@@ -314,9 +314,10 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
       updatedAt: now,
     })
 
-    await tx
-      .insert(projectWorkspace)
-      .values({ projectId: parentProject.id, workspaceId: childWorkspaceId })
+    if (parentProject)
+      await tx
+        .insert(projectWorkspace)
+        .values({ projectId: parentProject.id, workspaceId: childWorkspaceId })
 
     const sourcePermissions = await tx
       .select({ userId: permissions.userId, permissionType: permissions.permissionType })
 
@@ -61,7 +61,7 @@ import {
   revokePersonalApiKeysTx,
   revokeUserSessionsTx,
 } from '@/lib/organizations/members/revocation'
-import { tryLockProject } from '@/lib/projects/membership'
+import { lockProjectBackfillWrites, tryLockProject } from '@/lib/projects/membership'
 import { removeWorkspaceSkillMembershipsTx } from '@/lib/skills/access'
 import {
   reassignWorkflowOwnershipForWorkspaceMemberRemovalTx,
@@ -543,7 +543,7 @@ async function reassignOwnedOrganizationResourcesTx({
   organizationId,
   workspaceIds,
 }: {
-  tx: DbOrTx
+  tx: DbTransaction
   userId: string
   organizationId: string
   workspaceIds: string[]
@@ -557,6 +557,7 @@ async function reassignOwnedOrganizationResourcesTx({
   const ownerId = ownerMembership?.userId
   if (!ownerId || ownerId === userId) return 0
 
+  await lockProjectBackfillWrites(tx)
   const ownedProjects = await tx
     .select({ id: project.id })
     .from(project)
 
@@ -669,6 +669,8 @@ export const env = createEnv({
 
     // SSO Configuration (for script-based registration)
     SSO_ENABLED:                           z.boolean().optional(),                 // Enable SSO functionality
+    PROJECT_WRITES_ENABLED:               z.boolean().optional(),                 // Activate new Project assignments after old writers drain
+    PROJECT_API_ENABLED:                  z.boolean().optional(),                 // Expose Projects after backfill and contract enforcement
     SCIM_ENABLED:                          z.boolean().optional(),                 // Enable SCIM directory provisioning
     USAGE_MONITORING_ENABLED:              z.boolean().optional(),                 // Enable organization usage monitoring on self-hosted (bypasses hosted requirements)
     SSO_PROVIDER_TYPE:                     z.enum(['oidc', 'saml']).optional(),    // [REQUIRED] SSO provider type
 
@@ -2,13 +2,15 @@
 
 A Project groups environments. An environment is an existing `workspace` record; there is no separate environment table. Every newly created Project starts with an environment.
 
+Project APIs return HTTP 503 until the deployment enables `PROJECT_API_ENABLED`. Automatic assignment on legacy workspace creation requires `PROJECT_WRITES_ENABLED`; both server controls default off. The API requires writers to be enabled. Existing assigned Projects always retain their lifecycle protections, including fork inheritance and disconnect behavior, even if activation is disabled.
+
 ## Choose the creation flow
 
 | Caller | Flow | Result |
 | --- | --- | --- |
 | New Project onboarding | `POST /api/projects` | Creates a Project and its first environment together, with independently supplied names. |
-| Existing workspace creation UI or caller | `POST /api/workspaces` | Creates a workspace and automatically creates its Project, preserving the existing workspace response. |
-| Create another environment by forking | Existing workspace fork operation | Creates a child workspace in the source workspace's Project. |
+| Existing workspace creation UI or caller | `POST /api/workspaces` | Creates a workspace and, when Project writers are enabled, automatically creates its Project, preserving the existing workspace response. |
+| Create another environment by forking | Existing workspace fork operation | Inherits the source workspace's Project; unassigned legacy families remain unassigned until backfilled. |
 
 Both POST endpoints are internal, session-authenticated APIs. `POST /api/projects` is not a public `/api/v2` endpoint and does not accept API-key principals. This foundation does not remove or deprecate existing workspace creation endpoints.
 
@@ -67,10 +69,10 @@ Existing callers can continue to use `createWorkspaceContract` and `POST /api/wo
 
 `skipDefaultWorkflow` remains optional and defaults to `false`. The route uses the session's active organization and existing workspace creation policy to resolve ownership and billing. It does not take the explicit Project scope or independent Project name used by `POST /api/projects`.
 
-The workspace and its Project are still created atomically. The generated Project name is `Support workspace - Project`; long names are bounded to 100 characters while retaining the suffix. The response remains `{ "workspace": ... }` with HTTP 200, without a new Project response wrapper. Call `GET /api/projects/by-workspace/[workspaceId]` when an existing workspace caller needs its authorized Project details.
+When Project writers are enabled, the workspace and its Project are created atomically. The generated Project name is `Support workspace - Project`; long names are bounded to 100 characters while retaining the suffix. The response remains `{ "workspace": ... }` with HTTP 200, without a new Project response wrapper. Call `GET /api/projects/by-workspace/[workspaceId]` when an existing workspace caller needs its authorized Project details.
 
 ## Server implementation
 
 The Project route calls `createProject` in `application/create-project.ts`. Existing workspace callers continue through their current creation paths. Both use the shared transaction primitive in `lib/workspaces/create.ts`; surface adapters must not independently commit Project and workspace creation.
 
-Project descriptions and Project-scoped files are not part of this creation contract. Project-scoped files and a designated Project brief are follow-up work documented in the foundation plan.
+Project descriptions and Project-scoped files are not part of this creation contract. Project-scoped files and a designated Project brief are follow-up work.