Record zone-engine compilation invariant; drop uncommitted policy leftovers

flex-auth stays the only PDP. Zone membership reaches /v1/check as compiled
registry data, never a synchronous lookup. Uncommitted tenant-engine
read/role/grouping policy was discarded, not mixed into this pin.

docs/tenancy-posture-review.md

@@ -278,3 +278,27 @@ volunteer.
 
 Nothing in this review changes a running system, and T02 will not be applied
 to production without the usual staged-promotion path.
+
+---
+
+## 7. Zone membership reaches flex-auth by compilation only
+
+Recorded 2026-08-19 in reply to ops-warden (`fd4b2012`) after zone-engine was
+seeded. Hold both sides to this:
+
+- flex-auth remains the only policy decision point.
+- zone-engine is authority over zone identity, membership, and exception
+  lifecycle. It is never a second PDP and never a synchronous lookup on
+  `POST /v1/check`.
+- Membership (and any zone fact a decision may read) is compiled into the
+  registry snapshot the same way ops-warden's production actor inventory is
+  (`build_flex_auth_registry.py`). `service_class: latency-critical`.
+- Per-zone enforcement stance for controls flex-auth does not evaluate
+  (agent read-boundary on `risk: high` lanes, warden desk escalation) does
+  not belong in the policy package. Putting it there would split
+  authorization again. Facts we *do* evaluate at check time can be compiled
+  data that existing Rego reads.
+
+`flex-auth-ops-warden` stays `callerAuth.mode: enforce`. Recreating that
+Service would break the ops-bridge ClusterIP pin `10.43.1.165`; warn
+ops-warden first.