@@ -0,0 +1,37 @@
+---
+'@objectstack/plugin-auth': minor
+'@objectstack/spec': patch
+---
+
+**plugin-auth: under the `open` audience posture, the deployment can turn email verification off**
+
+Clause-②: yes
+
+Under `audience.posture: 'open'`, an explicit `emailAndPassword.requireEmailVerification: false`
+declared by the **deployment** is now honoured instead of refused at config entry. The deployment
+declares it through its stack config (the `AuthManager` constructor), host code calling
+`AuthManager.applyConfigPatch()`, or the `OS_AUTH_REQUIRE_EMAIL_VERIFICATION=false` env override
+of the `auth.require_email_verification` setting. A sign-up is then signed in at once, with no
+verification mail. This is for a deployment with no mail transport that trusts its sign-ups,
+such as a pre-production environment, which otherwise dead-ends every new account at the verify
+page.
+
+Nothing changes for anyone who does not opt out:
+
+- `open` with the value absent or `true` still forces verification on.
+- `email_domain` still refuses an explicit `false`, from any source, with the same message. The
+  domain allowlist is the only gate there, so an unverified sign-up could claim a colleague's
+  address.
+- `invite_only` is unchanged.
+- A `false` stored only through the settings console is still refused under `open`. The console
+  can agree with the deployment's opt-out, never make one.
+
+The opt-out is loud. `AuthPlugin` logs one warning at boot naming the posture and the
+consequence: anyone can register an address they do not control, and an organization invitation
+sent to that address can then be accepted by that account. `getPublicConfig()` reports
+`requireEmailVerification: false`, the value actually wired, because the wiring and the
+advertisement now read one resolver.
+
+`AuthManager.applyConfigPatch()` takes an optional second argument,
+`{ requireEmailVerificationFrom: 'deployment' | 'console' }`. It defaults to `deployment`; the
+settings binding passes `console` for a stored value and `deployment` for an env override.
@@ -81,7 +81,7 @@ read at startup unless noted otherwise. Boolean variables accept `true` / `false
 | `OS_DISABLE_SIGNUP` | boolean | `false` | When `true`, block new email/password sign-ups. Under the `single` posture the very first user can still sign up to bootstrap admin; under the walled postures no sign-up is ever promoted, so this leaves the deployment dependent on `OS_PLATFORM_OWNER_EMAIL` alone. |
 | `OS_AUTH_EMAIL_PASSWORD_ENABLED` | boolean | settings default | Settings env override for `auth.email_password_enabled`. Controls local email/password login. |
 | `OS_AUTH_SIGNUP_ENABLED` | boolean | settings default | Settings env override for `auth.signup_enabled`. Takes precedence over UI settings and is preferred over `OS_DISABLE_SIGNUP`. |
-| `OS_AUTH_REQUIRE_EMAIL_VERIFICATION` | boolean | settings default | Settings env override for `auth.require_email_verification`. |
+| `OS_AUTH_REQUIRE_EMAIL_VERIFICATION` | boolean | settings default | Settings env override for `auth.require_email_verification`. Under the `open` audience posture, `false` is the deployment's opt-out from the forced verification (one boot warning; see [Email verification under each posture](/docs/deployment/self-hosting#email-verification-under-each-posture)); under `email_domain` it is refused, since verification is forced there. |
 | `OS_AUTH_MEMBERSHIP_POLICY` | `auto` \| `invite-only` | `auto` | Settings env override for `auth.membership_policy` — what a newly created user joins (ADR-0093 D1). `auto` binds every new user to the deployment's default organization. `invite-only` grants membership solely through an explicit act: creating a workspace, accepting an invitation, an admin adding them, or SSO just-in-time provisioning. Applies to sign-up **and** to the backfill of pre-existing member-less users. An unrecognized value is rejected with an `error` log and **ignored** — the deployment keeps its current policy rather than silently reverting to `auto`. |
 | `OS_AUTH_GOOGLE_ENABLED` | boolean | settings default | Settings env override for `auth.google_enabled`. Requires Google OAuth credentials from Settings or env. |
 | `GOOGLE_CLIENT_ID` | string | — | Deployment-level Google OAuth client id for the open-source Google login implementation. |
 
@@ -577,8 +577,11 @@ this step.
   answer the `invite_only` default already gives for an address the directory
   holds, so the widened posture buys that person no login and their sign-in
   stays `401`. A fresh address does get an account, but every posture other
-  than `invite_only` forces email verification on, so its first sign-in is
-  refused `403 EMAIL_NOT_VERIFIED` until a mail transport delivers the link.
+  than `invite_only` forces email verification on (unless an `open` deployment
+  has itself declared it off — see
+  [Email verification under each posture](#email-verification-under-each-posture)),
+  so its first sign-in is refused `403 EMAIL_NOT_VERIFIED` until a mail
+  transport delivers the link.
 - **A hand-written credential row authenticates nothing.** The `sys_account`
   row shape is public; the format of the secret stored in its `password`
   column is the platform's own. A row carrying a plaintext password is refused
@@ -633,6 +636,30 @@ remove. If you run a real internet-facing `open` deployment and want that
 trade, open an issue saying so: it is a per-deployment decision, waiting on a
 deployment that needs it.
 
+### Email verification under each posture
+
+- **`invite_only`** follows `auth.require_email_verification`
+  (`OS_AUTH_REQUIRE_EMAIL_VERIFICATION`), off by default.
+- **`email_domain`** forces verification on, and an explicit `false` is
+  refused: the domain allowlist is the only gate there, so an unverified
+  sign-up could claim a colleague's address.
+- **`open`** forces verification on too, **unless the deployment turns it
+  off**: set `OS_AUTH_REQUIRE_EMAIL_VERIFICATION=false`, or
+  `emailAndPassword.requireEmailVerification: false` in the stack config. A
+  sign-up is then signed in at once and no verification mail is sent.
+
+The `open` opt-out is for a deployment with no mail transport that trusts
+whoever can reach it, such as a pre-production environment. It is loud and it
+has a cost:
+
+- The boot logs one warning naming the posture and the consequence, and
+  `/api/v1/auth/config` reports `requireEmailVerification: false` — the value
+  actually wired.
+- Anyone can register an address they do not control. An organization
+  invitation sent to that address can then be accepted by that account.
+- It is the deployment's to declare. A `false` stored only through the
+  settings console is refused under `open`, and verification stays on.
+
 ## Go-live
 
 Before pointing real users at the deployment, walk the
 
@@ -51,7 +51,7 @@ Advanced / low-level Better-Auth options
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **posture** | `Enum<'invite_only' \| 'email_domain' \| 'open'>` | optional (default: `"invite_only"`) | Who may self-register into this environment: invite_only (default — operator acts only), email_domain (allowlisted email domains), or open (anyone). Any posture other than invite_only forces email verification on. |
+| **posture** | `Enum<'invite_only' \| 'email_domain' \| 'open'>` | optional (default: `"invite_only"`) | Who may self-register into this environment: invite_only (default — operator acts only), email_domain (allowlisted email domains), or open (anyone). email_domain forces email verification on; open forces it on unless the deployment explicitly sets emailAndPassword.requireEmailVerification to false. |
 | **allowedEmailDomains** | `string[]` | optional | Email domains admitted to self-register under posture email_domain (exact, case-insensitive match; subdomains need their own entries). Required non-empty for email_domain; refused under other postures. |
 | **selfRegistrationPermissionSet** | `string` | optional | sys_permission_set name granted to each self-registrant. Required when posture is email_domain or open; refused for invite_only. admin_full_access is refused. |
 
@@ -168,7 +168,7 @@ OIDC / Generic OAuth2 provider configuration for enterprise SSO
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **posture** | `Enum<'invite_only' \| 'email_domain' \| 'open'>` | optional (default: `"invite_only"`) | Who may self-register into this environment: invite_only (default — operator acts only), email_domain (allowlisted email domains), or open (anyone). Any posture other than invite_only forces email verification on. |
+| **posture** | `Enum<'invite_only' \| 'email_domain' \| 'open'>` | optional (default: `"invite_only"`) | Who may self-register into this environment: invite_only (default — operator acts only), email_domain (allowlisted email domains), or open (anyone). email_domain forces email verification on; open forces it on unless the deployment explicitly sets emailAndPassword.requireEmailVerification to false. |
 | **allowedEmailDomains** | `string[]` | optional | Email domains admitted to self-register under posture email_domain (exact, case-insensitive match; subdomains need their own entries). Required non-empty for email_domain; refused under other postures. |
 | **selfRegistrationPermissionSet** | `string` | optional | sys_permission_set name granted to each self-registrant. Required when posture is email_domain or open; refused for invite_only. admin_full_access is refused. |
 
 
@@ -18,7 +18,10 @@
  *
  *   - empty domain list under `email_domain`;
  *   - missing / forbidden (`admin_full_access`) self-registration permission set;
- *   - posture ≠ `invite_only` with verification explicitly off.
+ *   - `email_domain` with verification explicitly off (any source), and `open`
+ *     with verification off stored only through the console (#20389: the
+ *     `OS_AUTH_REQUIRE_EMAIL_VERIFICATION` env override is the deployment's
+ *     opt-out and is honoured under `open`).
  *
  * Envelope note: refusals at THIS seam are log-line refusals (the binding runs
  * inside `applySettings`, not on an HTTP surface), so the assertions pin the
@@ -35,6 +38,7 @@ import type { PluginContext } from '@objectstack/core';
 import { AUDIENCE_POSTURES } from '@objectstack/spec/system';
 import { AuthPlugin } from './auth-plugin.js';
 import { AuthManager } from './auth-manager.js';
+import { OPEN_POSTURE_VERIFICATION_OFF_WARNING } from './audience-posture.js';
 import { assertEngineFindOnePredicate, type EngineFindOneQueryInput } from '@objectstack/objectql';
 
 const SECRET = 'test-secret-at-least-32-chars-long';
@@ -122,6 +126,8 @@ describe('auth.audience_* — the settings switch surface (#11768)', () => {
 
   const errorLines = () =>
     (mockContext.logger.error as any).mock.calls.map((c: any[]) => String(c[0]));
+  const warnLines = () =>
+    (mockContext.logger.warn as any).mock.calls.map((c: any[]) => String(c[0]));
 
   // ── 1. The declaration reaches the runtime, whole, through ONE patch ─────
 
@@ -226,23 +232,125 @@ describe('auth.audience_* — the settings switch surface (#11768)', () => {
     expect(errorLines().some((m: string) => m.includes('admin_full_access'))).toBe(true);
   });
 
-  it('a self-registration posture with verification explicitly OFF is refused', async () => {
+  it('open with verification OFF stored only through the CONSOLE is refused — the console cannot make the opt-out', async () => {
     // The audience patch is applied AFTER the main patch, so the merged-result
     // validation judges it against the `require_email_verification: false`
-    // this same pass just applied — the #11739 "verification forced when
-    // posture permits self-registration" invariant, held through the new door.
+    // this same pass just applied. A console-stored value (source `global`) is
+    // not the deployment's declaration, so under `open` it stays the #11739
+    // contradiction (#20389 honours only the deployment's opt-out).
     const { manager } = await boot({
       settings: {
         require_email_verification: { value: false, source: 'global' },
         audience_posture: { value: 'open', source: 'global' },
         audience_self_registration_permission_set: { value: 'member_default', source: 'global' },
       },
     });
-    // The main patch itself applied…
+    // The main patch itself applied (legal under the standing invite_only)…
     expect((manager as any).config.emailAndPassword?.requireEmailVerification).toBe(false);
     // …and the audience that contradicts it was refused: standing rules.
     expect(manager.getAudience().posture).toBe('invite_only');
     expect(errorLines().some((m: string) => m.includes('requireEmailVerification'))).toBe(true);
+    expect(errorLines().some((m: string) => m.includes('unless the DEPLOYMENT turns it off'))).toBe(true);
+    expect(warnLines()).not.toContain(OPEN_POSTURE_VERIFICATION_OFF_WARNING);
+  });
+
+  it('open with the OS_AUTH_REQUIRE_EMAIL_VERIFICATION env override OFF is honoured — the deployment declared it', async () => {
+    // Every key arrives as an env override (source `env`), the shape a
+    // deployment that configures itself only through OS_AUTH_* produces.
+    const { manager } = await boot({
+      settings: {
+        require_email_verification: { value: false, source: 'env' },
+        audience_posture: { value: 'open', source: 'env' },
+        audience_self_registration_permission_set: { value: 'member_default', source: 'env' },
+      },
+    });
+    expect(manager.getAudience().posture).toBe('open');
+    expect(manager.getPublicConfig().emailPassword.requireEmailVerification).toBe(false);
+    expect(errorLines().filter((m: string) => /audience|verification/i.test(m))).toEqual([]);
+    // Loud: exactly one boot warning naming the posture and the consequence.
+    expect(warnLines().filter((m: string) => m === OPEN_POSTURE_VERIFICATION_OFF_WARNING)).toHaveLength(1);
+    expect(OPEN_POSTURE_VERIFICATION_OFF_WARNING).toContain("audience posture 'open'");
+    expect(OPEN_POSTURE_VERIFICATION_OFF_WARNING).toContain('invitation');
+    // A later settings pass re-applies the same declaration without a second warning.
+    for (const cb of subscribers) cb();
+    await vi.waitFor(() => expect(manager.getAudience().posture).toBe('open'));
+    expect(warnLines().filter((m: string) => m === OPEN_POSTURE_VERIFICATION_OFF_WARNING)).toHaveLength(1);
+  });
+
+  it('stack-config open + false AND the same env override: both doors agree, and sibling settings still apply', async () => {
+    // A host that maps the env var into its stack config (the constructor
+    // door) while the settings service ALSO carries it as an env override:
+    // the second door must agree, never refuse the pass — a refused main
+    // patch drops every sibling auth setting in it.
+    const { manager } = await boot({
+      pluginOptions: {
+        audience: { posture: 'open', selfRegistrationPermissionSet: 'member_default' },
+        emailAndPassword: { requireEmailVerification: false },
+      },
+      settings: {
+        require_email_verification: { value: false, source: 'env' },
+        session_expiry_days: { value: 3, source: 'global' },
+      },
+    });
+    expect(manager.getAudience().posture).toBe('open');
+    expect(manager.getPublicConfig().emailPassword.requireEmailVerification).toBe(false);
+    expect((manager as any).config.session?.expiresIn).toBe(3 * 86_400);
+    expect(warnLines().some((m: string) => m.includes('failed to apply auth settings'))).toBe(false);
+    expect(warnLines().filter((m: string) => m === OPEN_POSTURE_VERIFICATION_OFF_WARNING)).toHaveLength(1);
+  });
+
+  it('email_domain with the env override OFF is still refused — no source can turn verification off there', async () => {
+    const { manager } = await boot({
+      settings: {
+        require_email_verification: { value: false, source: 'env' },
+        audience_posture: { value: 'email_domain', source: 'env' },
+        audience_allowed_email_domains: { value: 'acme.com', source: 'env' },
+        audience_self_registration_permission_set: { value: 'member_default', source: 'env' },
+      },
+    });
+    expect(manager.getAudience().posture).toBe('invite_only'); // refused: standing rules
+    expect(
+      errorLines().some((m: string) =>
+        m.includes("posture 'email_domain' opens self-registration, which FORCES email verification on"),
+      ),
+    ).toBe(true);
+    expect(warnLines()).not.toContain(OPEN_POSTURE_VERIFICATION_OFF_WARNING);
+  });
+
+  it('the no-mail-transport boot error offers the env opt-out only where the posture honours it', async () => {
+    // The harness registers no email service, so a REQUIRED verification
+    // reports at boot. Under `open` turning it off is a real remedy now…
+    await boot({
+      pluginOptions: { audience: { posture: 'open', selfRegistrationPermissionSet: 'member_default' } },
+    });
+    const openLine = errorLines().find((m: string) => m.includes('NO email service is registered'));
+    expect(openLine).toContain('OS_AUTH_REQUIRE_EMAIL_VERIFICATION=false');
+  });
+
+  it('…and under email_domain, where it is refused, the error does not offer it', async () => {
+    await boot({
+      pluginOptions: {
+        audience: { posture: 'email_domain', allowedEmailDomains: ['acme.com'], selfRegistrationPermissionSet: 'member_default' },
+      },
+    });
+    const line = errorLines().find((m: string) => m.includes('NO email service is registered'));
+    expect(line).toBeDefined();
+    expect(line).not.toContain('OS_AUTH_REQUIRE_EMAIL_VERIFICATION=false');
+    expect(line).toContain("cannot be turned off under the 'email_domain' audience posture");
+  });
+
+  it('CONTROL — no opt-out warning when open keeps verification on', async () => {
+    const { manager } = await boot({
+      pluginOptions: { audience: { posture: 'open', selfRegistrationPermissionSet: 'member_default' } },
+    });
+    expect(manager.getPublicConfig().emailPassword.requireEmailVerification).toBe(true);
+    expect(warnLines()).not.toContain(OPEN_POSTURE_VERIFICATION_OFF_WARNING);
+  });
+
+  it('CONTROL — no opt-out warning when invite_only turns verification off (nothing forced it there)', async () => {
+    const { manager } = await boot({ pluginOptions: { emailAndPassword: { requireEmailVerification: false } } });
+    expect(manager.getPublicConfig().emailPassword.requireEmailVerification).toBe(false);
+    expect(warnLines()).not.toContain(OPEN_POSTURE_VERIFICATION_OFF_WARNING);
   });
 
   // ── 5. Composition: posture anchors the declaration ──────────────────────