test(ontology): free-text org-unit labels never mint authority

[jason931225]

Draft. Independent review required before merge. Do not merge from this lane.

Candidate SHA: b029781cea7b1f2a9f4c3436a3cdbc8f1f877a84
Base: 2f99f9ea26b0813e8962c22a2e74f6376530e69b (origin/main)

Extend existing binding_seam_tests only. unambiguous_legacy_source_id still accepts only Uuid::parse_str of the trimmed whole string.

• free_text_labels_never_mint_authority also rejects empty string, Hangul+ASCII mix (영업HQ), UUID-like-but-too-short, and a name that contains a UUID as a substring.
• uuid_source_ids_are_unambiguous still accepts uppercase (because Uuid::parse_str does) and whitespace-trimmed UUIDs (because the seam trims).
• Text probes stay Err(AmbiguousTextAuthority) and cannot mint OrgUnit authority. No new #[test] function. org_unit.rs (feat(ontology): owner-adapter list/get for canonical heads #898) untouched. Production DML unchanged.

Lease: backend/crates/ontology/canonical-adapter-postgres/src/org_unit_binding.rs only. Disjoint from identity/directory (#897/#908/#909), canonical list/get (#898 — does not include this file), action-inbox (#899), inbox-payslip-filter (#900), attendance personas (#903), auth cookies (#904), FE/UI (#905), attendance CONFIRM parse (#907), and persona ESS HTTP (#910).

Tests

cargo test -p console-ontology-canonical-adapter-postgres --lib free_text_labels_never_mint_authority -- --nocapture

discovered 8 lib tests, executed 1, passed 1 (7 filtered out).

Also ran the sibling existing test (same module, still one #[test]):

cargo test -p console-ontology-canonical-adapter-postgres --lib uuid_source_ids_are_unambiguous -- --nocapture

executed 1, passed 1 (7 filtered out).

merge-tree --write-tree (all exit 0)

• vs origin/main 2f99f9ea
• vs PR 897 c9d8c558 path-overlap none
• vs PR 898 e390a25e path-overlap none (org_unit.rs only; this file not in feat(ontology): owner-adapter list/get for canonical heads #898)
• vs PR 899 f861f715 path-overlap none
• vs PR 900 b4ca34ab path-overlap none
• vs PR 901 MERGED 14944513 path-overlap none
• vs PR 902 MERGED 11645e48 path-overlap none
• vs PR 903 5d30ddec path-overlap none
• vs PR 904 e5164a42 path-overlap none
• vs PR 905 0c2b572c path-overlap none
• vs PR 906 65fa2123 path-overlap none
• vs PR 907 6b8d2de8 path-overlap none
• vs PR 908 053b96cd path-overlap none
• vs PR 909 00ccfb20 path-overlap none
• vs PR 910 af25cbca path-overlap none

HOLDs

• Production ensure_unambiguous_legacy_binding_in_tx still takes a typed Uuid; this lane does not add a text-to-authority writer.
• No sqlx/runtime binding tests here (unit parse only).
• Not merge/release. No live promo. Independent review before merge.

Blast radius / rollback

• Test-only change in one source file. Rollback is revert of b029781c. No schema, lockfile, OpenAPI, CI, or runtime change.

No merge.

[jason931225]

Independent adversarial review REVISE on b029781cea7b1f2a9f4c3436a3cdbc8f1f877a84: tests only exercise an unused parser; live port can still bind a non-UUID label. Do not merge this SHA as proof that free-text cannot mint authority.

[jason931225]

Closing: occupancy of an unused parser, not the live bind.

The diff only extends unambiguous_legacy_source_id unit tests in org_unit_binding.rs. Live OrgUnit labels are a different bind. Those parser cases were already green (or unenforced) on trunk; this is not a currently-red probe.

Independent review on b029781c: REVISE. Do not restart without a currently-red named command.