Record zone-engine compilation invariant; drop uncommitted policy leftovers

flex-auth stays the only PDP. Zone membership reaches /v1/check as compiled
registry data, never a synchronous lookup. Uncommitted tenant-engine
read/role/grouping policy was discarded, not mixed into this pin.

docs/tenancy-posture-review.md

@@ -278,3 +278,27 @@ volunteer.
 
 Nothing in this review changes a running system, and T02 will not be applied
 to production without the usual staged-promotion path.
+
+---
+
+## 7. Zone membership reaches flex-auth by compilation only
+
+Recorded 2026-08-19 in reply to ops-warden (`fd4b2012`) after zone-engine was
+seeded. Hold both sides to this:
+
+- flex-auth remains the only policy decision point.
+- zone-engine is authority over zone identity, membership, and exception
+  lifecycle. It is never a second PDP and never a synchronous lookup on
+  `POST /v1/check`.
+- Membership (and any zone fact a decision may read) is compiled into the
+  registry snapshot the same way ops-warden's production actor inventory is
+  (`build_flex_auth_registry.py`). `service_class: latency-critical`.
+- Per-zone enforcement stance for controls flex-auth does not evaluate
+  (agent read-boundary on `risk: high` lanes, warden desk escalation) does
+  not belong in the policy package. Putting it there would split
+  authorization again. Facts we *do* evaluate at check time can be compiled
+  data that existing Rego reads.
+
+`flex-auth-ops-warden` stays `callerAuth.mode: enforce`. Recreating that
+Service would break the ops-bridge ClusterIP pin `10.43.1.165`; warn
+ops-warden first.

tenancy.yaml

@@ -39,11 +39,12 @@ tenancy:
       decision point judges asserted claims, it cannot be the verifier of its
       own inputs. Not a defect and not a target for movement.
     A: >-
-      Both production pins are live A2 as of 2026-08-19 on digest
+      All three production pins are live A2 as of 2026-08-19 on digest
-      sha256:138aa347… with callerAuth.mode=enforce. Unbound requests
+      sha256:138aa347… with callerAuth.mode=enforce (user-engine,
-      return 401; a token bound to the other protected system returns 403.
+      tenant-engine, isolated ops-warden). Unbound requests return 401; a
-      user-engine probe from user-engine-8569d7cb87-fp7px;
+      token bound to the other protected system returns 403. Zone
-      tenant-engine probe from tenant-engine-6c6dcbddbb-4v26w.
+      membership, if any, reaches this PDP only as compiled registry
+      data — never a synchronous zone-engine lookup.
     E: >-
       No tenant data at rest. Tenant scoping in decisions runs through one
       choke point (internal/decision/engine.go normalizeRequest and the