fix(auth): enforce exact-credential normalized emails across users and aliases (595) - #7501

Refresh the existing normalized-email invariant draft onto main 033ce862 while preserving the original migration-595 SQL byte for byte and retaining the original PR head as an ancestor. Update the writer inventory for shared credential-event SQL and current migration 620. Update the production-seam fixture to bind only the explicit shared UPSERT name-policy parameter; unexpected parameters still fail and SQL NULLs stay unchanged.

Current main's 591 is unrelated, 592–594/596 are absent, and the migration runner mechanically supports an unapplied-number late fill. Those code facts do not decide the production allocation or ordering. Document that the 595 global gate can produce 55P03 after credential mutation has begun, where current auth code does not retry; retain this availability decision for database review. Alias-verification token atomicity remains owned by #7499 / its existing stack.

Validation on 59d266e: Unicode-17 generator parity and 47 real PostgreSQL 15.18 invariant tests pass. Five optional 592/8847fc composition tests remain skipped; that stack composition is not claimed. Full normal root/server hooks, guards and typechecks pass. Disposable local databases include current migration-620 prerequisites; no production inventory or migration was performed.

Release hold retained: Draft, auto-merge off, no deployment authorization. Coordinator approval of allocation/order, protected legacy-email inventory and reconciliation, global-serialization availability/cost, genuine security/database review and fresh exact-head CI remain required. #7514 has merged; its earlier CI-race hold is cleared, and the old-head failure is not carried forward as a qualification claim. This does not close #6827.

CI composition repair — 2026-10-10

Head 0443295a6cbb11f6a52cb8c14cd8b92485639fbd repairs the four failures in integration shard 2 on 59d266e5. The pool-admission test previously ran ten concurrent email UPSERTs, which correctly encountered migration 595's fail-fast normalized-email writer lock (55P03); its early Promise.all rejection also left callbacks racing subsequent cleanup.

The capacity test now seeds credentials sequentially and exercises overlapping active-credential callbacks without competing email writes. It still requires ten successful transactions and epochs, more than one concurrent callback, and at most seven admitted callbacks to reserve a deletion connection. allSettled drains every callback before cleanup. A real held (6827,595) lock additionally verifies that a rejected email write invokes its callback exactly once and leaves no user or authorization epoch.

This is a single-file test repair. Production source and the original migration 595 bytes remain unchanged (fa5e481145de1b6332ed0c6dded4c410caa05c3faa071e400d0567f78239b313). The 62 focused PostgreSQL 15.18 tests and the complete previously failing integration shard pass (48 files, 843 tests, no skips). Normal commit hooks pass (1,106 root units, guards and typechecks; test-only staging correctly does not request a full server-unit rerun). Sonnet and Haiku independently approved the final committed diff. The local advisory storyboard matrix was stopped and the normal push used the documented ADCP_SKIP_STORYBOARD_MATRIX=1; no storyboard grade is claimed from that run. GitHub remains authoritative. Exact-head GitHub CI is now green: 56 successful checks, including all four server integration shards, with one expected neutral review and one skipped deployment check. The prior head's failed run is superseded.

Release hold retained: Draft, auto-merge off; coordinator allocation/order, protected legacy inventory, availability/cost and genuine human security/database review remain unresolved. No production migration or #6827 closure is claimed.

Draft disposition — 2026-10-10

• Existing author: @bokelley.
• Workstream / hold: Engineering / human review; the credential-capacity CI regression is repaired, genuine draft and deployment holds remain.
• Next action: Use the green exact head 0443295a6cbb11f6a52cb8c14cd8b92485639fbd for the outstanding human security/database review. The invariant and no-replay predicates remain enforced; retain coordinator migration ordering, protected legacy inventory, availability and human security/database gates before promotion.

This draft is retained for the stated workstream. Continue on this existing branch; no parallel PR is needed. This disposition does not waive CI, review, migration, or release gates.