Task: Give the reporting line its own write

Changing who a person reports to writes that field alone, records why, and refuses a write against a stale account version.

• iam.v1.ops.set_reporting_line writes the reporting line alone, leaving every other field as the account had it.
• The request names the manager (empty clears the line), the version the caller read, and the reason.
• A stated version that no longer matches is refused as conflict, and the line does not move.
• A manager that does not exist, a self reference, and a line that would close a cycle are all refused, each naming the reason.
• The write needs iam::accounts:update, and a caller without it is refused before the service is reached.
• The browser reaches the write over PUT /api/accounts/:id/reporting-line, and the shell reaches the same subject.
• check_component_drift.py --component iam reports no drift, and the C++ and BFF tests cover it.

1. Declare iam.v1.ops.set_reporting_line: the account, the manager, the version the caller read, and the reason.
2. Write it in the service: read the account, refuse a stale version, refuse a self reference, set the one field, and answer the account as written.
3. Serve it from the account handler behind iam::accounts:update.
4. Wire the browser path, and let codegen emit the shell command.
5. Test what the narrow write promises: one field written, the reason recorded, a stale version refused, a self reference refused.

• The version is text, not a number. The first draft carried std::optional<int>. The shell facet refused it — a message field with an optional scalar has no shell token form — and a sentinel integer would not work either, because a fresh account's version is 0. Text with empty meaning "not stated" is what every other optional value on this wire already does. The gap in the shell generator is captured at An optional scalar in a message has no shell token form.
• The write answers the account as written. The store stamps the new version, so the service re-reads after the write rather than answering the copy it read. The screen then redraws against the version it must state next time.
• The cycle guard and the self check overlap, and both stay. The SQL guard catches every cycle including a self reference, but it arrives as a constraint violation; the service checks the self reference itself so it can answer with a result the screen can draw.
• wireAccountSchema and mapAccount became exports. The reply carries an account, and the alternative was restating sixteen fields and the nil-to-null rule in the membership seam.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

Done 2026-10-09.

The reporting line has its own write, so a screen can change one field without sending the rest of the account back:

Verification. check_component_drift.py --component iam reports no drift and clang-format is clean. The IAM core suite passes, 264 cases and 821 assertions (three new). The BFF membership tests pass, 8 cases. The three TypeScript packages typecheck.

What the task taught. The first draft carried std::optional<int> for the version and the shell facet refused the whole component: an optional scalar in a message has no shell token form. The field is text with empty meaning "not stated", which is the wire's existing idiom for an optional value; the generator gap is captured rather than papered over.