[rafiki270]

Valid /org/me bootstrap reads can expire while holding a shared user lock and waiting for an admin connection. Two confidential token exchanges can occupy that pool while waiting for the same lock, causing P2028 failures.

Keep the complete authority projection on one admin transaction and recheck live authority and session assurance after connection acquisition. Pass that transaction through every nested read. Explicit ACTIVE membership and lifecycle predicates preserve directory access, and server-owned product policy controls cross-product reach. Document the narrow RLS exception; ordinary tenant CRUD, pool sizes, transaction limits, SQL grants and the confidential exchange path stay unchanged.

The database fixture now awaits Prisma CLI processes asynchronously, keeping Vitest worker RPC responsive during schema provisioning and cleanup. Its CLI arguments, SQL input, retry/backoff, stderr bound and failure handling are preserved.

Validation:

• The deployed-source PostgreSQL regression passed its control and reproduced the shared-reader/two-writer cycle with P2028.
• The final six-file Maxis selection passed 47/47, with zero skips, failed suites or unhandled errors and exit code 0. It covers the repaired overlap, six post-preflight denials, directory lifecycle/product-policy exclusions, legitimate same-domain membership visibility and transaction/checkout guards.
• Scoped ESLint and API typecheck passed. The final documentation commit changes no tested inputs; the passing source is 2814ee39b139ca58ba688ad5959872007fcbc662.
• Test provisioning hooks used 900 seconds; behavioral cases remained 30 seconds, worker RPC 60 seconds and interactive transactions 5 seconds. Regression pools remained three app/two admin connections.
• Full CI passed: 3,698 cases passed and four unrelated skips. All six focused files / 47 cases passed without skips in CI too.
• Normal deployment promoted cff1e78. Cloud Run uoa-auth-00350-7zd is ready with 100% traffic; its served digest matches the merged-SHA image and public /health returned 200. Subsequent authenticated FullSend reads and operational-evidence lookups succeeded.
• Production contention and live identity revocation were not induced; those denial and overlap boundaries were verified on the real PostgreSQL fixture.

No visible UI changes or native build inputs change. No production state, credentials or grants were edited during verification.