···293293 // Auto-reconcile crew membership on first push/pull
294294 // This ensures users can push immediately after docker login without web sign-in
295295 // EnsureCrewMembership is best-effort and logs errors without failing the request
296296- // Run in background to avoid blocking registry operations if hold is offline
296296+ // Run synchronously to ensure crew record exists before write access checks
297297+ // (returns quickly if already a member - hold returns 200/201)
297298 if holdDID != "" && nr.refresher != nil {
298299 slog.Debug("Auto-reconciling crew membership", "component", "registry/middleware", "did", did, "hold_did", holdDID)
299300 client := atproto.NewClient(pdsEndpoint, did, "")
300300- go func(ctx context.Context, client *atproto.Client, refresher *oauth.Refresher, holdDID string) {
301301- storage.EnsureCrewMembership(ctx, client, refresher, holdDID)
302302- }(ctx, client, nr.refresher, holdDID)
301301+ storage.EnsureCrewMembership(ctx, client, nr.refresher, holdDID)
303302 }
304303305304 // Get service token for hold authentication (only if authenticated)