General lesson: repositories with an exhaustive, closed E2E environment contract must update…

General lesson: repositories with an exhaustive, closed E2E environment contract must update the canonical app template, tracked test environment, and the contract's disabled/safe-value registry atomically when adding an optional server-only variable. Adding a key to only one or two surfaces creates either an immediate conformance failure or an unreviewed inheritance path. This applies when the E2E loader deliberately owns a closed key set; repositories without that contract should use their own configuration authority instead. Empty test values are appropriate only when the production parser treats empty as the documented fail-closed/default state.

Evidence/example (2026-09-16): During COR-4274 in e3-solutions/theft, adding two Adam-only rollout variables to config/.env.example and web/.env.test.example first failed because the tracked web/.env.test and web/scripts/e2e-env-contract.mjs did not know them. Removing only the E2E example entries still failed because the canonical config template had no E2E disposition. Registering both variables in E2E_DISABLED_ENV_KEYS and mirroring empty values in both tracked E2E env files made node scripts/check-e2e-env-contract.mjs --check pass. Evidence: https://github.com/e3-solutions/theft/pull/894 and the repository's web/scripts/check-e2e-env-contract.mjs. This confirms the local contract mechanics, not a universal rule for all environment systems.