@@ -55,7 +55,7 @@ import type { VerifyStack } from '@objectstack/verify';
 import { columnsOf, type FixtureManifest } from './upgrade-harness/fixture-manifest.js';
 import { FIXTURE_NAMES, FIXTURE_PEOPLE, bootFixture } from './upgrade-harness/populate-fixture.js';
 import { loadSqlIntoSqlite } from './upgrade-harness/sqlite-text-dump.js';
-import { OWNERSHIP_MARKER, runOwnershipCeremony, runSchemaPlan } from './upgrade-harness/ceremony.js';
+import { OWNERSHIP_MARKER, SERVED_ENV, runOwnershipCeremony, runSchemaPlan } from './upgrade-harness/ceremony.js';
 
 const FIXTURE = new URL('./upgrade-harness/fixture-18.0/', import.meta.url);
 const MARKER = OWNERSHIP_MARKER;
@@ -368,7 +368,7 @@ describe(`[#24884] an 18.0.0 database (fixture from ${gaManifest.ref} @ ${gaMani
   }, 320_000);
 
   it('[ADR-0131 D1] HEAD\'s schema plan lists its nullable tenant columns as an advisory naming the ceremony, and as no drift', () => {
-    const plan = runSchemaPlan(file);
+    const plan = runSchemaPlan(file, SERVED_ENV);
     const advisory = plan.nullableTenantColumns;
     if (advisory.status !== 'read') throw new Error(`the advisory did not read: ${advisory.detail}`);
     expect(advisory.remedy).toBe('os migrate organization-ownership');
@@ -424,7 +424,7 @@ describe(`[#24884] an 18.0.0 database (fixture from ${gaManifest.ref} @ ${gaMani
     expect(stack, 'HEAD has stopped before the ceremony reads the file').toBeUndefined();
     const ceremonied = join(dir, 'ga.ceremonied.db');
     copyFileSync(file, ceremonied);
-    const report = runOwnershipCeremony(dir, ceremonied, 'ga-voluntary') as {
+    const report = runOwnershipCeremony(dir, ceremonied, 'ga-voluntary', SERVED_ENV) as {
       complete?: boolean;
       steps?: Array<{ step: string; summary: Record<string, number>; notes: string[] }>;
     };
@@ -434,7 +434,7 @@ describe(`[#24884] an 18.0.0 database (fixture from ${gaManifest.ref} @ ${gaMani
     expect(notNull.summary.alreadyNotNull, JSON.stringify(notNull)).toBeGreaterThanOrEqual(1);
     expect(notNull.notes.filter((n) => /created with \S+ nullable column/.test(n))).toEqual([]);
 
-    const plan = runSchemaPlan(ceremonied);
+    const plan = runSchemaPlan(ceremonied, SERVED_ENV);
     const advisory = plan.nullableTenantColumns;
     if (advisory.status !== 'read') throw new Error(`the advisory did not read: ${advisory.detail}`);
     expect(advisory.columns.filter((c) => c.ceremony === 'tightens'), 'a column the ceremony would still tighten').toEqual([]);
@@ -448,7 +448,7 @@ describe(`[#24884] an 18.0.0 database (fixture from ${gaManifest.ref} @ ${gaMani
     const fresh = join(dir, 'fresh.db');
     const booted = await bootFixture(fresh);
     await booted.stop();
-    const plan = runSchemaPlan(fresh);
+    const plan = runSchemaPlan(fresh, SERVED_ENV);
     expect(plan.nullableTenantColumns).toEqual({ status: 'read', adr: 'ADR-0131 D1', remedy: 'os migrate organization-ownership', columns: [] });
     // Its only nullable `organization_id` is the opt-out, which is no tenant column.
     expect(nullableOrganizationTables(fresh)).toEqual(['sys_sso_provider']);
 
@@ -23,15 +23,22 @@ const CLI_BIN = join(CLI_ROOT, 'bin', 'run.js');
 /** The ceremony's sys_migration row: its marker. */
 export const OWNERSHIP_MARKER = 'adr-0131-organization-ownership';
 
+/**
+ * The environment a production `os serve` of the showcase is started with: an
+ * auth secret, without which it is refused, and its auth family (the tenant
+ * tables among them) is not composed.
+ */
+export const SERVED_ENV: NodeJS.ProcessEnv = { OS_AUTH_SECRET: 'dogfood-upgrade-harness-auth-secret-0123456789' };
+
 /**
  * Run the ceremony on `file`: the plan into `dir/<tag>-plan.json`, then
  * `--apply --plan-file … --backup-taken`. The apply report. Throws, with both
- * runs' output, when either exits non-zero.
+ * runs' output, when either exits non-zero. `env` is laid over this process's.
  */
-export function runOwnershipCeremony(dir: string, file: string, tag: string): Record<string, unknown> {
+export function runOwnershipCeremony(dir: string, file: string, tag: string, env: NodeJS.ProcessEnv = {}): Record<string, unknown> {
   const run = (args: string[]) => spawnSync(process.execPath, [
     CLI_BIN, 'migrate', 'organization-ownership', '--database-url', `file:${file}`, ...args,
-  ], { cwd: SHOWCASE_DIR, encoding: 'utf8', timeout: 300_000, env: { ...process.env, NO_COLOR: '1' } });
+  ], { cwd: SHOWCASE_DIR, encoding: 'utf8', timeout: 300_000, env: { ...process.env, ...env, NO_COLOR: '1' } });
   const planFile = join(dir, `${tag}-plan.json`);
   const plan = run(['--out', planFile]);
   if (plan.status !== 0) throw new Error(`the ceremony's plan exited ${plan.status}:\n${plan.stdout}\n${plan.stderr}`);
@@ -52,7 +59,7 @@ export interface SchemaPlanChange {
  * `os migrate plan --json` on `file`, the real binary in the showcase's
  * directory, as an operator reads the drift before serving a database. Writes
  * no row or table. The parsed document; throws, with the run's output, when it
- * exits non-zero.
+ * exits non-zero. `env` is laid over this process's.
  */
 /** One tenant column `os migrate plan` lists as still nullable: its advisory, never drift (ADR-0131 D1). */
 export interface NullableTenantColumn {
@@ -63,7 +70,7 @@ export interface NullableTenantColumn {
   reason?: string;
 }
 
-export function runSchemaPlan(file: string): {
+export function runSchemaPlan(file: string, env: NodeJS.ProcessEnv = {}): {
   total: number;
   changes: SchemaPlanChange[];
   pending: unknown[];
@@ -73,7 +80,7 @@ export function runSchemaPlan(file: string): {
     cwd: SHOWCASE_DIR,
     encoding: 'utf8',
     timeout: 300_000,
-    env: { ...process.env, NO_COLOR: '1' },
+    env: { ...process.env, ...env, NO_COLOR: '1' },
   });
   if (plan.status !== 0) throw new Error(`os migrate plan exited ${plan.status}:\n${plan.stdout}\n${plan.stderr}`);
   return JSON.parse(plan.stdout);