chore(changeset): grade the runtime change minor — it grows a published interface

The changeset graded `@objectstack/runtime` `patch` and argued it in one line:
"Patch rather than minor: no accept set widens, and a declared guard returns to
enforced." That reasoning answers a different question than the level asks.

`DomainHandlerDeps` is a PUBLISHED type — `packages/runtime/src/index.ts`
re-exports it and the package's `exports["."]` resolves to the emitted
`dist/index.d.ts`, which carries the interface and the new REQUIRED member
`resolveServiceOrLoud(…)`. A required member added to an exported interface is a
new symbol on the published surface: every external `const deps:
DomainHandlerDeps = {…}` stops compiling. This repository's own history grades
that exact shape as minor — three entries under 17.0.0 / Minor Changes in
packages/runtime/CHANGELOG.md say `DomainHandlerDeps` grows two lazily-read
members, grows the shared facilities the body needs, and grows
`getRequestKernelService` and `routeNotFound`. Nothing distinguishes this growth
from those three.

The earlier `patch` rested on an in-repo grep — one constructor, no implementer
outside `packages/runtime` — which is evidence of presence and never evidence of
absence. The mechanical floor exists so that likelihood is not the thing being
argued.

So: level `minor`, and the clause-② declaration in the PR body moves to `yes`
with it — the LEVEL AXIS check makes `yes` plus `patch` a self-contradiction, and
the two belong to one judgement. The justification sentence for the level no
longer used is removed rather than left standing.

The changeset text also picks up what round 2 measured: the activation gate is
one body behind TWO routes, so three routes change, not two, and every gate now
reads the posture in the request's own environment scope.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N

Author: claude

.changeset/runtime-domain-gates-tenancy-posture-loud.md

@@ -1,11 +1,11 @@
 ---
-'@objectstack/runtime': patch
+'@objectstack/runtime': minor
 ---
 
 The `/keys` mint gate and the install-wide activation-write gate classify a tenancy resolution failure instead of reading it as "no wall"
 
 Both gates derived the effective tenancy posture through `DomainHandlerDeps.resolveService`, the dispatcher's capability **probe**: every step of its fallback chain absorbs every rejection and answers `undefined`. So a `tenancy` service that was registered and **failed to build** arrived at both gates as the same value a deployment that never registered one produces, and both read that as "there is no wall". Measured on the pre-fix tree against a real kernel whose `tenancy` is registered through a throwing factory: `POST /keys` answered **201** and minted an organization-less key, echoing the raw secret once, where a walled posture refuses one; and an organization administrator's install-wide activation write answered **200** and wrote the row, where ADR-0126 §5 requires the platform operator.
 
-The identity step already read this fact through the classified lookup, so one failure made the same deployment answer 503 at the identity step while admitting at these two gates — "is this deployment walled" had two answers at once. The gates now read the same classification, taken from the registry's own brand and never from message text: a service that was **never registered** stays quiet and behaves exactly as before (an org-less key is still minted, and a single-organization deployment's own admin can still flip an install-wide switch — with no tenancy service, install-level and org-level are one scope under ADR-0093 D4/D5), while a service that is **registered and unable to answer** raises `AuthzStoreUnavailableError` — 503 `SERVICE_UNAVAILABLE` — instead of degrading to "no posture". Nothing is minted and nothing is permitted on a posture that was never read.
+The identity step already read this fact through the classified lookup, so one deployment held two readings of its own wall question at once — 503 at the identity step, admitted at the door bodies these gates guard. The gates now read the same classification, taken from the registry's own brand and never from message text: a service that was **never registered** stays quiet and behaves exactly as before (an org-less key is still minted, and a single-organization deployment's own admin can still flip an install-wide switch — with no tenancy service, install-level and org-level are one scope under ADR-0093 D4/D5), while a service that is **registered and unable to answer** raises `AuthzStoreUnavailableError` — 503 `SERVICE_UNAVAILABLE` — instead of degrading to "no posture". Nothing is minted and nothing is permitted on a posture that was never read. The activation gate is one body behind **two** routes, so three routes change: `POST /keys`, `POST /actions/_activation/:object/:action` and `POST /automation/:name/toggle`. Every gate reads the posture in the request's own environment scope, as the identity step does, so a `tenancy` registered `ServiceLifecycle.SCOPED` is resolved rather than reported as an outage.
 
-`resolveService` keeps its probe contract for every other name and every other domain; the classified read is a second, opted-into dependency the two named gates call, so no gate that was not named here changes behaviour. Patch rather than minor: no accept set widens, and a declared guard returns to enforced.
+`resolveService` keeps its probe contract for every other name and every other domain: the classified read is a second, opted-into member — `DomainHandlerDeps.resolveServiceOrLoud` — that a gate calls one site at a time, so no gate outside the three routes above changes behaviour. **Minor** rather than patch: this grows the exported `DomainHandlerDeps` interface with a required member, which is a published-surface addition — the same shape the three `DomainHandlerDeps` growths in 17.0.0 shipped as minor changes.