).
   methods and asserts the analyzer report is empty for the module.
 - **Source:** ADR-0032 § Sub-decision 4;
   [09-error-handling.md § Domain Exceptions](09-error-handling.md).
-- **Type:** xUnit + Roslyn analyzer report inspection.
-- **Status:** **Deferred** — not yet implemented as a discrete architecture
-  test. The enforcement it represents is already live: the `LS0001`
-  analyzer runs in every module's `Domain` + `Application` build and the
-  `DomainExceptionThrowAnalyzerTests` unit tests lock its behaviour. The
-  report-walking architecture test lands when module domain code exists to
-  walk (Packet 6+). Until then this row documents the intent, not a shipped
-  test.
-- **Phase:** target 02a (Warning); escalates to Error after Phase 03 exit.
+- **Type:** xUnit + Roslyn analyzer report inspection. **Kind:** compile-time.
+- **Status:** **Registered.** The enforcement it represents is already live — the
+  `LS0001` analyzer runs in every module's `Domain` + `Application` build and
+  `DomainExceptionThrowAnalyzerTests` locks its behaviour — but the report-walking
+  architecture test needs module domain code to walk, and none exists yet.
+- **Phase:** 02a (Packet 10); severity escalates Warning → Error after Phase 03 exit.
 
 #### `LearnStackException-DomainExceptionThrow` (Roslyn analyzer)
 
@@ -160,7 +313,9 @@ otherwise).
   and asserts `LS0001` is reported (and no `AD0001` crash).
 - **Source:** ADR-0032 § Sub-decision 4 + Amendment 1;
   [09-error-handling.md § Domain Exceptions](09-error-handling.md).
-- **Phase:** 02a.
+- **Kind:** compile-time.
+- **Status:** **Implemented** — analyzer + unit tests.
+- **Phase:** 02a (Packet 3).
 
 #### `Handlers_Return_Result`
 
@@ -172,8 +327,11 @@ otherwise).
 - **Source:** ADR-0032 § Sub-decision 2;
   [02-backend-coding.md § MediatR Use Cases](02-backend-coding.md).
 - **Type:** xUnit + reflection over `IRequestHandler<,>` implementations.
-- **Phase:** 02a (Packet 3 — lands now while the pipeline contract is
-  fresh; vacuous until handlers exist, active the moment they land).
+  **Kind:** structural.
+- **Status:** **Implemented** — `CrossCuttingFoundationTests.cs`. Vacuous until handlers
+  exist; the first real handlers arrive in
+  [Phase 02d](../roadmap/phase-02d-walking-skeleton.md).
+- **Phase:** 02a (Packet 3).
 
 #### `Adapters_Wrap_Provider_Exceptions`
 
@@ -184,8 +342,9 @@ otherwise).
   `Application`, `Domain`, or another adapter's namespace.
 - **Source:** ADR-0032 § Sub-decision 5;
   [09-error-handling.md § Provider Failures](09-error-handling.md).
-- **Type:** xUnit + NetArchTest.
-- **Phase:** 02a.
+- **Type:** xUnit + NetArchTest. **Kind:** structural.
+- **Status:** **Implemented** — `CrossCuttingFoundationTests.cs`.
+- **Phase:** 02a (Packet 3).
 
 #### `Modules_Do_Not_Reference_Sentry_SDK_Directly`
 
@@ -195,8 +354,9 @@ otherwise).
 - **Source:** ADR-0032 § Sub-decision 9;
   [09-error-handling.md § L1 Exception Handler](09-error-handling.md);
   [20-infrastructure-stack.md § Forbidden](20-infrastructure-stack.md).
-- **Type:** xUnit + assembly-dependency walk.
-- **Phase:** 02a.
+- **Type:** xUnit + assembly-dependency walk. **Kind:** structural.
+- **Status:** **Implemented** — `CrossCuttingFoundationTests.cs`.
+- **Phase:** 02a (Packet 3).
 
 #### `Logging_Goes_Through_Microsoft_Extensions_Logging`
 
@@ -206,8 +366,9 @@ otherwise).
   implementation wired once at the composition root.
 - **Source:** ADR-0032 § Sub-decision 8;
   [10-observability.md § Stack](10-observability.md).
-- **Type:** xUnit + NetArchTest.
-- **Phase:** 02a.
+- **Type:** xUnit + NetArchTest. **Kind:** structural.
+- **Status:** **Implemented** — `CrossCuttingFoundationTests.cs`.
+- **Phase:** 02a (Packet 3).
 
 #### `Modules_Do_Not_Reference_DeploymentMode`
 
@@ -217,8 +378,9 @@ otherwise).
   site per Standards 20 § Composition Root and Deployment Mode.
 - **Source:** ADR-0020;
   [20-infrastructure-stack.md § Composition Root and Deployment Mode](20-infrastructure-stack.md).
-- **Type:** xUnit + NetArchTest.
-- **Phase:** 02a (Packet 3 — landed alongside the cross-cutting tests).
+- **Type:** xUnit + NetArchTest. **Kind:** structural.
+- **Status:** **Implemented** — `CrossCuttingFoundationTests.cs`.
+- **Phase:** 02a (Packet 3).
 
 #### `OTel_Pipeline_Includes_TenantContextSpanProcessor`
 
@@ -227,8 +389,9 @@ otherwise).
   removes the processor.
 - **Source:** ADR-0032 § Sub-decision 10.
 - **Type:** xUnit + service-collection inspection of
-  `IOptions<OpenTelemetryTracerOptions>`.
-- **Phase:** 02a.
+  `IOptions<OpenTelemetryTracerOptions>`. **Kind:** structural.
+- **Status:** **Implemented** — `CrossCuttingFoundationTests.cs`.
+- **Phase:** 02a (Packet 3).
 
 #### `TenantContextSpanProcessor_DoesNotThrow_When_Context_Missing`
 
@@ -237,8 +400,558 @@ otherwise).
   `Activity` instances created during startup, background tasks before
   any scope populated the accessor).
 - **Source:** ADR-0032 § Sub-decision 10.
-- **Type:** xUnit unit test.
-- **Phase:** 02a.
+- **Type:** xUnit unit test (`LearnStack.Tests.Unit`). **Kind:** runtime.
+- **Status:** **Implemented** — outside the Architecture assembly.
+- **Phase:** 02a (Packet 3).
+
+#### `IErrorTrackingProvider_Is_Singleton`
+
+- **Asserts:** exactly one `IErrorTrackingProvider` implementation is
+  registered per host, with singleton lifetime, selected at the composition
+  root by `DeploymentMode`.
+- **Source:** ADR-0032 § Sub-decision 9.
+- **Type:** xUnit + service-collection inspection. **Kind:** structural.
+- **Status:** **Implemented** — `CrossCuttingFoundationTests.cs`.
+- **Phase:** 02a (Packet 3).
+
+### Repository layout and module boundaries
+
+#### `No_Source_Folder_Named_Verticals`
+
+- **Asserts:** no directory named `Verticals` exists anywhere under
+  `backend/src`. ADR-0018 supersedes ADR-0011; domain-specific shapes are tenant
+  customization data, never a source folder.
+- **Source:** [ADR-0018](../decisions/0018-tenant-driven-customization-model.md).
+- **Type:** xUnit + directory scan. **Kind:** structural.
+- **Status:** **Implemented** — `RepositoryLayoutTests.cs`, green since Phase 01.
+- **Phase:** 01.
+
+#### `Core_Modules_HaveNo_DomainSpecific_Names`
+
+- **Asserts:** no class, file, table, column, permission key, audit operation, feature
+  key, or namespace inside a core module carries a domain term from the maintained
+  forbidden list (`CEFR`, `English`, `Asana`, `Kyu`, `Dan`, `Kata`, `Chord`,
+  `CodeChallenge`, …). Matching is on word segments, so `ClassName` and `Grade` survive
+  while `CefrLevel` and `AsanaPose` do not.
+- **Source:** [ADR-0018](../decisions/0018-tenant-driven-customization-model.md)
+  (and its 2026-08-08 genericity-boundary amendment);
+  [00-principles.md § 1](00-principles.md).
+- **Type:** xUnit + NetArchTest over type / member names, plus a migration and
+  permission-catalogue scan. **Kind:** structural.
+- **Status:** **Registered.** This is the mechanical guarantee behind the platform's
+  entire premise — "the core stays generic" — and it is the one rule in the whole
+  corpus that has never had an implementation, while its far weaker sibling
+  `No_Source_Folder_Named_Verticals` has been green since Phase 01. Renaming a folder is
+  not the failure mode anyone was worried about; `CefrLevel` on an Education aggregate
+  is.
+- **Phase:** 02a (Packet 10).
+
+#### `Frontend_Has_Only_The_Web_App`
+
+- **Asserts:** `frontend/apps` contains exactly one Next.js application (`web`).
+  A peer `studio` or `portal` app requires an ADR amending
+  [ADR-0009](../decisions/0009-frontend-single-app-first.md).
+- **Source:** ADR-0009.
+- **Type:** xUnit + directory scan. **Kind:** structural.
+- **Status:** **Implemented** — `RepositoryLayoutTests.cs`.
+- **Phase:** 01.
+
+#### `Generic_Primitives_Only_In_Renderer`
+
+- **Asserts:** the frontend `PRIMITIVE_RENDERERS` map contains only the documented closed
+  set of generic primitives. A new primitive is a LearnStack release guarded by
+  CODEOWNERS, not a tenant action — tenant-specific blocks are `TenantPageBlock` rows
+  pointing at a composite renderer key.
+- **Source:** [ADR-0018 § Architecture tests](../decisions/0018-tenant-driven-customization-model.md);
+  [32-tenant-customization-model.md § 2](../architecture/32-tenant-customization-model.md).
+  Named in shipped code at `frontend/apps/web/src/lib/customization/primitives.ts`.
+- **Type:** frontend test over the renderer map. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 10).
+
+#### `Only_SanitizedHtmlPrimitive_Uses_DangerouslySetInnerHtml`
+
+- **Asserts:** the sanitised-HTML primitive is the only component in `apps/web` that
+  calls `dangerouslySetInnerHTML`, and it does so exclusively on the sanitiser's output.
+  This is the rule that stops the `embed-html` sanitisation contract being bypassed by a
+  convenient one-off.
+- **Source:** [32-tenant-customization-model.md § 8.5](../architecture/32-tenant-customization-model.md)
+  and its § 11 hard invariants.
+- **Type:** ESLint rule in `frontend/`. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 10).
+
+#### `ModuleDomain_DoesNotDependOn_OtherModuleDomain`
+
+- **Asserts:** per module, `LearnStack.Modules.<X>.Domain` has no type reference into
+  any other module's `Domain`. Cross-module navigation is one of the four sanctioned
+  mechanisms in [ADR-0010](../decisions/0010-cross-module-communication.md) or it is
+  nothing.
+- **Source:** ADR-0010; [01-architecture-standards.md](01-architecture-standards.md).
+- **Type:** xUnit theory + NetArchTest, one case per module. **Kind:** structural.
+- **Status:** **Implemented** — `ModuleDependencyTests.cs`.
+- **Phase:** 02a (Packet 2).
+
+#### `ModuleDomain_DoesNotDependOn_AnyApplicationOrInfrastructure`
+
+- **Asserts:** per module, `Domain` depends on neither `Application` nor
+  `Infrastructure` — the dependency direction points inward only.
+- **Source:** ADR-0010; [01-architecture-standards.md](01-architecture-standards.md).
+- **Type:** xUnit theory + NetArchTest, one case per module. **Kind:** structural.
+- **Status:** **Implemented** — `ModuleDependencyTests.cs`.
+- **Phase:** 02a (Packet 2).
+
+#### `Meta_NetArchTest_DetectsAPlantedViolation`
+
+- **Asserts:** NetArchTest reports a **deliberately planted** forbidden dependency. If
+  this test ever reports the planted dependency as absent, every NetArchTest-based row
+  in this catalogue is vacuously green and the suite is meaningless.
+- **Source:** [06-testing.md](06-testing.md) — a test suite must be able to fail.
+- **Type:** xUnit + NetArchTest. **Kind:** structural (meta).
+- **Status:** **Implemented** — `ModuleDependencyTests.cs`. Keep in perpetuity.
+- **Phase:** 02a (Packet 2).
+
+#### `Modules_Do_Not_Inject_Valkey_Directly`
+
+- **Asserts:** no module assembly injects `IConnectionMultiplexer` or
+  `IDistributedCache`. All cache access goes through `ICacheService`.
+- **Source:** [20-infrastructure-stack.md § `ICacheService`](20-infrastructure-stack.md).
+- **Type:** xUnit + NetArchTest. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 10).
+
+#### `Modules_Do_Not_Read_Entitlement_Cache_Directly`
+
+- **Asserts:** `platform_entitlement_cache` is referenced only from the Tenancy module's
+  infrastructure. Every other read goes through `IFeatureFlags`.
+- **Source:** [20-infrastructure-stack.md § Entitlement Projection](20-infrastructure-stack.md);
+  [ADR-0021](../decisions/0021-feature-based-entitlement.md).
+- **Type:** xUnit + source / SQL scan. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 10).
+
+### Tenancy and isolation
+
+Source: [ADR-0003](../decisions/0003-tenant-isolation-defense-in-depth.md) (Amendments
+1 and 3), [ADR-0017](../decisions/0017-tenant-organization-hierarchy.md). Introduced by
+[Phase 02a Packet 7](../roadmap/phase-02a-kernel-tenancy.md), closed by Packet 10.
+
+Read § What a structural test proves before relying on any row in this section. The
+first two rows are coverage checks; the last three are the proof.
+
+#### `Every_TenantOwned_Entity_HasFilterAndRlsPolicy`
+
+- **Asserts:** every entity marked `[TenantOwned]` (or implementing `ITenantOwned`)
+  has a `TenantId` property, an EF global query filter referencing it, and — in the
+  migration that creates its table — `ENABLE` **and** `FORCE ROW LEVEL SECURITY` plus
+  exactly one policy carrying both a `USING` and a `WITH CHECK` clause over
+  `app.tenant_id`. A second **permissive** policy on the same table fails the test: that
+  is the defect ADR-0003 Amendment 3 corrects.
+- **Canonical name.** See § Canonical names and superseded spellings for the five
+  superseded spellings.
+- **Source:** ADR-0003 Amendment 3;
+  [05-database.md § Tenant-Owned and Organization-Scoped Tables](05-database.md).
+- **Type:** xUnit + EF model inspection + migration SQL scan. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 7 introduces, Packet 10 closes).
+
+#### `Every_OrgScoped_Entity_HasOrgIdAndFilter`
+
+- **Asserts:** every entity marked `[OrganizationScoped]` carries a **nullable**
+  `OrganizationId` (null = tenant-wide per ADR-0017), an org-aware EF query filter, and
+  an organization term `AND`-ed into the same single policy as the tenant term.
+- **Canonical name.** See § Canonical names and superseded spellings for the four
+  superseded spellings.
+- **Source:** ADR-0017; ADR-0003 Amendment 3.
+- **Type:** xUnit + EF model inspection + migration SQL scan. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 7 introduces, Packet 10 closes).
+
+#### `No_IgnoreQueryFilters_Outside_PlatformAdminScope`
+
+- **Asserts:** `IgnoreQueryFilters()` appears only inside the audited
+  `EnterPlatformAdminScope(reason)` path.
+- **Source:** ADR-0003; [11-security.md](11-security.md);
+  [05-database.md § Forbidden](05-database.md).
+- **Type:** xUnit + source scan / Roslyn allowlist. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 7).
+
+#### `AllowsUnresolvedTenantContext_Only_On_Provisioning_Commands`
+
+- **Asserts:** the `[AllowsUnresolvedTenantContext]` marker appears only on the narrow
+  set of tenant-provisioning and platform-admin commands that legitimately run before a
+  tenant is resolved. Any other request type carrying it fails the build.
+- **Why it matters:** the marker is a deliberate hole in the tenant-context assertion at
+  pipeline step 4. A hole nobody counts becomes a hole everybody uses; this test counts
+  it. It replaces the `TenantContextBehavior.AllowsUnresolvedContext` predicate stub
+  shipped in Packet 3.
+- **Source:** ADR-0003; ADR-0032 § Sub-decision 2;
+  [02-backend-coding.md § Pipeline Behaviors](02-backend-coding.md).
+- **Type:** xUnit + reflection over `IRequest<>` implementations. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 7).
+
+#### `TenantWide_Row_Of_TenantB_Is_Invisible_To_TenantA`
+
+- **Asserts:** a row of tenant B with `organization_id IS NULL` — the defined
+  representation of a tenant-wide row — returns **zero** rows when read under tenant A's
+  context. This is the exact case the superseded RLS template leaked, and it leaked
+  while satisfying every structural assertion above.
+- **Runs as `learnstack_app`.** A non-owning, `NOBYPASSRLS` role. Connecting as the
+  owner or as a `BYPASSRLS` role makes this test pass against an inert policy set.
+- **Source:** ADR-0003 Amendment 3 § Test requirement.
+- **Type:** **integration** test (Testcontainers + PostgreSQL), not an architecture
+  test. **Kind:** runtime.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 7).
+
+#### `Write_With_Foreign_TenantId_Is_Rejected_By_WithCheck`
+
+- **Asserts:** an `INSERT` or `UPDATE` carrying a `tenant_id` other than the caller's is
+  rejected by the policy's `WITH CHECK` clause. Without an explicit `WITH CHECK`, a
+  `USING`-only policy constrains reads and leaves writes unconstrained — a read-side
+  test cannot observe that.
+- **Runs as `learnstack_app`.**
+- **Source:** ADR-0003 Amendment 3 § Test requirement;
+  [05-database.md](05-database.md).
+- **Type:** **integration** test (Testcontainers + PostgreSQL). **Kind:** runtime.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 7).
+
+The Packet 7 suite additionally carries `Tenant_A_cannot_read_Tenant_B_data`,
+`Org_X_cannot_read_Org_Y_within_TenantA`, and
+`Unsetting_tenant_context_returns_zero_rows_through_RLS`. Those are ordinary integration
+tests named in the phase document rather than catalogue-governed rules; they are listed
+in [Phase 02a Packet 7](../roadmap/phase-02a-kernel-tenancy.md).
+
+#### `Db_Connection_String_Is_TransactionPooled`
+
+- **Asserts:** the deployment configuration points at PgBouncer in **transaction**
+  pooling mode. `SET LOCAL app.tenant_id` is transaction-scoped, so statement-mode
+  pooling would reset the value between statements and silently break isolation.
+- **Source:** [05-database.md § Connection Management](05-database.md).
+- **Type:** xUnit + configuration inspection. **Kind:** structural.
+- **Status:** **Registered** — needs a non-development deployment configuration to
+  inspect.
+- **Phase:** 11.
+
+#### `User_Aggregate_Has_No_TenantScoped_Columns`
+
+- **Asserts:** the `users` EF configuration declares only global attributes. Anything
+  whose value depends on which tenant is asking lives on the membership or as a
+  `TenantCustomFieldDef`, never as a column on the global aggregate. The reviewer's
+  version of the same question is "which tenant authored this value?".
+- **Source:** [Phase 03 § Attribute ownership](../roadmap/phase-03-identity-admin.md);
+  [ADR-0017](../decisions/0017-tenant-organization-hierarchy.md).
+- **Type:** xUnit + EF model inspection. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 03.
+
+#### `Every_TenantCustomFieldDef_Declares_PiiCategory`
+
+- **Asserts:** every `TenantCustomFieldDef` carries a PII category — enforced on the
+  aggregate's invariants and by a migration scan for a `NOT NULL` `pii_category` column.
+  A custom field without a category cannot be routed by the GDPR erasure and export
+  paths.
+- **Source:** [Phase 03 § Tenant Custom Fields](../roadmap/phase-03-identity-admin.md);
+  [ADR-0018](../decisions/0018-tenant-driven-customization-model.md).
+- **Type:** xUnit + reflection, plus a migration scan. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 03.
+
+#### `Tenant_Scoped_Export_Contains_No_Foreign_Tenant_Rows`
+
+- **Asserts:** a data export run for a person holding memberships in **both** seed
+  tenants, executed as `learnstack_app`, produces a single-tenant bundle. Requires two
+  memberships: a single-tenant fixture passes against a broken export.
+- **Runs as `learnstack_app`.**
+- **Source:** [Phase 03 § Attribute ownership](../roadmap/phase-03-identity-admin.md);
+  ADR-0003 Amendment 3 § Test requirement.
+- **Type:** **integration** test (Testcontainers + PostgreSQL). **Kind:** runtime.
+- **Status:** **Registered.**
+- **Phase:** 03.
+
+### Audit
+
+Source: [ADR-0033 Audit Durability Model](../decisions/0033-audit-durability-model.md)
+(supersedes ADR-0016); [18-audit-coverage.md](18-audit-coverage.md). Introduced by
+[Phase 02a Packet 9](../roadmap/phase-02a-kernel-tenancy.md).
+
+#### `AuditEntry_Inherits_Entity_Not_AuditableEntity`
+
+- **Asserts:** `AuditEntry` derives from `Entity<TId>`, not `AuditableEntity<TId>`.
+  An audit row that carries `UpdatedAt` / `DeletedAt` is a mutable audit row, which is a
+  contradiction.
+- **Source:** ADR-0033 (carried from ADR-0016).
+- **Type:** xUnit + reflection. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 9).
+
+#### `MustClass_Audit_Writes_Share_The_Business_Transaction`
+
+- **Asserts:** a MUST-class audit row is inserted on the **same transaction** as the
+  business write it records. The proof is behavioural: one command produces exactly one
+  `audit_log` row; a command whose durable audit write is forced to fail produces **zero**
+  business rows and returns `503 audit_unavailable`; a denied MUST-class command produces
+  exactly one row carrying the `denied` outcome and zero business rows.
+- **Why it matters:** ADR-0016's "audit never blocks business logic" applied uniformly,
+  which meant a privileged operation could commit while its audit row was lost. It also
+  meant the audit insert could run outside the transaction that sets `app.tenant_id` —
+  where Row Level Security rejects it. ADR-0033 puts the write inside the transaction, at
+  the commit boundary, and this test is what holds the line.
+- **Runs as `learnstack_app`.** A non-owning, `NOBYPASSRLS` role; connecting as the owner
+  would pass against inert policies and prove nothing about the RLS half of the claim.
+- **Source:** ADR-0033 § Decision + Implementation Notes.
+- **Type:** **integration** test (Testcontainers + PostgreSQL). **Kind:** runtime.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 9).
+
+#### `Audit_Survives_Transaction_Rollback`
+
+- **Asserts:** a MUST-class command whose transaction rolls back produces **zero**
+  business rows and **exactly one** `audit_log` row, with outcome `failed`. Two cases: a
+  forced fault at `COMMIT`, and the ordinary path where the handler calls `SaveChanges`
+  and then returns `Result.Fail(...)`.
+- **Why it matters:** the durable write happens before `COMMIT`, so a row that has been
+  inserted is not yet durable. A design that marks the intent "consumed" at insert time
+  and skips the standalone write on the way out loses the audit **and** the business
+  change on every rolled-back MUST-class operation — and a per-request DI-scoped flag
+  cannot observe a database rollback. This test is the only thing that distinguishes a
+  correct implementation from that one.
+- **Runs as `learnstack_app`.**
+- **Source:** ADR-0033 § Decision.
+- **Type:** **integration** test (Testcontainers + PostgreSQL). **Kind:** runtime.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 9).
+
+#### `Audit_Classification_Does_Not_Read_The_Database_On_The_Request_Path`
+
+- **Asserts:** with the `audit_config` table made unreadable, a MUST-class command still
+  completes and still writes its `audit_log` row at the in-process catalogue
+  classification; and an operation absent from the catalogue is rejected with
+  `audit_unclassified_operation`.
+- **Why it matters:** `AuditLogBehavior` runs at pipeline step 3, `SET LOCAL
+  app.tenant_id` is issued at step 6, and `audit_config` carries ENABLE + FORCE row level
+  security. A classification query at step 3 therefore returns **zero rows silently** —
+  not an exception — so a fail-closed `catch` around it can never fire and "RLS filtered
+  everything" is indistinguishable from "this tenant has no overrides". Moving the
+  classification off the request path is the fix; this test is what stops it drifting
+  back.
+- **Source:** ADR-0033 § Decision;
+  [31-audit-subsystem.md § 5](../architecture/31-audit-subsystem.md).
+- **Type:** **integration** test (Testcontainers + PostgreSQL). **Kind:** runtime.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 9).
+
+#### `AuditLog_Update_Is_Column_Restricted`
+
+- **Asserts:** as `learnstack_app`, any `UPDATE` or `DELETE` on `audit_log` raises
+  `42501` (the role holds neither privilege). As `learnstack_platform`, an `UPDATE`
+  touching only `actor_email`, `ip_address`, `user_agent`, `before_state`, `after_state`
+  and `changes` succeeds; an `UPDATE` touching any other column — `actor_user_id`,
+  `operation`, `outcome`, `timestamp` — is rejected by `audit_log_append_only_guard`; and
+  a `DELETE` succeeds, because the retention purge needs it.
+- **Why it matters:** "append-only" stated as "no `UPDATE` or `DELETE` anywhere" is
+  unimplementable — the corpus itself ships two mutating paths (GDPR redaction, retention
+  purge). This test pins what is actually allowed so the rule is enforceable rather than
+  aspirational.
+- **Source:** ADR-0033; [18-audit-coverage.md § Storage](18-audit-coverage.md);
+  [31-audit-subsystem.md § 7](../architecture/31-audit-subsystem.md).
+- **Type:** **integration** test (Testcontainers + PostgreSQL). **Kind:** runtime.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 9).
+
+#### `Every_TenantOwned_Command_HasAuditCoverage`
+
+- **Asserts:** every command touching a `[TenantOwned]` aggregate appears in its
+  module's audit-coverage matrix with a MUST / SHOULD / MAY classification. An
+  unclassified command fails the build rather than defaulting to silence.
+- **Source:** [18-audit-coverage.md](18-audit-coverage.md); ADR-0033.
+- **Type:** xUnit + reflection over commands cross-checked against the matrix.
+  **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 9).
+
+#### `Every_Module_Has_An_AuditCoverage_Matrix`
+
+- **Asserts:** every module directory contains `docs/modules/<module>/audit.md` with a
+  parseable coverage matrix.
+- **Source:** [18-audit-coverage.md](18-audit-coverage.md).
+- **Type:** xUnit + file scan. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 9).
+
+#### `Modules_Do_Not_Write_AuditLog_Directly`
+
+- **Asserts:** no module assembly references the `audit_log` table or the `AuditEntry`
+  type outside `LearnStack.Infrastructure.Audit`. `IAuditStore` is the only write path.
+- **Source:** ADR-0033 (carried from ADR-0016);
+  [20-infrastructure-stack.md § Audit Plumbing](20-infrastructure-stack.md).
+- **Type:** xUnit + NetArchTest + SQL scan. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 10).
+
+#### `AuditEntry_Is_AppendOnly`
+
+- **Asserts:** no `UPDATE` or `DELETE` statement targets `audit_log` anywhere in the
+  codebase or in any migration **except** inside
+  `LearnStack.Modules.Audit.Infrastructure` — the GDPR redaction handler, the per-module
+  `IUserReferenceLocator` implementations, and the retention purge job. Every such site
+  must be inside an `IPlatformAdminScope` block. `IAuditStore` is asserted to expose no
+  update method at all.
+- **Why the exception list is closed and named:** the earlier phrasing ("anywhere in the
+  codebase") contradicted two paths the corpus ships by design and would have failed on
+  its first green run. Naming the two sites keeps the rule enforceable; widening the list
+  requires an ADR. The database-level guard is
+  [`AuditLog_Update_Is_Column_Restricted`](#auditlog_update_is_column_restricted), which
+  is what actually constrains *which columns* may change.
+- **Source:** ADR-0033 (carried from ADR-0016).
+- **Type:** xUnit + source / migration scan. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 9).
+
+#### `OperationType_Enum_Matches_Catalog`
+
+- **Asserts:** the `OperationType` enum and the audit-operation catalogue in
+  [18-audit-coverage.md](18-audit-coverage.md) contain the same members.
+- **Source:** ADR-0033 (carried from ADR-0016).
+- **Type:** xUnit + reflection + Markdown parse. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 9).
+
+> **Retired from this section.** `AuditLogBehavior_NeverBlocks_BusinessWrites` — see
+> § Retired. Its assertion is now false for MUST-class audit.
+
+### Hub contract surface
+
+Source: [ADR-0034 Hub Contract Surface Invariant](../decisions/0034-hub-contract-surface-invariant.md),
+[ADR-0019](../decisions/0019-learnstack-hub.md),
+[ADR-0020](../decisions/0020-triple-deployment-hybrid-license.md).
+
+#### `LearnStack_Modules_DoNotReference_Hub`
+
+- **Asserts:** no module assembly references a Hub client type or the Hub URL.
+- **Source:** ADR-0019; ADR-0034 invariant 2.
+- **Type:** xUnit + NetArchTest. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 10).
+
+#### `Hub_Client_Referenced_Only_By_Named_Adapters`
+
+- **Asserts:** the Hub HTTP client type is constructed or injected **only** inside
+  `IEntitlementProvider`, `IUsageReporter`, and `IHubTenantSync` implementations. Any
+  other holder fails the build.
+- **Why it matters:** this is the mechanical half of ADR-0034's second invariant, and it
+  is the check that would have caught `CachedHostToTenantResolver` calling
+  `IHubClient.LookupHostAsync` — an unrecorded endpoint, called from outside the
+  sanctioned adapters, on the hot path of every anonymous public page load.
+- **Source:** ADR-0034 § Implementation Notes.
+- **Type:** xUnit + NetArchTest over constructor and field types. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02c.
+
+#### `Hub_NeverStores_TenantData`
+
+- **Asserts:** the Hub schema contains no tenant-content table (courses, lessons,
+  learners, enrollments, sessions, media, content entries). Invariant 1 of ADR-0034.
+- **Source:** ADR-0034 § Decision.
+- **Type:** schema scan. **Kind:** structural.
+- **Status:** **Registered** — owned and run by the `learnstack-hub` repository; listed
+  here because the invariant is shared.
+- **Phase:** 02c (Hub-side).
+
+#### `Internal_API_Endpoints_AreNot_Public`
+
+- **Asserts:** every `/api/internal/*` route is served by the internal listener only and
+  is absent from the public route table and the public OpenAPI document.
+- **Source:** ADR-0019; ADR-0034.
+- **Type:** xUnit + route-table inspection. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02c.
+
+#### `IEntitlementProvider_Implementations_Are_Three`
+
+- **Asserts:** no `IEntitlementProvider` implementation exists outside the named three —
+  `NullEntitlementProvider`, `HubEntitlementProvider`,
+  `SignedLicenseKeyEntitlementProvider` — and the composition root selects one by
+  `DeploymentMode`.
+- **Source:** ADR-0020; ADR-0034.
+- **Type:** xUnit + reflection. **Kind:** structural.
+- **Status:** **Registered** — vacuous until the second implementation exists; only
+  `NullEntitlementProvider` ships before Phase 02c
+  ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)).
+- **Phase:** 02c.
+
+#### `NullEntitlementProvider_NotRegistered_OutsideDevelopment`
+
+- **Asserts:** once Phase 02c lands, `NullEntitlementProvider` is registered only under
+  `DeploymentMode.Development`.
+- **Source:** ADR-0020; ADR-0035 § Implementation Notes.
+- **Type:** xUnit + service-collection inspection per mode. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02c.
+
+#### `LicenseKey_Validation_Is_Pinned_RSA2048`
+
+- **Asserts:** signed-licence verification pins RSA-2048 and rejects an algorithm named
+  by the token itself.
+- **Source:** ADR-0020.
+- **Type:** xUnit. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 11 — the signed-licence adapter is demand-gated on a signed Self-Hosted
+  contract ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)).
+
+#### `Hub_Modules_DoNotReference_LearnStack_Internals`
+
+- **Asserts:** Hub module assemblies reference LearnStack `Application.Contracts` DTOs
+  only — never a LearnStack `Domain` or `Infrastructure` type. The mirror image of
+  `LearnStack_Modules_DoNotReference_Hub`; without both, the contract is one-directional.
+- **Source:** [24-learnstack-hub.md § 10](../architecture/24-learnstack-hub.md);
+  ADR-0019; ADR-0034 invariant 2.
+- **Type:** xUnit + NetArchTest. **Kind:** structural.
+- **Status:** **Registered** — owned and run by the `learnstack-hub` repository; listed
+  here because the invariant is shared.
+- **Phase:** 02c (Hub-side).
+
+#### `Stripe_SDK_Types_NotImportedOutsideInfrastructure`
+
+- **Asserts:** `Stripe.*` types appear only inside
+  `LearnStack.Hub.Modules.Subscriptions.Infrastructure.Stripe`.
+- **Source:** [24-learnstack-hub.md § 10](../architecture/24-learnstack-hub.md);
+  ADR-0019 § provider adapters.
+- **Type:** xUnit + NetArchTest. **Kind:** structural.
+- **Status:** **Registered** — owned and run by the `learnstack-hub` repository.
+- **Phase:** 09b (Hub-side).
+
+#### `Iyzico_SDK_Types_NotImportedOutsideInfrastructure`
+
+- **Asserts:** `Iyzipay.*` types appear only inside the Subscriptions module's Iyzico
+  infrastructure namespace.
+- **Source:** [24-learnstack-hub.md § 10](../architecture/24-learnstack-hub.md);
+  ADR-0019 § provider adapters.
+- **Type:** xUnit + NetArchTest. **Kind:** structural.
+- **Status:** **Registered** — owned and run by the `learnstack-hub` repository.
+- **Phase:** 09b (Hub-side).
+
+#### `Hub_Operator_JWT_NeverAccepted_On_LearnStack_Routes`
+
+- **Asserts:** a `learnstack-hub` realm JWT is rejected by every LearnStack
+  tenant-facing endpoint, and a `learnstack` realm token is rejected on
+  `/api/internal/*`. The two-realm boundary from [ADR-0004](../decisions/0004-authentication-strategy.md)
+  is the reason the Admin Studio proxies custom-domain submission instead of calling the
+  Hub directly.
+- **Source:** [24-learnstack-hub.md § 10](../architecture/24-learnstack-hub.md);
+  ADR-0004; ADR-0019.
+- **Type:** **integration** test, run from the Hub side against a LearnStack instance.
+  **Kind:** runtime.
+- **Status:** **Registered** — owned and run by the `learnstack-hub` repository; listed
+  here because the boundary it defends is LearnStack's.
+- **Phase:** 02c (Hub-side).
+
+### Events, jobs, and correlation
+
+Introduced by [Phase 02b](../roadmap/phase-02b-events-auth.md).
 
 #### `Outbox_Row_Carries_Correlation_Context`
 
@@ -247,7 +960,8 @@ otherwise).
   through `IOutbox.EnqueueAsync` and inspects the row.
 - **Source:** ADR-0032 § Sub-decision 12;
   [ADR-0006](../decisions/0006-events-and-outbox.md) Amendment 1.
-- **Type:** integration test (Testcontainers).
+- **Type:** integration test (Testcontainers). **Kind:** runtime.
+- **Status:** **Registered.**
 - **Phase:** 02b.
 
 #### `Hangfire_Job_Payloads_Include_TenantId`
@@ -256,7 +970,8 @@ otherwise).
   or `correlation_id`. Per the `JobActivator` contract the enqueue path
   fails at submission, not at activation, so the failure mode is loud.
 - **Source:** ADR-0032 § Sub-decision 12; Phase 02b deliverable.
-- **Type:** xUnit + Hangfire enqueue interceptor test.
+- **Type:** xUnit + Hangfire enqueue interceptor test. **Kind:** structural.
+- **Status:** **Registered.**
 - **Phase:** 02b.
 
 #### `Integration_Event_Handler_Restores_Tenant_Context`
@@ -265,59 +980,146 @@ otherwise).
   the inner handler scope has `ITenantContext.IsResolved == true` before
   business code runs. Verifies the envelope-to-context restoration.
 - **Source:** ADR-0032 § Sub-decision 12; Phase 02b deliverable.
-- **Type:** integration test (Testcontainers + Dapr sidecar).
+- **Type:** integration test (Testcontainers). Runs against
+  `InProcessEventBus` — which is a first-class transport with the same handler
+  interface, inbox guard and context restoration as the durable path
+  ([ADR-0035](../decisions/0035-demand-gated-infrastructure.md)), so the assertion does
+  not wait on the Dapr adapter. **Kind:** runtime.
+- **Status:** **Registered.**
+- **Phase:** 02b.
+
+#### `Integration_Event_Handlers_Use_InboxGuard`
+
+- **Asserts:** every `IIntegrationEventHandler<T>` calls
+  `IInboxGuard.IsAlreadyProcessedAsync` before any business logic.
+- **Source:** [20-infrastructure-stack.md § `IEventBus`](20-infrastructure-stack.md);
+  [ADR-0006](../decisions/0006-events-and-outbox.md).
+- **Type:** xUnit + IL / source scan. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02b.
+
+#### `Integration_Events_Inherit_From_IntegrationEventBase`
+
+- **Asserts:** every type implementing `IIntegrationEvent` extends `IntegrationEventBase`,
+  which carries `EventId`, `OccurredAt` and `TenantId`, and is a JSON-serialisable record.
+- **Source:** [15-event-and-outbox.md § Architecture tests](../architecture/15-event-and-outbox.md);
+  [ADR-0006](../decisions/0006-events-and-outbox.md).
+- **Type:** xUnit + reflection over module assemblies. **Kind:** structural.
+- **Status:** **Registered.**
 - **Phase:** 02b.
 
-### Earlier ADRs (to be backfilled)
-
-Existing architecture tests already cited from other ADRs / standards live
-in their respective docs. They will be migrated into this catalogue in
-follow-up PRs as their text is touched (no rewrite-for-rewrite churn);
-until then the originating doc remains the single reference. Known
-identifiers awaiting migration:
-
-- ADR-0003 / ADR-0017 — tenant + organization isolation:
-  `Every_TenantOwned_Command_HasAuditCoverage`,
-  `Every_OrgScoped_Entity_HasOrgIdAndFilter`.
-- ADR-0014 — Dapr building blocks:
-  `Dapr_SDK_Types_NotImportedOutsideInfrastructure`,
-  `Modules_DoNotReference_DaprPackage`,
-  `ICacheService_Is_OnlyCacheAbstraction`,
-  `Dapr_PubSub_TopicNames_FollowConvention`.
-- ADR-0016 — audit subsystem:
-  `AuditEntry_Inherits_Entity_Not_AuditableEntity`,
-  `AuditEntry_Is_AppendOnly`,
-  `AuditLogBehavior_NeverBlocks_BusinessWrites`,
-  `Modules_Do_Not_Write_AuditLog_Directly`,
-  `OperationType_Enum_Matches_Catalog`.
-- ADR-0018 — domain-specific names forbidden:
-  `Core_Modules_HaveNo_DomainSpecific_Names`,
-  `No_Source_Folder_Named_Verticals`.
-- ADR-0019 — Hub HTTPS contract:
-  `LearnStack_Modules_DoNotReference_Hub`.
-- ADR-0020 — entitlement providers:
-  `IEntitlementProvider_Implementations_Are_Three`,
-  `NullEntitlementProvider_NotRegistered_OutsideDevelopment`,
-  `LicenseKey_Validation_Is_Pinned_RSA2048`.
-- Standards 20 — composition-root + direct-injection bans:
-  `Modules_Do_Not_Inject_Valkey_Directly`,
-  `Modules_Do_Not_Read_Entitlement_Cache_Directly`.
-  (`Modules_Do_Not_Reference_DeploymentMode` migrated to the main
-  catalogue below in Phase 02a Packet 3 — see the dedicated entry.)
-
-The next PR that edits any of these source documents folds the
-corresponding row in here.
+#### `Integration_Event_Declares_PartitionKey`
+
+- **Asserts:** every `IIntegrationEvent` resolves a non-null partition key. `PartitionKey`
+  on `IntegrationEventBase` is threaded through `IEventBus` and honoured by
+  `InProcessEventBus`, which serialises dispatch per key — concurrent across keys,
+  sequential within one.
+- **Source:** [Phase 02b](../roadmap/phase-02b-events-auth.md);
+  [15-event-and-outbox.md](../architecture/15-event-and-outbox.md).
+- **Type:** xUnit + reflection over module assemblies. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02b.
+
+#### `OutboxProcessor_NeverBlocks_OnSingleMessageFailure`
+
+- **Asserts:** one poisoned message does not prevent the rest of its batch from being
+  dispatched.
+- **Source:** [15-event-and-outbox.md § Architecture tests](../architecture/15-event-and-outbox.md);
+  Phase 02b deliverable.
+- **Type:** **integration** test (Testcontainers). **Kind:** runtime.
+- **Status:** **Registered.**
+- **Phase:** 02b.
+
+#### `Outbox_Claim_IsHeld_Until_Dispatch_Completes`
+
+- **Asserts:** two concurrent `OutboxProcessor` instances draining one pending batch
+  dispatch each message **exactly once** — the claim is held for the duration of the
+  dispatch, not released when the row is read. Requires **two** processors: a
+  single-processor test passes against the broken protocol.
+- **Source:** [Phase 02b](../roadmap/phase-02b-events-auth.md);
+  [15-event-and-outbox.md](../architecture/15-event-and-outbox.md).
+- **Type:** **integration** test (Testcontainers, two processes). **Kind:** runtime.
+- **Status:** **Registered.**
+- **Phase:** 02b.
+
+### Demand-gated: lands with its adapter
+
+These rules are agreed but cannot be written until the technology they constrain is
+wired. Their owning phase is the phase that lands the adapter, per
+[ADR-0035](../decisions/0035-demand-gated-infrastructure.md). Registering them here
+rather than deleting them keeps the rule visible and stops it being re-invented under a
+different name.
+
+| Test | Rule | Lands in |
+|---|---|---|
+| `Dapr_PubSub_TopicNames_FollowConvention` | Topic names match `learnstack.{module}.{aggregate}` | [Phase 11](../roadmap/phase-11-production-hardening.md), with the Dapr adapter |
+| `Dapr_SDK_Types_NotImportedOutsideInfrastructure` | Dapr SDK types appear only in `LearnStack.Infrastructure.*` | [Phase 11](../roadmap/phase-11-production-hardening.md) |
+| `Modules_DoNotReference_DaprPackage` | No module assembly references the Dapr package | [Phase 11](../roadmap/phase-11-production-hardening.md) |
+| `ICacheService_Is_OnlyCacheAbstraction` | No second cache abstraction is introduced alongside `ICacheService` | [Phase 11](../roadmap/phase-11-production-hardening.md) |
+
+`Dapr_PubSub_TopicNames_FollowConvention` was previously listed as a Phase 02a
+deliverable. Phase 02a ships `InProcessEventBus` and no Dapr components, so there is
+nothing for that test to scan — it inspects the Dapr component bindings.
+
+Deferring it left the convention unasserted against the transport that is actually
+registered, which is the shape of gap this catalogue exists to close. It is therefore
+**split in two**, and the transport-independent half is not deferred:
+
+#### `Integration_Event_TopicNames_FollowConvention`
+
+- **Asserts:** every declared integration-event type resolves a topic matching
+  `learnstack.{module}.{aggregate}` (and `learnstack.hub.*` for Hub-side topics). Reads
+  the event declarations, not a broker, so it holds for whichever `IEventBus`
+  implementation is registered.
+- **Source:** [20-infrastructure-stack.md § `IEventBus`](20-infrastructure-stack.md);
+  [ADR-0006](../decisions/0006-events-and-outbox.md).
+- **Type:** xUnit + reflection over module assemblies. **Kind:** structural.
+- **Status:** **Registered.**
+- **Phase:** 02a (Packet 5) — lands with `InProcessEventBus`, the first transport.
+
+`Dapr_PubSub_TopicNames_FollowConvention` keeps its Phase 11 slot and narrows to what
+only it can check: that the Dapr component bindings agree with the topics the events
+declare.
+
+`Modules_Do_Not_Inject_Valkey_Directly` is **not** in this table. It constrains module
+code rather than adapter code, holds regardless of which cache implementation is
+registered, and is listed under § Repository layout and module boundaries as a
+Packet 10 deliverable.
+
+### Awaiting backfill
+
+Every identifier previously parked in this section has been folded into the catalogue
+above under its canonical name. Anything newly discovered in an ADR or standard is added
+here with **Status: Registered** by the next PR that touches its source document —
+registering costs one row, and an unregistered rule is how the six-spelling drift
+started.
 
 ### Retired
 
-(none yet)
+#### `AuditLogBehavior_NeverBlocks_BusinessWrites`
+
+- **Retired 2026-08-08** by [ADR-0033](../decisions/0033-audit-durability-model.md),
+  which supersedes ADR-0016. The assertion is now false by design for MUST-class audit:
+  a MUST-class audit failure **must** block the business write, because the audit row is
+  part of the operation's contract and shares its transaction.
+- **Replaced by** [`MustClass_Audit_Writes_Share_The_Business_Transaction`](#mustclass_audit_writes_share_the_business_transaction).
+  The surviving half of the old rule — SHOULD/MAY-class audit never blocks — is asserted
+  inside that test's SHOULD/MAY cases.
+- Never implemented, so nothing was deleted from CI.
 
 ## References
 
+- [ADR-0003 Tenant Isolation Defense in Depth](../decisions/0003-tenant-isolation-defense-in-depth.md) (Amendment 3)
+- [ADR-0018 Tenant-Driven Customization Model](../decisions/0018-tenant-driven-customization-model.md)
 - [ADR-0032 Exception Handling, Logging, and Observability Architecture](../decisions/0032-exception-handling-logging-and-observability.md)
+- [ADR-0033 Audit Durability Model](../decisions/0033-audit-durability-model.md)
+- [ADR-0034 Hub Contract Surface Invariant](../decisions/0034-hub-contract-surface-invariant.md)
+- [ADR-0035 Demand-Gated Infrastructure](../decisions/0035-demand-gated-infrastructure.md)
 - [02-backend-coding.md § Pipeline Behaviors](02-backend-coding.md)
+- [05-database.md § Tenant-Owned and Organization-Scoped Tables](05-database.md)
 - [09-error-handling.md](09-error-handling.md)
 - [10-observability.md](10-observability.md)
+- [11-security.md § Tenant Context](11-security.md)
 - [20-infrastructure-stack.md](20-infrastructure-stack.md)
 - [Phase 02a Roadmap § Architecture Tests](../roadmap/phase-02a-kernel-tenancy.md)
 - [Phase 02b Roadmap § Architecture Tests](../roadmap/phase-02b-events-auth.md)
diff --git a/docs/standards/README.md b/docs/standards/README.md
index c72bf97..aee6962 100644
--- a/docs/standards/README.md
+++ b/docs/standards/README.md
@@ -33,18 +33,77 @@ This directory contains the engineering rules that apply across the LearnStack c
 | 17 | [Code Review Standards](17-code-review.md) | What to look for, what *not* to block on, etiquette. Zero-tolerance blockers and author self-review gate. |
 | 18 | [Audit Coverage Standards](18-audit-coverage.md) | Which operations must be audited; payload contract; retention; per-module classification matrix. |
 | 19 | [Permissions Standards](19-permissions.md) | `{module}.{resource}.{action}` naming, closed action set, registry pattern, matrix template, built-in roles. |
-| 20 | [Infrastructure Stack Standards](20-infrastructure-stack.md) | Dapr building blocks (`IEventBus`, `ICacheService`, `ISecretProvider`), APISIX gateway, Hub HTTPS contract surface, entitlement projection, outbox/inbox usage. |
-| 21 | [Architecture Tests + Analyzers Catalogue](21-architecture-tests-catalogue.md) | Single source of truth for the identifier, assertion, and source ADR / standard of every non-skippable architecture test or Roslyn analyzer. Cross-link target so renames touch one place. |
+| 20 | [Infrastructure Stack Standards](20-infrastructure-stack.md) | Demand-gated building blocks, the foundation ports (`IEventBus`, `ICacheService`, `ISecretProvider`), APISIX gateway, Hub contract surface + its two invariants, entitlement projection, outbox/inbox usage. |
+| 21 | [Architecture Tests + Analyzers Catalogue](21-architecture-tests-catalogue.md) | Single source of truth for the identifier, assertion, status, and source ADR / standard of every non-skippable architecture test or Roslyn analyzer. Cross-link target so renames touch one place. |
 
 ## Status of Each Standard
 
 Standards have one of three states:
 
-- **Active.** Currently enforced; PRs must comply.
-- **Adopted.** Agreed, but not yet enforced by tooling — manual review only.
+- **Active.** Currently enforced; PRs must comply. There is code, tooling, or a live
+  process that the standard governs **today**.
+- **Adopted.** Agreed and binding on the code that will implement it — but that code does
+  not exist yet, so nothing enforces it beyond review.
 - **Draft.** Proposed; open for discussion.
 
-Each document declares its state at the top.
+### The rule that makes the model mean something
+
+> **A standard with no implementing code is `Adopted`, not `Active`.**
+
+Each document declares its state at the top, and until 2026-08-08 **all twenty-two
+declared `Active`** — including standards governing endpoints, migrations, permissions
+and audit rows that do not exist. A three-state model whose every member sits in one
+state is decorative: it tells a reader nothing, and it quietly overstates how much of the
+corpus is load-bearing.
+
+"Adopted" is not a weaker commitment. It is the honest one. It says: this is the rule the
+implementing PR must satisfy, and there is nothing standing between a violation and
+`main` except a reviewer who remembers. That is exactly the situation in which a reviewer
+most needs to know.
+
+Promotion `Adopted → Active` happens in the PR that lands the enforcement — the
+migration, the endpoint, the analyzer, the architecture test — not in a separate
+bookkeeping pass.
+
+### Honest status today
+
+The table below is the current, accurate state as of 2026-08-08, at HEAD with
+[Phase 02a](../roadmap/phase-02a-kernel-tenancy.md) Packets 0–3 shipped.
+
+**The individual documents still declare `Active` in their own headers.** Reconciling the
+twenty-two status lines with this table is a
+[Phase 02a Packet 10](../roadmap/phase-02a-kernel-tenancy.md) deliverable, landed
+together with the architecture-test reconciliation so the two views of "what is actually
+enforced" change in one commit. Until that lands, **this table wins**.
+
+| # | Standard | Status | What does or does not enforce it today |
+|---|---|---|---|
+| 00 | [Principles](00-principles.md) | **Active** | Governs every PR and every ADR; principles 1, 16 and 17 are already deciding live scope questions. |
+| 01 | [Architecture Standards](01-architecture-standards.md) | **Active** | Module layout shipped; `ModuleDomain_DoesNotDependOn_*` and the planted-violation meta-test are green. |
+| 02 | [Backend Coding](02-backend-coding.md) | **Active** | MediatR pipeline, `Result<T>`, `IClock`, the `LS0001` analyzer and the pipeline-order test all ship. Its EF Core and domain-modelling clauses are `Adopted` until Packet 6 brings a `DbContext`. |
+| 03 | [Frontend Coding](03-frontend-coding.md) | **Adopted** | ESLint and TypeScript strict mode are configured, but `apps/web` is a scaffold with no components and no tests. First real code: [Phase 02d](../roadmap/phase-02d-walking-skeleton.md). |
+| 04 | [API Design](04-api-design.md) | **Adopted** | No endpoint exists. Problem Details, cursor pagination, idempotency and ETag land in Packet 4. |
+| 05 | [Database](05-database.md) | **Adopted** | No `DbContext` and no migration exist. The canonical RLS template it now owns is applied by Packet 6's first migration. |
+| 06 | [Testing](06-testing.md) | **Active** | Unit, architecture and contract suites run in CI, and the meta-test proves the architecture suite can fail. The **integration** suite does not: the backend job filters it out (`FullyQualifiedName!~LearnStack.Tests.Integration`) and its own job is gated on an unset `vars.ENABLE_BACKEND_INTEGRATION` until Phase 02a Packet 7 lands the first isolation test. |
+| 07 | [Frontend Architecture](07-frontend-architecture.md) | **Adopted** | Route groups exist as empty layouts; server/client split, tenant context and SDK shape are exercised first in [Phase 02d](../roadmap/phase-02d-walking-skeleton.md). |
+| 08 | [Localization](08-localization.md) | **Adopted** | `tenant_locales` and the slug schema land in Packet 6; the i18n runtime in [Phase 04](../roadmap/phase-04-cms-media-pages.md). |
+| 09 | [Error Handling](09-error-handling.md) | **Active** | L1 `IExceptionHandler`, the exception hierarchy, `ProblemDetailsFactory` and `HttpStatusMap` shipped in Packet 3. |
+| 10 | [Observability](10-observability.md) | **Active** | Serilog → OTLP, OpenTelemetry SDK, `TenantContextSpanProcessor` and the redaction enrichers shipped in Packet 3. |
+| 11 | [Security](11-security.md) | **Adopted** | No auth, no RLS, no header middleware yet. Tenant isolation lands in Packet 7, authentication in [Phase 02b](../roadmap/phase-02b-events-auth.md). Its § Tenant Context is nonetheless the binding authority the implementing PR must follow. |
+| 12 | [Infrastructure](12-infrastructure.md) | **Active** | Compose stack, `Makefile`, CI workflow, pre-commit hooks and secret scanning all live since Phase 01. |
+| 13 | [Documentation](13-documentation.md) | **Active** | Governs this corpus; the CI link audit walks changed Markdown. |
+| 14 | [Git Workflow](14-git-workflow.md) | **Active** | Conventional Commits, hooks and required checks are live. The branch-protection settings that contradict this standard are reconciled in Packet 3b. |
+| 15 | [Performance](15-performance.md) | **Adopted** | No budget is measured and no load test exists. Enforcement lands in [Phase 11](../roadmap/phase-11-production-hardening.md). |
+| 16 | [Accessibility](16-accessibility.md) | **Adopted** | No user interface to audit. First surfaces render in [Phase 02d](../roadmap/phase-02d-walking-skeleton.md); automated axe checks in [Phase 06](../roadmap/phase-06-renderer-admin-studio.md). |
+| 17 | [Code Review](17-code-review.md) | **Active** | Applied to every pull request merged so far; the zero-tolerance blocker list is in live use. |
+| 18 | [Audit Coverage](18-audit-coverage.md) | **Adopted** | `AuditLogBehavior` is a shell and `audit_log` does not exist. Lands in Packet 9 under [ADR-0033](../decisions/0033-audit-durability-model.md). |
+| 19 | [Permissions](19-permissions.md) | **Adopted** | No permission key, policy or role exists. Lands in [Phase 03](../roadmap/phase-03-identity-admin.md). |
+| 20 | [Infrastructure Stack](20-infrastructure-stack.md) | **Adopted** | `ISecretProvider` shipped in Packet 3 and `DeploymentMode` branching is real, but the ports land in Packet 5 and the Dapr / Kafka / APISIX / Vault adapters are demand-gated to [Phase 11](../roadmap/phase-11-production-hardening.md) per [ADR-0035](../decisions/0035-demand-gated-infrastructure.md). |
+| 21 | [Architecture Tests Catalogue](21-architecture-tests-catalogue.md) | **Active** | Fourteen tests run in CI; the catalogue's own per-row status column distinguishes those from the registered-but-unimplemented majority. |
+
+Eleven `Active`, eleven `Adopted`. That split is the honest picture of a platform whose
+foundation is real and whose domain has not been written yet — and it is far more useful
+to a reviewer than twenty-two identical labels.
 
 ## Relationship to ADRs
 
diff --git a/infra/dapr/README.md b/infra/dapr/README.md
index 6787b51..f1bf542 100644
--- a/infra/dapr/README.md
+++ b/infra/dapr/README.md
@@ -16,11 +16,19 @@ Phase ownership (per [phase-02a](../../docs/roadmap/phase-02a-kernel-tenancy.md)
 [phase-02b](../../docs/roadmap/phase-02b-events-auth.md)):
 
 - **Phase 02a** declares all three interfaces in `LearnStack.SharedKernel`
-  with default in-process implementations (`InProcessEventBus`,
-  `InMemoryCacheService`, `EnvironmentSecretProvider`) **and** ships the
-  Dapr-backed implementations (`DaprEventBus`, `DaprCacheService`,
-  `DaprSecretProvider`) in `LearnStack.Infrastructure`. The composition
-  root picks between in-process and Dapr-backed per `DeploymentMode`.
+  with default in-process implementations — `InProcessEventBus`,
+  `InMemoryCacheService`, and `ConfigurationSecretProvider`. Only the third
+  exists today (`SharedKernel/Secrets/ConfigurationSecretProvider.cs`, Packet 3);
+  the other two land with their interfaces in Packet 5. Those defaults are the
+  **only** implementations registered, in every `DeploymentMode`.
+- **Phase 11** ships the Dapr-backed implementations (`DaprEventBus`,
+  `DaprCacheService`, `DaprSecretProvider`) in `LearnStack.Infrastructure`, on
+  the triggers written in
+  [ADR-0035](../../docs/decisions/0035-demand-gated-infrastructure.md). Until
+  then this compose stack runs Dapr, Kafka, Valkey and Vault for local
+  familiarity only — no backend code path reaches them, and
+  `backend/Directory.Packages.props` declares no client library for any of the
+  four.
 - **Phase 02b** wires the `OutboxProcessor`, which is the only sanctioned
   caller of `IEventBus.PublishAsync` per ADR-0010 Amendment 1. Modules
   therefore *consume* `ICacheService` and `ISecretProvider` from 02a but