Task: Bring ores.iam to the clean standard

ores.iam passes the Component Clean Standard for a component of kind Entity.

• Every checklist item that applies to a component of kind Entity passes, with its evidence recorded on the task.
• Every item that does not apply is recorded as not applicable, with the reason.
• Every generator defect found is fixed at its source, with a regression test.
• ores.iam is listed in COMPONENTS_UNDER_TEST, and check_component_drift.py --all passes.

Work the Component Clean Standard in its section order, one entity at a time, and record each item's result in the table below.

1. Baseline and inventory (B01 to B06). Record the baseline before any edit.
2. Models (M01 to M10).
3. Protocol (P01 to P06).
4. Generation (G01 to G08).
5. Wiring and data (W01 to W04).
6. Shell (S01, S02).
7. Structure and hygiene (H01 to H05).
8. Verification (V01 to V08), ending with the registry question.

The standard holds 49 items. An earlier draft of this task listed 47, stopping at G06 and V06, so G07, G08, H04, H05, V07 and V08 were absent from it. All 49 are worked below.

• The component is not "more or less clean", and the record should say so. It is in the registry as the standard's reference component, and the pass found: ten generated event registrars with no caller, so no entity change event ever left the component; five entities added after the sprint-25 bind and never bound; a hand-written JSON I/O layer beside its generated twin; a dead protocol umbrella; a dead service; a boolean flag stored as an integer in three columns, one of which carried a partial-index predicate that would have failed outright once the type was corrected; and a messaging reference that named subjects which do not exist. The sprint-25 survey bound the six orgs that existed then and was correct about them; the debt is what landed after it.
• The most useful single check was not a gate. W01 – the unwired event family – is invisible to codegen drift, because regeneration produces the files either way, and invisible to ctest, because the generated eventing tests register their own mappings. Only reading the composition points found it. The standard says as much; this component is the proof.
• The items left open, and why. Each is named above; the shape of the reason matters. S01's wholesale deletion would remove live behaviour, so it needs the per-verb analysis the workflow task did. The six dead *_table_io pairs and the missing export macro are generated from templates shared with every component, so fixing them here would rewrite the estate; the vacuous operation test template looked like the same case and is not – its eight instances are all iam's, so it is fixed here. The unmodelled tables (account_role, role_permission, auth_event) are new modelling work, not cleanup. The account write protocol and the list_by_as_of flag are design decisions. The permission_codes constants need adoption by the components that hardcode the literals. V08's uncovered list is a coverage work item. B06, M02, P02, P03, P04, P05, G02, G04 and S02 each close with findings recorded rather than an exception taken, so the review can weigh them.
• One earlier claim on this task was wrong and is corrected here. The vacuous operation-test template was recorded as house-wide on the assumption that other components generate operation command units. The census says no other component has one: all eight generated operation test files are iam's. The item was therefore this component's, and is fixed rather than deferred.
• House-wide findings this pass produced, beyond the component. ores.workflow's workflow_constraints_create.sql adds a foreign key to a non-unique key, so compass db recreate aborts on main – a blocker for every component's V03, not only this one, and the reason V03 here carries a locally neutralised statement rather than an unqualified pass. The event-mapping family is unwired in ores.assets, ores.workflow and ores.marketdata as well. The operator-parse defect left phantom members in ores.synthetic and ores.testing diagrams, which a refresh clears. ores.variability declares system_setting_changed and never publishes it, so iam's and ores.http's subscriptions to it are dead. ores.web duplicates ten iam subjects and their zod bodies by hand. The application_exception class is never thrown in any of the twelve services that include it.
• The standard grew while this pass ran, and iam is checked against the growth. Between the base this branch started from and the main it rebased onto, component_clean_standard.org gained lessons from the ores.scheduler pass. Two of them imply a check here. The first is that a unique index on a nullable tenant does not make NULL one tenant: a tenant-scoped natural key on a nullable tenant_id still admits duplicate system-scope rows, because PostgreSQL treats NULLs as distinct unless the index says nulls not distinct. Measured against the live database rather than the generated text: the iam tables carry 103 columns across their unique indexes, and not one of them is nullable (pg_index joined to pg_attribute), so the failure mode cannot occur here. The second is that model prose becomes the generated documentation, so a model states facts and a task states instructions – which is the same defect the M09 row records and fixes for role and session, and the reason the generator snippet's rationale in account_contact_information was moved into the column prose. The remaining lessons (weld-free decisions, an unlinkable class as a finding, re-measuring cited figures, a private constructor as an invariant) are already the shape of this record's V07, V08 and M02 rows.
• Verification evidence is under build/audit_iam/ (survey reports, gate outputs, drift baselines, bind tests, the manual-pass reports). The build/ tree is not committed.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

Merged as PR #2180, 19 commits, every check green. The task stays STARTED, deliberately: the standard keeps a component out of the registry until every item passes or its exceptions are accepted, and V06 puts that decision to the review rather than to me.

What landed. Fifteen defects fixed at source. The one that mattered is W01: the component published no entity change events at all, because the ten generated registrars had no composition point – invisible to the drift gate and to ctest alike, and proved fixed against the running fleet by 19 events on NATS. Then the last two entities bound to profiles, with two no-matches recorded rather than forced; login_info's three flags moved from integer to boolean with every predicate and writer that had to follow; a hand-written JSON I/O layer, a protocol umbrella, a dead service and seventeen stale recipe documents deleted; the diagram capture's operator-function defect fixed with a regression test that fails on the pre-fix parser, and all four diagrams refreshed with ~3000 hand-authored lines read back as images; the operation command tests made to assert the menu instead of CHECK(true), proved by stubbing; and documentation that was materially false corrected.

Verified. The whole tree builds. All four iam suites and all three workflow suites pass. Registration is byte-identical and idempotent at every address. Every codegen gate is green with iam registered, including the new registry check. Schema validation reports 304 tables and 0 warnings. The database recreates from scratch with no workaround, because main removed the foreign key that had blocked it. 141 shell recipes replay live: 120 answered, 20 recorded as destructive, one aborts.

What did not land, and why. One recipe still aborts, and the reason is a duration rather than a defect in the command: tenant_provisioning provision-acme-tenant takes about 32 seconds on the server while the shell's request timeout is 30, so the client gives up seconds before the answer arrives. Both fixes are design changes – make the operation asynchronous behind a poll, or let an operation command declare a longer timeout – and neither is surgical. The items the review must weigh are otherwise recorded individually in the table above: S01's hand-written shell units, the six dead *_table_io pairs and the missing export macro, the unmodelled account_role=/=role_permission=/=auth_event tables, and three design decisions. Three defects this pass found in other components are filed as captures: the workflow start failure (fixed here), the assets publish function's missing columns, and the workflow actor attribution the fix leaves to its owner. Two of this task's own follow-ups are captured beside them, so they do not live only in the table above: the four iam commands left without a recipe when the stale documents were deleted, and the provisioning command's duration against the client's request timeout.