Confine pending-claim exceptions to initial admission bootstrap

A durable claim waiting behind closed admission is not the same as an active effect, but that distinction is safe only in a narrow bootstrap. Initial admission may tolerate pending work when active work is zero, the same provider and immutable release are already healthy, the runtime is fenced, and opening authority is what allows the waiting claim to proceed. Every switch, drain, stop, rollback, and standby proof should still require both active and pending work to be zero. Do not generalize the exception into a count threshold or reusable readiness flag.

Applies when: A fail-closed controller bootstraps authority over an already serving queue-backed provider. Keywords: bootstrap admission fence pending claim active work provider switch drain zero