Task: Bind ores.iam entities to profiles; verify zero-diff regen

Survey every ores.iam entity (projects/ores.iam/modeling) against the profile catalogue, rebind matches, regenerate, and require zero additional diff against the pre-rebind checked-in output.

• Every entity discovered under projects/ores.iam/modeling is surveyed against all Variability Profiles.
• Every matching entity is rebound and regenerated with zero additional diff versus its pre-rebind checked-in output.
• No-match entities are recorded with their actual feature values, not silently dropped.
• The tenant_type has_tenant_id model/table drift is resolved as part of this survey, not carried forward as a separate open item.
• The known service_find_prefix gap on tenant_type and tenant_status is resolved as part of reaching zero drift.

• #1961 audit: the PR that first regenerated the iam lookup SQL under the then-new lookup templates was audited for dropped rules. The audit found adds-only: the committed tree gained the generated validate fns and their wiring; no committed rule was dropped and no rule text was weakened. #1961 does not set a drop-SQL precedent, so this unit followed its lead: every rule the pre-rebind iam SQL carried has a codegen home in the committed tree today.
• The tenant type/status validation idiom changes shape: committed inline blocks raised 23503 with bespoke messages; the regenerated tables call the generated ores_iam_validate_tenant_type_fn and ores_iam_validate_tenant_status_fn (lookup SQL), which raise 23503 with an allowed-values listing and pass through bootstrap inserts while the lookup has no active system rows. Rule semantics (reject unknown type/status at insert) are unchanged.
• tenant_type has_tenant_id drift (capture 2F793500-FBD1-4E4F-8B6E-15D03337FBD2): closed pre-branch by the ir-curve-followups task (task_tenant_type_has_tenant_id_drift.org, DONE), which deleted the three _lookup_entity.org duplicates; the simple-lookup entity orgs are the sole authority and regenerate byte-identically.
• The superseded ad hoc task 'Apply safe drift to iam-cpp' (task_apply_safe_drift_iam.org) is ABANDONED and already points to this story.

Manual QA scenarios (scaffolded via compass add test_scenario, run through the QA Validation Runner panel) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

Closed 2026-09-05. Bound the six ores.iam codegen-eligible orgs per the Plan survey: ores.iam.tenant to uuid-identified-lookup, ores.iam.account_party_junction to tenant-scoped-junction, ores.iam.account_contact_information to self-referencing-hierarchy; account_type, tenant_status and tenant_type were pre-bound simple-lookup entities and regenerated byte-identically through the unit. Every committed SQL rule the pre-rebind iam tables carried has a codegen home: the four tenant table checks via the Checks section, the status = 'terminated' delete rule via the new ** Delete sets section, the hostname active-record unique index via the new column :unique: flag, the type/status insert validations via the generated lookup validate fns, and the account_party soft-FK blocks via the junction foreign-keys section. Template-era modernization on the regenerated tables (clock_timestamp, the security-definer function-attribute form, the junction insert fn losing its legacy attribute) is the sign-off class the refdata anchors already carry; regeneration also surfaced a latent generator bug the old template never rendered, the tenant name snippet calling the nonexistent faker::company::name(), fixed to companyName() to match every sibling org (05c1a89a2d).

Regeneration surfaced two further losses from the earlier C3-era regeneration, both restored at source: the tenant provisioning protocol and handler (a custom flow with no template output path, restored by hand, bec4d7d61d) and the cross-tenant tenant_lookups (the hand-authored counterpart of tenant_repository; no template emits the file, and it keeps the pre-rebind unfiltered reads, ef7a2a8ee2). The shell tenant-history command and the qt IamPlugin were adapted to the regenerated APIs (e8094a710d, d61e26fd61). The drift gate now covers iam and iam-cpp (b85c6ac327, per the compute unit's extension of the compass-pr-raise check list); a full retangle leaves the tracked tree byte-identical to the committed output.

Moving the acceptance runs onto a recreated test DB (compass db recreate) surfaced three defects the previous DB had masked, each fixed at source rather than worked around. Generated eventing tests now seed transitive FK ancestors in a two-phase declare/write split and write under the system-scoped context (4e3fc08cd6, 5ea58e41b2, aaab07e8c1); synthetic :unique: plain-string columns take the process-counter suffix, ending the tenant-hostname collisions on unique indexes (a9ecc71021); and the tenant lookup test now asserts what the committed tenants_read_policy admits – the row's own tenant context and the system context resolve the system-owned tenant rows, a peer tenant's context stays isolated – with the constraint documented in the tenant_lookups header (15e4abbc25).

Acceptance: every entity surveyed and every match rebound (survey table above); regenerated output byte-identical to the committed tree for refdata, reporting, marketdata, compute-cpp, iam and iam-cpp (check_component_drift.py, 2026-09-05); no genuine no-match; the tenant_type has_tenant_id drift closed pre-branch and independently confirmed by the zero-diff regen; the service_find_prefix gap on tenant_type and tenant_status was already declared at the branch point and stayed byte-stable; full build clean at 100% with ores.qt.exe linked (linux-clang-debug-make); ctest 71/71 green on the recreated DB; iam and iam-cpp covered by the drift gate.