@@ -0,0 +1,14 @@
+---
+'@objectstack/core': patch
+'@objectstack/cloud-connection': patch
+---
+
+feat(core): `isCloudManaged()` is the one reader of `OS_CLOUD_MANAGED`, and a production boot that sets it without a bound control plane refuses to start
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+- **New exports of `@objectstack/core`:** `isCloudManaged()`, `resolveControlPlaneApiKey(configured?)` and `resetCloudManagedForTesting()`. `isCloudManaged()` is synchronous and answers `true` when `OS_CLOUD_MANAGED` is exactly `1`, `false` when it is unset or empty; any other value is refused with an error that names it. The answer is memoized for the process; tests that set the variable call `resetCloudManagedForTesting()` before and after.
+- **The fuse.** On a production boot (not `--dev`, which sets `NODE_ENV=development` only when `NODE_ENV` is unset, and not `NODE_ENV=test`; so `NODE_ENV=production os serve --dev` counts as a production boot and is refused the same way), `OS_CLOUD_MANAGED=1` with `OS_CLOUD_API_KEY` unset or empty refuses: `ObjectKernel.bootstrap()` and `LiteKernel.bootstrap()` reject before any plugin initialises, and `isCloudManaged()` throws the same error. The cloud sets both variables on the runtimes it hosts. A self-hosted deployment that has `OS_CLOUD_MANAGED=1` in a copied env file now fails to boot; remove the variable, which a self-hosted deployment never needs.
+- **One caveat:** the fuse reads the environment only. A runtime that binds its control plane solely through `CloudConnectionPlugin`'s `controlPlaneApiKey` option, and also sets `OS_CLOUD_MANAGED=1` in production, is refused. Set `OS_CLOUD_API_KEY` instead.
+- **`@objectstack/cloud-connection`:** the plugin resolves its control-plane credential through `resolveControlPlaneApiKey(controlPlaneApiKey)`, so the plugin's "platform-managed" answer and the fuse share one derivation. Its behaviour is unchanged: the option wins, then `OS_CLOUD_API_KEY`, trimmed.
@@ -141,6 +141,7 @@ import {
     userAuthGateSourceOf,
     apiKeyLifecyclePolicySourceOf,
     classifyAdmissionTenancyPosture,
+    resolveControlPlaneApiKey,
     type TenancyPostureSource,
 } from '@objectstack/core';
 import type { AuthSessionApi, IAuthService, IObjectQLEngine } from '@objectstack/spec/contracts';
@@ -313,7 +314,7 @@ export class CloudConnectionPlugin implements Plugin {
             // them between config load and kernel boot — preserves the
             // behavior of the original app-level wiring.
             const cloudUrl = (this.cfg.controlPlaneUrl ?? process.env.OS_CLOUD_URL ?? '').trim().replace(/\/+$/, '');
-            const cloudApiKey = (this.cfg.controlPlaneApiKey ?? process.env.OS_CLOUD_API_KEY ?? '').trim();
+            const cloudApiKey = resolveControlPlaneApiKey(this.cfg.controlPlaneApiKey);
             const deviceClientId = (this.cfg.deviceClientId ?? process.env.OS_CLI_CLIENT_ID ?? 'objectstack-cli').trim();
             const deviceScope = 'openid profile email';
 
 
@@ -0,0 +1,156 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #25294 — `isCloudManaged()`, the one reader of `OS_CLOUD_MANAGED`, and its
+ * production fuse (ruling 6341690661 on #25083, Q2 → D). Pin 9 as the ruling
+ * reads it, one case each: a `--dev` boot with the variable runs managed; a
+ * production boot with the variable and a bound control plane runs managed; a
+ * production boot with the variable and no control plane refuses loudly;
+ * without the variable nothing is managed. Then the fuse at both kernels'
+ * `bootstrap()`, before any plugin initialises. The environment is driven
+ * through `process.env` and restored; the memo is reset around every case.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { ObjectKernel } from './kernel.js';
+import { LiteKernel } from './lite-kernel.js';
+import { isCloudManaged, resetCloudManagedForTesting, resolveControlPlaneApiKey } from './stack-auth.js';
+import type { Plugin } from './types.js';
+
+const ENV_VARS = ['OS_CLOUD_MANAGED', 'OS_CLOUD_API_KEY', 'NODE_ENV'] as const;
+const saved = Object.fromEntries(ENV_VARS.map((k) => [k, process.env[k]]));
+beforeEach(() => {
+  for (const k of ENV_VARS) delete process.env[k];
+  resetCloudManagedForTesting();
+});
+afterEach(() => {
+  for (const k of ENV_VARS) {
+    if (saved[k] === undefined) delete process.env[k];
+    else process.env[k] = saved[k];
+  }
+  resetCloudManagedForTesting();
+});
+
+/** A production boot: `NODE_ENV` as `os serve` defaults it without `--dev`. */
+const production = () => { process.env.NODE_ENV = 'production'; };
+
+describe('isCloudManaged — pin 9, as ruling 6341690661 (Q2 → D) reads it', () => {
+  it('a `--dev` boot with the variable runs managed, with no control plane bound', () => {
+    process.env.NODE_ENV = 'development'; // what `os serve --dev` sets
+    process.env.OS_CLOUD_MANAGED = '1';
+    expect(isCloudManaged()).toBe(true);
+  });
+
+  it('a production boot with the variable and a bound control plane runs managed', () => {
+    production();
+    process.env.OS_CLOUD_MANAGED = '1';
+    process.env.OS_CLOUD_API_KEY = 'svc-key';
+    expect(isCloudManaged()).toBe(true);
+  });
+
+  it('a production boot with the variable and no control plane refuses loudly, naming the variable and the binding', () => {
+    production();
+    process.env.OS_CLOUD_MANAGED = '1';
+    expect(() => isCloudManaged()).toThrow(/^\[Kernel\] Refusing to start: OS_CLOUD_MANAGED=1 is set on a production boot with no bound control plane \(OS_CLOUD_API_KEY is unset or empty\)/);
+  });
+
+  it('without the variable nothing is managed, on any boot', () => {
+    production();
+    expect(isCloudManaged()).toBe(false);
+    resetCloudManagedForTesting();
+    process.env.OS_CLOUD_API_KEY = 'svc-key';
+    expect(isCloudManaged()).toBe(false);
+    resetCloudManagedForTesting();
+    process.env.NODE_ENV = 'development';
+    expect(isCloudManaged()).toBe(false);
+  });
+});
+
+describe('isCloudManaged — the edges of the switch and of "production"', () => {
+  it('NODE_ENV=test is not production: the variable alone runs managed (the services half sets it under vitest)', () => {
+    process.env.NODE_ENV = 'test';
+    process.env.OS_CLOUD_MANAGED = '1';
+    expect(isCloudManaged()).toBe(true);
+  });
+
+  it('an unset NODE_ENV is production (`os serve` defaults it so), and a blank key is no binding', () => {
+    process.env.OS_CLOUD_MANAGED = '1';
+    process.env.OS_CLOUD_API_KEY = '   ';
+    expect(() => isCloudManaged()).toThrow(/no bound control plane/);
+  });
+
+  it('an empty variable is off; any value but `1` is refused on every boot, naming the value', () => {
+    process.env.NODE_ENV = 'development';
+    process.env.OS_CLOUD_MANAGED = '';
+    expect(isCloudManaged()).toBe(false);
+    for (const value of ['true', '0', 'yes']) {
+      resetCloudManagedForTesting();
+      process.env.OS_CLOUD_MANAGED = value;
+      expect(() => isCloudManaged()).toThrow(`OS_CLOUD_MANAGED is set to ${JSON.stringify(value)}`);
+    }
+  });
+
+  it('memoized for the process, the refusal included, until reset', () => {
+    process.env.NODE_ENV = 'test';
+    expect(isCloudManaged()).toBe(false);
+    process.env.OS_CLOUD_MANAGED = '1';
+    expect(isCloudManaged()).toBe(false);
+    resetCloudManagedForTesting();
+    expect(isCloudManaged()).toBe(true);
+
+    resetCloudManagedForTesting();
+    production();
+    expect(() => isCloudManaged()).toThrow(/no bound control plane/);
+    process.env.OS_CLOUD_API_KEY = 'svc-key';
+    expect(() => isCloudManaged()).toThrow(/no bound control plane/);
+    resetCloudManagedForTesting();
+    expect(isCloudManaged()).toBe(true);
+  });
+});
+
+describe('resolveControlPlaneApiKey — the one derivation of "a control plane is bound"', () => {
+  it('the configured value wins, even empty; else OS_CLOUD_API_KEY; trimmed; `` when neither', () => {
+    expect(resolveControlPlaneApiKey()).toBe('');
+    process.env.OS_CLOUD_API_KEY = '  env-key  ';
+    expect(resolveControlPlaneApiKey()).toBe('env-key');
+    expect(resolveControlPlaneApiKey(' cfg-key ')).toBe('cfg-key');
+    expect(resolveControlPlaneApiKey('')).toBe('');
+  });
+});
+
+describe('the fuse at kernel boot — refused before any plugin initialises', () => {
+  const probe = () => {
+    const calls: string[] = [];
+    const plugin: Plugin = {
+      name: 'test.cloud-managed-probe',
+      init: async () => { calls.push('init'); },
+      start: async () => { calls.push('start'); },
+    };
+    return { calls, plugin };
+  };
+
+  for (const [label, make] of [
+    ['ObjectKernel', () => new ObjectKernel({ logger: { level: 'error' }, gracefulShutdown: false, skipSystemValidation: true })],
+    ['LiteKernel', () => new LiteKernel({ logger: { level: 'error' } })],
+  ] as const) {
+    it(`${label}: a production boot with the variable and no control plane refuses; with a binding it boots`, async () => {
+      production();
+      process.env.OS_CLOUD_MANAGED = '1';
+      const refused = probe();
+      const kernel = make();
+      await kernel.use(refused.plugin);
+      await expect(kernel.bootstrap()).rejects.toThrow(/no bound control plane/);
+      expect(refused.calls).toEqual([]);
+
+      resetCloudManagedForTesting();
+      process.env.OS_CLOUD_API_KEY = 'svc-key';
+      const booted = probe();
+      const second = make();
+      await second.use(booted.plugin);
+      await second.bootstrap();
+      expect(booted.calls).toEqual(['init', 'start']);
+      expect(isCloudManaged()).toBe(true);
+      await second.shutdown();
+    });
+  }
+});
@@ -16,6 +16,7 @@ import {
 import { dispatchHookIsolating, dispatchHookPropagating } from './hook-dispatch.js';
 import { registerPluginByName } from './plugin-registration.js';
 import { raceWithTimeout } from './timeout-guard.js';
+import { isCloudManaged } from './stack-auth.js';
 
 /**
  * The kernel service a DEGRADED boot's conclusion is published on (#16630).
@@ -527,6 +528,12 @@ export class ObjectKernel {
             throw new Error('[Kernel] Kernel already bootstrapped');
         }
 
+        // The cloud-managed fuse (ruling 6341690661 on #25083, Q2 → D): a
+        // production boot with `OS_CLOUD_MANAGED=1` and no bound control plane
+        // refuses here, before any plugin initialises — every kernel in the
+        // process reads the one memoized fact. See `isCloudManaged()`.
+        isCloudManaged();
+
         this.state = 'initializing';
         this.logger.info('Bootstrap started');
 
 
@@ -6,6 +6,7 @@ import type { LoggerConfig } from '@objectstack/spec/system';
 import { ObjectKernelBase } from './kernel-base.js';
 import { registerPluginByName } from './plugin-registration.js';
 import { assertPluginContract } from './plugin-contract.js';
+import { isCloudManaged } from './stack-auth.js';
 
 /**
  * ObjectKernel - MiniKernel Architecture
@@ -87,6 +88,11 @@ export class LiteKernel extends ObjectKernelBase {
     async bootstrap(): Promise<void> {
         this.validateState('idle');
 
+        // The cloud-managed fuse, as in `ObjectKernel.bootstrap()`: every
+        // kernel in the process reads the one memoized fact before any plugin
+        // initialises. See `isCloudManaged()`.
+        isCloudManaged();
+
         this.state = 'initializing';
         this.logger.info('Bootstrap started');
 
 
@@ -1,6 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { readEnvWithDeprecation } from '@objectstack/types';
+import { getEnv } from './utils/env.js';
 
 /**
  * The ONE rule that decides whether a boot composes the platform's auth family
@@ -118,6 +119,97 @@ export function isHostKernelComposition(plugins: readonly unknown[]): boolean {
   });
 }
 
+/**
+ * The control-plane credential this process is bound with: the configured
+ * value when one is given, else `OS_CLOUD_API_KEY` (which the cloud injects
+ * into the runtimes it hosts), trimmed; `''` when neither. The ONE derivation
+ * of "a control plane is bound" — `CloudConnectionPlugin` (`@objectstack/cloud-connection`)
+ * resolves its `platformManaged` through it with its `controlPlaneApiKey`
+ * option, and {@link isCloudManaged}'s fuse reads it with none, because a
+ * process-wide accessor sees no plugin's options. Ruling 6341690661 (#25083),
+ * Q2 → D: the fuse reads the fact cloud-connection already computes, ⛔ never
+ * a second spelling of it beside a reader.
+ */
+export function resolveControlPlaneApiKey(configured?: string): string {
+  return (configured ?? getEnv('OS_CLOUD_API_KEY') ?? '').trim();
+}
+
+/**
+ * The memoized answer of {@link isCloudManaged} — its refusal included, so a
+ * boot the fuse refused stays refused on every later read in the process.
+ */
+let cloudManagedVerdict: { readonly managed: boolean } | { readonly refusal: Error } | undefined;
+
+/**
+ * Is this process the cloud-managed runtime? `OS_CLOUD_MANAGED=1` is the
+ * switch on EVERY boot, and this is its ONE reader (ruling 6341690661 on
+ * #25083, Q2 → D): every judgement site — plugin-auth's sign-in surfaces, the
+ * admin user doors, the audience posture, invitations, the just-in-time path —
+ * calls it and nothing else, and every kernel in the process reads the same
+ * fact, the per-environment kernels the cloud builds beside its host kernel
+ * included. The name is the maintainer's: no `_ENABLED` suffix (the recorded
+ * exception to Prime Directive 9), and not `isManaged()`, which already names
+ * `idp_provisioned` identities and `managedBy` provenance in this tree.
+ *
+ * Exactly `1` turns it on; unset or empty leaves it off; any other value is
+ * refused, so a mistyped switch cannot run a hosted runtime unmanaged.
+ *
+ * **The fuse.** A production boot — not a development boot
+ * ({@link isDevelopmentBoot}, which `--dev` sets through `NODE_ENV`) and not
+ * `NODE_ENV=test` — that finds the switch on with no bound control plane
+ * ({@link resolveControlPlaneApiKey}) refuses: the cloud injects
+ * `OS_CLOUD_API_KEY` into every runtime it hosts, so a runtime without it is
+ * a self-hosted deployment carrying a copied env file, and it is refused
+ * instead of silently narrowed. It fires at the first read here, and at
+ * `ObjectKernel` / `LiteKernel` `bootstrap()`, which read it before any plugin
+ * initialises — ⛔ never in `os serve`, which the hosted process never runs.
+ * A control plane bound only through `CloudConnectionPlugin`'s
+ * `controlPlaneApiKey` option is invisible to the fuse and is refused.
+ *
+ * Synchronous and memoized for the process; tests reset it with
+ * {@link resetCloudManagedForTesting}.
+ */
+export function isCloudManaged(): boolean {
+  cloudManagedVerdict ??= decideCloudManaged();
+  if ('refusal' in cloudManagedVerdict) throw cloudManagedVerdict.refusal;
+  return cloudManagedVerdict.managed;
+}
+
+/**
+ * Forget {@link isCloudManaged}'s memoized answer, so the next read decides
+ * again from the environment. For tests that set `OS_CLOUD_MANAGED` and remove
+ * it afterwards; ⛔ never called by a boot.
+ */
+export function resetCloudManagedForTesting(): void {
+  cloudManagedVerdict = undefined;
+}
+
+function decideCloudManaged(): { readonly managed: boolean } | { readonly refusal: Error } {
+  const raw = getEnv('OS_CLOUD_MANAGED');
+  if (raw === undefined) return { managed: false };
+  if (raw !== '1') {
+    return {
+      refusal: new Error(
+        `[Kernel] OS_CLOUD_MANAGED is set to ${JSON.stringify(raw)}. The managed-mode switch takes exactly 1, `
+        + 'or is left unset: set OS_CLOUD_MANAGED=1 on a cloud-hosted runtime, and remove it everywhere else.',
+      ),
+    };
+  }
+  const production = !isDevelopmentBoot(undefined) && getEnv('NODE_ENV') !== 'test';
+  if (production && resolveControlPlaneApiKey() === '') {
+    return {
+      refusal: new Error(
+        '[Kernel] Refusing to start: OS_CLOUD_MANAGED=1 is set on a production boot with no bound control plane '
+        + '(OS_CLOUD_API_KEY is unset or empty). The cloud sets both on every runtime it hosts, so this runtime is '
+        + 'not cloud-hosted: remove OS_CLOUD_MANAGED (a self-hosted deployment never sets it), or set '
+        + "OS_CLOUD_API_KEY to the environment's control-plane service key. A key passed only as "
+        + "CloudConnectionPlugin's controlPlaneApiKey option does not count.",
+      ),
+    };
+  }
+  return { managed: true };
+}
+
 /**
  * The auth secret a development boot falls back to, so trying the login flow
  * locally does not need `OS_AUTH_SECRET`. Never used outside development.